Do I have to relinquish my PC password to my former boss?

Question

I worked in a tech company and recently put in notice. I was told to leave and to not come back. I did not get an opportunity to clean personal files off of my work computer. My former boss has now just sent me an email to my personal email asking for the password on my work computer.

Do I need to relinquish my password? I know for a fact that they are capable of reformatting the computer and using it without needing my password. My fear is that they are only asking so they can snoop through what's on it.

I should mention the second part of the issue is that I use the same password for everything: email, online banking, etc. I would need to change all of my passwords if I gave them this one and I can't even remember every account I've created. There is no written policy about this.

Answer 1

There are ways for your employer to get access to the computer without your current password. For that reason I would contact the Companies HR or Legal department and advise them that due to the risk of your identity being used you are unwilling to provide provide your password to the company. I would not have any direct contact with your former manager without HR being included.

Until the court orders you to provide assistance you can choose not to provide the password. However if you choose to force them to go that route you do risk being found liable for other damages and costs as once a company starts down the legal process they are usually more willing to pursue a case in full. If you are not prepared and experienced in dealing with this it can be an expensive learning experience. So read what ever documentation you have and make sure you understand where you stand based on those documents.

If this legal fight is something you would just prefer to avoid, I would offer to come in and change the password to something that the company defines. I would define the process that you will use to change the password and then log off of the computer and require that someone from HR or the Legal team be there for the entire visit.

Another option is to ignore the email. Email is not a reliable method of communication. If the message got moved to your junk e-mail, or trash without being read there is no way of telling for either side without investigation.

Finally, there is no business need demonstrated for the CEO to have your password. Your login can be bypassed through a number of standard methods. The company should have obtained everything it needed prior to dismissing you since there was no misconduct. You are no longer employed there and not subject to their policies that might have required you to provide the password. That should have been obtained prior to your termination, their failure to follow good business practice does not create an obligation for you.

Your company should have created a separation agreement prior to your termination. It would have protected you both. You from continued harassment and requests, and them from any claims by you to any rights to the contents of your computer files. Since you are no longer bound by company policy you could potentially have rights to privacy for all documents on the computer that were not work product. But you would need to consult an attorney to be sure.

If I were in your situation and I wanted to resist providing the password, I would make them get a court order requiring my compliance. Then I would probably seek to quash that order. The requirement to force the disclosure of the password is that the company show they can not proceed without it, or that the impact with be significant. Since they can bypass your password, this is going to be a very high bar. That whole process will take months to resolve. Either way these are my rights I am exerting and there is no cause to award them fees, as this should have been obtained prior to termination. But that is what I would do I am not providing legal advice for you to follow what could be a very bad example. Should you choose to follow this course you should be aware that many judges are business friendly and may choose not to interpret the law in your favor. This is especially true when you are acting as your own attorney. So no matter how valid your argument and how "right" you are, there is a risk of losing, and in my experience, appellate courts practically ignore pro se pleadings.

Answer 2

You should check all of your employment related documents, including offer letter, employee handbook, and separation documents, for any mention of penalties for failure to comply with company requests regarding accounts and equipment. These documents, if present, should provide you with legal guidance to answer your question of "Do I have to" (which I have taken to mean "Am I legally obligated to").

One reason to check your employment-related documents is for clauses you may have glossed right over when signing them, such as "All ideas, concepts, or expressions (copyrightable or not); copyrighted or copyrightable material; trademark; trade secret; works, inventions, discoveries, improvements, or inventions (whether patentable or not) made, devised, or discovered by the Employee are the property of the Company" which typically is interpreted by the company to mean "Anything you think or do, especially on our equipment, belongs to us, so we have the right to get it." Such wording and expectations are especially true in the state or federal government (in the US) jobs, in which computer use and expectations of privacy or lack thereof are explicitly spelled out, as are personal use of computers, period.

After checking your documents, you can decide for yourself if any stated penalties are worth not relinquishing your password, or, in the absence of no legal guidance, if your failure to comply with the request is something you want to be remembered for (by people who may be reference checks).

The equipment belongs to the company and, in many organizations, anything on the machine also belongs to them (see examples noted above). In the absence of legal guidance in signed documents, your ethics are your own; as a manager (and someone who very much values privacy) I would recommend giving them the password to the machine (or, as Dukeling says in a comment, offering to go in and type it yourself) and learning a hard lesson about keeping personal stuff on company equipment (e.g. don't do it, or if you do, don't have an expectation of privacy) when your employee agreement actually even allows you to do so.

Answer 3

No, don't hand over your password, as a matter of personal security.

Others here have mentioned that your former employer owns your former work computer and the data on it. If they provided the computer that's generally true.

However, all of that is entirely separate to your password. This is personal information that should be treated as confidential: you have no obligation to hand it over, ever. Your company is not entitled to know your password. None of their ownership over the data, hardware or software entitles them to know this. They are entitled to know and store a hashed version of your password (this is what lets you log in), but they are not entitled to know your password in plain text.

They should not need this information under any circumstance.

Speaking as someone in IT, if they have half-decent IT resources, they'll be able to reset your account password to something that'll let them gain access, which means they get what they want, and you keep your password private. Or, they'll be able to access your personal files anyway via an administrator's account, and will not require your password to do it. If there's full-disk encryption via BitLocker or some other product, and it's part of company protocol, they should have a plan for how to access your data without needing your information (speaking as someone who works for a company which uses full-disk encryption).

If they need your password for anything, it's because they bungled up their IT strategies somewhere, and that's their problem to deal with.

Of course, if you encrypted your work stuff outside of protocol (using TrueCrypt or etc) and it's the password for that stuff which they're asking for, then you probably do have at least an ethical responsibility to go in there and provide them with the work they paid you for. Meaning: go in there, decrypt it yourself, and take out the work stuff to give to them. Still don't give them your password.

If you're obligated, find another means.

I'll maintain that you should absolutely not hand over your password. You should definitely not respond to their email with it, even if you can tell it's authentic (it might not be).

Check your company's materials they gave you. If you have any obligations around this, offer an alternate arrangement, such as returning to the company to change your password. If you don't have obligations, decline their request. As I said, their IT folks should be able to handle this without your help.

Be willing to burn your bridges here.

Others have mentioned they may give you a poor reference if you don't want to comply. It's not worth sacrificing your personal security and confidentiality for the hope of a good reference, though. Further, you have no guarantee they'll give you a good reference if you do comply, but in return you'll be sabotaging yourself so they can get something they want which they shouldn't need. Given how they reacted to your leaving and how they've treated you previously, it doesn't seem you're going to get a good reference anyway.

Answer 4

Given that, in this situation, you haven't left on good terms, simply ignore this request - don't respond to the email asking for the password.

This bridge is already burnt, and there's nothing to be gained by complying with them, while there are potential losses. You've already left the job, there's no need to engage with them further.

For the future, as a matter of general practise, don't reuse your personal passwords at work, and clear your personal data down before you leave.

Answer 5

I think the tricky gotcha here is that they told you to leave, so to me that implies at that moment you were no longer an employee and they can't demand anything more of you. If they wanted the password, they should have taken your offer of a two week notice and had you create a document for that type of information. But, local laws on this may say something different. Had they not told you to immediately leave, I think it would be well within their right to demand the password since you are an employee using their computer. Or, at the very least, they would be within their right to have you hand over a password to the machine after you changed it to a different one.

And in the future, always, always, always clean your machine before giving notice!!!! In fact, clean your machine if you have even a hint that something may be changing. And it goes without saying, never use personal passwords on company machines.

Answer 6

You are not an employee any more. This person is not your boss any more. At the point when they told you to leave the building and not come back, they more or less gave up the right to tell you to do anything else ever again. If they want to read any data on the computer you used while you were an employee, they can do that without your password, unless the data is encrypted. If the data is not encrypted, nothing related to your former employment causes them to need your password so they surely have no more right to demand passwords from you than they do from any other non-employee. Me, for example.

Answer 7

Most companies (including the one I work for) specifically state in their policies that any network, computer or device that you connect to the network can be legally searched without your consent.

Here's an excerpt from my company's manual (we're required to agree before we begin working):

Use of company technology, networks, and Internet services does not create any expectation of privacy. [The Company] reserves the right to search and/or monitor any information created, accessed, sent, received, and/or stored in any format by any Company employee on Company equipment or any equipment connected to [The Company's] network.

Now, I'm not a lawyer, and the laws in your country may differ from others, but generally speaking, if a company owns a device, they are legally allowed to monitor or search whatever their employees are doing on said device.

Furthermore, many company policies also state that personal use of computers or networks is prohibited, so it may actually be possible that you keeping personal information on the computers is a violation of company policy in and of itself, but that's besides the point:

If you refuse to surrender your password, they may just say "oh well", format the PC, and you'll never hear from them again.

On the other hand, they could possibly take legal action against you, since you've locked up information that they have legally stated is theirs and not given them the key.

I would advise you to give them the password or seek legal counsel if you feel that you have other options.

Answer 8

In any responsible company regardless of size, there will be a checklist for the manager to go through with departing workers, or whomever is responsible that day, if manager is absent. They'll get your badge or key card or company ID, that sort of thing. Sometimes it is done by Human Resources. At that time, while you were still on the premises, they should have asked for your password.

Of course, as everyone else said, the IT department should be able to reset the password, or get access to your former computer, easily!

It is very peculiar for your former employer to contact you by personal email, (several days? weeks?) later, after telling you to leave immediately after giving notice. Are you certain that the email you received is truly from your former manager, not spoofed or forged?

I would NOT disclose the password by return email, under those conditions. That is possibly worse than not responding at all. Even thought your accounts should have been terminated, you can't be certain, as you aren't an employee anymore. Given that you use the same password everywhere, you should be even more leery of sending it by email. I wouldn't reply, but rather wait and see if your former boss telephones you with the same password request.

Answer 9

Asking for your work password doesn't sound that unusual of a request. If it was a work computer, you shouldn't have had anything too personal on there you wouldn't want your employer to have access to. However, does seem like a bit of a security risk divulging your password if you use it elsewhere.

If I were in your situation, what I would do is act ignorant. Tell them you don't remember the password. If you can't remember the password, then there's little you can do, and unless they can prove you do remember the password (which they can't), then they are fresh out of luck.

While I doubt it would happen, giving them your computer password means they could easily open a web browser and access any website you might have logged into previously and selected, "remember me". If you use the same password for your email, Facebook or Twitter (amongst others) they can log in to those. Chances are they won't, but it is a possibility. It depends on who will be logging onto the computer and what their intentions are.

All that said; please know that this would be considered profoundly immoral to withhold a password intentionally. The employer probably has justified reasons like wanting to make sure you saved all appropriate files to a server they can access. Just because it might be something I would do, doesn't mean you should heed my advice and do it too.

Answer 10

There is no obligation of an employee to give any sort of password information to a company that is for a personal machine.

I know that a person should not use the same work and personal passwords but it happens and thus a company has no rights to this.

How do I know? I used to run the IT department for a very large international company. We had many users who left without giving us their password. There is nothing legally we could do and trust me if there was my company would certainly follow through on those people. Even people who would not divulge passwords to shared machines/servers/routers/switches, there was basically nothing we could do.

So the easiest way out of this... give them a password, but not yours.

Now I get them asking if it is a smaller company that has little IT help (or bad IT help). It saves them time and maybe $50. But they should either have an administrator account on every machine that they control or they should have the ability to change your password via Active Directory.

What would I do to get your password? I would run rainbow tables against Windows and have it in 5-10 minutes if that. I then would have your exact password. Reason why I mention that is to alert people that if they want their password to remain a secret they should rename it (I suggest 3 times) before handing their equipment over.

Answer 11

Let's make one assumption here to begin: that there is no arrangement between you and your (former) employer in regards to this situation. Note that I am not referring to a manual excerpt such as what Moses posted - such an excerpt enables the company to monitor and access that information, but does not require you to relinquish passwords.

Remember that passwords = authentication. When you authenticate with a username + password, the username just defines who you are, while the password proves you are who you say you are. If anyone else can prove that, they are functionally you for every location that you chose to use that password. (try telling a boss that you didn't access [random site] when a server log says that your account did)

That being said, I'd approach this pragmatically, and reply with the assumption that your former boss is looking to get into the account that you formerly used; it doesn't matter why, but if you approach it from that angle, there is a lot that you can provide without actually giving your password:

• If you know that the computer had a separate administrator account, you could instruct him/her on logging into that account, changing your account's password to something else, then logging into your former account that way.

• If the hard drive was not encrypted, you could instruct them on reading the contents of the drive by using a USB-to-SATA adapter.

• You can provide brief instruction on how to reset a forgotten administrator password, which isn't as hard as it sounds.

• If it isn't a major hassle for you, and both parties are willing, you could also offer to stop in over the next couple days, where you would login and change the password to a generic one. You may also be able to use this time to get off any documents you (and the company) consider to be personal to you.

Any of these can also be accomplished with a referral to instructions found off of a Google search, and each accomplishes what your former boss is likely looking to accomplish, without actually relenquishing your password.

Answer 12

What rights does the ex-employer have? They have the rights to any company data on the computer, and the right to have that computer in a usable state. With hard drive encryption, the computer might not actually be usable. Throwing out the employee and turning him into an ex-employee without making sure they have these things is of course stupid.

What rights does the ex-employee have? He has the right not to divulge his password, which he is using for his private banking as well (I know it is stupid to use the same password), he has the right that private data on the computer stay private and are not used against him. Remember he is an ex employee. He has the right not to do any work for the company without payment.

A reasonable thing to happen would be for the ex-employee to come to the company at a reasonable time, with expenses paid, and change the computer password to "1234" or "Password" or whatever, so the company can exercise their rights. The next reasonable thing to happen would be for the company to accept that other or to make a different reasonable offer.

The former boss has no right to know the password, but he has the right to get the computer made usable. But not for free; the notice period is there for exactly that kind of thing.

Answer 13

If the PC is company property and you have "locked" access by the company by using a password and not making it available, you could be in trouble. And if you opened the company by using a password that you also used for some potentially insecure remote site, you could be in even more trouble.

The reference in the @jcmeloni answer to intellectual property could be an additional element. If it's a company PC, the company owns the password as well as everything else on the PC.

While you might not be in a jurisdiction that explicitly covers this situation, case law does exist that could be relevant. Probably the most notorious was over Terry Childs ( see People v. Childs, 2013 WL 5779044 (Cal. App. Ct. Oct. 25, 2013). ) That was far more egregious than your circumstances, but there are related principles.

You'll not only want to be sure you're legally covered, but you'll also want to be sure your future career is safe. Even a small court case can be long-term trouble for your future.

With all of that said, as others have mentioned, the company has physical access to the PC and can recover the password without much trouble. You aren't keeping it "secret" by refusing to divulge it. At most, you're delaying access. But at worst, you might be making serious trouble for yourself with essentially zero risk to the company.