How can I complain against someone when my evidence was obtained from an unethical source?

Question

A part of my IT job I take upon myself is to sieve through outgoing employee emails to remove confidential and personal information before handing over the account to the succeeding person.

One fateful occasion, I found a strange email in the inbox with salary information that was sent from employee X to the HR manager, and in turn forwarded by the HR manager to the email account owner (who is now an ex-employee). It appears that the HR manager had sent the salary information to employee X to work on some document formatting.

This raises the alarm.

In order to obtain more evidence, I logged into their email accounts and searched for the correspondences. Eventually I ended up finding more such cases between 3 other employees, together with the HR manager. Altogether 12 cases breach of trust; 6 sowing discord; and 3 asking others to do her job.

I wanted to report on misconduct but I am worried about my unethical access. As an IT personnel, I have authorised access to all systems, but I feel I could have consulted with a director before proceeding with the search. I have no idea how the management will think/act if I reveal this. What should I consider for protecting myself while be able to do justice?

EDIT: At which level (manager, director, or a particular department) would "snooping around" be legal? Or can make a legal decision to search?

EDIT 2: The answers thus far uses the legal explanations and the simple "ask your boss". I have done a Google search and it appears that in the case where law is in place, you cannot "ask your boss". The only legal way is to ask the email owners to grant access (but I still think there is a grey area: who gives permission to view ex-employee emails?). Whereas in the absence of a law, it is not clear who has the ethical authority i.e. which boss is it?

EDIT 3: Due to the majority enthusiasm for policy of minding-my-own-business and self-protection before the law (which I must admit I find rather surprising), I feel that the answers have deviated substantially from my intended main theme of "how to bring justice" to "problem with unethical evidences".

Anyway, I do appreciate that the short answer is I cannot do anything (at least under majority of country laws). Thanks for the answers. To some of the commenters/answerers, I regret that I am unable to provide more details regarding my position in the company and the nature of the misconduct I am complaining about etc. thus making this question a bit of a guess in the wild.

Answer 1

If I understand this correctly, it appears that you are snooping through closed mailboxes without any permission or authorization from your management. In my opinion, this is misconduct equal to or greater than any of the perceived offenses that you mention.

I'm assuming that you aren't privy to every conversation held by the HR manager. Maybe this person has approval to work with one or more outside individuals for purposes of document formatting and the like. Maybe the things that you view as a "breach of trust" are perfectly OK from the organization's standpoint. (I won't even get into the "asking others to do her job" comment.) The point that I'm trying to make is that you're trying to do someone else's job, and that you are commiting the same violations that you're trying to prevent (breach of trust, for example) in your own actions.

Do not take this to management if you value your job, and by all means, stop snooping through email that doesn't belong to you unless you have specific written permission from your supervisor authorizing this. You may have access to sensitive information, but make no mistake, this does not automatically mean that you can look through it and act upon anything that you find.

Answer 2

A part of my IT job I take upon myself is to sieve through outgoing employee emails to remove confidential and personal information before handing over the account to the succeeding person.

[tl;dr answer - why, oh why?]

Stop right there. Leaving aside the issue of not having official sanction to do this, and having picked up a lot of confidential information you are not entitled to have, what do you mean by "handing over the account to the succeeding person"? Do employees not have individual outgoing mail accounts? Do you recycle stuff so that a new employee could reasonably stumble across their predecessor's work? That appears to be a major problem in itself.

• Assuming you weren't doing what you do, could users ever have unintentional access to potentially confidential mails sent by other people?

• Given that you "remove confidential information", how do you know you haven't accidentally removed something important, eg. evidence for or against wrongdoing which might subsequently be demanded by a court?

• How can anyone trust email for security and honesty if the system allows you and your fellow sysadmins to dip in and change stuff?

Basically you haven't just read stuff you weren't entitled to, you (as a result of a dysfunctional set up) have undermined the whole integrity of the email system in the company. The right thing to do would be to get the email system changed so that outgoing personal messages are never sent from generic accounts, making your sanitisiation unnecessary - but justifying that change is going to get management asking questions which could cost you your job.

Answer 3

What should I consider for protecting myself while be able to do justice?

Find a good lawyer.

This answer may not be applicable in all juristdictions, but at least in Central Europe what you do is probably completely ILLEGAL*. I am sure it is at least in Germany and the Czech Republic.

Purposeful pinpoint searches, requested by management and perhaps approved (or requested) by court is tghe only legal (if questionable) setting in which you, as an employee, can read through a limited subset of one's mail. In the above named countries the employee must know or express consent to the fact that his mail are being scrutinized.

Reading your coworkers' e-mail systematically without any consent at all is inexcusable considering the ethicality only.

And the answer is: your company should be protecting itself from you, not the other way around.

(*) I just couldn't stress the word illegal enough.

Answer 4

Typically one does not search through anything without authorization from a lawful authority. Within a company this would probably be the board of directors and/or the CEO backed up by your AUP - That is to say that your employees have agreed to this beforehand.

In a very clear sense you've breached your duty of trust (or as I like to say, the great responsibility that comes with the great power of being an IT Manager and Operator. You've abused both your positional power and the powers vested in you to do your job.

In a very real sense this is precisely why a forensics trained IT professional has to work within a very strict set of rules, since in many cases, what you've found is probably legally useless.

Outside legal issues (And I find this varies widely), if employees believe that their work emails can be monitored without a proper procedure, they're likely to simply switch to private email accounts anyway, and it may affect morale. This may also have office-political implications, but that's a whole another story.

What's the right way to do this?

1. Make it clear to start with, that you have a right to check employee email if there's a certain suspicion of wrongdoing. Make the requirements to do this clear, and have at least two people do the investigation after it has been authorised by the relevant authority. Have this in your AUP

2. Decide very clearly who the relevant authority is, both to request such an investigation and in order to authorize it. Where possible separate these roles as much as possible. In short, make it VERY difficult for someone to just rifle through someone elses email and make sure there's a clear chain of command to authorize it. It always helps to have someone who is fairly neutral to help decide when this is needed.

3. Have a log of your investigation including what triggered the investigation, what you found and where. Keep backups of relevant mail stores (Ideally on read only media) at the start of the investigation, and ensure that there's a clear chain of custody.

While its UK specific (And I'm more familiar with the way things are done in the commonwealth) findlaw UK has a nice, comprehensive article on this. While in the US, there's apparently no right to privacy (Better citation required!), its still not best practice, and might lead to other issues.

Answer 5

The answers thus far uses the legal explanations and the simple "ask your boss". I have done a Google search and it appears that in the case where law is in place, you cannot "ask your boss". The only legal way is to ask the email owners to grant access (but I still think there is a grey area: who gives permission to view ex-employee emails?). Whereas in the absence of a law, it is not clear who has the ethical authority i.e. which boss is it?

Whenever you don't know the scope of your job, you need to talk to your boss. In this case, your immediate boss - the one who has the responsibility to tell you what your job is, and what it is not.

Go to your boss now, and ask what you are supposed to be doing about looking through emails. And ask what you are supposed to do if you find something suspicious.

Taking it upon yourself to "sieve through outgoing employee emails to remove confidential and personal information" may or may not be what your boss/company wants you to do. Doing it anyway, without knowing if it's actually part of your job, puts you at risk.

Answer 6

It was wrong to take responsibilities like this upon yourself. If you were Information Security, Assets Protection, Auditing, or some similar role in your company, you would likely either already have authorization for this, or know the process for getting authorization, or know how to report something suspicious. Even they wouldn't be able to just go look at whatever they like.

You can't report the incident with how you have accessed the information without getting yourself in trouble. However, there are some options you have.

1. Show a great amount of Integrity and talk to your supervisor about the whole situation. Come clean. You should expect punishment, don't make excuses or fight it. You already seem to know what you did was wrong.

2. Suggest concerns that people are sending out sensitive information. This will be handled appropriately and you may be found out.

3. Ask your manager(or whatever supervisor would have enough power) if he would like you to have this responsibility. If yes, catch it next time it happens.

4. See if you, or suggest to somebody else in HR, can send out reminders of company policy to the general email users, along with encouraging reporting any issues.

5. Speak to the victims personally and see if they bring anything up. Encourage them to report it if they do.

6. Do nothing.

Most importantly, with the exception with a yes on #3, stop cleaning up the emails. If there is a need in the company for the position you are trying to perform it should become apparent soon. Doing #2 will help that along.