20

A part of my IT job I take upon myself is to sieve through outgoing employee emails to remove confidential and personal information before handing over the account to the succeeding person.

One fateful occasion, I found a strange email in the inbox with salary information that was sent from employee X to the HR manager, and in turn forwarded by the HR manager to the email account owner (who is now an ex-employee). It appears that the HR manager had sent the salary information to employee X to work on some document formatting.

This raises the alarm.

In order to obtain more evidence, I logged into their email accounts and searched for the correspondences. Eventually I ended up finding more such cases between 3 other employees, together with the HR manager. Altogether 12 cases breach of trust; 6 sowing discord; and 3 asking others to do her job.

I wanted to report on misconduct but I am worried about my unethical access. As an IT personnel, I have authorised access to all systems, but I feel I could have consulted with a director before proceeding with the search. I have no idea how the management will think/act if I reveal this. What should I consider for protecting myself while be able to do justice?

EDIT: At which level (manager, director, or a particular department) would "snooping around" be legal? Or can make a legal decision to search?

EDIT 2: The answers thus far uses the legal explanations and the simple "ask your boss". I have done a Google search and it appears that in the case where law is in place, you cannot "ask your boss". The only legal way is to ask the email owners to grant access (but I still think there is a grey area: who gives permission to view ex-employee emails?). Whereas in the absence of a law, it is not clear who has the ethical authority i.e. which boss is it?

EDIT 3: Due to the majority enthusiasm for policy of minding-my-own-business and self-protection before the law (which I must admit I find rather surprising), I feel that the answers have deviated substantially from my intended main theme of "how to bring justice" to "problem with unethical evidences".

Anyway, I do appreciate that the short answer is I cannot do anything (at least under majority of country laws). Thanks for the answers. To some of the commenters/answerers, I regret that I am unable to provide more details regarding my position in the company and the nature of the misconduct I am complaining about etc. thus making this question a bit of a guess in the wild.

  • 27
    Don't worry about getting fired; the NSA will hire you for your flexible morals an blatant disregard for any notions of privacy. I think you may actually have a promising career intelligence sector! – user25891 Oct 31 '14 at 16:02
  • 12
    There is so much wrong with this that there is no point in making another answer. I would like some clarification though: you have judged the HR manager with "12 cases breach of trust; 6 sowing discord; and 3 asking others to do her job." Yet the actions she has taken aren't against the law. As far as I can tell, you've invented a set of rules, and then applied them to her, and are asking us how to help you have her punished for breaking your made up rules. She has the authority to have others work on salary documents. What is your authority? – Adam Davis Oct 31 '14 at 16:31
  • 16
    My issue with this is "A part of my IT job I take upon myself is to sieve through outgoing". You shouldn't even be clearing out confidential information. I'm sure you have an IT policy for that. – Prinsig Oct 31 '14 at 16:47
  • 4
    My personal rule is "Even though I have the power to know, I don't want to know, because then I would be responsible for knowing." Some don't understand that this is actually the right attitude, not that I am being lazy. Even further, you might not be able to do anything about it, even though you feel like you should. This is the situation you are in. You cannot do anything. – Jeff Davis Oct 31 '14 at 20:55
  • 2
    If the HR representative in question is the same one "sitting in" during your performance review from this question, you may do well to quietly and quickly cease and desist all activities you've described (which honestly would be wise to do regardless). I see zero-chance of a good outcome from this if that is the case, and quite the contrary; this could turn ugly quickly. – WhozCraig Nov 1 '14 at 6:45
69

If I understand this correctly, it appears that you are snooping through closed mailboxes without any permission or authorization from your management. In my opinion, this is misconduct equal to or greater than any of the perceived offenses that you mention.

I'm assuming that you aren't privy to every conversation held by the HR manager. Maybe this person has approval to work with one or more outside individuals for purposes of document formatting and the like. Maybe the things that you view as a "breach of trust" are perfectly OK from the organization's standpoint. (I won't even get into the "asking others to do her job" comment.) The point that I'm trying to make is that you're trying to do someone else's job, and that you are commiting the same violations that you're trying to prevent (breach of trust, for example) in your own actions.

Do not take this to management if you value your job, and by all means, stop snooping through email that doesn't belong to you unless you have specific written permission from your supervisor authorizing this. You may have access to sensitive information, but make no mistake, this does not automatically mean that you can look through it and act upon anything that you find.

  • 14
    This depends on the organization. I'm an IT Director - my firm's equivalent of CIO - and I would not authorize any of my staff to look through a user's email without express instructions to do so from either HR or senior management. If I found that a member of my staff were participating in this sort of fishing expedition, a write-up would be the minimum action that I would take. I have worked for less ethical organizations that routinely snooped through individual email accounts, but even in those organizations the action was initiated by a senior manager and not an IT staff member. – Roger Oct 30 '14 at 16:11
  • 14
    You're missing what I'm saying. You CANNOT act upon the things that you have found. If you think it's important to do this -in the future-, you should obtain approval -in advance- from your supervisor before looking through any other email accounts. – Roger Oct 30 '14 at 16:16
  • 6
    Think of it like this. You're your network's detective. When someone with authority (basically someone higher up the hierarchy than the person being investigated) asks you to investigate something, you have all the access and privileges necessary to do so. This is actually a pretty cool perk. Unfortunately your vigilante search for problems is HIGHLY ILLEGAL in most of the modern world. What HR did may or may not even be an issue. They could be acting on the advisement of higher ups. Even if it's the worst case what you've done far out weighs their actions. Unless you're told to, don't dig. – RualStorge Oct 30 '14 at 19:12
  • 6
    @Jake: The question, "do we read employees' email without cause?" is a very top-level policy, the CEO or another C-level role with responsibility for IT security should make it. However, that decision being made, lower-level people should be aware of it. Your immediate supervisor should be aware of it (or can find out from their immediate supervisor and so on), so the advanced approval you seek should be at that level. This isn't a matter for going over your manager's head, since your manager should be in the loop of whether this is part of your duties or not. Follow chain of command. – Steve Jessop Oct 31 '14 at 11:29
  • 13
    @Jake: I think you still missed their point. You shouldn't be asking anyone for approval. You should be minding your own business unless directed to look for these things. – Joel Etherton Oct 31 '14 at 15:11
41

A part of my IT job I take upon myself is to sieve through outgoing employee emails to remove confidential and personal information before handing over the account to the succeeding person.

[tl;dr answer - why, oh why?]

Stop right there. Leaving aside the issue of not having official sanction to do this, and having picked up a lot of confidential information you are not entitled to have, what do you mean by "handing over the account to the succeeding person"? Do employees not have individual outgoing mail accounts? Do you recycle stuff so that a new employee could reasonably stumble across their predecessor's work? That appears to be a major problem in itself.

  • Assuming you weren't doing what you do, could users ever have unintentional access to potentially confidential mails sent by other people?

  • Given that you "remove confidential information", how do you know you haven't accidentally removed something important, eg. evidence for or against wrongdoing which might subsequently be demanded by a court?

  • How can anyone trust email for security and honesty if the system allows you and your fellow sysadmins to dip in and change stuff?

Basically you haven't just read stuff you weren't entitled to, you (as a result of a dysfunctional set up) have undermined the whole integrity of the email system in the company. The right thing to do would be to get the email system changed so that outgoing personal messages are never sent from generic accounts, making your sanitisiation unnecessary - but justifying that change is going to get management asking questions which could cost you your job.

  • 6
    “Do employees not have individual outgoing mail accounts? Do you recycle stuff so that a new employee could reasonably stumble across their predecessor's work?” I assumed that this was for e-mail addresses that aren’t specific to a given person, e.g. human-resources@company.com. – Paul D. Waite Oct 30 '14 at 17:24
  • 21
    @PaulD.Waite Typically modern companies generic accounts aren't shared anymore, instead when you email human-resources@company.com, it redirects that email to SallyTheyHRManager@Company.com. When Sally quits her email is archived incase it's needed for legal reasons and the HR address is then forwarded to whomever takes over. The individual's address is then set so send a "I no longer work here" or forwarded to the replacement person, or a manager, or whomever is appropriate. (companies practices differ, but you avoid "catch all" boxes for both legal and practicality reasons) – RualStorge Oct 30 '14 at 19:19
  • 4
    Commonly, companies archive an ex-employee's email and permit their manager access to it for some period of time, because you might have issues that were left unfinished when they left and/or need to find past correspondence. I wouldn't generally expect it to be forwarded whole hog to the next person up, though. Either way, I think you shouldn't have any expectation of privacy in work email, and shouldn't use work email for anything you would be bothered by someone else seeing. – Joe Oct 30 '14 at 21:41
  • 3
    @RualStorge: Can't talk to what is common, but that's quite an outdated set up to be honest. What I have been seeing more and more is that addresses like support@company.com can be accessed by everybody in the support group (even if that's just one person). In addition to this they would have their private inbox and they can choose to reply from either. – David Mulder Oct 31 '14 at 2:09
  • 1
    @RualStorge: we used to have a setup like the one you mention with email forwarding, and it was a nightmare. An employee would take maternity leave, and suddenly there was no immediate access to relevant data from a few months ago. A generic account should be precisely that, and not a frontend for a person's personal account. – Martin Argerami Oct 31 '14 at 12:17
11

Typically one does not search through anything without authorization from a lawful authority. Within a company this would probably be the board of directors and/or the CEO backed up by your AUP - That is to say that your employees have agreed to this beforehand.

In a very clear sense you've breached your duty of trust (or as I like to say, the great responsibility that comes with the great power of being an IT Manager and Operator. You've abused both your positional power and the powers vested in you to do your job.

In a very real sense this is precisely why a forensics trained IT professional has to work within a very strict set of rules, since in many cases, what you've found is probably legally useless.

Outside legal issues (And I find this varies widely), if employees believe that their work emails can be monitored without a proper procedure, they're likely to simply switch to private email accounts anyway, and it may affect morale. This may also have office-political implications, but that's a whole another story.

What's the right way to do this?

  1. Make it clear to start with, that you have a right to check employee email if there's a certain suspicion of wrongdoing. Make the requirements to do this clear, and have at least two people do the investigation after it has been authorised by the relevant authority. Have this in your AUP

  2. Decide very clearly who the relevant authority is, both to request such an investigation and in order to authorize it. Where possible separate these roles as much as possible. In short, make it VERY difficult for someone to just rifle through someone elses email and make sure there's a clear chain of command to authorize it. It always helps to have someone who is fairly neutral to help decide when this is needed.

  3. Have a log of your investigation including what triggered the investigation, what you found and where. Keep backups of relevant mail stores (Ideally on read only media) at the start of the investigation, and ensure that there's a clear chain of custody.

While its UK specific (And I'm more familiar with the way things are done in the commonwealth) findlaw UK has a nice, comprehensive article on this. While in the US, there's apparently no right to privacy (Better citation required!), its still not best practice, and might lead to other issues.

  • Regarding the U.S., it's pretty much the same as what you described for the U.K. If e-mail accounts are not private, it needs to be in the company policy that employees are made aware of and agree to that they have no expectation of privacy on company computer or e-mail systems. This is the policy of most U.S. companies as well as the U.S. federal government, though. If such policies are not in place, though, any evidence obtained would be inadmissible in court. Forensic investigators follow a similar chain of custody here as what you described. – reirab Oct 31 '14 at 16:43
  • 2
    Well I'm forensics/security trained, so my answer is heavily coloured by that. If your evidence isn't good enough to hold up in court, it is garbage. – Journeyman Geek Oct 31 '14 at 23:00
  • 1
    Agreed. I'm also trained in forensics and security. I was mostly just confirming that procedures in the U.S. are almost identical to what you described for the U.K. for almost identical reasons. – reirab Nov 3 '14 at 20:21
10

What should I consider for protecting myself while be able to do justice?

Find a good lawyer.

This answer may not be applicable in all juristdictions, but at least in Central Europe what you do is probably completely ILLEGAL*. I am sure it is at least in Germany and the Czech Republic.

Purposeful pinpoint searches, requested by management and perhaps approved (or requested) by court is tghe only legal (if questionable) setting in which you, as an employee, can read through a limited subset of one's mail. In the above named countries the employee must know or express consent to the fact that his mail are being scrutinized.

Reading your coworkers' e-mail systematically without any consent at all is inexcusable considering the ethicality only.

And the answer is: your company should be protecting itself from you, not the other way around.

(*) I just couldn't stress the word illegal enough.

8

The answers thus far uses the legal explanations and the simple "ask your boss". I have done a Google search and it appears that in the case where law is in place, you cannot "ask your boss". The only legal way is to ask the email owners to grant access (but I still think there is a grey area: who gives permission to view ex-employee emails?). Whereas in the absence of a law, it is not clear who has the ethical authority i.e. which boss is it?

Whenever you don't know the scope of your job, you need to talk to your boss. In this case, your immediate boss - the one who has the responsibility to tell you what your job is, and what it is not.

Go to your boss now, and ask what you are supposed to be doing about looking through emails. And ask what you are supposed to do if you find something suspicious.

Taking it upon yourself to "sieve through outgoing employee emails to remove confidential and personal information" may or may not be what your boss/company wants you to do. Doing it anyway, without knowing if it's actually part of your job, puts you at risk.

5

It was wrong to take responsibilities like this upon yourself. If you were Information Security, Assets Protection, Auditing, or some similar role in your company, you would likely either already have authorization for this, or know the process for getting authorization, or know how to report something suspicious. Even they wouldn't be able to just go look at whatever they like.

You can't report the incident with how you have accessed the information without getting yourself in trouble. However, there are some options you have.

  1. Show a great amount of Integrity and talk to your supervisor about the whole situation. Come clean. You should expect punishment, don't make excuses or fight it. You already seem to know what you did was wrong.

  2. Suggest concerns that people are sending out sensitive information. This will be handled appropriately and you may be found out.

  3. Ask your manager(or whatever supervisor would have enough power) if he would like you to have this responsibility. If yes, catch it next time it happens.

  4. See if you, or suggest to somebody else in HR, can send out reminders of company policy to the general email users, along with encouraging reporting any issues.

  5. Speak to the victims personally and see if they bring anything up. Encourage them to report it if they do.

  6. Do nothing.

Most importantly, with the exception with a yes on #3, stop cleaning up the emails. If there is a need in the company for the position you are trying to perform it should become apparent soon. Doing #2 will help that along.

  • 2
    Even if they were infosec, auditing, etc, it would still be wrong to take on this role themselves, and without authorization from executives of the business (or court order). – atk Oct 30 '14 at 22:57
  • @atk True, I meant to say if he had one of those roles he would likely already have authorization, or know the process to get authorization. I'll re-word it some. – DoubleDouble Oct 31 '14 at 15:07
  • not necessarially! Such access is more likely to be restricted to individuals in such roles, but (a) not everone in those roles will know how to get access, especially in larger organizations, and (b) many individuals in those roles do not already have such access. Nonetheless, you are otherwise spot on, and I thought you already had my upvote :-) – atk Oct 31 '14 at 16:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy