17

I work in IT and whilst configuring emails for an employee I found several memes/joke emails containing pornography which have been circling between employees. What is a good way to handle this? Should I report these emails? The emails are 2 years old.

I would like to add that all emails sent within the company network are property of the company and I am authroised to monitor everything. There is no legal implications in my jurisdiction regarding this. Lastly, I had a reason to be looking at the users emails and I was not just 'snooping'. Even though I am authorised to do so, I do not do this unless absolutely necessary

We're looking for long answers that provide some explanation and context. Don't just give a one-line answer; explain why your answer is right, ideally with citations. Answers that don't include explanations may be removed.

  • 1
    There are several issues that could arise from this. 1) Someone could see the messages and find them offensive 2) The messages have been forwarded outside of our network. If the mesages continue to be forwared, it is possible for people to see that they originated inside the company. This can cause reputation issues. 3) There is a moral issue with pornography, as it does not align with the spirit of the company. 4) There is obviously a productivity issue – pgunston Sep 4 '15 at 0:45
  • 1
    In my opinion, all of these things are managerial issues, not IT issues. – duzzy Sep 7 '15 at 3:38
44

This depends on whether the company policy allows an IT support staff to "see" an employee's emails, and what it expects the IT support staff to do in case they see something "interesting". You should describe the situation to your supervisor/manager, and ask him what the company policy requires you to do. Be aware that if you report that you read an employee's email which you were not "supposed" to read, you could get in trouble as well. For example, you could hear this:

"Oh, its great you reported an employee who was forwarding porn using official email. We have taken disciplinary action against him. Hey, by the way, why were you reading his emails? What else have you read from his emails?"

Most companies I have worked at have a so-called "need to know" policy for IT support staff. This means, for example, if I have an issue in sending email, the IT support staff would likely have to login to my email client or access my machine remotely, but he should only see what is needed to get the issue resolved, and not read my emails, etc. If he "accidentally" reads an email, he is not allowed to disclose its contents.

However, as is usually the case, the company policy also had a rather verbose list of exceptions. For example, if the IT support staff accidentally read an email which described some illegal activity, then he was "allowed" to "see" it and report it.

  • 16
    "What else have you read from his emails?" leads to the sup asking "Are you reading my e-mail?" – Hannover Fist Sep 2 '15 at 16:45
40

Unless it's child pornography, or other content that you know to be illegal in your jurisdiction, you don't worry about it.

  1. Because the OP's job is to fix machines, not police policy compliance.
  2. It may have already been dealt with. After all, it's two years old.
  3. Where the OP is does not change the fact that the rules change drastically across this site's user base.
  4. Your company's policies may be different, but unless policy enforcement is a specific assignment, you should mind your role and let management mind theirs.

It may violate policy, but that's not your area. The employees' manager is the one who should be concerned.

Also, in some European countries, I know that there is an expectation of privacy on work systems. While that idea is met with loud outbursts of laughter and sometimes beverages spewed across the room here in the U.S., it actually is a serious thing in Europe.

  • 6
    French man here, can confirm. Several ruling happened, forbidding anyone, even CEOs, to read any email clearly displayed as "personnal", be it on the personnal computer, email inbox or anything. – Clement Herreman Sep 2 '15 at 8:27
  • 3
    The distinction between illegal and policy is indeed important here. The first rule from "first aid" applies too: don't intervene if you can't guarantee your own safety. Check with your supervisor first, even if it is hypothetically. – Konerak Sep 2 '15 at 9:30
  • 2
    indeed. In the Netherlands the law explicitly states that work computers may be used privately. Employers have to respect privacy laws which means they can't just snoop around in your email or on your drives (which at times clashes with the fact that they are the owners of the drives and technically the data contained on them). – jwenting Sep 2 '15 at 13:38
  • 4
    you don't worry about it. <-- why? This seems like a very bold statement to be made without a somewhat comprehensive explanation of "why." While some readers may work in Europe, the OP's profile shows Australia. In some companies you may be responsible for not acting, too, especially if it's something that is being shared among employees. At my company following this advice would be pretty bad advice if it was ever discovered that I knew about this and didn't at least inform my supervisor. – enderland Sep 2 '15 at 14:35
  • 2
    1) Because the OP's job is to fix machines, not police policy compliance. 2) It may have already been dealt with. After all, it's two years old. 3) Where the OP is does not change the fact that the rules change drastically across this site's user base. 4) Your company's policies may be different, but unless policy enforcement is a specific assignment, you should mind your role and let management mind theirs. – Wesley Long Sep 2 '15 at 15:58
20

It really depends a lot on the situation.

If you discovered the emails because you were snooping into emails with out being directed and with no business reason then the proper thing to do is turn yourself into HR for violating the privacy of the other employees and misusing company computer resources.

If you discovered the emails as part of a diagnostic because the mail server was being overloaded by large attachments or something similar, then the proper way to handle this is to report the problem up the chain. If the problem is large attachments then report that not the content. You could mention that in investigating you noticed a significant amount of these attachments are the result of forwards and material that may violate company policies. You do not have to be specific, and I would not try to throw anyone under the bus. If management wants an investigation they can make that decision and assign the tasks associated appropriately.

If you found these emails as a direct result of trying to do troubleshooting on an issue that was reported to you(through a help desk call maybe) and the email(s) was/were directly contributing to the problem then it would be appropriate provide copies of the offending emails your your manager with a detailed explanation of how you found them and how they were causing the problem. If the person that you would normally report this to is or may be the person responsible for the emails then reporting them to their manager with an additional explanation of why you escalated it beyond the person you would normally report to would be advisable.

It is important to note that unless you have been tasked with monitoring content of emails, you may have been violating company policy by even looking at the content. If you report it you may find yourself under a microscope and having to defend your reading of the emails. If what you did was appropriate and necessary for the execution of your job functions you should be fine, but if you broke any rules, or if they decide it was not necessary for you to read that content you could find yourself in trouble.

9

A little story:

When I was a young engineer in Scotland, I went on a business trip to Colombia with my boss and our company's agent, who were both old men. Therefore the client's plant operators (who were nearer to my own age, but, shall we say, far more "working class") adopted me and took me out a couple of times (I will leave it to your imagination to guess where they took me.)

Anyway, I made the mistake of giving these guys my work email. When I got back to the office I had several emails of pornography. One was of disgustingly hairy women, with commentary by Elmo the cute monster from Sesame Street. Very funny but not sexy.

Fortunately no-one from IT snooped through my emails, so I never had to explain anything.

In addition to the existing comments of "it's not your business, ignore it" The point I want to make is that you don't know who is to blame, and it may even have started with a legitimate business contact. Yet another reason to leave it alone.

  • 2
    indeed. My father went on business trips to many countries and regularly was offered the services of prostitutes and got to hear quite a few sexist/lewd/use your imagination jokes that would be considered totally inappropriate at home. He had no email address so he never got such stuff mailed to him but if he had he probably would have. Instead of looking at what people are receiving on their corporate email addresses a person looking for stuff that's in violation of corporate policy should look for what's being SENT. – jwenting Sep 3 '15 at 6:19
3

I will answer this from a IT perspective. Please note that this is going to depend a lot on company culture and policies. I used to do IT work in the US and this came up from time to time.

First let's address one key thing. The email, the address, the server, the computer, the network et al. are the property of the company. The company 100% has the right to do with it what ever they want including reading it. This is a very important fact. Lots of people get fired because they assume their company email address is private when it is not. Company emails accounts should always be used only for company stuff.

Now, as to the content of the email. As an IT person, you will be given access to a lot of things that a person considers private. You can see pay data, or emails, or files, or chat conversations. The higher up you are in the IT structure the more you're going to see. First and foremost your job is to make sure everything runs, and runs well. At times that means cracking down on "personal" emails. But you have to decide on a case by case basis, if this is one of those times. If you are fixing someones mailbox and see 2 porn emails from 2 years ago, I would say "let it go". It has no bearing on "today" and you don't know why they got those emails. You're certainly not going to have any effect on the current network by addressing those emails. If you were repairing an email box and saw 2,000 porn emails, then I would say it's time to take action.

Basically it comes down to a fast check against a set of rules.

  1. does the email effect the current network?
  2. does the email constitute some kind of security risk?
  3. does the email violate some law?
  4. does the email violate some "hard" policy?

If the answer is yes to any of these, then you report the email to "who needs to know". That need to know list is very short. Again the goal here is to keep the network running, and apply a bit of CYA for yourself and your company.

For rule 3. This is simple. If the email violates some law, then inform the right people. Usually this your supervisor, or the supervisor if the person in question (depending on how far up the food chain you are). Do so quietly. Let them take the action.

Rule 4 only applies if there is a hard rule. Like a 0 tolerance policy for porn, or personal emails. Usually if this is the case there will be a policy somewhere stating who to tell.

It is very important to remember that it is your job to police the network and address, through the appropriate channels, problems that you see. However, you need to use some common sense. If it's not causing a problem, and it's not against a company policy, then your personal feelings aside "it's none of your business".

Finally, there is no harm in asking, quietly, others you work with (in IT), what they recommend. Specially if they have been there longer. No need to mention names, or specifics, just ask for advice.

  • 3
    Again this is in the US, other countries have different rules when it comes to who the email belongs to. – coteyr Sep 2 '15 at 18:47
  • 2
    Your answer may not be true for some US jurisdictions. From Wikipedia's "email privacy" article: In 1972, California amended Article I, Section 1 of its state constitution to include privacy protections. A California appellate court then held that the state’s right of privacy applied to both public and private sector interests. Further in Soroka v. Dayton Hudson Corp., the California Court of Appeals reaffirmed this view and held that an employer may not invade the privacy of its employees absent a "compelling interest". – ceejayoz Sep 2 '15 at 19:52
  • Hurray for Common Sense! I will expect privacy at work when my company expects that it can intrude on my home life. Until then, work time belongs to my employer, and all equipment and use of it. Why is this such a hard concept for people to accept? Run your own company from home if you want work and personal to get totally mixed together! – user37746 Sep 2 '15 at 22:27
  • 1
    @nocomprende, common sense also says that people don't really work 100% of the time. For example, they chit-chat around the water cooler or the bathroom. By the way, would you be ok with being taped in the bathroom? After all, it's their equipment. – Cristian Ciupitu Sep 3 '15 at 0:59
  • @CristianCiupitu: People are so funny about privacy. There are places where it doesn't exist, and they get along. In answer to your question, I suppose it depends on whether you think that developing good relations with co-workers is worth paying people to do. It could vary. And, how much of it is really needed - judgment call. – user37746 Sep 3 '15 at 1:04
2

in addition to what's already been said (iow it's none of your business if you don't already know how to handle it, and that's putting it mildly) you should not look at what people are receiving.
IF, and only IF, it's your job to look at violations of corporate email policies you should look at what people are SENDING.
What people are receiving is largely outside their influence, especially if you have a mail server where people can receive messages from outside the company.

If I had your email address I could send you links to porn sites from some anonymous yahoo or hotmail account and someone like you would blame you for having messages with links to porn sites on his computer. How'd you like that from happening?

And of course, being years old, it's almost certainly no longer relevant. If it were still going on today rather than existing in some email archive the person holding the account may not even be aware of (here for example all email older than 3 months is archived, many people aren't even aware those messages still exist, they think messages older than 3 months are deleted so many print them out or save them to a document on some network drive if they're important).

1

Unless you have been tasked as part of your job to be checking for porn, it's none of your business. A large part of what I do is the prevention of internet abuse. Emails tend to be disregarded as unimportant. Disclosure of any non work related information found is unprofessional at best.

2 year old emails are even more unlikely to constitute a problem.

This is an industry where trust in an individuals professionalism is vital for your career. Many CEO's and Govt heads who have their own IT team here, will not let their own team work on them but will pay someone like me to service them for that very reason. There's probably very little I haven't seen. But unless it's my task, I don't say anything, even to the machines owner.

Lose that trust in your professionalism and you create manifold problems for yourself. As well as probably some personal antagonism which is never helpful.

So in summary my advice is "it's not your problem, don't make it a problem."

-2

I agree with @ReallyTiredOfThisGame's answer but wanted to add something if you think it is not going to be a good idea to report these specific instances

You should review your company policies on What is acceptable and not acceptable. Then without mentioning you saw this material, you might send out a reminder about the policy against porn (you can tell your boss that you were reading about some issue having to do with problems due to porn on a some other company's network as the reason why you think a reminder would be a good idea, I'm sure Google could find some bad examples for you pretty quickly).or suggest to your boss that it would protect the company if they had an explicit porn policy.

  • 7
    Don't take unilateral action and then lie to your boss about your motivation. It's very possible your boss already knows what's happening to some degree, so your deception would be VERY transparent. – brian_o Sep 2 '15 at 14:59
  • I agree with both of you. The time has come and pass to deal with this directly -- perhaps the employees in question were already disciplined 2 years ago. But OP should, without lying, ascertain the policy and steps to take in the future. (Of course, the policy might involve reporting these old instances in which case that should probably take precedence.) – Matthew Read Sep 2 '15 at 16:01
  • It's not a lie, it is just not telling everything you know. There are very good reasons why it is a bad thing to have any pornography on your work systems, making sure these types of policies are in place and followed are part of a sys admin's job. I suggested he bring up a new policy with the boss or the reminder about policy so it is hardly unilateral action. – HLGEM Sep 3 '15 at 13:31
  • If the review of the e-mail was above-board, which it often is in the financial industry, there should be no need to hide what the motivating factor was. If the review of the e-mail wasn't above-board, it's similar in my mind to "the fruit of the poisonous tree" and shouldn't be acted on because it encourages shady behavior. I think it's a really bad idea to try to hide your motivations - if people see through it, you lose a lot of credibility. If you weren't doing anything wrong, be direct with the boss and let her figure out how to act on it. – ColleenV Sep 4 '15 at 2:10
  • @ColleenV , the data is two years old. It serves more as a reminder that he should have been looking at this policy all along. There is nothing deceptive about suggesting they look at this policy without bringing up two year old records, this is a normal part of the sys admin job, It is something that should be periodically looked at whether there were porn emails found or not. – HLGEM Sep 4 '15 at 13:34

protected by enderland Sep 2 '15 at 13:21

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.