How to handle a boss asking me, an IT admin, to monitor an employee's activity on his computer?

Question

Here's the background of my specific case. The director of a department suspects that an employee is playing video games at work. This problem is aggravated by the fact that the department is understaffed right now, and work is pilling up. I had another employee of the same department come to me with the same suspicions, motivated by the fact that the low output of his coworker is making him have to work harder. He claims that he sees weird flashes in his monitor sometimes, but every time someone gets close he switches to work related windows.

After hours, his boss was snooping around on his PC and he asked me for help. We found Diablo 3 installed, and browsing history of a few dating sites. Now he's asking me to monitor his activity to get concrete data about the frequency of those activities.

I have two concerns going forward. One is legal, but that's off-topic here; the other is about my relationships with those people at work. I've been told not to talk with him about this matter before we have concrete data, which means that by trying to solve this issue having a conversation with the employee, I'd be going against direct instructions (plus, the employee could take offense if he thinks the accusation is unfounded); on the other hand, by monitoring him and forwarding all the results to his boss, he'd probably feel betrayed when he realizes the past week I've been gathering that data behind his back that could potentially get him fired, while at the same time interacting with him as if nothing was happening.

I should add that, even though we don't usually hang out, I like the guy, which makes this much more difficult and uncomfortable for me.

Answer 1

I want to address the uncomfortableness issue. Many employees are given tasks to do that require, by the nature of the task, that the information be held closely or kept secret from other employees altogether. This is one example, the list for a layoff next week is another, or the reason why a person was put on a PIP (Performance improvement plan), etc.

Whether this particular task is legal in your country is an issue. But given a task of this nature that the boss can legally ask you to perform and maintain silence about, then it is your work responsibility to maintain the confidentiality of the task.

IT admins (who might be asked to be ready to turn off someone's permissions while they are being fired, for instance), database admins (who can see data in the database that might not be appropriate for others to see), HR people, Accounting clerks and all managers are examples of professions that often have access to information that needs to be kept secret from other employees or specific individuals.

Since keeping secrets is in the nature of your particular profession, you need not feel guilty about doing so and, in fact, you should feel guilty if you do not keep the secret you were supposed to keep. Violation of this principle is something that can get you fired in these professions in many parts of the world. You are asked to hold information in trust, you must prove trustworthy.

Will some people react badly when you don't tell them things they should not at that moment know? Yes, they will. But that is their personal problem, not yours. You cannot allow friendship to make you violate the standards required in your profession. You may need to learn that in some professions, you need to keep your distance. People who don't understand that and who complain to you that you held out on them are the ones behaving unprofessionally. Anyone who is a professional will know that you did what was required by your job.

An excellent point is made by @RichardU in this comment:

I agree, with one caveat. If the company has a set procedure on how to track an employee for disciplinary action up to and including termination, it is your job to follow that policy, and not your manager's orders. I worked for one company that had very strict protocols for dealing with potential security issues, which this falls under. ANY sort of employee surveillance required both HR and security to be involved. He should check with both to see what the proper course of action is. – Richard U

A good way to respond if the person gets mad is pointed out in the comments by @JoelEtherton

On the topic of the colleague feeling "betrayed" if you perform this task as asked: Remind him that he betrayed you by willingly violating the policy and placing you in that position in the first place. He has no one to blame but himself. – Joel Etherton

Answer 2

You are an employee and it is a request from your boss.

You can block web sites.
Just installing Diablo should be a violation.

I would ask for the request in writing with a cc to HR.

If you can have it set up that your boss views the screen shots but not you. You can even record the whole day but then someone has to watch the whole day.

Privacy laws in the US are different and I am not a lawyer so I have no idea about the legality.

Based on excellent comments from WernerCD and slebetman another option is to monitor IP addresses and ports. Without seeing the actual content you can show when sites or game servers were accessed. This may be a difference in privacy but that is a legal question

Answer 3

You and your boss should probably approach HR as a means to better understand your companies policies towards such things. This would for sure take care of any possible legal issues as HR shouldn't advise you to do anything that is against your countries/states law.

I would also suggest to the manager of this employee to simply bring up his lack of performance in the workplace. A simple One-on-One where the manager expresses displeasure is usually enough to get the point of "Maybe I shouldn't be playing games or browsing personal sites at work" across.

Ultimately it sounds like the manager may be stressed out (understaffed, overworked) and not wanting to deal with the employee the correct way. Which brings me back to the HR option, chances are the HR manager will bring in the Manager and Employee and mediate any grievance while also filling out proper paper work to make sure the employee gets his/her fair shake. Instead of the manager going incognito trying to find grounds to fire an employee; even though lack of performance is usually enough grounds anyways.

Answer 4

This is one reason I never get overly friendly, because such a situation can easily crop up.

In your particular situation I would tell the boss that prevention is better than cure and ask for and almost always get permission to perform blocks on the computer to prevent abuse. Because it's better to rectify it that way than spend time and resources trying to play cat and mouse. I would not worry about offending the employee and would probably uninstall Diablo in front of them and give them a friendly verbal warning. I've done this many times, it's part of my role.

I have never had anyone take this badly. They know they shouldn't be doing it and they're usually grateful for the heads up.

"You can't have this on your machine, so I'm taking it off before it gets you in trouble. Don't put it back on or I'll have to lock down your machine. And I'll be checking, it's part of my job mate."

or

"Internet usage is unusual in this section, it needs to stop before I'm asked to investigate. And I've been told to monitor you chaps for a while."

If the boss does insist on doing it undercover, then I follow those orders without qualms, that's part of the job. But a good boss for the sake of morale usually allows me to handle it in the first instance. Also the boss usually likes the fact that it will be me facing the employee rather than them. If the warning doesn't work then I will investigate thoroughly and give a professional and factual report.

Answer 5

There is no ethical issue here. Do what your boss says, and monitor the system.

As an IT administrator, you have an ethical responsibility to do your job. (I'm a systems admin myself, for what it's worth.)

Part of the job of an IT administrator is to monitor the systems you are entrusted with, for (among other things) "misuse." An employee playing Diablo 3 instead of working is misusing his system, so it's cut-and-dry that your ethical obligation is to comply with this request by your boss. And not incidentally, it would be negligent of your boss not to investigate this suspicion.

As much as you may not like it, the only person acting unethically here is the employee who's playing video games instead of doing what he's getting paid to do. Implement the monitoring, turn the data over to your boss and if it still bothers you, put yourself in your company's shoes. What if you were paying someone to work for you, and he decided to play video games instead of whatever you paid him for?

Answer 6

I should add that, even though we don't usually hang out, I like the guy, which makes this much more difficult and uncomfortable for me.

I hate to say this , but you have to grow a thicker skin and separate your personal feelings from your professional obligations. I work in IT Audit and a primary job duty of mine is to enforce internal control over IT policies. Some time back, I discovered users improperly accessing a sensitive system, activity that no one in management can reconcile or explain. I immediately documented the chain of events such as how I discovered this information and presented to my manager with a CC' to HR. A period of unease followed, but I did the job I was supposed to do and did not compromise my integrity for the sake of keeping the peace.

The recommendations made by Kilsi and by Matthew are both good. Corrective controls through blocking and preventative controls through policy establishment work in tandem to accomplish your goal. The block serves as the medium through which policy is enforced.

Answer 7

A perspective from the third side of the fence: the security department.

Such questions (including moral and legal aspects, but also the fact that some people could be expected to go through possibly personal data) is the reason for a clear policy. A policy accepted by management, HR and legal.

Under this policy any operations related to data on personal devices ("personal" means a device which is expected to hold personal data) follow strict rules

• a formal, written case is raised by a requester (your boss in this case). It does not matter whether this is a standard employee or the CEO. This is a standard form, no room for improvisation.
• the case has to be accepted by three people: the head of HR, the COO and the head of legal. It is the problem of the requester to get these approvals.
• the approved form is the entry point for the CIO to request any kind of investigation.

There are more aspects to it (notably the legal sustainability of the forensics process) but one of the main reasons is to make everyone comfortable. The requester, the executive staff, the CIO, the actual investigator.

The number of cases did not go down after the policy was put in place but the quality sky-rocketed.

Answer 8

You are the admin and this is a company PC. You can sidestep the problem:

Establish guidelines of what may be installed. Do not allow games to be installed. Do not allow users to access internet sites like dating, social networks, etc. You can give security as the reason. Lots of places do this.

Send a mail round telling everybody this will be policy starting on Monday. Have a remote way of cleaning up PCs regularly.

This way you stop the guy doing this without breaking any law or union agreement and without offending anybody.

Answer 9

Against all other answers posted until now, I think this is definitely an ethical issue. In your job interview did you sign up for spying on a friend? What if this were your spouse working at the same company? What if your boss asks you to install a listening device at their desk or in the cafeteria of you company and listen in to all the talks if someone is cheating the company?

As you seem very uncomfortable with the situation, I guess this is the first time you have to monitor employee activities. And I think monitoring people, reading private mails or watching their browser-history is not automatically included in an IT/sysadmin position and is also not automatically expected by employees. As such, if you never expected this to be part of your job, I think it is a perfectly valid concern to tell your boss. If my boss would ask me to clean the toilets (as an IT employee) I would also say that I didn't expect this to be part of my Job and probably would not have taken the position if I knew this was a requirement.

Not everyone is built to work in HR or an intelligence agency or in a job where you have to lie to people. And I don't think this is a requirement in every job which you just have to accept. If you feel very uncomfortable with this and do it anyway, it may as well affect your well-being and weigh very heavy on you and eventually break your working morale, lower your output or lead to you seeking a new position without this moral requirements.

So I would inform my boss that I'm not comfortable with doing this and will not be happy with my position if this is a regular requirement. There are enough IT positions out there which don't require lying and spying on your friends. - I think keeping a secret password or some internal trade secrets from people a whole different thing than actively spying on someone, working to get him fired behind his back.

If there is no company policy stating "employee activity on any company device will on suspicion be monitored" the whole request is at least ethically questionable (and probably illegal depending on jurisdiction).

Answer 10

Me personally, if I liked the guy, as soon as I possibly could after the moment when the boss asked me to look at his computer with him, I would tell the guy. I would speak to him privately, and tell him that we looked at his computer, what we found, and that I had been asked to monitor his activity and report my findings to the boss. I would tell him that I planned to do exactly that, and then I'd do exactly that. If the boss found out I warned him and was mad about it, I'd say bite me, I'm not going to keep something like that from somebody. I'm a human before I'm a worker. If he fired me, I'd get another job. Probably a better paying one, given that this company is having trouble making enough money to staff themselves well enough.

We live the majority of our waking hours at work. All day long, every day. Yeah 'the company' probably owns all the stuff it issues to us to work with all day every day, but we're not slaves. We can leave and get a different job at any time. Good luck making any money with all that equipment without any workers! If you do something cerebral at a computer all day, every day, every now and then you need to be able to take a freaking break and do whatever the hell you want for a little while, if you're going to be maximally productive. Lots of fortune 100 companies know and understand that, and even intentionally facilitate it.

Yeah, if someone isn't getting their crap done, and it's causing trouble for other people, that's a problem that needs to be dealt with. If I were the guy's boss, I'd have a private conversation with him that was calm and pretty much congenial. I'd say hey, we're in this spot right now in which we're a little under staffed in this area. People are feeling the strain of it, and some of us around are feeling like you're output isn't what it needs to be, and we're suffering more for it, because we have to take up the slack. Some people suspect that you've been playing games and stuff. Are they wrong? If I were to look at your computer right now, would I find any games? Would I find questionable things in your browsing history? Those are just rhetorical questions, ok? I'm not going to do any of that. I just need you to turn that perception around. If you can't do it I'm going to have to let you go, understand? We really need the person in your position to be giving us their best effort right now. I'd like to hope you can turn it around. Give it a shot, alright? We'll chat again next week.

Something like that. Don't be concerned with the details of what he's doing when, be concerned with his results. If his results aren't what are needed from the person in his position, then get him out of that position and put someone else in it.

Answer 11

Well, difficult and uncomfortable feeling is natural however the same goes for every person of your job role. The IT managers are supposed to keep a check on how the company’s electronic assets are utilized.

The same happened with me some couple of years back when I was working at a software company as IT supervisor and my boss asked me to provide him a complete browsing history of an employee who was a very close friend of mine. Despite my unwillingness to do so, I had to do the same.

I would suggest you to block specific websites for all the employees. This thread would give you an idea about how to do so. Besides, with smartphones getting more popular than laptops for internet browsing and social networking, secretly installing cellphone spying apps like xnspy etc. on employees’ smartphones can open up doors of endless possibilities to track and monitor employees’ activities.

This is what my current boss is up to. However, I would strongly suggest you to first check with the laws in your jurisdiction.