2

I work in an office in which all computer usage is via a secure server owned and administrated by the company. The IT admin and I have had numerous altercations as well as my boss asking us to do some unethical things. Boss and IT admin are in cahoots in many ways. Boss can be a bully and not allow inter office discussion about serious issues we all face.

I was recently confronted by my boss that numerous emails he had received from me are fraudulent. He would not show me any nor allow me to even defend myself. I do not have admin clearance and can not create any email addresses but IT admin is constantly at our terminals doing "updates".

I have not created any fraudulent emails and I believe that only the admin has the clearance to do so. How can I defend myself against this false accusation of misusing company email when I don't have access to the "evidence"?

Improve this question
8
  • 1
    Yes, author info can be falsified; botnets do this, for example, and that's what the limited info you've given us suggests might have happened... But as others have said that's off-topic here.
    – keshlam
    May 15, 2016 at 13:35
  • 2
    I'm voting to close this question as off-topic because it's about IT security, not navigating the workplace.
    – Philip Kendall
    May 15, 2016 at 14:11
  • @PhilipKendall, did my edit help?
    – Anthony
    May 15, 2016 at 14:12
  • 2
    What are fraudulent emails in this scenario?
    – Lilienthal ♦
    May 15, 2016 at 15:08
  • I did ask this exact question in security and they suggested I come here. Perhaps my issue falls into the in between abyss.
    – John Grayson
    May 15, 2016 at 16:43

2 Answers 2

Reset to default
5

Given I work in IT, in a profession that tries to deter fraud, let me give you what I think happened in your case. It appears that your email address was spoofed, for the purpose of sending malicious emails. Email spoofing is actually not hard to do given you have the technical knowledge of how emails are sent and interpreted at the receiving email server.

Using the old method of validation, SPF,(Sender permitted form), your email server as the receiver compares the IP address of its domain host (ex: @XXX)with the origination IP of the email. Only if these match would the email be allowed through, and blocked else wise as spam / malicious email. This old method is flawed though as it relies heavily on user administration and is not standardarized in how failures are handled. Sometimes, one may not want to block legitimate email, which eases network administration but phishing / spam / become a problem.

A more modern method that is being used in conjunction with SPF is DMARC. DMARC policy is embedded within the DNS information in the email server and tells the email how a message failing SPF validation (Sending origination IP <> receiving domain host IP) via its -p flag. This would definitely help you avoid a similar situation in the future, but I doubt a small employer would have the resources to properly implement this technique.

How you should proceed

Your SysAdmin is suspect in this case. Its highly unusual for him to need to update your machine locally, as updates can almost always be pushed centrally from a server to each initial client authenticated against it. There should be logs, if they have not been tampered with showing an user trail of actions taken.

If there a another person with admin privileges who you trust and you reasonably believe is not involved, explain what you saw, and only stick to facts, such as the IT admin frequently logging on your machine for "updates". Work with this person to gather some evidence such as logs from your email server. Depending on what you find, present to higher management or HR your facts.

Improve this answer
5
  • Thank you for your professional opinion. I was shut down completely at my brief meeting with the director. The only higher ups are a board consisting of volunteer members that honestly are just show. I was not allowed to see any alleged emails nor attempt to explain anything. He just shot accusations at me stating the fraudulent emails commended and praised my performance at numerous meetings and the names attached to the emails don't exist. Meanwhile he has spoken to some and knows others professionally. He even went as far to accuse me of not attending said meetings .
    – John Grayson
    May 15, 2016 at 17:05
  • If they won't listen, and you don't have someone willing to fight for you, there is little you can do in the US. They've decided you are a convenient scapegoat.
    – keshlam
    May 15, 2016 at 18:51
  • If I may, a little more background on said company and it's director. They are funded through grants for various programs from the state. On at least 3 occasions the expected funding did not "drop" as they call it and we all worked without pay through periods up to 5-6 weeks. We were not permitted to ask or discuss when and how we were to receive back pay. There is a check still due from 12/2015. I recently questioned the accountant, possibly part of the reason for termination.
    – John Grayson
    May 15, 2016 at 21:19
  • @JohnGrayson sadly it seems that the only question you really need to be asking right now is whether the expense of suing the company could be justified. Which would definitely be off-topic for this site.
    – Carson63000
    May 16, 2016 at 1:48
  • 4
    @JohnGrayson, Assuming you live in the US, report this to the Department of Labor in your State. You may be an "at will" employee, but not paying employees is a serious offense and terminating you after you've officially filed a complaint with the Department of Labor can even more serious still. Please talk to them, ask them for advice (again, this is assuming this is in the US). Also, all these slanderous and unsubstantiated accusations could tarnish your reputation and potentially prevent you from getting a job elsewhere. Talk to the Department of Labor about that part of it as well.
    – Stephan Branczyk
    May 16, 2016 at 4:21
1

Whether you can or cannot do it, is not really the point. I have to take your word for it (that you do not have authority to do said actions).

Judging from the look of things, it does not make sense. There would be no purpose for you to be spoofing emails and sending them to your boss. Knowing a spoofed email came from you also does not make sense. Even if they were trying to get you fired it seems like they would come up with something better than sending fraudulent email to your boss.

A boss typically cannot just terminate someone without getting permission from higher up. Is HR not involved in your termination?

You need to appeal to HR and higher management. I don't know that trying to defend yourself on a technical level helps.

I did not do it. As far as I know I don't even have authority to create an email address. I don't know how it happened. It just makes no sense to me. I have not been shown any of the emails I have been accused of sending.

I think the best you can hope for is they will do an internal review and determine if you were "framed". If you cannot get a meeting with HR / higher management then I just don't think there is anything you can do.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .