My CEO wants permanent access to every employee's emails. How do I explain that this is a terrible idea?

Question

Our CEO wants our IT provider to configure his email client so he can see every employee's work emails in his inbox all the time. To make a long story short he's concerned about a specific employee being difficult to reach so asked to get his emails and then decided he might as well pre-emptively get access to everyone's emails in our company of ~15 people.

As I see it, this is an absolutely terrible idea for all sorts of reasons. Just off the top of my head:

• Right now, to get access to somebody's emails, you have to ask our IT provider to arrange it. This necessitates authorisation and an audit trail. This would be lost going forward.
• It makes access to the CEO's computer the weakest-link in internal security & data protection.
• Relatedly, it's not an incredibly secure computer. He habitually leaves it logged in when he's not around.
• Huge potential for abuse.
• Permanently weakens all internal data protection & controls
• Could be a general breach of regulations (that could open us up to an employment lawsuit. Not sure. Not a lawyer.)
• I don't want somebody spying on my inbox, and neither does anyone else.
• It erodes employee trust, because it feels like spying, regardless of motive.

I understand his concern and his motives. I think he genuinely wants to do the right thing but he hasn't thought through the ramifications of what he's asking.

I am just an employee (we have a HR/Compliance Director who's not in the office today). How do I effectively communicate my concerns to the CEO? I know that they legally can do this. I'm asking for advice on how to persuade them not to.

Answer 1

You say you have a Compliance Officer. It strikes me that you should ask him/her for some guidance on this. If he's not in the office today, it can wait - I kind of doubt that something bad can happen within the space of a few days.

If you're met with some uncertainty, then just press home the security implications of one computer having access to all of the company's emails and what might happen if that one computer happened to be left unlocked and unattended....

As a side-comment, it seems as though your CEO doesn't really have a handle on what's happening in the company (if one employee can go off-radar for two weeks). It might be better to correct this behaviour and lack of oversight by having regular catch-up calls/emails/status reports/whatever. There's a clear lack of basic communication.

Answer 2

You shouldn't do it. You are unlikely to effect any change, and it may damage your reputation with the boss.

The CEO could have made this request to your IT provider in private, but he chose to make the request in front of you all. This was a calculation on his part.

He wants you to know that your work emails can and will be reviewed. It may very well be a mistake on his part (we're in agreement on this,) but if so it is a mistake that he has put some thought into. He has made up his mind, and your arguments are unlikely to sway him.

Due to the Streisand Effect your assertion that this is a bad idea could potentially make you a target and subject your email inbox to further scrutiny.

I wouldn't recommend taking it to HR either. Talking to HR instead of the CEO directly would actually be worse in my opinion. HR is there to protect the interests of the company, not the resources themselves.

If you absolutely must complain, you should do so in person directly to the CEO, face to face, with no one else in the room. Explain to him why the decision is bad for the company. Don't talk about your feelings or include yourself in any way. Talk about the company and the employees. Talk about morale and employee retention.

He is unlikely to change his stance, but if he is any good as a CEO he will listen and he may respect you for your courage if you don't come across as a whiny complainer.

If it were me I wouldn't do it, but if I did I would do so in person, one on one, and I would talk about the concerns of the company, not my own concerns from a personal perspective.

Answer 3

Appropriate company staff must and will have access to all company accounts at need. There is no privacy argument; anyone who believes anything done on company equipment is private is being unrealistic at best. The IS shop, if nobody else, certainly has access now unless you have an unusually strongly protected environment with encryption keys managed from elsewhere in the company.

There are, however, questions of defining "appropriate staff" and "at need". There is certainly some data, typically but not limited to health issues and some kinds of customer data (eg HIPAA info, in the US), which should not be exposed except on specific need, to protect the company from lawsuits. And there are general issues of security and accountability.

The CEO is right about the need for a process to do this. The CEO is wrong about wanting the process to be "because I felt like it." The correct path here is to make clear that controls are needed to protect the company, and put a proper mechanism in place to address the legitimate issue within those controls.

The company needs access. The CEO does not need continuous unlogged access. Implement an explicit data retention and control policy which recognizes those constraints. There are lots of good references on this topic, not least in the sections of SE that focus on security and system administration.

Answer 4

To make a long story short he's concerned about a specific employee being difficult to reach so asked to get his emails

You don't explain what is meant by "difficult to reach" but let's assume it means the person just needs to respond to important emails and phone calls the same day during business hours, and that is currently not the case.

What issues would be resolved by allowing the CEO to read this person's email? Is the employee not responding to clients or partners? If so, then maybe the person is overloaded or in the wrong role.

Why is this employee difficult to reach, in the first place? Travel? Other responsibilities? The CEO, HR, or that employee's direct manager needs to work with that employee to work out a communication protocol that is acceptable to all parties. If the employee is just irresponsible, then there no sense in creating additional management overhead for the CEO by having him babysit the employee. The CEO should be able to trust those working for him to do their jobs, and should focus on higher-level strategy rather than the lower-level details that he has presumably entrusted to this employee. If this person cannot communicate reliably and can cause damage such as allowing a deal to fall through by not responding within a reasonable amount of time, then those duties need to be given to someone else. This person may be able to be delegated certain tasks through whatever system actually works.

and then decided he might as well pre-emptively get access to everyone's emails in our company of ~15 people.

You have already identified plenty of reasons why this is a bad idea. It's possible he just hasn't thought it through, and thought it would be a convenient solution to head off similar issues with other employees. If you are comfortable talking to him directly, go for it. If not, inform an appropriate manager of your concern and ask them to talk to him about it, possibly not naming you (if that is a concern).

If this goes through, then at best, your CEO will have to spend more time duplicating someone else's effort in reading emails, and at worst, he is potentially exposing himself to legal liability down the road. If the someone does something inappropriate and he does not intervene because he didn't have time to read an email thread about sexual misconduct or bribery or other illegal activity, it won't look good that he has all these emails in his inbox. Maybe he hires a secretary to handle his email at some point. One could argue that he should have been aware because he had unfettered access to everyone's email, but he failed to act.

Answer 5

You can simply tell your CEO about the security vulnerabilities. What I think your CEO is trying to achieve is simply to monitor what is going in the organization. There is a better way. From email settings you can setup to forward any email, an employee sends or receives, to the CEO without giving direct access to the CEO. This is a normal pratice. I have experienced it. By settings I mean where you setup the official emails not the interface. FYI, it does not get the employees moral down.

Answer 6

You should tell your CEO to hire and or consult an IT investigator. They're much more qualified then your CEO and can easily find more "dirt" on the rogue employee then your CEO can.

They're trained for it and know how to do their work without getting your company in legal trouble.

I think if you bring this as a selling point to your CEO it will work: "find more dirt", "less potential legal problems".

I don't know of course how amicable with your CEO you are but if your relationship is good you could ask him: "If you want a cake, would you bake it yourself or let a professional do it?". Same for an investigation: Hire professionals.