81

Our CEO wants our IT provider to configure his email client so he can see every employee's work emails in his inbox all the time. To make a long story short he's concerned about a specific employee being difficult to reach so asked to get his emails and then decided he might as well pre-emptively get access to everyone's emails in our company of ~15 people.

As I see it, this is an absolutely terrible idea for all sorts of reasons. Just off the top of my head:

  • Right now, to get access to somebody's emails, you have to ask our IT provider to arrange it. This necessitates authorisation and an audit trail. This would be lost going forward.
  • It makes access to the CEO's computer the weakest-link in internal security & data protection.
  • Relatedly, it's not an incredibly secure computer. He habitually leaves it logged in when he's not around.
  • Huge potential for abuse.
  • Permanently weakens all internal data protection & controls
  • Could be a general breach of regulations (that could open us up to an employment lawsuit. Not sure. Not a lawyer.)
  • I don't want somebody spying on my inbox, and neither does anyone else.
  • It erodes employee trust, because it feels like spying, regardless of motive.

I understand his concern and his motives. I think he genuinely wants to do the right thing but he hasn't thought through the ramifications of what he's asking.

I am just an employee (we have a HR/Compliance Director who's not in the office today). How do I effectively communicate my concerns to the CEO? I know that they legally can do this. I'm asking for advice on how to persuade them not to.

  • 3
    Related, but not completely duplicate: Can HR/Boss Require Your Username and Password? – David K Oct 14 '16 at 12:13
  • 3
    Same question, different SE security.stackexchange.com/questions/139766/… – Jared Smith Oct 14 '16 at 19:19
  • 3
    @Lumberjack I don't necessarily think posting about this issue in both places is in any way 'wrong', just adding transparency. – Jared Smith Oct 14 '16 at 20:13
  • 2
    For the record, there are not good ideas or bad ideas. There are pros and cons to every course of action. Once you've laid out the pros and cons, then it's just a matter of weighing those. If you need to convince someone that it's a "bad idea" but laying out the list of pros and cons isn't enough, you should accept that you can't convince them. – corsiKa Oct 15 '16 at 7:20
  • 3
    The employees must be made aware that their email is actively watched. Lots of legal issues may lurk here. – Thorbjørn Ravn Andersen Oct 15 '16 at 11:31
55

You say you have a Compliance Officer. It strikes me that you should ask him/her for some guidance on this. If he's not in the office today, it can wait - I kind of doubt that something bad can happen within the space of a few days.

If you're met with some uncertainty, then just press home the security implications of one computer having access to all of the company's emails and what might happen if that one computer happened to be left unlocked and unattended....

As a side-comment, it seems as though your CEO doesn't really have a handle on what's happening in the company (if one employee can go off-radar for two weeks). It might be better to correct this behaviour and lack of oversight by having regular catch-up calls/emails/status reports/whatever. There's a clear lack of basic communication.

  • 11
    You may also want to point out to the compliance officer that the CEO is leaving his computer (ostensibly with very sensitive company information on it even without access to other users' emails) unlocked and unattended. That should be a huge problem in and of itself, and even if they are otherwise okay with him having access to the emails, a prerequisite should be that an idle lock policy (3 minutes or less ideally) is enforced on his computer to minimize the window for unauthorized access to his computer. – Doktor J Oct 14 '16 at 14:36
  • 2
    OP should not need to explain that this is a terrible idea. Company's legal counsel should be this authoritative source. (Compliance Officer sounds like a great fit for this in a small company.) – blaughw Oct 14 '16 at 19:09
18

You shouldn't do it. You are unlikely to effect any change, and it may damage your reputation with the boss.

The CEO could have made this request to your IT provider in private, but he chose to make the request in front of you all. This was a calculation on his part.

He wants you to know that your work emails can and will be reviewed. It may very well be a mistake on his part (we're in agreement on this,) but if so it is a mistake that he has put some thought into. He has made up his mind, and your arguments are unlikely to sway him.

Due to the Streisand Effect your assertion that this is a bad idea could potentially make you a target and subject your email inbox to further scrutiny.

I wouldn't recommend taking it to HR either. Talking to HR instead of the CEO directly would actually be worse in my opinion. HR is there to protect the interests of the company, not the resources themselves.

If you absolutely must complain, you should do so in person directly to the CEO, face to face, with no one else in the room. Explain to him why the decision is bad for the company. Don't talk about your feelings or include yourself in any way. Talk about the company and the employees. Talk about morale and employee retention.

He is unlikely to change his stance, but if he is any good as a CEO he will listen and he may respect you for your courage if you don't come across as a whiny complainer.

If it were me I wouldn't do it, but if I did I would do so in person, one on one, and I would talk about the concerns of the company, not my own concerns from a personal perspective.

  • 1
    Thanks @Kevin. After confirming your assertion, I have edited my question. Thanks again! – Lumberjack Oct 14 '16 at 13:54
  • 17
    A good CEO should trust his employees until proven otherwise; to explicitly demand carte blanche access to everyone's emails demonstrates a horrifying level of Orwellian distrust, so the last three paragraphs of this answer aren't really applicable. HR's protection of the interests of the company do indeed cover this problem, as it creates a hostile workplace environment, and Legal should be involved too because this opens a myriad of liabilities that absolutely are not worth the risk. – Doktor J Oct 14 '16 at 14:45
  • 4
    Getting HR involved or not largely hangs on whether or not the CEO is also the company owner – Robert Dundon Oct 14 '16 at 15:06
  • 4
    It was better before the edits – paparazzo Oct 14 '16 at 17:13
  • 1
    This answer is fine provided it is given from a paranoid person to a paranoid person. If trust is not there to begin with, it cannot be squandered. In all other cases, do not think like this and be honest about telling your boss how this measure compromises the basic trust you need in order to function as an employee. – reinierpost Oct 14 '16 at 23:58
7

Appropriate company staff must and will have access to all company accounts at need. There is no privacy argument; anyone who believes anything done on company equipment is private is being unrealistic at best. The IS shop, if nobody else, certainly has access now unless you have an unusually strongly protected environment with encryption keys managed from elsewhere in the company.

There are, however, questions of defining "appropriate staff" and "at need". There is certainly some data, typically but not limited to health issues and some kinds of customer data (eg HIPAA info, in the US), which should not be exposed except on specific need, to protect the company from lawsuits. And there are general issues of security and accountability.

The CEO is right about the need for a process to do this. The CEO is wrong about wanting the process to be "because I felt like it." The correct path here is to make clear that controls are needed to protect the company, and put a proper mechanism in place to address the legitimate issue within those controls.

The company needs access. The CEO does not need continuous unlogged access. Implement an explicit data retention and control policy which recognizes those constraints. There are lots of good references on this topic, not least in the sections of SE that focus on security and system administration.

1

To make a long story short he's concerned about a specific employee being difficult to reach so asked to get his emails

You don't explain what is meant by "difficult to reach" but let's assume it means the person just needs to respond to important emails and phone calls the same day during business hours, and that is currently not the case.

What issues would be resolved by allowing the CEO to read this person's email? Is the employee not responding to clients or partners? If so, then maybe the person is overloaded or in the wrong role.

Why is this employee difficult to reach, in the first place? Travel? Other responsibilities? The CEO, HR, or that employee's direct manager needs to work with that employee to work out a communication protocol that is acceptable to all parties. If the employee is just irresponsible, then there no sense in creating additional management overhead for the CEO by having him babysit the employee. The CEO should be able to trust those working for him to do their jobs, and should focus on higher-level strategy rather than the lower-level details that he has presumably entrusted to this employee. If this person cannot communicate reliably and can cause damage such as allowing a deal to fall through by not responding within a reasonable amount of time, then those duties need to be given to someone else. This person may be able to be delegated certain tasks through whatever system actually works.

and then decided he might as well pre-emptively get access to everyone's emails in our company of ~15 people.

You have already identified plenty of reasons why this is a bad idea. It's possible he just hasn't thought it through, and thought it would be a convenient solution to head off similar issues with other employees. If you are comfortable talking to him directly, go for it. If not, inform an appropriate manager of your concern and ask them to talk to him about it, possibly not naming you (if that is a concern).

If this goes through, then at best, your CEO will have to spend more time duplicating someone else's effort in reading emails, and at worst, he is potentially exposing himself to legal liability down the road. If the someone does something inappropriate and he does not intervene because he didn't have time to read an email thread about sexual misconduct or bribery or other illegal activity, it won't look good that he has all these emails in his inbox. Maybe he hires a secretary to handle his email at some point. One could argue that he should have been aware because he had unfettered access to everyone's email, but he failed to act.

-6

You can simply tell your CEO about the security vulnerabilities. What I think your CEO is trying to achieve is simply to monitor what is going in the organization. There is a better way. From email settings you can setup to forward any email, an employee sends or receives, to the CEO without giving direct access to the CEO. This is a normal pratice. I have experienced it. By settings I mean where you setup the official emails not the interface. FYI, it does not get the employees moral down.

  • 7
    Forwarding every company email to the CEO entails pretty much the same security risks as granting him access to their mailbox; now a security breach on one of the CEO's devices no longer just exposes the sensitive information the CEO himself is handling, but any sensitive information traveling anywhere in the company. As I've stated in other comments, this is a Bad Idea™. It is not "normal practice", and even if it didn't affect your morale, there are many who will interpret it as a sign of distrust and whose morale will suffer. – Doktor J Oct 14 '16 at 14:57
  • I think you mean "morale", not "moral". – Keith Thompson Oct 14 '16 at 16:22
-7

You should tell your CEO to hire and or consult an IT investigator. They're much more qualified then your CEO and can easily find more "dirt" on the rogue employee then your CEO can.

They're trained for it and know how to do their work without getting your company in legal trouble.

I think if you bring this as a selling point to your CEO it will work: "find more dirt", "less potential legal problems".

I don't know of course how amicable with your CEO you are but if your relationship is good you could ask him: "If you want a cake, would you bake it yourself or let a professional do it?". Same for an investigation: Hire professionals.

  • 1
    The question is how to keep the boss from something wrong. Your answer is to tell the boss to let a professional do it. What would you say if the boss was demanding the keys to his employees' cars? "Tell him to hire a Formula one race driver to drive you around in those cars."? – reinierpost Oct 14 '16 at 23:51
  • @reinierpost Tapping the email of everyone is wrong. Investigating an employee is not wrong and to do it in a right way, best thing is to hire a professional, because as an amateur you're much more likely to do things in the process that ARE wrong and hurt people you didn't want to hurt. – Pieter B Oct 15 '16 at 7:51
  • Where does it say the CEO wants to get "dirt" on an employee?? The original question says "he's concerned about a specific employee being difficult to reach so asked to get his emails." Sounds like the worry is that the employee is neglecting his duties, not that he's doing something unsavory. – sumelic Oct 15 '16 at 15:42
  • Pieter B: Would you seriously want to work for an employer who hires private investigators to spy on his employees? – reinierpost Oct 15 '16 at 18:56

protected by enderland Oct 14 '16 at 14:42

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.