114

Every six months or so, we have to take an online security course that includes training on the security badges we carry around. Basically, our company assigns each employee a security badge, which is needed to get into office areas. We are instructed to not allow others to "piggyback" (i.e. going through a door after someone else uses a badge to open it), or to allow someone in who is waiting for a person with a badge to walk by.

However, the vice president for our division frequently chooses not to carry around her security badge. On a regular basis, she either piggybacks or asks someone to open a door for her if she walks by. She seems to rely on the fact that people know who she is, and the only person I've known who challenged her on this was someone who didn't know who she was (she later joked about this event, saying that she just needs to get to know more people). To my knowledge, this vice president is the only person who regularly flouts the security badge rules.

I am concerned about this double standard in company security. This is the boss of my boss, so I don't have an easy avenue to report this. What should I do?

Edit: To answer some of the comments, this does not appear to be a test where the vice president is just pretending to not have her security badge and anyone who lets her in fails. She does not have her badge on her and anyone who lets her in is politely thanked, with no consequences of any sort ever occurring. It seems that she is genuinely wanting someone to let her in without a badge.

  • Comments are not for extended discussion; this conversation has been moved to chat. – Monica Cellio Nov 16 '16 at 16:01
  • 16
    A trick a friend used in a similar situation was to add a security lock to the closest bathroom and configure it "for directors only". The director was delighted to have her own bathroom and couldn't ask a regular employee to open it. Passive reinforcement might just work. – 0xFF Nov 17 '16 at 16:11
  • 1
    @jamesdlin The official security policy is that everyone must put sir security badge to the door, even if they are coming in together. I suspect this is to avoid a blurry line of what piggybacking means. – Thunderforge Nov 18 '16 at 5:07
  • 1
    And is that what you do in practice? Does each person badge in, open the door, close the door behind them, and wait until it locks before letting the next person in? – jamesdlin Nov 18 '16 at 8:11
  • 2
    @jamesdlin We don't let it lock, but each person walking through puts their badge next to the reader and it emits a beep. We are instructed that if somebody doesn't beep, we should make sure that they have a badge. This way, you can be courteous to open the door behind you while still making sure their badge gets logged. – Thunderforge Nov 18 '16 at 16:06

13 Answers 13

191

You have a VERY easy avenue to report this: the company Chief of Security.

Dressing down employees for flouting the security rules is specifically in the Chief of Security's job description. It does not matter whether the employee in question is the lowliest janitor or the Chairman, CEO, and President of the company, or anywhere in between.

  • 56
    Assuming you have one, the Chief Security officer is the perfect person for this. It is literally their job and they should have the authority to actually reprimand the VP if necessary. – Evan Steinbrenner Nov 14 '16 at 17:48
  • 8
    @Thunderforge The person who gives out the company badges is most certainly a part of the security team, even if they're not the "Chief of Security". They would at least be able to point you to the right person. Just ask them to whom you would report a security violation. Also, as Vietnhi pointed out, there were probably some contact numbers in the training you took. – David K Nov 14 '16 at 18:05
  • 15
    @Thunderforge If you have online security courses you need to take then I'm absolutely positive that you have a Chief of Security. – Lilienthal Nov 14 '16 at 18:26
  • 123
    If you can, do this anonymously. We'll assume your boss's boss has a LOT of reports. Don't send an e-mail. Use a word processor to write a simple note, print it, and drop it in an inbox (a physical one) someplace. Keep your name out of it. – Xavier J Nov 14 '16 at 18:35
  • 30
    @John I had to report an as---le boss once while I worked for a school district. The jerk knowingly and fraudently crossed my name off the payroll for the next month. Went to district police. Turns out that the chief was his buddy. See? Better to keep a low profile. – Xavier J Nov 14 '16 at 21:54
48

Well, if the company offered you the security course, they should also have provided you with contacts in case of security breaches.

Report her to your contacts and let them take it from there. Assume (correctly) that they are professionals, let them do their job her, step back from the affray and the flying feathers and focus on looking photogenic :)

Your department or group should be getting a memo from Security reiterating their policy and you know what - just comply with the policy! She'll get her butt burned a couple of times but eventually, she'll settle down into compliance - I am assuming here that she is a totally sane individual who keeps doing what she is doing until she stops getting away with it :)

  • 3
    My employer has us review our corporate ethics policy annually and take a test to prove we've actually read it. There is a rule that says that being aware of a violation and failing to report it is itself a violation. And that, of course, is grounds for termination. Hey, how do you know that's really her, and not just someone who looks like her? How do you know she's not in cahoots with the Chief Security Officer doing this on purpose to test people? Maybe the people she piggybacks on will be fired for letting her. – Monty Harder Nov 14 '16 at 22:03
  • 19
    @MootyHarder - My employer has exactly that policy. I had to take a security training course, the course explicitly laid out the employer's policy - I am not to let anyone in. If someone wants in, then they use their badge. No badge? Then go to Security for a badge. Either you let yourself in with your badge - or screw you. That's all there is to it. And just to give me the proper motivation, they mentioned in the course that I could be terminated for failing to comply with the policy. In summary, no screwing around. – Vietnhi Phuvan Nov 14 '16 at 22:10
  • 3
    @MontyHarder The problem is that in many companies (from what I've heard) annoying the Vice President is also grounds for termination. – user253751 Nov 16 '16 at 5:39
  • 3
    @immibis Causing a security breach and violating security policy is is grounds for termination with cause. Choose your poison. I have decided that the security policy is sound and reasonable and that it's not worth it for me to keep my job by endangering other people. I am enraged that you put a premium on kissing up to the Vice-P over doing your part to ensure the safety of everyone. If I have my way, you're NOT working for me. – Vietnhi Phuvan Nov 16 '16 at 6:30
  • @MontyHarder or maybe she got fired three days ago, or has had her access restricted in some way... – user60393 Nov 18 '16 at 9:14
31

This is wrong and a poor example for others but it is just plain above your pay grade.

Clearly other people have noticed this including your boss.

You could ask your boss what you should do but I bet he/she will say let it go.

If you have security training then you should have procedure for reporting a security breach. Not sure I would do it but it is an option for you.

  • 9
    +1 for asking for instructions. You don't need to report a breach. You just need to ask what to do next time the vicepresident asked you to open a door for him. – Pere Nov 14 '16 at 21:59
  • 2
    This is the best answer – Kilisi Nov 15 '16 at 0:14
  • 22
    Specifically, get it in writing from your boss that they expect you to violate security policy for the VP. – R.. Nov 15 '16 at 5:53
28

I am concerned about this double standard in company security.

Think for a minute why you are concerned here.

  • Because everyone should live by the same rules no matter who they are?
  • Because this Vice President is a security risk?
  • Because I hate this rule, and if I must obey a foolish rule, everyone must?
  • Because I follow every process rule to the letter every time?

Then realize that "double standards" like this happen in every company. Everyone in a company is not equal. Maybe you'd be better off just letting this one go, and save your concern for more important matters.

I work in a company with similar security rules. The rules may make sense for headquarters, but in my small office, they really don't. Lots of folks "tailgate" or knock to be buzzed in. It's just not that big of a deal.

I simply won't damage my work relationship with others by being the "badge police". Nor will I accost someone who is walking around without visibly displaying their badge.

This is the boss of my boss, so I don't have an easy avenue to report this. What should I do?

If you really want to pursue it, you should have a chat with your boss. Explain what you see happening, and ask for guidance as to how you should handle it. I'd guess that you'll be told to just let it go, but anything is possible.

Remember that this could not only reflect on you, but also on your boss. You probably don't want to put your boss in a tough spot without at least talking it through.

  • 18
    Note that if the OP allows the person—no matter who is the person, by the way—to tailgate, the OP violates the security policy, with consequences which could be severe. You don't mention that reason at all in your answer. It's not about double standards: it's about putting the OP in a situation where he can be fired for security policy violation. By the way, in some companies, both letting the person tailgate as well as observing this behavior and not reporting it was considered against the security policy. – Arseni Mourzenko Nov 15 '16 at 1:18
  • 1
    @ArseniMourzenko - the OP says it is a double-standard. Why do you say it's not? – WorkerDrone Nov 15 '16 at 12:57
  • 2
    @RaoulMensink - "I am concerned about this double standard in company security" seems clear to me. – WorkerDrone Nov 15 '16 at 13:29
  • 1
    Yes, sadly junior staff are rarely thanked for reporting very senior staff for their everyday procedural transgressions. In this case the genuine risk to the company seems low so I would let it go! – EleventhDoctor Nov 15 '16 at 15:38
  • 5
    If the badges were just used as identification, then opening the door for the VP would be a minor flouting of the rules and not a big deal - employees already know what he looks at so don't need to see his badge. But if all employees are supposed to swipe their badge at the door, then the badge is also used as an authorization method. If the VP were quietly terminated due to misconduct and locked out of the office, opening the door for him would be a security breach... and may be a violation of possible security regulations/certifications the company follows. – Johnny Nov 16 '16 at 1:18
9

I would not report this to a person directly; that's an avenue for trouble as it won't necessarily be anonymous.

Instead, find your company's anonymous ethics hotline. They should have one if they're of the size you're suggesting; call it in there. It should be staffed by non-employees (some hired company that just does ethics lines or similar) and entirely take you out of the loop.

Otherwise, I'd say it sounds like this behavior is well known enough that reporting it yourself is just adding risk for you; if the head of ISO or similar group doesn't already know of the issue, they're really not doing their job.

  • +1 for the ethics hotline. If your company has one, this is The Time to use it. – user2943160 Nov 18 '16 at 3:21
9

There is no question here - you must report this. I'll tell you why.

  • As @Closetnoc said, if you let in someone who looks like the VP and theft occurs, who will be held responsible? You let them in.
  • If the VP is fired and you don't know about it and let them in, who will be held responsible? You let them in.
  • If an audit is carried out on security policy, and you let them in, who will be held responsible? You broke policy.

I have seen all of these happen to others.

From a very basic level, you need to protect yourself and your organisation here. Reporting them, or even better, disallowing entry, is the right thing to do, and has the backing of policy - so if it does go to HR or Security Officer then you are in the right.

I have in the past disallowed access to senior partners and even board members as they didn't have passes. Sure, they got annoyed but that is their problem. They ended up realising that I was protecting them as well as myself.

  • 3
    Once in a similar situation I was going out and nearly held the door open for a group of people going in. Then I caught myself and said, wait a minute, who did you want to visit (much politer than who on earth are you) and the leader (the guy in the suit and tie) said I'm the head of security. And I said, well, this is one of those areas you need a pass to get in (a small moment of revenge for all the minutes spent while we all solemnly open the door, one after another), and he said, of course it is, and they all laughed and got their passes out. And I thought, whew, just saved my job. – RedSonja Nov 17 '16 at 9:44
8

It feels unfair, but that's not really the problem. The problem is that the company (as represented by the senior exec's preference) appears to allow "human recognition" as a security validation, but doesn't have a clear policy that describes how to do it.

So your action can be to address the security issue with whoever makes security policy, with a request like this:

Currently there is a convention that senior staff are permitted to enter without badges. This is difficult to manage for new security staff and allows for confident tricksters to gain entry based on bluff. Can we start a photobook or photo wall of senior executives who will be entering without identification, so that security staff can have clarity about who is or is not permitted to enter without a badge.

The result might be that you get photocopies of half a dozen executive ID cards up on the wall, or maybe senior execs start carrying badges, but either way you're able to raise the issue without having to call shenanigans on an executive.

  • 1
    The important point for OP is to cover his ass. So I would ask in writing how I should handle it if the VP asks me to let her in. If it is a problem, the security officer will handle it. If I get a reply that I should just let her in, not my problem anymore. If she gets fired, asks me to let her in and steals all company data: not my problem. I have it in writing that I should just let her in. – Josef Nov 15 '16 at 7:46
  • Exactly -- it's fine if that's what they want to do, you just need a well defined policy saying so. Having the photobook also defends against some other suit you don't recognise demanding to be let in -- you can show them the book and how they're not in it. – Daniel Baird Nov 18 '16 at 0:43
7

I think I would bring the problem directly to her attention, the next time it happens to me. "Ma'am, I can't do that; it would be a violation of our corporate security policy. Perhaps you could have someone bring your badge down to you." I'd say it quietly, so as not to put her on the spot. I'd try to be as helpful and sympathetic as I could be, without violating policy. I'm not trying to make trouble for anyone; I'm trying to prevent it.

  • Exactly. There is no need to report what others are doing: this won't help the OP make friends in this company. However, nothing forces the OP to let the vice-president in. Refusing, quietly, to let the person in is the right reaction. One could also add: “but if you disagree, I believe you may ask our security rules to be changed.” – Arseni Mourzenko Nov 15 '16 at 1:12
  • 11
    EITHER speak directly to the VP about your concerns, OR bring your concerns to the corporate security officer. Do not under any circumstances do both. If you do both then when security gets on her case she will know where the complaint came from. – A. I. Breveleri Nov 15 '16 at 3:13
5

I will begin by telling a short story.

Once a member of a management team was let go early in the morning and no e-mail was sent except to a few that would be directly effected. Later in the afternoon, the fired employee walked into the company as easily as they ever had and was able to get into secured areas and do damage without a trace of responsibility. The police could do virtually nothing.

The fact that someone routinely forgets their badge may come by honestly. At one place where the company was located in several buildings up and down the street, it was not that uncommon for one of us to forget their badge and need help. All well and good. However, routinely forgetting their badge may a simple form of narcissism even if it does not seem to be. It could be a lighter form of "the rules are... [fill in the blank]" just in the same way anyone up and down the chain of command may feel. I have seen very good people fall into this category without realizing it. It does not mean that they necessarily feel superior. It actually becomes a habit that is enabled over time by being recognized and not realizing the effect of not following the rules as closely as everyone else.

Forgetting fairness for a moment since too many of us seek a fairer world that will never be, what is important is that it is bothersome regardless of how slight the offense may actually be.

For this reason, the problem should be resolved.

If you can talk frankly and openly with your own boss without judgement or reprisal, then I suggest that you say little, but say enough. No body likes a tattle-tale, so avoid it as much as possible while adding respect for all concerned. For example,

I have noticed that a member of management, I will not say who because I believe that they genuinely mean no harm, forgets their badge quite a lot and requires someone to let them into secure areas. While this is completely understandable from time to time, if I let them into the secure area and something were to go wrong, then it is I who is looked upon as being responsible. Can you keep an eye out and see if you can rectify the problem so that we as a team can feel better about the problem? Thanks!

If you cannot trust your boss, then same speech can be given to HR or security. By couching it in the way you have, people will understand the problem and hopefully protect you as a genuinely concerned member of a corporate team. You may want to ask to remain anonymous as not to embarrass anyone.

To add some humor to this answer, the company that was located in several buildings up and down the street bought a huge building, refit it, and during the process, in the IT areas, the instruction was to place magnetic badge readers about butt level. This was questioned by our contractor as a mistake. It was no mistake. Why? If you place the badge in your other pocket, opposite from your wallet, then all you have to is wag your butt near the reader and forgetting your badge far less likely. It was a perfect solution for the IT team (at least)!

  • Butt height... I just jump a little. :) – Dan Henderson Sep 30 '17 at 5:49
  • @DanHenderson Sometimes life is hilarious!! The guy who was in charge of the refit and gave the instructions for the butt height rule was rather short. He was a reasonable man with a sense of humor so he did not have them set to his butt height and just did a little hop instead. See? Even the simplest ideas can have it's problems. Want is funny is how your comment furthers the story. Cheers mate!! – closetnoc Sep 30 '17 at 14:35
0

In addition to the other answers to anonymously report to the security division, I want to suggest how to handle it if and when you specifically are asked to swipe her through somewhere.

This may be different in your institution, but where I work, the security people take security very seriously. If anyone were to swipe anyone else through they would both face a significant financial penalty and would also likely be let go and perhaps face criminal charges. I would recommend that if you are asked, politely decline, and be as assertive as the situation requires. If you hurt her feelings she may try to get back at you via office politics but (again, this depends on your institution), if you directly violate the written security policy and someone in security finds out, or if something happens, you will be on the hook for it. Be careful, polite, and stick to written policy.

0

I understand your concern for security and unhappiness with this double-standard, but you won't be telling anyone anything they don't already know.

You have a fairly sophisticated security system, company training program and a person who is in charge. It's not difficult for them to determine that someone who should be entering the office on a regular basis is not using their card to get into the building.

If they are not aware of this, your company has bigger problems. My guess is they just don't care enough about this individual's behavior or they're not in power to do anything about it.

Sorry.

0

I am concerned about this double standard in company security. This is the boss of my boss, so I don't have an easy avenue to report this. What should I do?

Is it really a concern for you? That someone should be thinking about this event not you. Yes that is double standard, but world is not perfect place. You need to learn to strike the balance in your life. It's not her but you who need to learn the way the world moves. Why should you be the one to report this incident, when all other took it lightly or pretended so at least. Do you really think all others are fool? May be but it's better to be a fool and be in herd than be alone fight the whole world. Trust me you will find such people every now and then in every company. You cannot escape so learn to live in it without harming others. That VP was given a chance to understand but she chose otherwise and instead made fun of that someone, that shows she is not thinking straight and its worthless to make such people understand. It could backfire though so its always a good idea to step aside from their path as they cannot see straight, do not be a revolutionist. Learn to be a ordinary guy. Live and let live.

0

I used to be the security officer (amongst other things) for a medium sized company with several offices. The top management not only did as your VP does, but lost their access cards/badges and refused to pay the replacement fee, etc.

It is an ego thing for them. "Don't you know who I am?" dynamic. By flouting the rules they distinguish themselves from the "workers".

As annoying at it is, challenging such behaviour is an office politics risk and besides, have a look at whose signature is on your paycheck.

Golden Rule: "They who have the gold make the rules."

Not the answer you're looking for? Browse other questions tagged or ask your own question.