When I joined this company, I had the unfortunate experience of working with very jaded and unprofessional developers. They wanted me to work on their personal projects and hide my activity from IT by installing a different OS on a test machine that IT couldn't spy on. I declined, and wanted to focus on my real work instead. My reputation was smeared behind my back, I was lied to about projects, and set up for failure.

One of these developers named Bob, has the password to my work PC. He brought it to me from IT when I first started working there. He tried to make it seem like he was being helpful, but I am extremely suspicious. IT is also required to know our passwords. This guy works together with a family member, and is family friends with senior management in our office including the Chief engineer and head of security. The chief engineer and head of Security fired the IT guy, and promoted his friends to be the new IT guys, so he completely controls IT. This top dog is very informal and likes to tease people, so I doubt he take any concerns about bullying or IT violations seriously.

I am worried that Bob may have planted something on my PC, since he has my password. I never changed my password, since IT knows our passwords anyway. I do not doubt he could have gotten my password if I changed it.

If I report anything, I am unlikely to keep my job. I doubt management would risk disciplining and pissing off multiple developers and family friends. It would be easier to get rid of me.

How do I leave this company and minimize the liability of leaving behind a computer which may used against me in the future?

I work in the US and these guys work for the government.

  • 9
    You ask way too many questions in one post and shut out most plausible answers as well. Voting to close as unclear what you're asking. Please edit the question to focus on exactly what help you need. – Masked Man Mar 18 '17 at 7:43
  • 3
    This is a terrible situation to be in - and there's really it's nothing to do but get out it and into a new job. – HorusKol Mar 18 '17 at 7:51
  • 14
    "IT is also required to know our passwords." - no they are not if they know what they are doing. – piet.t Mar 18 '17 at 8:47
  • 6
    In fact IT should not know your passwords. – Ed Heal Mar 18 '17 at 10:32
  • 4
    Change your password – Simon Mar 18 '17 at 12:57

I may get down-votes on my answer but I will answer as I work in the IT Security profession, and see fundamental security issues that are not addressed and present a real risk to you. There is also an implicit question which is very legitimate:

"How do I protect myself while leaving the company"

First, at the company level, your firm is failing at the basics of computer security and operating using practices that will not fly in a regulated environment (such as the government) with a glaring example being the below statement:

IT is required to know our passwords.

By the very fact that IT has the password to your computer means they can impersonate you. Any unscrupulous actions they take on the network will be traced directly back to you and there will be no way for you deny the action as its your account that was used. The fact that multiple other people can now use your account is immaterial, as in the audit logs, only your user ID will be associated with any changes, legitimate or malicious.

Some of your statements are also problematic. You state that these people work in government and that IT is very informal. Just because IT operates in a informal manner, as is often the culture of IT, does not mean that security best practices are suddenly no longer applicable.

I never changed my password anyway

It should not even have been possible for you to have the choice in the first place. Good practice dictates that the password be changed upon first use by the assigned user.

As to how to protect yourself, you can request your machine be wiped before leaving which should sanitize the machine for the next user. In addition, keeping clear documentation of incidents such when you were requested to work on pet projects and by whom, rather than legitimate work protects you by keeping a paper trail on what was said.

Overall, while you may not have much chance this time, the information above can be used if you ever face a similar situation in the future.

  • 1
    It's quite the opposite if it is known that IT has your password - exactly because they can impersonate you, that means nothing can be effectively traced back to you. That's why any decent IT department doesn't know your password. – gnasher729 Mar 19 '17 at 17:40
  • @Gnasher729 , check the edit I made. While multiple people can use his account, any actions taken by that account will be accounted for in audit logs under his single user ID. – Anthony May 24 '17 at 2:09
  • @Anthony yes, but if the policy that IT knows his password is well known, i.e. if he can prove that this is the policy, then the user ID appearing in the logs doesn't hold as evidence against OP as IT could have impersonated him. Plausible deniability. – Frank Hopkins Dec 5 '17 at 16:35

Not the answer you're looking for? Browse other questions tagged or ask your own question.