212

I work as a senior developer in a small/medium UK-based company with multiple offices. Rarely do personnel go between the different offices. Our office has a publicly accessible reception area but the various departments are secured with keycode-locked doors. Junior employees only receive codes for departments they are expected to access regularly. We don't wear any passes or ID badges.

At this time, there happened to be only a new start - "James" - and I working in the IT department. The rest had gone home for the day. I was called away to help in a task I knew would only take a few minutes, so I was confident James could be left unsupervised for such a short time. During this time however, someone tried to access the IT room. They tried to input a code for the door, it was incorrect, and then tried to force the door open anyway before knocking. James opened the door but did not let the visitor inside. The visitor said he was looking for me. James explained I would be back soon but the visitor simply replied with "I'll just wait for him in here then". He then tried to get past James into the room, but James still did not let him in. According to James, he asked again who he was but the visitor just repeated "I'll just be waiting for Kozaky". James held his ground though and the visitor left in a bad mood. When I returned, James explained the situation and described the visitor. I did indeed know him as a manager from another office who is technically a superior to us, but not someone whom we would ever directly report to. The visit was unplanned as well.

My currently out-of-office manager emailed me with a message along the lines of "Did James really not let that guy into the IT department? Did he really not know who he was?" I explained it was all true, but that the visitor did not even give his name. I also mentioned I was briefly out of the room, that had I not recognised him, I would probably have done the same thing, and that if James is disciplined for this, I should take some of the blame for leaving him alone. I would guess there are less than 20 people in superior roles to my own but even I have not met all of them and would likely not recognise them.

My questions are:

  • Should an employee be disciplined for not recognising those further up the chain of command?
  • Should employees be encouraged to learn who is above them, even if they will never directly report to them?

We're looking for long answers that provide some explanation and context. Don't just give a one-line answer; explain why your answer is right, ideally with citations. Answers that don't include explanations may be removed.

closed as off-topic by gnat, IDrinkandIKnowThings, Jim G., Dukeling, Rory Alsop Sep 30 '17 at 10:48

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking advice on company-specific regulations, agreements, or policies should be directed to your manager or HR department. Questions that address only a specific company or position are of limited use to future visitors. Questions seeking legal advice should be directed to legal professionals. For more information, click here." – gnat, IDrinkandIKnowThings, Jim G., Dukeling, Rory Alsop
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 7
    Comments are not for extended discussion; this conversation has been moved to chat. Please celebrate James' dedication to operational security in the chatroom so we can reserve the comment space to request clarification from the OP. – Lilienthal Sep 28 '17 at 18:21
  • 16
    Just to elaborate, from the current version of the question, it cannot be determined with absolute certainty that the higher management wants the OP to punish James. If it turns out that the higher management had no such intention, then there really isn't much of a question here. – Masked Man Sep 29 '17 at 8:42
  • 4
    Did you ever find out what the visiting manager came to discuss with you? It's not directly relevant to the question(s) at hand, but if it was something urgent, it might help to add some context about the actual consequences of James' actions beyond just hurt feelings. – AffableAmbler Sep 29 '17 at 14:00
  • 2
    Does the company's security policy have anything to say on the topic of allowing someone into secured areas, when that person doesn't have the access code for that area? – Dan Henderson Sep 30 '17 at 5:30
  • 1
    If you already have the feeling that you would have done the same, the question about punishment of someone below is hypocritical per definition. Moreover, the one above him should be punished, because he was unable to identify himself :/ – user71715 Nov 14 '17 at 13:08
675

Sounds to me like James did the right thing: he refused someone he didn't know entry to a secured area when they didn't know the door code and didn't identify themselves. All of which is totally reasonable and best practice under the circumstances.

As for whether he should have recognized the person - it's not unreasonable for someone who is relatively new to the organisation to not recognize someone from an entirely different office. Especially where that person isn't in their direct reporting line. Disciplining him for this would be ridiculous in my book.

  • 356
    +1 Another scenario: Higher-up with well-known face gets fired, no one knows about it, and people open the door to him out of fear of being disciplined. What an idiotic system. It's the higher-up who should be reprimanded. – rath Sep 28 '17 at 11:06
  • 96
    Yes. A well-run organisation should make it clear to the Manager that they acted improperly and that if they do it again they will be disciplined. Terrible conduct. – Francis Davey Sep 28 '17 at 11:29
  • 214
    James should be PRAISED for having the integrity to do what was absolutely the right thing despite the fact that he was new. – Kevin Sep 28 '17 at 12:52
  • 73
    In my company CEOs do not have access to the server rooms, so even recognizing someone does not mean you know what access level they have, and asking someone to remember the access level of everyone else above them is just ridiculous. – PlasmaHH Sep 28 '17 at 14:24
  • 76
    In the military I've been told I had permission to use lethal force to prevent anybody attempting to forcibly gain access to a secured area and that in that specifically including higher ranking officers in the military. "Everybody knows the rules. If they try to access a secured area without proper authentication they are to be forcibly dealt with." The superior should commend the new guy if anything for bravely standing up for physical security measures in the face of overwhelming pressure. – leigero Sep 28 '17 at 18:08
226

Doesn´t matter who he is, even if I recognize him. If he doesn´t know the door code, then he doesn’t belong inside. If he is supposed to know the door code, he should follow the proper procedures to obtain it.

  • 90
    Bingo - James followed procedure - so why should James be disciplined for following procedure? The guy, as you point out, was behaving as an intruder, not a manager. – user45269 Sep 28 '17 at 11:58
  • I used to get quite frustrated when help desk would call me and ask me to add someone to an access list when the app screen clearly said they had to be added by their manager. – WGroleau Sep 28 '17 at 11:59
  • 5
    James certainly "did the right thing", but we don't know if he "followed procedure". Since no-one is required to carry an ID badge (note I said "carry," not necessarily "wear at all times") there may not even be a formal procedure to follow! Just relying on a random employee "recognizing somebody" is a ludicrous approach to security. – alephzero Sep 28 '17 at 13:49
  • 5
    @alephzero We do know that he did the right thing. From the question, we know that to enter the room, you're required to either know the code to enter or be accompanied by someone who knows the code. Having a badge is immaterial as it is not the entry code nor is it a person who knows the code accompanying you. – iheanyi Sep 28 '17 at 19:59
  • If that person was such an important manager, he should have known the way to get the code to the room - if he needs one. – WoJ Sep 28 '17 at 20:01
111

Should an employee be disciplined for not recognising those further up the chain of command?

No they shouldn't, James did the right thing and your manager will/should support him now that he has the facts. But life is not always fair. This is fairly straightforwards though and even the disgruntled manager knows it.

We're looking for long answers that provide some explanation and context. Don't just give a one-line answer; explain why your answer is right, ideally with citations. Answers that don't include explanations may be removed.

  • 38
    Yes. James is fine, especially when the manager point blank refused to identify himself. – Snow Sep 28 '17 at 10:14
  • 3
    We're looking for answers with some depth that explain why and how. Our goal is to build a library of knowledge for navigating the professional workplace. Please consider an edit to expand why this was the right thing to do. – Lilienthal Sep 28 '17 at 18:29
107

James did the right thing. In fact, James proved himself resistant to a social engineering trick often referred to as a "Bavarian fire drill".

IF anything James should be commended as he has demonstrated that he will adhere to policy and not be intimidated by someone using social engineering tricks.

A similar thing happened to a friend of mine when he was in the military. He was ordered to guard an area. An officer of some rank decided to try to bully his way in and nearly got shot. He was officially given a dressing down, but unofficially congratulated and told "good job". His record remained intact.

  • 23
    Linking TV Tropes is the social-engineering attack! – Nat Sep 28 '17 at 23:26
  • 2
    Which begs the question: why was he officially given a dressing down? It sounds like he followed his orders. Military politics? – marcelm Sep 29 '17 at 12:22
  • @marcelm yes, military politics. He followed orders perfectly, but he had a run in with a superior officer. So, to satisfy the military politics, he was given an official "talking to", but it didn't go in his record. It DID bolster his career though. – Retired Codger Sep 29 '17 at 12:37
  • 1
    One of the interesting things about the military, which I learned from a (UK, not US) civilian contractor rather than first hand, is that to get on you have to learn which rules are real rules, that must be followed, and which rules are arrant nonsense that would cripple the organisation if anyone followed them, but that you must pretend to follow. Naturally, this distinction is never written down anywhere. Sounds like there was a difference of opinion in this case between the "officer of some rank" and the person with actual authority, but that the visitor was widely regarded as in the wrong! – Steve Jessop Sep 29 '17 at 12:48
  • @SteveJessop my father and brother were both US military. I tried to enlist but was rejected due to my bad hearing. Your friend was right, and there is an additional unwritten rule. If you irritate the wrong person, then EVERY rule will be enforced on you, some contradictory, so that no matter what you do, you WILL be violating some rule. One thing they do is have two superiors of equal rank give you contradictory orders. Since neither outranks the other, both have equal precedent and you WILL be disobeying orders regardless of your actions. – Retired Codger Sep 29 '17 at 12:54
28

I'm just going to answer the questions as stated here, since the security process aspect of the question here is clearly understood and has been handled appropriately.

Should an employee be disciplined for not recognising those further up the chain of command?

No. If they don't identify themselves or carry security credentials (business card, key code number, security pass), then the existing security measures trump everything.

Should employees be encouraged to learn who is above them, even if they will never directly report to them?

Yes. It makes sense for employees to be aware of the managerial hierarchy of the company, especially in the immediate chain of command above them. Knowing their names is fairly important in knowing how to deal with them if they happen to deal with you.

  • 5
    It does make sense to try to learn upper level management. But often the only way to learn is through photos on an org chart or corporate website. These photos tend to be the absolute best appearance of the person and are often years (decades?) out of date. Even if someone could ID a photo it doesn't mean they could recognize the person in real life. – John Oglesby Sep 28 '17 at 12:09
  • 8
    LOL, I know who my manager is, and I know who his manager is (simply because they were above me in my old role). There is a great many people in this small company, who I have no clue who any of them are, and I'd do exactly the same in James' situation. Then again, I once didn't let the CEO into his office, because I didn't know who he was either (different job) and he commended me for it, so maybe I'm just lucky... – djsmiley2k Sep 28 '17 at 12:29
  • 3
    Good answer except a business card shouldn't be counted as a security credential. A false manager could just have obtained one from a real manager. – Sumyrda Sep 29 '17 at 8:50
15

Ideally, James would not have even opened the door though, so if there is anything to be learned from this on his part it's that. I'd say there are lessons to be learned by all, but disciplining this employee is not only not right but creates liability for the company.

Lesson for senior management is there needs to be policy on this and it needs to be agreed across all areas and understood, how this should have been handled by James. Without such policy, and that being in the employee handbook or among a stack of policies all employees are required to read, understand, and sign, then the employee is expected to handle situations according to what is generally accepted across the industry -- and that is what he did.

Even if he is not formally disciplined, it sounds like the culture in this company is really not good. If it is even being contemplated to discipline a new employee for this, and/or other senior managers think their ego should trump IT security best practices.

The company paid money to put a coded lock on that door, so somewhere someone made the business case that what is in that room needs to protected and only accessible by persons authorized and with a need. I am sure that the argument the senior manager is making is "but I am authorized and not a bad guy!" Then why spend the money on that door security? If all employees are expected to personally know which other employees, at that point in time, are active employees and possess a business need to that room, then why was the money spent?

I worked for a company that is a global Fortune 50 company and their intellectual property is what pays for the jobs and lives of over 100,000 people. At that company, there is no circumstance where personal recognition is allowed to be used. No matter who, they need the credentials and physical ID card.

If your company has intellectual property that unauthorized disclosure would cause grave consequences, then the ones to discipline here are all the executives with a hand in responsibility of securing that IP. They should be disciplined for failing to create a culture that puts protecting that IP is everyone's first responsibility above all others -- including senior manager egos.

I personally would be looking for a new job if I was in your shoes. Sorry.

Edited to add: Another business reason there is a coded lock on that door is that perhaps there is a legal or regulatory requirement to have an audit trail of all who access that room. If that is the case, then your company is contemplating disciplining an employee for not breaking the law.

4

They should not be. The employee "James" (assuming their description of events is accurate) did exactly what they should have done.

Of course it's possible that James was rather ruder or more abrupt in the moment than he later was when describing it to you. In that case then possibly he was out of line.

i.e. the difference between "sorry, I can't let you in without a pass or code" and "get lost sucker" is pretty large.

Having said that, even if James is completely in the right - some people are petty and vindictive. It's entirely possible that this manager will decide to take things personally and attack James over it. It would be worth logging the incident in detail now. Note down the time, the location, and what happened. If there is CCTV you could even record that.

Now should the manager start making life difficult for James he will have ammunition to take to HR and/or use for legal action should that become needed.

Escalation like that isn't likely, but some people are just petty and vindictive enough to do it so it's worth having some coverage in place.

4

My currently out-of-office manager emailed me with a message along the lines of "Did James really not let that guy into the IT department? Did he really not know who he was?"

I'm Sorry Boss but even the million dollar security system our company had installed did not recognize the guy, how could James have? That guy did not correctly identify himself to either of them. James seems to have followed the book.

4

James did the right thing, but he may or may not have done it in the right way. Your company policy may or may not be good enough and/or clear enough, and he may or may not have known the policy. This is an opportunity to review (with your boss) and improve company processes and/or how they are communicated to new hires. As a benefit, the more you do that the less likely it is James can be considered responsible for doing anything wrong, and the more likely it is that the visitor will be found to have done something that either is against the current policy or that policy needs to change to forbid. As for James, the primary issues of concern seem to be:

  • He didn't allow an unknown person the free run of the IT room. This is definitely right.
  • He didn't recognise the guy and leap to attention. Entirely reasonable, especially for a new hire, unless the company induction process includes a list of names and faces and a note that it's important to learn them all! However, it seems to be why the guy is annoyed, so dealing with this as the real issue might make the spurious issue (not letting him in) go away too.

The visitor seems to have thought that his face should work as a security pass -- that is, every employee (even new ones) should recognise it and let him in. If that is company policy, then it is sufficiently unusual (and unwise IMO) that it needs to be properly communicated, which hasn't happened here since even you don't know about it. If it is not company policy, then ideally it should be communicated to managers that their face is not an access-all-areas pass, and they shouldn't get grouchy when employees fail to treat it like one.

Should an employee be disciplined for not recognising those further up the chain of command?

Not unless their boss (you) has told them this is important. Even if the company would prefer him to recognise managers, it would be rather disproportionate to make disciplinary matter of it on the first offence, early in his employment, if he has never been told that it's important.

Should employees be encouraged to learn who is above them, even if they will never directly report to them?

If they have no useful work to be doing, then I suppose so. Recognising your own chain of command, even up to C-level, is probably useful and a good idea as a matter of courtesy to their position. A UK SME (so up to 250 employees) in which you have too many people in your chain of command to recognise them all, needs to sort out its org chart with a weed whacker! In contrast, recognising everyone in the whole organisation who outranks you is often impractical, although it does no harm provided you don't waste a lot of time on it.

For that matter, how should James have acted differently if he had recognised the guy? It's one thing to recognise him, it's another thing to let him into an area that he apparently (due to not knowing a door code) may not be authorised for. Given that each office has its own code, it seems natural to assume that those who don't know the code shouldn't be there, even if you do recognise them.

Regarding that and other security matters, you know more than we do about the details of the event and of your office's general policies, but there are various secondary things that could have gone differently.

  • He didn't establish the guy's name. You say he asked the guy his name "again" and that the guy refused to answer. You don't say when he asked the first time, so without those details perhaps James could have been clearer what it was he needed from the guy. The guy should have been willing to give his name (but, as above, it seems what he really wanted was to be recognised wherever he goes, so I suppose that's why he refused). Not that the guy's name is a magic password that should let him into the room, but asking visitors to your office what they claim their name is, is still a good idea.
  • He held a conversation with the guy while standing with the door open. This is probably wrong but for a typical office only very marginally so. It led to a situation where the unknown person "tried to get past him", and he blocked him. Presumably with body language rather than physical force, but it's still not an ideal situation to put random IT staff into. One option would be to come out of the room, close the door behind him, and hold the conversation in the corridor, and that would be the preferred option for a seriously-secure room. James could be advised to do that in future, and/or it could be made written policy for the room if appropriate. He could even wait with the guy in the corridor for your return.
  • He didn't allow the guy supervised access to the room. Now, if this IT room is a secure server room, that's certainly right. But maybe it's "just" a random office, with no particular security protocols beyond all the other offices in the building, that you sometimes do allow people into for meetings/conversations/etc. If so, then James had the option to let the guy in and sit with him waiting for you. He chose not to take that option, but could be advised to at least consider it in future. One can speculate wildly about the possibility of some burglar overpowering him once in the room, but frankly they could have done that while he was standing in the open doorway. So far as physical security is concerned, that ship sailed when he opened the door at all. Of course, if there are confidential documents visible on desks and so on then it would not be appropriate to allow someone in, even supervised, without establishing their name and authorisation to be there. This is the primary non-aesthetic argument for "clean desk" policies, which you may or may not have.
  • He didn't escort him to reception and/or call security. Presumably that would have seriously ground the guy's gears in this case. But if you're in an even lightly-secure area, and decline to identify yourself, then you shouldn't really be surprised if that's what happens from time to time! As a matter of site policy, you should probably tell James (and all employees) what they're supposed to do about possible intruders, and what they're supposed to do to distinguish themselves from intruders.
  • Letting someone in the room even supervised is a big can of worms. Is there any paper around they shouldn't see? If they start wondering around and poking at things what are you going to do? If the employee gets called out to a tech support issue somewhere what does he do with the guy? etc – Tim B Sep 29 '17 at 14:55
  • @TimB: right, the policy item to look at, is whether or not that can of worms is already open in this particular office. If so (that is, if the office is generally regarded as safe for supervised visitors) then it's an option. If not then of course a new hire shouldn't take the decision to open it :-) – Steve Jessop Sep 29 '17 at 16:43