Tech Snoops into Client's Private EMail

What you have described, I believe, is a form of stalking, it is definitely harrassment and it is illegal.

Some have suggested fire and arrest. Hold on that for a bit. Instead, since your are dealing with criminal activity, contact the local law enforcement agencies and find out how to correctly proceed. Follow their instructions carefully. They may have specific things that they need in order to proscute that cannot be provided yet.

Firing the tech first may allow the tech to go on to another location and commit the same crime against other people.

I personally would consider this as a form of stalking and as the owner of my email account, I would press charges on the IT tech & business owner, plus sue both the IT tech & the business owner for the stocking & invasion of privacy. I feel that it is the duty of the business owner to immediately remedy the situation once discovered. I view this the same as stealing money from someone's desk or purse.

This is really a can of worms.

1. How is it that the tech has the owner's login? Was it given to him - or did he acquire it on his own?

If the owner gave it to him then there is little recourse - implied permission exists. Have the owner change his password and start from there. I know any administrator has the skills to get into any account under his control - the issue is ethical rather than technical.

2. Is there an acceptable use policy in effect, does it cover snooping (trespassing) and has the Admin signed it? If all three are "YES" there are grounds for dismissal - just don't do that until the system(s) have been examined by outside experts.

There are all kinds of possible exploits that someone ethically bereft could have in-place. To summarily dismiss could trigger system events that totally shut down your friend's business. Depending on the state he is located in, there may be legal avenues, but it is better to do an end-run and eliminate the possibility.

A thorough audit of the system is in order, from an outside source.

BTW unless the company has a policy specifically stating that email is private, it is not. It is incredibly poor judgement to read the boss's email - and employing the "iceberg principle" If this guy is reading the boss's email then it is a safe bet he is reading everyone's email - what corporate secrets are referenced in executive-level emails?

Another issue - does he read emails that have not been read yet? That is Federal, and certainly grounds for dismissal.

Respond privately to s_norris@email.com if you would like to discuss this further.

Regards,

Sam Norris
CDFR, Inc.

From what I have read the owner is a good friend, but you must explain to him this is the way business is done. That tech should be fired for his gross his conduct of reading other people's email. What you should do is tell the party that is getting thier email read is to change their password on their workstation to put a stop to this. If the tech gets into the workstation again have a lawyer and security computer expert walk him out the door.

You don't want to let this guy see your upper hand. He may be more tech saavy then you think and you can see that he has no morals about what's right. Contact both a lawyer and an IT security specialist. Have the IT security specialist check to see what other damage this guy has done. Then have him go to work finding ways to keep this guy locked out and prevented from doing further damage. I don't see any legal problems in firing him, but your friend should have saved any e-mails he sent to him regarding private messages with other parties. I also hope your friend has written in his policy and procedures his right to fire an employee at will for misconduct or otherwise.

First of all, if I'm getting this right, your friend owns this business, right?? He pays this jerk? The jerk needs to be dismissed and removed from the property. I agree with all of the posts, get rid of him and hire a security consultant to review the systems.

Second, I don't care WHAT kind of genious this guy thinks he is, everyone is replaceable. Your friend should talk to his staff to see what kind of requests the staff are making of him and you may find that he is just doing simple support.

The bottom line is: the jerks user ID, password, access to the system is the PROPERTY of your friend and he is able to do whatever he wants with it. He is not a God unless your friend regards him as one.

...and to prevent him from getting work elsewhere I would make some bogus user names in forums and reveal his antics using his real name. A future employer Googles him and the truth comes out.

Aaron; I too am a Canadian 'tech'. As a long-term member of the IT fraternity, as well as a respected professional in my field, I have to state that it is just this type of unprofessional activity that gives the technical/professional side of IT a 'black eye'.
My considered opinion would be to have your friend (who owns the business) immediately engage a professional firm to document and secure his system. Then, once the hired firm has the administrators' passwords etc., fire the offender and ensure that any requests for reference document the unprofessional activities of this individual.
Depending on the type of business (IE. can it be harmed by this individual leaking information...especially to competitors?) it might also be advisable to contact the Commercial Crimes division of the R.C.M.P.
I say this because it is a VERY small step from reading emails to gleaning confidential data from a companies' network. In my opinion, someone with the unmitigated gall to insinuate himself into the private life of his employer has utterly no morals and is not deserving of ANY degree of trust. In any event, this individual is not going to like being fired, and may attempt to retaliate; either by attacking the system, or by 'running to their competition'.

Regardless of the owners' fear of this individual and his knowledge of their system, his hold on them will only get worse as time progresses. The time to cut their losses is NOW...before he can do any real damage!!

As an old business professor of mine once said, "The time to fire someone is the first time you consider that it might be necessary." He meant this in the context of dealing with an individual who had commited some serious or criminal act of course, not just for minor transgressions. However, trifling with confidential information IS just such an act. I fail to see how ANY employer could trust an individual who has shown such complete disregard for the concepts of privacy and confidentiality.

I would also go so far as to say that if this individual were to be a member of the Canadian Information Processing Society (heavens' forfend he is an I.S.P.) or The Network Professionals Association, I would file a report with the Ethics committees of either body.

Finally, please stress to your friend that while big firms act immediately on cases like this, most small firms do what your friend is doing and 'sit on the fence' rather than acting. In the case of a small company, they may be taking their very existance in their hands with this decision. I have seen cases like this ignored before and the results have always been devastating. Put it to him like this...he would not let a thief handle his cash, would he? Then why let someone who has shown he has no morals have access to his whole business?

I invite your comments.

Regards,
BillT

QuickBooks Online Edition lets you work on your books anytime, from anywhere via the internet.

That way you don't need to keep your computers on at night. I'm going to install it later this week.

Hi Aaron,

Just me again...I have been reading some of the later comments here in this 'column' and I can see that there is quite a misconception of the scope of this activity and possible actions.

A lot of the postings regard company policies and rules. The point everyone seems to be missing is that in fact, most small businesses and even a lot of medium-sized ones have no concept of how to set up ANY form of policies in regards to IT concerns.
Most small businesses regard computers and networks as 'necessary evils' much like photocopiers and faxes. Very few of them have the necessary expertise to draft such policies, much less know how to go about implementing and enforcing them!

In any event, in this case, written policies are unnecessary, Canadian privacy laws take precedent.

They are also missing the point that this is a CANADIAN company. Most of the US laws, both State and Federal have no application here.

It is true that in Canada, email hosted by a corporation is owned by that corporation. That does not, however, give the IT staff blanket permission to peruse it at their leisure! IT staff only have the right to open email not specifically addressed to them if they are instructed to do so by an officer of the company, on the companies' behalf.

Under Labour laws in both BC and Alberta, (both provinces I am familiar with) this individuals activity would be considered 'just cause' for dismissal. I suspect that Ontario law would be similar.

Again, I cannot stress strongly enough that the time for dismissing this individual is long past!!

Regards,
BillT

"Guess what? I know all of your little secrets. Don't even THINK about firing me. In fact, maybe you should be working on my raise, hmm?"

I have a hard time believing this is merely a personality problem. This guy should be treated with extreme caution. The business owner has no choice but to get rid of him, but I suspect this guy has every intention of taking the business down with him if he doesn't get his own way.

After warning the tech verbally and written, I would bring in a consultant (preferably when your tech is not there) to evaluate the system. If the consultant can run what the tech does, fire the tech and have the consultant train your tech's replacement. Once you get a bad rep in IT you most likely will not get hired by anyone in your area.

Oh yeah so how as the wine and pizza?

That is definitely improper use of IT priviledges and that person should be out on the street.

Can you drop me an e-mail thought the peer about this?

Col

True, I have only been a mainframe operator for 15 years or so, and had my own computers for about as long. But I would swear that the Network Admins had access to all the passwords so that they could help users with password resets and such.

So would changing passwords REALLY help the owner keep this smuck out of his Email? Wouldn't he have access to the password file so he could just look up the new password everytime the owner changed it? That doesn't solve anything.

I know this post comes really late in the game to have my two-cents-worth mean much, but I agree the Tech guy needs to be fired ASAP. But yes, making sure all employment laws in regards to giving warnings, written notice, etc be followed to make sure the guy can't sue and win for unlawful discharge.

I would also suggest that if this guy is really good, he probably has back doors into the system that need to be plugged. I'm thinking a PC with PC Anywhere, or running GOTO MYPC, or whatever other remote access method. That would be why the owner needs to get another IT Security contractor in (on the sly perhaps) to find and be able to plug the holes the second the door hits the guy in the ass on the way out.

In the meantime, yes, document (save) the Emails that he sends referring to content in the email account of the owner (as well as the original emails). Contact Lawyers for guidance.

Larry B.

first has this tech read or snooped anyone else so you can have others thinking the same way. Second ask the owenr what he would feel if HIS email was read and then commented on. Third the king of the hill comment reminds me of an OLD website that had a character called the bastard operator from hell. He was an Englishman who essentially did as he pleased in a company.

A very good point,
Thank you
Aaron

is this in terms of the big picture: if he's willing to read the owners' email. How many OTHER people's email is he reading?

It's not just a question of personal privacy but how much information he's gleaning in terms of B2B interactions, marketing and sales data. I mean if your workplace is one of those companies that has to sign confidentiality and disclosure agreements with other vendors and business, if he leaks any information or is feeding it to your competitors, your company could easily be down the road to litigation.

I am much more concerned about the security aspects of the setup and situation that you have described. As you have stated that your friend has not given permission to this Tech to read his emails, then clearly the Technician is guilty of Professional Misconduct and may also be facing criminal charges, and should have his employment terminated immediately. (Your initial thought is precisely correct). How this should be done is relatively simple, by simply having your friend go to the HR department, have somebody draw up termination papers, phone the police so that they will be present immediately after this Technician's employment is finished so that they can arrest him on the spot. Before he is actually terminated your friend (or somebody else with Administrative privileges) will need to get control of any and all accounts that this Tech uses on the System (which includes the password for his account, and, access passwords for all shares, encrypted file systems, or any other resources that are subject to access control in any shape or form), so that proper Administration of the System can continue, otherwise your friend could well end up with an unusable system with all users locked out, which very few business survive because of the data loss. If the Tech becomes suspicious that his employment is about to end he could do a lot of damage to the business, so security of the system needs to be ensured before he finds out what is going on. This also includes preventing any person in HR who may have reason to tell him what is going to happen from contacting him.

Before he is fired, the following MUST be done:
Firstly, at least one other person must already have Administrative Access to the Network, otherwise you may have a real headache on your hands as another account has to be granted Admin status, which this tech would have to do. If he is the only person with Administrative Access, then a new Administrative level Account needs to be created before he finds out that he is no longer working for your friend.

Secondly, given that the Tech has Administrative access to the email Server (and maybe any other Server(s) as well) , because that seems to be the only way he can read your friends email, the next thing that needs to be done is that his access account needs to be disabled so that he cannot do any damage to the system. If his work requires Admin privileges (or his work involves the system administration as well), although neither of these things should be happening in a Medium sized Business, then clearly the security of the network is compromised, as no Technician should have that level of access.

Thirdly, a full backup should be made of all data on the system should be made, so that if anything goes wrong afterward, the business won't be adversely affected.

Only once these three steps are completed is it reasonably safe to fire the Tech, escort him from the premises (if the business has it's own security staff), and if the police have criminal matters to investigate then they should be present either immediately afterward, or outside the business when he is escorted from the premises.

As soon as he is gone, his access account needs to be removed, and a careful investigation of all computer accounts needs to be made to ensure that he hasn't created one or more redundant accounts that still give him access to the system from outside. Then a check needs to be done that searches for any back door(s) (there could be more than one) that he could have installed on the system. A search for root kits should also take place, just in case. Any positive results to these steps require that appropriate action be taken, after recording all findings as the police will certainly be interested in his activities in these areas.

Following these more important matters, then there are many other items that need to be looked at, including an Acceptable Use Policy (AUP), System Security, Account Management and similar matters. Several resourses come to mind, including searching for articles on TechRepublic, SearchNetworking.com, SearchSecurity.com, and other related sites. Other suggestions that I think that would be good include limiting the hours that access is granted to the network, both internally and externally. Granted that people may require access to their email accounts outside of working hours, only means that User level access is necessary, but certainly not Admin, for people to read their corporate email, as they shouldn't be using the company's account for private communication, and the Server shouldn't require Admin access outside of work hours, makes this much easier to setup.

Real Aus Tech

(:- If you cannot have everything that you want, be happy with what you have!

The really big problem isn't that he's into the owners E-Mail but what else is he into?

And how many Back Doors has he inserted into the system?

It's people like that that give us all a bad name and they need to be weeded out but without taking the business to the wall with them. I know that if I really wanted to there is nothing in any of the systems that I administer that I couldn't get into if I was that way inclined but I'm honestly far too professional to act like that, this guy on the other hand has shown that he isn't and that worries me no end as he could do unlimited damage to the business if he took it into his head to do such a thing. If he has access to the E-Mail he undoubtedly also has access to the On line Banking and many other things so if not handled correctly he could bankrupt the company in no time at all or even worse use the companies assets to bring them into disrepute by telling tales to all of their customers or making public via the web the dealings of this company.

Sure he quite rightly may be sued for damages but if he doesn't have sufficient assets will that do any good? He obviously has the run of the network and can do as he pleases that is what really worries me and the fact that he has a big mouth that he doesn't know when to keep shut only makes it worse.

While I see the personal comments to the owner as totally unprofessional that is just the tip of the iceberg as far as I'm concerned. There is a very big difference between being friendly with the owner or even for that matter all the workers I'm that but I would never dream of opening anything that I wasn't asked to by my customers and even if I did stumble onto something I wouldn't mention it unless of course it was something illegal {Like Kiddie Porn} and then I'm duty bound to report it to the proper authorities but I certainly wouldn't be looking for anything unless I'm doing some data recovery.

I totally agree that the guy not only has to go but be totally discredited as well so that anything that he may leak isn't accepted as fact. Just how you manage to accomplish this particularly as he is very close to the owner I don't know. About the only way I can thing of freezing him out is to take the entire network down at a point in time when the business isn't working and do a full security Audit and plug any holes that you find, but I would most likely prefer to do a total reinstall of all the products just to make sure that there are no hidden processes running undetected in the background.

Col

simply because this guy has Admin level access to the email server, where the mails are stored. Changing user passwords in this situation is not going to change anything as he is just going to continue looking on the server. The only answer is to terminate this guy, and have him prosecuted for whatever crimes he has committed. See my other post much later in the forum for more information.

(:- If you cannot have everything that you want, be happy with what you have!

Fire him and do it now, who know what data hes giving away to competitors if hes doing this kind of snooping.

It is not just misconduct but it rises to the level of harrasment (bordering on sexual) and creating a hostile work environment.

They can dump him on EEO laws let alone other computer use policies.

I would say dump him.

Yes, the Company or its' owners have rights to all the bits and bytes on the computers they own, but this Tech is NOT an owner... He has no rights, but he does have an ethical and moral oblication to stay out of others peoples files and emails. This is an invasion of privacy. Plain and simple. Yes it is Company email, but if the owners let people use it for private purposes, then private messages and the expectation of limited confidentiality follow. Get a security consultant to lock things down and fire the bum. I don't even think you have to worry about civil liberties at this point. This person has crossed the line.

In the USA, the present Republican Congress basicly gave away our right to employee corporate privacy, but with a catch.

Under the law as it stands now your corporate email is open to IT access, providing a corporate policy does not expressly state otherwise.

However, if the company would state in writing that it is not allowed. The IT tech would be committing a fellony, since corpoate privacy is protected under the law.

The best thing your friend could do is implement a PGP policy with his "private" friends. Send the PGP keys by an outside email and set them up with a password requirement (not any regular passwords). However, be carefull, some companies have express rules forbiding email encryption so know your situation first.

In the mean time, report it to his superiors. If enough people come forward it will likely stop or he will be fired.
--------
By the way, we brought in after a simular issue a few years ago. Though he was eventually fired, one of the employees emailed over 200 head hunters in the area and around the country. He was eventully forced to leave the state because no-one would hire him again. The word is, he took a 30% paycut.

Un-ethical branding lasts.

To paraphrase a famous quote...With friends like that, who needs enemies?

This is called Corprate Spying its aginst the law. He has no rights to enter your password afterhours and no right to read your mail, to read your mail and tell you about is also considered herassment agine aginst the Law. Inform the Owner of this and also sugest that if he is reading your mail, he could be reading Others aka. Your bosses! Don't play around with this, the person has no reguard for anyone!

Do you know the section of legislation that covers E-Mail Privacy here in AU?

I've run across a case where someone within a company has been doing exactly this and I need to be able to go to the Legislation to point out where they are going wrong.

Col

Yup, That sound's just about right. We've been at it none stop most of the year and are almost burned right out. Fried actually. Then comes the vision of a restful vacation at home. This the place where we are supposed to read, relax etc. What we keep forgetting is the myriads of "Little Chores" that could get done and all of a sudden you realize you've jumped out of the frying pan right into the fire. Raking Leaves, rebuilding the garage, adding a brand new patio or porch, Ah yes, these are fun days that we dream of. Ever notice how our wives are never included in our daily Deliriums?, that's because right behind them come all those "Little Jobs" that she's got waiting if it even looks like your have a moment's rest. Sound familiar? , Joke ladies :) That's when the memory of a fouled up SCSI or totally fouled up system begins to look good, and in the middle of your vacation too. Scary huh.
We really must put all our heads together and find a little Island somewhere in the Pacific where we can vanish for a few weeks at a time. The only reason we don't go is that the "Chores List" will still be there when we get back. Ah Yes, the joys of Vacation time. That's when we see that light again and it's coming down on us.
Hang in there Col, I'm down to my last fingernail, but still hanging on, :)
Warmest regards
Aaron

I know it was a typo, but I LOVE the idea of getting everybody to "sing" the Acceptable Use Policy (especially the Tech)

Maybe they will pay more attention to it if they have to keep in tune

Where I work, this is consider a very serious offence which could lead to dissmissal. If this IT Pro takes it uponh themselves to deliberately login with another colleagues for the purpose of reading their email, then what is to stop him from from connecting to their personal and departmental shares on the network in order to read sensitive company information of which he has no requirement to access.

Discipline him now. If anything take all the evidence and show it to his and your boss. I know what will happen.

It's hard for me to imagine that this tech isn't actually trying to provoke some sort of reaction. Why else would he knowingly violate all codes of proffesional ethics and then flaunt it like this. He either believes he has something in the system that assures him he won't lose his job(like a triggered worm etc) or the company hr policy is very badly doc'ed and he may be counting on suing the company for wrongful termination. Either way, first force him to take a vacation where his access from the system is completely cut-off to find out if there is something in the system. Document all his work and third, yes definitely terminate him. Last make sure he knows what in his work habit is unproffesiona, so he does not make the nmistake of passing on your name as a reference.

Hand him this shirt as Severance pay and escourt him out of the building.

http://www.thinkgeek.com/tshirts/frustrations/31fb/

I'm not sure why this thread came up, since it's apparently old (and I haven't gone through all the replies to check), but, since the question still appears to be on the table: The guy sounds like a nut job (not only the nonprofessional prowling, but the messages by which he further intrudes himself); hopefully he is long gone! Best regards.