Protecting Data While Protecting Your Job

An acquaintance approached me with a dilemma recently.

Her supervisor had requested the password of a coworker who was out on

extended sick leave. The supervisor said, ”Joe gave it to me before he

left, but I misplaced it. Just go ahead and give it to me again,

please.”

The system administrator told me that at first she was going to just give

the password to her boss, but began to have second thoughts about it.

What was the right thing to do?

If it meant saying no, how was she supposed to do that without getting

fired?

It turned out that Joe’s password wasn’t available, and the system

administrator didn’t have to actually say no. But the situation raises

larger questions, involving the ethical administration of corporate

assets. Often the situation can be sidestepped with some creative

solutions. However, it can be tricky to face the situation in a manner

that won’t lead to the end of your career or a colleague’s.

First, find out what your supervisor really wants.

It may be that Joe forgot to turn in the quarterly report, but left you a

copy. It’s possible the required information resides in more than one

location. If your supervisor has authorization for administrative access

on the system, providing him with his own administrative-level password

should be sufficient.

Second, it’s possible your supervisor is looking for evidence. It may not

be something he/she is allowed to discuss with you, or it may be they

can’t articulate specifically what they’re looking for. This presents a

different ethical dilemma that can be examined from two different

standpoints.

First, does explicit corporate policy exist regarding the use of company

assets for personal use? Are there awareness notifications? When you

login, are you required to do something like click through a window with

huge letters saying something like:

CORPORATE PROPERTY

The use of this system is restricted to authorized users and is for

system. etc. etc.

Is this caveat enforced? Understand that I’m not a lawyer, and I don’t

play one on TV, but in HR terms, this is an unenforced corporate policy

which lends itself to a concept known as ‘acceptable practice’. Having

unenforced corporate policies could leave an organization vulnerable to

litigation.

Here is an example of unenforced corporate policy and acceptable

practice. Let’s say, a company policy states working hours are from 8

a.m. to 7 p.m. with one hour for lunch. An individual or individuals

consistently arrive late, take an hour and 20 minutes for lunch or leave

15 minutes early. This behavior is not documented and the individuals

involved are not counseled or marked adversely on performance

evaluations. Thus, a standard of acceptable practice is set that the

company must tolerate based on this previous behavior, or aggressively

pursue a re-education campaign that has clear requirements and consistent

consequences.

Even if the company spells out what is and isn’t acceptable, if there is

no accountability for inappropriate behavior, it is much more difficult

to pursue disciplinary action.

The notion of acceptable behavior leads us to the second concept that

must be examined.

Is there an expectation of privacy? Is it commonly understood and

accepted that private materials can be kept on a company workstation and

will be kept confidential or considered confidential by management?

Litigation also is a possibility when dealing with matters that involve

personal privacy in the workplace.

Let’s look at one final consideration.

You and Joe are friends and you know he spends a good portion of his day

online looking for stuff, chatting with pals, and surfing various

questionable Web sites. Where should your loyalties lie? Your decision

might seem more difficult because sometimes it’s hard to identify with an

impassive impersonal corporate entity, or you may disagree with corporate

policy.

I look at it like this: Even if Joe is my friend, he causes more work for

me and for others when he doesn’t do his share. He lowers the value of

the company by stealing time and services from the corporation. This

places my job at greater risk. Finally, Joe has the audacity to put me,

as system administrator, in an awkward position because I know what

happens on his computer, and NOW, my boss also is interested.

OK, let’s get back to the system administrator who was asked to hand over

a password.

I’m still personally unwilling to just give out the password. Depending

on the circumstances, suggest contacting the employee to retrieve the

password. This is a reasonable option if you don’t retain password

records. An alternative would be to change the user’s password (as

administrator), and then have the user change it again when he or she

returns.

Earlier we talked about administrative access. This method should be used

if at all possible. This is a reasonable option if you don’t retain

password records.

Remember that every set of circumstances is different and I can’t give

you the definitive answer on how to handle your specific situation.

Whatever you do, get the request in writing before you act on it. Ask

your boss to send you email, print it, with the complete headers, sign

and date it and put it away. You don’t ever want to be in a position

later where your recollection and your boss’s recollection differs.

If you believe your supervisor’s request to be unlawful, against company

policy or suspicious in some other way, tell them you are acting in

protest on their written request, and you will be documenting the

exchange. You can then speak to your supervisor’s boss, where you might

gain a better understanding of actions being taken. If you think it is

appropriate, you also can speak to someone in HR, or if your organization

has legal counsel, speak to them. Be aware they get paid by the company

as well, and you may find they have a conflict of interest.