Expectation of privacy at work?

November 9, 2007 11:56 PM

I think my boss is spying on my computer. Complicated info follows...

I work for a small college. Over the 2 yeas or so, my boss has become increasingly paranoid and unstable. In the past two years we've lost one person every 2 months due to either being fired or harrassed, nitpicked and micromanaged into quitting. Basically, once she decides you're gone, you're gone.

She has no reason to terminate me based on my performance, but based on what she is saying to other staff members, she is looking for a way to get rid of me. A few weeks ago she asked all of us for our user names and passwords for the network, saying IT needed them to fix some printing issues we her having. At the time it didn't occur to me that this was ridiculous, as IT can probably get into all of our accounts. After a co-worker voiced her suspicions to me yesterday, I changed my password. Today I tried to log in and could not. I called IT and they told me I was locked out of my account because of too many bad password tries. Sounds like someone was trying to get into my account. If someone (like my boss) has been logging in to my account, they could access my e-mail as well as my documents and web history.

I read a few askme questions about similar situations, which led me to find out if my college has an employee internet use policy. I found a pdf of this on the website, and there is a place for the employee to sign it. It states that employees have no expectation of privacy etc. etc. I have no recollection of ever seeing such a document, let alone signing it.

I am going to HR about a whole bunch of other issues, and I will see if there is a copy of this document in my file. If there is not, meaning the college never made me aware of the policy, does that change my expectation of privacy? Does the fact that my boss seems to want to snoop on me by simply logging in as me rather than going through HR and IT change the situation at all? I just want to have my ducks in a row before I go to HR.

posted by anonymous to work & money (28 comments total)

You should find out what your IT department's policy is regarding giving away your password as well as asking another employee to do so. In the places I've worked, you're expected never to give out your password to anyone. (The fact that your boss asked for it may be part of her plan to sabotage you - you probably signed something somewhere in which you promised never to do that.)

While it's true that you may have no expectation of privacy on your employers' network, it may be that your boss isn't the one who's authorized to read your e-mail. If that's the case and she was operating in violating of the company IT guidelines, she's the one who should take the heat for it - not you. But you can't count on it.

I wouldn't bother with HR. To whom does your boss report? Go to that person. Ask straight up whether or not it was appropriate for your boss to request your network password and to use it to read your email. Let that person and IT sort out the rest of it.
posted by ikkyu2 at 12:07 AM on November 10, 2007 [1 favorite]

you wrote:

Basically, once she decides you're gone, you're gone.
and
(...) she is looking for a way to get rid of me.

may I recommend starting to look around for another job?

the question doesn't seem to be what you can do about this situation but how long you have until she has an excuse. there is little you can do against an unreasonable superior, even if they are morally wrong.

(I actually think this person is creepy and more interested in violating other people's privacy than checking on their work performance.)

perhaps raising flags with her superior and/or HR might be a good idea but I'd do that once I were prepared to give notice because even if you do succeed and someone reigns her in, the work enviroment will be somewhat poisonous after that.
posted by krautland at 12:35 AM on November 10, 2007

You should never have to give up your password for any situation. This is very bad that they even asked you. Seconding GTFO, but I'd ask IT if they know that this request was made. If this person is logging into accounts surreptitiously they should (and would, at many companies) be fired.
posted by rhizome at 12:48 AM on November 10, 2007 [1 favorite]

You may have no expectation of privacy, under the terms of your employment and your insitutions computer usage policies, but you would almost certainly be in violation those same usage policies if you actually gave her your logon password. If management need access to your files, or records of your activities, there are other ways they should be able to obtain them without your password.

N+1 what everyone else has said. If she's trying to log on to your account as you, she is almost certainly breaking the rules. This should be reported to your system administrators, and in the circumstances, to HR and/or her manager.
posted by kxr at 1:35 AM on November 10, 2007

I assume you are not doing anything you shouldn't be doing on your computer at work. You could tell IT that you are concerned that someone may be trying to access your computer account without authorization and ask them what you should do. That will highlight the issue and you can then bring it up with HR. While you probably do have an end user agreement that you may/may not have signed (you may have agreed to it simply by using the computer), that does not entitle your boss to invade your privacy or harass you at work. If she's gone through the right channels HR and IT will already be aware, if not this might raise a flag about what she is doing that is inappropriate.

Of course, this is in an ideal world, Krautland may be right that it is time to look for a new job.
posted by Elmore at 2:05 AM on November 10, 2007

"I changed my password. Today I tried to log in and could not. I called IT and they told me I was locked out of my account because of too many bad password tries."

I assume IT unlocked your account for you. It sounds as if you've already put a substantial obstacle in her way. If she suddenly asks you for your password again, that'll clarify who's been poking around. A little investigation into college policies about who can ask for your password, who you can give it to, who is entitled to access your personal files, should make it clear where you (and she) stand.
posted by jon1270 at 3:29 AM on November 10, 2007

Confront her. Tell her you changed your password and yesterday you were locked out because of too many invalid attempts. Tell her that she is the only one that has your password so you are wondering why she was trying to get into your email, browsing history etc. Tell her that in the future if there is something she needs from your email that she can just ask you. And then document the conversation.
posted by ian1977 at 4:09 AM on November 10, 2007

her snooping has stopped for the time being, if she's got something she can fire you with your doomed if not its possible she may ask again. I would suggest next time you stall her and go down to IT and give it them yourself. When they look blank go to the IT boss and ask him why your boss would be asking for your password and is that usual.
If you're in a us and her situation in your department. ie you can talk freely amongst your colleagues about her, or just the ones you trust. get everyone to change their passwords. and then if she asks again go down to IT as a delegation. If you cant avoid it then give her the wrong one and when all your accounts get disabled you can go to IT and ask what the hells going on.

I work in education and the politics are incredible. Its partly to do with the fact at least where I work managers rarely leave or get promoted and its pretty impossible for them to get fired. There's a lot of battling of wills and despairing, even between managers.

The best defence you've got is for all you subordinates to band together and get new workers into the 'club' asap. You cant stop people from quitting apart from asking them to go to HR and cite their reasons but you can work together to stop people from getting fired. Also get friendly with all the ppl in the chain that she'd have to go thru to get you fired. And someone lower down in HR who you can tell you how ppl get fired and might give you a heads up if anythings in the wind. The more allies you've all got the harder it will be for her.
posted by browolf at 4:34 AM on November 10, 2007

I would think that her logging on to read your email and documents is the best case scenario.
If she was really looking to make trouble for you she would log on with your password in order to send or download incriminating material. Then it would be left to you to prove she had access. Tell someone the date you gave out the password as well as the date you changed it to try and preempt any accusations.
posted by InkaLomax at 4:59 AM on November 10, 2007 [2 favorites]

To whom does your boss report? Go to that person.

Going around your paranoid boss to her boss is just asking for trouble. If her sights aren't solidly on you, they will be if after she finds out you do that.

I agree with krautland--a new job may be in order. If you're going to salvage this situation, you'll need to work it out with your boss or get a new one.
posted by sexymofo at 5:31 AM on November 10, 2007

Or get her ass fired for hacking your email account. She has committed an unreasonable breach. You have no expectation of privacy, but your privacy has to be violated according to the rules. Any university IT department is going to take something like this very seriously, if what you suspect is true; you will be yelled at for revealing your password, but since she was your boss it was not unreasonable for you to give it to her. But she is guilty of a crime for hacking your account, very likely, unless she had authorization to do it, and most certainly if she did it for personal reasons.

Are you in a union? If so, see the shop steward first.
posted by fourcheesemac at 6:01 AM on November 10, 2007

Is your boss crazy enough for you to get her fired or sent on sick/disability leave? If not, get ready to leave.

Check the IT policy on sharing passwords. If asked again, refer to the policy. In most IT depts, passwords may not ever be shared. You have no expectation of privacy in email or in your use of your employer owned computer & network. However, if the Acceptable Use Policy says that you may not use someone else's password, that will apply to your boss, as well. Use a gmail or other web-based email account and don't save any passwords on your work pc. Make sure your competence is quite well documented. Make sure you have copies of evals, and your current job description.

When your boss decides to have a grudge against you, you're generally going to end up leaving. So you have little to lose. Ask your boss for a meeting, and ask her to tell you about any problems she may be having with your performance. If the concerns are frivolous, wrong or not documented, you'll have some ammo. If the concerns are valid, you can improve the specified performance.
posted by theora55 at 7:04 AM on November 10, 2007

Nthing "get a new job." Stat. Is it really worth it to stay when you have a paranoid, mentally unstable boss who harrasses people into quitting? Are there things you are getting at this job you wouldn't get anywhere else? Probably not.

Polish up that resume, whip out your Rolodex, and start hunting.
posted by Rosie M. Banks at 7:17 AM on November 10, 2007

Regardless of your expectation of privacy, your boss's behaviour is not appropriate and I believe it would be of concern to HR.
posted by winston at 7:28 AM on November 10, 2007

I have no idea about actual US laws in this context, but I'm pretty sure that no sensible company would tolerate behaviour like that. Yes, you have no expectation of privacy, but that doesn't usually imply that your boss is supposed to read your email without cause. If she's the only dysfunctional step in the ladder above you, I'd strongly consider documenting stuff like this and talking to HR or her boss. What do you have to lose, if she's aiming to get you fired anyway?
posted by themel at 7:28 AM on November 10, 2007

I'm on your side, but you probably don't have much right to electronic privacy in the workplace, even if you did not sign your employer's policy. Here's a discussion specific to MA on a case with a similar situation.

Going to HR with your issues is an important and correct step if your boss has acted inappropriately, but it may be a mistake to take a legalistic approach about this network password incident, where you only have suspicions. Good luck!
posted by Snerd at 7:43 AM on November 10, 2007

I think you should make a report to IT that someone has hacked into your account ASAP. IT should take this pretty seriously and will likely be able to find the computers that were used to access your account, especially if they are on campus.

your boss is probably afraid that she is going to be fired and replaced by you: she may have reason at least to think she is going to be fired and this 'incident' might be the final straw for someone higher up in the administration to bite the bullet.

basically, if you can convince IT that "someone" has hacked into your work account they will take it very seriously and can likely determine who did it.

also, if they do try to force you out don't just resign and make their lives easier: your boss is able to do this because the college administration doesn't want to make hard decisions. if they can make the problem go away by having you quit quietly that may be preferable to dealing with a crazy paranoid administator. if you force them to actually terminate your contract they may well decide that your boss is the problem...
posted by geos at 7:58 AM on November 10, 2007

Do yourself a favor: Attempt a lateral move within the college, if possible. You'll be out from under your boss's prying eyes, and you won't be giving up your accumulated benefits, leave time, and the like. You win. She loses another employee.

When department heads see an area that bleeds employees, they are usually going to ask questions. Unfortunately, in academic institutions it is fairly easy for an ineffective or incompetent boss to remain in place indefinitely. You won't be able to get your boss fired. I've known people in similar confrontations at universities, where a supervisor was making life difficult for employees, and when one finally did complain everyone else kept mum. The person with the guts to confront the supervisor ended up looking awkward, like she had a massive chip on her shoulder. People will complain in private but when it comes to taking action it's a selfish herd at work.
posted by caution live frogs at 8:12 AM on November 10, 2007

Hire a lawyer.

If you contact your local bar association you'll be able get a referral and a low-cost initial consultation.

Even if you do not intend to engage in litigation, it's a very good idea to make sure that a lawyer with the correct specialties has advised you on your possible courses of action, and actions that you should take.

One thing I can recommend for sure, document everything that has happened, both for yourself and for other people who have left. Recreate timelines for the past, and make sure that every substantive new fact is recorded in the future.

You'll be doing everybody a huge favor if you make it easy for the university to prove that she is in breach of duty.
posted by Tacos Are Pretty Great at 9:42 AM on November 10, 2007

I work for a college as well and my boss had forgotten to have me sign it until almost a year later when he was going through our files. By the way, my form also had some clauses in there about not having a running business online using school computers, no porn, etc., it wasn't just focused on privacy issues. So if your college is like mine, you either signed it, or it was never given to you.
posted by slc228 at 9:48 AM on November 10, 2007

Nthing that you probably have no real right to privacy on the company's machines/network. But if you boss needed to personally have access to your account for a legit reason, she would likely be expected to go through the proper channels.
posted by desuetude at 9:57 AM on November 10, 2007

I think your boss would be terminated immediately in any well run organization where her superiors knew what she was doing with your password.

However, if I were your boss, I might well be sitting over my morning coffee reflecting that I had made an awful, possibly fatal blunder, and that the fact you changed your password could mean you are onto me, and that my best, perhaps only chance to save my job is to formally accuse you of some kind serious deficiency or misconduct before you report me, so that any accusation you might make against me would look at a glance like a desperate defensive maneuver.

Therefore, I believe you ought to strike first if possible, or run a high risk of being fired and having your reputation damaged whether or not your school ultimately gets rid of her. I think you should put together as detailed an account of the whole password business as you can, starting with the meeting where she asked for everyone's passwords, complete with dates and times and people in attendance, and present it in writing, and email as well, I suppose, to HR and/or her superiors first thing at the end of the weekend. If you are reasonably sure any of your co-workers would corroborate your account, I would give them a heads-up, too.
posted by jamjam at 11:15 AM on November 10, 2007

In quasi-casual conversation, you could ask one of the lead people in IT if the printing issues were resolved successfully...

You: "Hey did those major printing issues ever get resolved?"

IT person: "Huh?"

You: "Oh, you know, the printing issues you guys needed our passwords for. Boss Lady was going around collecting our usernames and passwords like crazy. I thought that was weird because I always thought IT had administrator access to all the accounts anyway... Hm. Whoa! Hey! Wait a minute, last week, I was locked out of my account for too many bad password tries after I did a routine password change on my accounts. You don't think..."

See how the conversation goes from there. They might be concerned and they might not. And then when you go to HR, take your conversation with IT with you as a "point of concern."

Hello Boss Lady.
posted by jerseygirl at 6:25 PM on November 10, 2007 [1 favorite]

I skimmed through these answers quickly, but I think no one has mentioned that your boss and employed have the right to watch every keystroke you type, all your emails, etc under the law. She has done absolutely nothing illegal. You have no rights to privacy at work. This is well established law.

Googling "privacy rights work" turns up this for instance:

Employers can use computer software that enables them to see what is on the screen or stored in the employees' computer terminals and hard disks. Employers can monitor Internet usage such as web-surfing and electronic mail.

People involved in intensive word-processing and data entry jobs may be subject to keystroke monitoring.
posted by about_time at 4:14 AM on November 11, 2007

about_time, I agree that she has no right to privacy on the company's machines. But monitoring and her boss asking for passwords are two very different things, and the latter is almost certainly against network security policies. This is what the majority of the responses in this thread are addressing.

If I, as a manager, have a reason to investigate an employee's computer usage, I do it "impartially" through the IT department. Snooping with the employee's password is not appropriate, at the very least because it calls into question whether the usage history on the computer is even that of the employee.
posted by desuetude at 4:43 PM on November 11, 2007

Yes, I agree desuetude, it probably is technically against IT policy at this organization. However, I'm willing to bet that the boss doesn't know about keystroke loggers, network sniffers, etc., and is performing the monitoring though use of the password to read email and the like.
posted by about_time at 5:08 PM on November 11, 2007

I think getting a new job is the least stressful way of dealing with this. In my experience, no one can ever really trust company policy unless it is downward facing, meaning that it is primarily there to use against lower level employees unless it is like a sexual harassment issue or blantant racism or something of that nature. Unless I am completely jaded (I wouldn't put it past me, the strategy should always be to be completely transparent with everything. You are doing during work at the worksite.

This lady sounds mental. Get a new job or find a new depth. Assuming you weren't doing anything NSFW, don't worry about it.
posted by onepapertiger at 5:18 PM on November 11, 2007

"No right to privacy" does not equal "the boss may monitor employees in any haphazard way she dreams up."

"Monitoring" in this fashion is an HR nightmare, because the security of the account has already been breached -- it would be MUCH harder to fire someone for inappropriate use of resources this way.

Anyway, regarding getting your ducks in a row, anonymous. Don't panic, don't get too defensive, and stay cool and professional with HR. And take the high road. You're the sane one, remember. Absolutely no need to defend your websurfing unless specifically asked to do so. If you are, just point out that you had no idea that you were doing anything not permitted. Now you're aware of the policy. Problem solved.
posted by desuetude at 9:30 PM on November 11, 2007