That's why I didn't feel bad taking it to HR. I already had a sense that he was doing bad stuff, and the password just solidified it for me.
I think OP acted entirely appropriately.
To address a couple specific points:
> As an admin you have an obligation to your users to not be nosy
In the free-wheeling academic sense where your users are more of a community, sure, I think that's the accepted social contract. In the workplace, not at all. While I'm not a fan of employers spying on what their employees do on the employer's network and hardware, I fully appreciate that it is their right to do so, and in some situations, for some purposes, I might even agree with its necessity.
> reading the plaintext yourself for fun then scurrying to HR is kinda a slimy thing to do
I don't think "fun" had anything to do with it, and reporting a likely case of sexual harassment, regardless of how the information was obtained, is never "slimy". Quite the opposite.
> Just because you have the ability to peek into the CFO's mailbox and see what everyone's salary is, doesn't mean you print out the spreadsheet and take it to your boss demanding a raise.
That is indeed slimy, unethical, and likely a violation of company policy, but that is not even remotely the same as what the OP did.
> if you got in trouble for playing Farmville or whatever while sitting on the toilet at work, which they found out about by installing cameras in the stalls
Also not even remotely the same. Any reasonable person would agree that cameras in bathroom stalls would be a gross violation of privacy (and probably illegal).
As a user, you should realize that when you're on company equipment, privacy is more of a courtesy than a right. It's their equipment you're using. It's reasonable to expect them to use it in a way that furthers the company's interests. So act accordingly.
As an admin, you don't ever go digging through stuff for no reason, for curiosity, voyeurism, or for personal reasons. But again, watching out for the company's interests is part of your job, so if you run across something or have a concrete need to actively look for something (not just a fishing expedition), then lifting the veil of privacy might be the right choice or even the only right choice.
Basically, in a corporate computing environment, privacy is not guaranteed, but crossing lines should have a proper justification. In your CFO example, the sysadmin is using official powers but acting in their own interest, so that's definitely not an OK justification.
I don't find this a very good argument. Sourcing inspiration from a sibling comment, it's also the employer's bathroom stall. I might be convinced it's okay to snoop when it comes to their network usage, but this is not the argument to do so.
The difference to me is in the purpose of the two facilities. A toilet is there for the employees' physical needs and more or less no other purpose. A computer is there primarily to do business work on. The company has a clear need to be involved in how that computer is used in several ways, such as maintaining its security, monitoring its performance, making sure it isn't misused, etc. They can afford you some privacy, but only on a best-effort basis because it's not reasonable to be entirely hands off.
If you don’t want something read by your employer don’t do it with company property or on their WiFi. It’s a rule I live by and I never connect any personal device to my company’s guest WiFi.
The questionable behavior in this case is getting a guy fired for selecting a politically-incorrect secret passphrase. This is merely one step removed from reading his brain and figuring out he fantasizes about spanking coworkers while having sex with them. (I've done this, and yet we are good friends!)
We don't know all the details, maybe that guy actually harassed people, but scrutinizing someone's private thoughts without prior suspicion for offensive-but-noncriminal behavior that can be pivoted into larger accusations is how police states work.
In the best case, this encourages people to filter their private thoughts and actions by the standards of what is acceptable to advertise publicly, which is incredibly unhealthy and oppressive.
I think you're being disingenuous. The guy got fired for sexual harassment. The password merely tipped people off as to what was going on. Don't use a weasel word like "politically incorrect" to re-frame the discussion in a way that's both incorrect and more favorable to an emotional reaction in your favor.
Do you see how I took you at your word and extended sympathy, rather than questioning whether you're misrepresenting the situation? Is there something you know about the facts of jedberg's situation that lead you not to do the same?
The politically and economically safe option in the workplace is always to discard people who fall under scrutiny that exposes an employer to liability. This raises the reasonable standard of complaint for these types of issues beyond "his password, which I cracked despite design and goal to remain private to one human soul ever, was weirdly suggestive, and none of the people ostensibly involved have voiced any concerns but I must Report This to The Authorities and Start the Hammer Falling."
Suspicion and doubt are very powerful weapons, and sometimes they're used against good people in the name of heroism, saying nothing of bad motives. They also have the feature of being incredibly hard to dispel entirely once raised, regardless of the quality or scale of the evidence. If someone looked at my F-word password with the wrong prior or coaching, I'd have to break out volumes of psychotic voicemails, videos, pictures, testimony by family and close former friends, etc, to prove I shouldn't be Cancelled.
Can you think of a crackable-length passphrase that would make a normal, level-headed person suspicious enough to make efforts that almost guarantee someone is going to get fired in the worst way possible?
What leads you to believe this? You are aware, I assume, of the existence of "wrongful termination" lawsuits, many of which have cost companies millions of dollars?
> Can you think of a crackable-length passphrase that would make a normal, level-headed person suspicious
"rape Karen fun"
> fired in the worst way possible
What about this sounds to you like the worst way possible to get fired? Here are some ways to get fired that sound way worse to me:
"several frightening, anonymous calls that came into his work phone. One caller told him that [...] he wouldn’t live to see the weekend. Another said that the “fancy blue tie” he was wearing that day might wind up turning red. [...] an effort by the [company's] attorney to discredit him by falsely claiming he’d had a romantic relationship with [coworker he was standing up for]. Shortly afterward, [his employer] fired him."
"only two weeks after her hire, while she was in the passenger’s seat of [male employee]'s car returning from a business meeting, he exited the 101 freeway, stopped his car on a side street, and pulled his erect penis from his trousers. With the doors and windows locked from the driver’s side, he reached over “and pushed her head on his erect penis in an attempt to force her to orally copulate with him,” according to her complaint. He then ejaculated.
[her] horrifying depiction of sexual assault went on for pages. There was the ride back to the office after a client visit two days later, when [male employee] again tried to force her to touch his penis and “almost careened into a commercial eighteen-wheel vehicle.” Another time in the car, this time in standstill traffic, he took his erect penis out of his trousers and shoved her left hand back and forth on it, again ejaculating. In the complaint, she says she tried to free her hand but “was unable to overcome his strength.” In another incident, he called her into his office, locked the door behind her, and tried to force her to have sex. That time, the complaint says, she “managed to escape his grasp.”
A month after that frightening incident, [she] was fired by [him], purportedly for “an attitude problem, aversion to directions, resistance and resentfulness.” She told the office supervisor about [his] assaults and suggested that the “attitude problem” [he] had referred to was her resistance to his assaults. The supervisor told her that sort of workplace conduct was considered “normal”"
https://theintercept.com/2019/10/07/metoo-wall-street-sexual...
1. The courts are profoundly unfair. Are you comfortable forcing harassment victims to go through the courts for what are literally criminal allegations?
2. This example seems too contrived and implausible, as is anything else I could think of. The whole story just seems too magical. Maybe I'm just being hard-headed and arguing with a hero.
3. I will concede that is a more unpleasant series of events without care for semantics.
2. Someone sexually harassing his coworker and saying something sexual about her in his password seems magical and unlikely to you? You don't believe the hundreds of corroborated stories about men saying stuff like that openly? Or you think people are less likely to do that in something semi-private like a password than openly?
2. It's magical that some guy exposed a "creep" Doing Very Bad Things by looking at his password he cracked. No witnesses complained, the victim had never complained, just from a distant computer we catch this faint whiff of something wrong in the strangest (invasive, aside) way and turn out to be a hero. Or maybe we just sent a weird password to HR, and they did the default thing and fired the guy for nuisance and liability, and years later we remember the justification that he must have deserved it because he's gone. (Details? Sorry, can't!) It's easier on the conscience, too.
2. "maybe we just sent a weird password to HR, and they did the default thing and fired the guy"
You just acknowledged in the prior paragraph that an actual complaint was necessary.
"years later we remember the justification that he must have deserved it because he's gone. (Details? Sorry, can't!)"
To be clear, you have already said you have no basis whatsoever to believe that he made up the details that justified the firing.
Just like I could suggest, with no basis, that you actually dumped your ex-girlfriend in a mean and nasty way over her struggles with addiction, and while distraught over the breakup she expressed her displeasure with you in conversations with mutual friends. You weren't actually present at any of these conversations, but you're sure she called you schizophrenic, satanic, and a creep, details you made up because it's easier on your conscience. You were the only person who ever perceived her as "frenzied", her job never did and neither would the cops, but it's easier on your conscience to say the only reason you didn't get a restraining order was to keep her out of jail.
All that would be entirely consistent with the facts you've told us, if I wanted to view you in the worst possible light with no basis whatsoever. Just like you're doing to jedberg.
2. I'm willing to divulge the massive amount of evidence that exists in my favor, and there's nothing self-serving about my story. In fact, it's a huge embarrassment. I shared it in the interest of getting things a little more straight in the world, not to feel good or look like a great guy. That's the difference. If anything I've said concerns you and you'd like to know more, my email is in my profile.
a) The company's reason for firing the guy was the content of the password, not the behavior of harassment, and jedberg was outright lying in claiming otherwise. If so, what basis do you have to believe this? What do you know about the company or the guy that jedberg is talking about other than what jedberg has told us?
b) The company's reason for firing was the harassment, but somehow the unsavory password is a complaint of harassment that cannot be disproven. This makes no sense. The content of the password cannot be disproven, of course, because it's in the computer system and so is a plain fact to all observers, but the existence or nonexistence of harassment can of course be disproven, which they checked by asking the officemate (unless you believe jedberg outright lied to us). Hence the officemate's complaint was necessary for the guy to be removed, and going to management about the password couldn't "almost guarantee someone is going to get fired".
2. The only way in which jedberg's story is self-serving is gaining imaginary points on the Internet, unless you have reason to believe jedberg stands to gain money or something else from writing his story the way he did. If your story is not self-serving because it merely helps you gain sympathy and anecdotally substantiate your argument about how the term "creep" can be used, then neither is jedberg's.
We don't know what that "other stuff" is and if it's right or wrong, but it's also likely not the exact same situation as your very detailed and specific story, is my point.
As opposed to the softcore kind, natch.
It was obviously wrong to be the creepy sexist.
In the abstract sense, it is wrong to invade privacy.
But then, if in your invasion of privacy you uncover a wrongdoing, the right thing to do is report it.
It would be wrong to read the CFO's email inbox, and probably illegal. But then if you uncover they are committing fraud, you need to report it to police, as well as confess your own crime.
Unfortunately, there's never easy rules for these things.
>In the abstract sense, it is wrong to invade privacy.
You have no real expectation of privacy when using company owned equipment. This was almost certainly spelled out to the employee in question in the acceptable use policy he agreed to upon being hired. Companies have to operate this way so they can investigate computers if compelled to by court or law, and so they can recover important information off computers when the user exits the company.
If he was using a BYOD computer I'd have a different opinion on the matter.
I don't know, but I imagine that such considerations could easily extend to your password.
Btw, how did the sysop know that what he recovered was the actual password? I mean, it's unlikely, but at least theoretically possible that it was a false positive. The password hashes in those days were pretty weak... Just a thought; I don't think it realistically was a false positive.
As far as it being the actual password, a false positive AND the fact he had been creeping on a coworker at the same time seems extraordinarily unlikely to me.
Acceptable use is cracking passwords in an investigation with just cause.
Acceptable use is a script to automate the checking of weak passwords, and notify users.
Unacceptable use is an admin browsing cracked passwords, without just cause.
I personally think acting on the information obtained afterwards is acceptable, but some would disagree.
Remember even in some courts, evidence obtained by police illegally cannot be submitted for trial.
I maintain these moral problems are hard ones.
Ultimately, I think it's a case-by-case on this type of thing.
Btw, I find it very interesting that e.g. most EU courts will consider "tampered-with" evidence, but obviously take into account that it may have been tampered with and so accord it much less weight than "pristine" evidence. Whereas US courts will[0] absolutely throw out anything that's shown to be even mildly "tampered-with". I don't know what the right answer is, but it's an interesting question to ponder.
[0] Maybe this is wrong; I'm not a US-ian, so I may not have perfect insight into the court system :|.
It's not obvious as we haven't heard his side of the story.
"Don't be snarky."
So don't be so arrogant about someone being "creepy" when they are not mentioned as doing anything specific in public...
I agree with this. Everyone deserves due process.
It sounds in this situation like they got their due process. (HR didn't fire them based on the password report, but rather used diligence and due process to investigate/corroborate and only then terminate them.)
Browser and search history, email passwords, diaries, and a list of medical professionals that I can contact to vouch for your mental stability should suffice.
We will reach out in the next few days to conduct a character assessment review. Thank you for your cooperation!
If you have any questions, do not hesitate to fill out a form with the Health and Safety Commission offices. Our hours are 10 AM to 3 PM every other Tuesday of every other month.
Remember, your health and safety is important to us.
It's kinda like if you got in trouble for playing Farmville or whatever while sitting on the toilet at work, which they found out about by installing cameras in the stalls. Yes, I shouldn't have been doing that, but how you found out is also a huge issue and I'd feel pretty violated.
You should probably re-read the sudo warning: