Are there any quick ways to identify unethical behavior? 5

[telayla]

I am in a leadership position within my company, and have a strong IT background (managed an AS-400 when mainframes were still around) but no longer have the role of IT management (I have telecom and telecom integration).

The owners my organization are somewhat naive and trusting with regard to information security and I have some real concerns regarding the security and use of our corporate data.

The IT manager for our organization is an individual with very little formal training in the management of information. He learned networking from reading books, and building a network in his house and his hardware expertise is pretty good. Whenever you ask him a question about applications or networking or honestly anything... this person gets "diahrea of the mouth" and starts slinging around technical jargon emphasized by terms like "my network". Having over 15 years of industry expertise, however, I have learned "technogy as a second language" and speak and converse in it fluently. Much of what he says makes no sense at all and there is little logic to his statements. Quite frankly, I think I scare the crap out of this guy, and he won't let me anywhere near the network. He reports to the CFO of our company, who has absolutely no interest or knowledge of the IT field. Basically, there are no checks and balances, no reports, and no oversite with regard to how he uses the information, or what he does with it.

There have been periods of time when he and I have been at cross-purposes and my Outlook would change viewing methods overnight or my defaults would all be different the morning after I decided to close and lock my door. There was an occasion when I was on vacation last year, in the godforsaken jungle (with a coworker)that I received a read receipt for an e-mail sent to this coworker during the time we were away with nothing but monkeys to grant us access to e-mail. The last time I was away (this past March), he took it upon himself to copy my entire home directory to DVD, and delete it from the server. I do not have a DVD reader on my local PC. When I got in I could not access any of my data and when I asked when it would be made available to me (after several hours of NO response), he said he was eating and he would get to it after lunch (it was a really long lunch that lasted till 4:00PM). I spent four days exclusively trying to recover this data, but there were lots of recording errors and I have only been able to retrieve 30% of my data. In my opinion NO I.T. PERSON IN THE WORLD SHOULD HAVE THAT MUCH CONTROL or AUTONOMY!

He has VNC loaded on the network and it was loaded locally on my PC several months ago, but I removed it the same day it was installed.

His method of data security is to perform back-ups at midnight take that tape and put it into a firesafe (which is only safe up to one hour in a fire). He keeps the most current tapes on-site and after 7 days takes the tapes home to his house and he keeps them there for 6 months.

I AM VERY CONCERNED THAT THIS INDIVIDUAL IS IN CHARGE OF ALL THE DATA FOR MY ORGANIZATION. I NEED TO FIND A WAY TO DELIVER PROOF OF IMPROPIETY TO THE OWNERS OF MY COMPANY SO THEY WILL AGREE TO HIRE A SECURITY CONSULTING FIRM TO ASSESS OUR NETWORK. If I am wrong or severely paranoid, I will be happy to accept that, but I would rather be wrong than imagine the ramifications if I am right. Do you have any suggestions for me? Or are you all asleep from this book I wrote?

 

[SantaMufasa]

From what you say, your organisation sounds to be at high risk from a backup and security perspective. I highly recommend your company's retaining a highly recommended security-audit consulting firm to assess the state of your organisation from a backup and security perspective. If the company is unwilling to effect such an engagement, then I would say that something is rather fishy.

BTW, I'm curious about your joining Tek-Tips just minutes before your posting this thread. Are you an existing Tek-Tips member joining under a different handle to ensure your anonimity, or did you come to Tek-Tips to just to ask an ethics question? (I ask because most folks come here initially for answers to technical questions.) I hope you don't mind my curiosity...it's just a rather atypical "first blush" with Tek-Tips.

Mufasa
(aka Dave of Sandy, Utah, USA)

http://www.dasages.com

Do you use Oracle and live or work in Utah, USA?
Then click here to join Utah Oracle Users Group on Tek-Tips.

 

[pmonett]

telayla :

I think your company is a disaster waiting to happen. I would not envision a long career there, even if they have been lucky until now.
Get out before lightning strikes, because it will.
And do not worry about IT or how it is managed. If the CEO thinks it is good enough to ignore all basics about security and accountability, well you are apparently not in a place to change that. The real question is : do you really want to risk your career on changing this ?
I must admit that I would have had quite an argument about the removal of my mail without warning or consent. I do believe that I could have walked out on that basis alone. The picture I get is that this company has a very strong buddy system, and one buddy is in the wrong position. I doubt you'll gain anything by going head-to-head on this.

No, I really cannot advise you to stay there. You're on an idiot's blacklist, and that idiot has the means to harm you repeatedly. You cannot remove the idiot, and you can expect little support from above. To me, that indicates a very bad position, one I would not stay in.

Pascal.

 

[DPlank]

I'd second Pascal's opinion, and as soon as you have another job set up, get out of the place. On the way out, write a (very) courteous letter to the CEO explaining your concerns and advising him of the situation he is being placed in. Explain your reasons for leaving and wish him and the company well for the future.

Never hurts to leave a job on a good note...

Cheers,
Dave

Probably the only Test Analyst Manager on Tek-Tips...therefore whatever it was that went wrong, I'm to blame...

animadverto vos in Abyssus!

Take a look at Forum1393!

 

[LTeeple]

I agree with others here.

That guy is showing a serious lack of ethical standards. Given his reported behaviour, I wouldn't at all be surprised if this person would attempt to sabotage your career.

Play it safe, and jump ship.


Cheers!
Laura

 

[Dollie]

Does your company have any type of computer use policy or confidential information policy? If so, I'm sure you can find numerous reasons to bring up this person's unethical behaviour to management. There are probably numerous examples that can be found online that show what can happen when a company owner trusts the network person a little too much, then finds out too late what a mistake that was.

When the person in charge of the network and the information it contains makes it virtually impossible for someone to perform their job functions...well, he's not doing his job. Period.

If your company condones this, then I echo everyone else's sentiment that you might want to start looking elsewhere.

 

[EBGreen]

It sounds like your company is probably privately owned, but if it is not and if it is incorporated in the US, then it sounds like there are gross violations of Sarbanes-Oxley going on.

[red]"... isn't sanity really just a one trick pony anyway?! I mean, all you get is one trick, rational thinking, but when you are good and crazy, oooh, oooh, oooh, the sky is the limit!" - The Tick[/red]

 

[SantaMufasa]

Telaya, you have 10 hours-worth of responses here. What are your reactions to this point to our observations? Since I'm guessing it is about noon where you are, you have had a chance to get those first few cups of coffee and assess our contributions.

Mufasa
(aka Dave of Sandy, Utah, USA)

http://www.dasages.com

Do you use Oracle and live or work in Utah, USA?
Then click here to join Utah Oracle Users Group on Tek-Tips.

 

[mrdenny]

From what you've described I would have to agree with my esteemed colleagues. It's time to find a new position and move on before something does happen and your career is destroyed because of the shortcuts that this person who has no business being in his position is taken. By chance is he related to someone in senior management?

Good luck!

Denny
MCSA (2003) / MCDBA (SQL 2000)

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com

(Not quite so old any more.)

 

[Dollie]

Oh, and to answer your question "Are there any quick ways to identify unethical behavior?"....

Yes. Just remember, if it looks like a duck and sounds like a duck, it's probably a duck.

 

[dkediger]

Telaya - You are certainly not over-reacting as, by your account, the person seems to be acting on his own and as you said, is himself likely overly paranoid about you.

The real question is your response. I get the impression that you are satisfied with your job situation - save for this issue. Being in a management position, you would appear to have a better starting position to "pull rank" and force the issue if you desire. The key is of course documentation. The email incident is a prime example if that can still be saved and shown that you were out of the office. The event logs would be another place to start investigating and saving.

If there is a corporate legal department, or outside adviser, this might be another place to ask some questions. As mentioned previously, there could be SOX (if public) or HIPAA (if medical) implications.

 

[telayla]

I want to thank all of you for the feedback. I honestly didn't want to seem like this paranoid alarmist, but much of what has been going on doesn't seem right or ethical to me.

To answer mufasa's question, I googled information technology ethics and came to this forum.

Some of you indicated that you thought this guy would try to sabotage my career. He has tried, but it didn't go very far, because #1 I don't use the CO PC for ANYTHING other than work. #2 The position I hold as manager of all office services, facilites and administration is a rather unpopular position and a constant target of unsubstantiated complaints, the owners are aware of this and the contributions I make and thus do not listen to what others say. #3 I believe the deletion of my home directory, corruption of the .pst file was an attempt to erase my CYA data. I keep paper files of most CYA stuff though, so if need be I can get it back. Unfortunately this person is my peer and we both report to the CFO.

My company is a privately owned family run company of 200 employees. We have grown rapidly over the last 10 years but the "small business" mindset hasn't changed from the time when they only had 15 employees. Their business philosophy has been to hire good people, pay them well and trust them to do their job without a whole lot of oversite. I myself have very little oversite , which is great if you are self motivated.

I honestly like and respect the owners of my company, they are visionary and have done great things in our community. They are very well respected locally and they really care about the people they have working for them. Coming from a corporate environment, it was refreshing to see this philosophy.

I've been with them for 5 years and have recently been going through an exercise with one of the principals to hire an organizational consultant to help manage the paper and information the consumes our desks and clutters our desktops. I have learned alot about where they are coming from in going through this process. I honestly think it's only a matter of time before they face what has been going on for the last seven years. We've retained a great consultant who is very skilled at assessing situations. So I'm not ready to give up on them yet, although I do have some other options "brewing".

I was really just hoping for some tips on how to catch him in the act. I did start logging activity and have 325 pages to look through for the last two days. Something wierd happened when I tried to open the log, it said I could only open it as a read only because it was being "edited by another user", I opened it as a read only and disconnected my network connection and killed most of the SYSTEM processes running on my desktop and then tried to exit. I was informed that the file was now free but it had deletions. Lots of them. I saved a copy of the changes to a flash drive and printed the original "read only" version. Why would there be deletions in a log file? Am I just being paranoid? Also, I had some questions about DNS servers. There are two IP addresses listed in the network connection details for DNS servers. The DHCP server, #1 DNS server and WINS server all have the same IP address and then there is this other IP address that has a completely different structure. (example: 123.456.789.237, 123.456.789.141, 123.456.789.133, and then 213.645.89.250). What is that telling me? Anything? Is there anything in these log files that I should be looking for? Anyway, thanks for your support. I'll be checking back tomorrow night for your responses.

 

[SF0751]

My job function is Telcom, so I can't address your concerns about the log files, DNS, etc. However, you stated that "We've retained a great consultant who is very skilled at assessing situations." If you can, I would talk to the consultant about SantaMufasa's suggestion of having an outside source assess your company on data and network security.

Sometimes, especially in smaller "family" companies, bad news can be accepted when it comes from a neutral 3rd party.

Susan
"'I wish life was not so short,' he thought. 'Languages take such a time, and so do all the things one wants to know about.'"
- J. R. R. Tolkien, The Lost Road

 

[lionelhill]

Just reading through this, what are you trying to catch him in the act of doing?

Most of the things you've accused him of (in your first e-mail: talking rubbish, messing up your files, failing to keep proper backups for the company) could just be viewed as heavy-handed, rather stupid, and incompetent. Unfortunately there's nothing unethical or illegal about being diabolically bad at the job! The only dubious area seems to me to be reading e-mails in your absence, and even then, if they were not personal and marked personal, it might be difficult to be 100% sure there was no work-related reason to look at them.

He might actually feel rather attacked were he to find that one of his peers is recording a lot of data on his computer usage with a view to pushing him out of his job, even if he is bad enough at it for this to be justified...

Maybe I'm misunderstanding this?

 

[Dollie]

You've come to the perfect place, telayla, for discussions like this. This is one of the few sites on the internet where you can be guaranteed to get intelligent answers to your questions. I've never been disappointed, and I'm quick to recommend it to others. I hope you stick around!

 

[dennisbbb]

Since this is a small company, the things you accused this Admin of, seems to me like it's coming from a disgruntle user, mad about the power of the Admin to take control of your PC, your network files, your email. I see nothing wrong with the Admin's job to safeguard data and protect his network with whatever it takes. After all, he is entrusted to do so from his manager and CEO.

Don't take it personally when you have to think of a few points:

1) You should not have personal email on your work PC
2) The admin as the right to monitor all your actions
3) The admin can backup data and store in a remote location, in his car or in his house's bathroom, because it is HIS ASS when data is lost.

Final note: What I see here is an employee such as you, who gathers company data to CYA, is a complete threat to the company. You are being closely monitored by the Admin under the direction of the CEO. The more you do to CYA, the more fishy you will look. So question what is it that you are doing? The question should really come from the Admin himself "Are there any quick ways to identify unethical behavior of an employee who does a lot to CYA?"

 

[Dollie]

dennisbbb, it was his work e-mail, not personal e-mail, that was tampered with. (He's also specified above that he does not send personal email from work.) While the admin has the right to monitor actions, he can only do that when a policy is in effect that employees could be monitored at any time, and he does not have the right to interfere with normal job duties. The admin, while he doesn't seem to have the best method of backing up data and keeping it offsite, also seems to have a questionable attitude that gives cause for concern. Management should consider a set policy for offsite data, regardless of who's ass it is.

I too keep a CYA folder. It's for all the times when I'm told one thing one week, then told something different the next. It's to cover my keister, and it's for good reason. It's not fishy, it keeps things straight when there are questions as to why a certain action was taken.

There are far too many cases of disgruntled admins doing a great deal of damage to corporate servers. In this case, it's a manager in one area having an issue, and I believe there is just cause for questioning the ethics and the intentions of the admin. When it's one person being singled out by the admin (note that this is not management directing it), I'd be worried too.

 

[dkediger]

But, telayla has specifically related that the admin in question has actually lost data - at the best through ineptitude (who actually deletes an active user's home directory?) - at the worst through maliciousness.

Further, the admin in question proved to have not safeguarded backed up data via his inability to retrieve data from a backup.

Being an admin is not a god-given right to peruse each and every network resource at their whim. The ability to do so, sure, but the right to do so, definitely not.

As far as CYA activities, telayla never said what materials, or where, this information was located. I myself keep detailed information of important conversations in more than one format. Particularly as the admin in question has demonstrated, it may even be vital to the company that there is other forms of the companies data rather than digital bits. Regardless, maintaining separate materials is more a policy decision.

 

[Stella740pl]

lionelhill,
It's an interesting take on the subject. Worth some thorough thinking.

dennisbbb
Now, this sounds disturbing.

Apart from admin's right to monitor someone's actions and possible valid reasons to retrieve a vacationing person's email, does an admin really has the right to store a company's data in his car or in his house's bathroom? Or it is so in small companies.

Does copying someone's home directory and then deleting it from the server count as a backup?

Should the admin be accountable for not making the deleted data available (and the person's not being able to perform his duties) for several days? After all, it's the users who actually do the business, and admin is there to serve them.

it is HIS ASS when data is lost.
But he did lose it! So now what?

 

[jrbarnett]

There are technical reasons why your DNS Servers could be on different subnets to your own LAN (most likely is as a backup if the local one dies). By using a Whois tool such as

http://www.demon.net/external/

you can find out if the IP address is owned by your company's ISP. If its not, then more investigation is required.
For a more technical discussion on the reasons for this, search above for forums about DNS on Tek-Tips as this is not the place to go into it futher.

John