Hi,
I have a dilema. I work in IT and when looking on a co-workers computer for software that I needed, I found a folder with some material in it that freaked me out. I think I know what the right thing to do is, but I don't know how to do it. I found a hidden folder with pictures of employees (female) that were very improper. I'm pretty sure these girls aren't giving pictures to this individual. So, it leads me to suspect that the pictures were somehow taken privately.

How do I approach this? Do I go straight to HR or go to my manager? Or do I set up a meeting with both and just drop the bomb on them?

Please help..

First, the Forum Help area is for question about using this forum. I moved your post to a more appropriate forum.

If the pics were not of current employees, I would be more inclined to not be a snitch. But If I'm getting your drift, these appear to be pictures of current employees surreptitiously taken without the approval or knowledge of those employees.

This is criminal behavior in most places. And if someone finds out, the company could be in trouble. So yes, I would report this to HR.

First, the Forum Help area is for question about using this forum. I moved your post to a more appropriate forum.

If the pics were not of current employees, I would be more inclined to not be a snitch. But If I'm getting your drift, these appear to be pictures of current employees surreptitiously taken without the approval or knowledge of those employees.

This is criminal behavior in most places. And if someone finds out, the company could be in trouble. So yes, I would report this to HR.

Do I go straight to HR or bring in my direct manager as well? I'm afraid that if I bring in others that are not HR, it will get swept under the rug. This puts a lot of IT folks in risk due to this behavior... We're responsible for sensitive data, financials, etc... I'm not afraid of being a snitch, but afraid of losing my job and feeding my family.

Go to whomever you sense is best but do it now, today.
I don't know why bringing in others means it will be swept under the rug. You are the one who has an idea of what your company is like. I don't know of a rule of thumb for involvement.
Bring it up first as a situation without names: 'I found compromising pictures of employees on someone's computer here.'
(There's no chance the pictures were taken with their permission, I take it.)

I would start with your boss. Do as Joy suggested and start with explain that you found the pics in the course of performing your normal duties. Don't mention names at first. When you saw them you became concerned about the company's liability if they should be found as well as the privacy of the subjects. Ask that your boss go with you to HR to report it.

I would start with your boss. Do as Joy suggested and start with explain that you found the pics in the course of performing your normal duties. Don't mention names at first. When you saw them you became concerned about the company's liability if they should be found as well as the privacy of the subjects. Ask that your boss go with you to HR to report it.


So, went and talked to my boss and after the discussion he deleted all the files and then went and talked to HR or at least that's what he said he did. Now, I'm wondering if it is getting swept under the rug like I suspected. I guess the only thing I can do is just follow up with HR to be sure it was really reported accurately. Not wanting anyone to get into trouble, but just want to make sure it doesn't happen again and that it is dealt with properly.

You did what you are responsible for. Its not up to you to follow-up. If you want to CYA, send your boss an e-mail thanking him for helping you with this issue.

This gives you a record that you reported it properly so you are covered. The only other thing I would do is check this person's PC in a month or so, to see if there is a recurrence of new photos.

Going back to HR to check is not a good political move. The HR person will see you as someone who goes around your boss and who doesn't trust him or her. It could put a blot on your future, even if never written into your file.

I suppose this will put a bee in your bonnet, but I would be wondering if this person has another copy of the file at home. Depending on how and where the pictures were taken, I might put my job on the line and tell the people whose pictures you saw. I know no other way to deal with it even if you lose your job (and then maybe sue). In other words, don't the women have a right to know their pictures were taken, and might still be out there?
It might be a police matter if you chose to tell the women. You say they were 'very improper' and truthfully all I can think of is the ladies' room. Care to tell us in general the nature of the pictures, and how many women there were?
Another approach you could take is to meet with the women and swear them to say they didn't find out from you, let them deal with it, and hope that they do keep you out of it. With the boss and the HR person now being at least 2 other people who know, I think you are safe in denying everything. Of course that doesn't mean the company will believe you, but the law has to.

The only way you have liability here is if someone knows you saw the pics and but did nothing. That's why I suggested you document that you reported it to your boss. That covers you.

Personally, I wouldn't have deleted the pics. At least not without documenting that they were there. Depending on what these pics represent, this person may be charged criminally. Your boss may have gotten himself in trouble by destroying evidence of a crime.

I'm inclined to agree with joy about talking to some of the victims. Especially if these pics were taken in some place this person shouldn't be. Its one thing if these are up skirt pics which could have been taken anywhere. Its another if they are hidden cam pics. They may be able to find the cam and they don't have to say it was you that gave them the idea to look for it.

I don't think that telling the women and getting them to swear they won't say who told them is practical. If this develops into something bigger (which it sounds like it certainly should), you will be called upon to tell what you found. Especially if the photos have been deleted you are the only one who can say they were there except that there will be a record somewhere on a server (scott knows much better than I about that aspect).
If it does go further, the ladies will have to give you up at some point and you may become the scapegoat for the company, that you were a party to covering it up. I am not in the job market nowadays, but anyone putting their job in jeopardy for any cause other than their own cause- is foolish.
You don't give enough details about the photos or whether they were from a hidden camera or not. Maybe the ladies posed for them- we are just guessing.

I disagree about giving you up, because you told your boss, and the boss supposedly told HR, so there's a minimum of 2 others who could have leaked it. Others could have overheard too.
She/he could even contact the women anonymously.
One thing that is still tugging at me though is the belief that ' I'm pretty sure these girls aren't giving pictures to this individual.'
These days I am constantly amazed at what women will willingly reveal. So this could all be moot. Unless OP is going to give us some clues about the nature of the pictures.

I don't think that telling the women and getting them to swear they won't say who told them is practical. If this develops into something bigger (which it sounds like it certainly should), you will be called upon to tell what you found. Especially if the photos have been deleted you are the only one who can say they were there except that there will be a record somewhere on a server (scott knows much better than I about that aspect).
If it does go further, the ladies will have to give you up at some point and you may become the scapegoat for the company, that you were a party to covering it up. I am not in the job market nowadays, but anyone putting their job in jeopardy for any cause other than their own cause- is foolish.
You don't give enough details about the photos or whether they were from a hidden camera or not. Maybe the ladies posed for them- we are just guessing.

Well,
I am going to follow up with HR to be sure that what I said to my boss is what was accurately reported. Since I am in IT and have the responsibility for the privacy of my users, it's the right thing to do regardless of whether I lose my job. From my best guess, it looks like the person who is a network admin was able to go into their phones via their PC as a local admin and take these photos off their phone, then store them on his hard drive under a hidden folder. I didn't delete the folder along with the photos, my director did.

I didn't walk down to HR with him when he went and had that discussion, so I don't know what was said. Even though he deleted the evidence, I still have proof that these photos were there and who's computer they were on. Since I feared what has happened, I took precautions to make sure I didn't turn out to be a liar. My goal isn't to get anyone in trouble, but to respect and protect the privacy of my customers, which are our users. If my wife decided to spice up our marriage and take photos of herself for me and they were taken from her phone at work, I'd be pretty upset and would want to know that the company she worked for had taken the necessary steps to be sure this type of behavior doesn't happen again.

Others may disagree and think I'm a snitch, but there still are people out here that have ethics and morals.

Users should feel safe that they aren't being violated. And those that are violating the privacy of others should be called out to be sure that this type of behavior doesn't repeat. It could start small and snow ball into worse and worse behavior. Nip it in the bud and hopefully the behavior will be tamed...

I totally disagree with going to HR over his head.

I don't think you are a snitch, but by going over his head, you are risking your job for naught.

Are these phones company phones or personal ones. Are you sure these are pics that they had on their phones and were not taken by the computer user who's PC you found them on?

If you are going to HR, I would go as someone with an ethical dilemma of right not to have anything stolen off a phone vs caveat emptor about lack of security and privacy by owning a phone and using it this way. Plus the right to know the pics were stolen.
The employee of course should be fired.
You need to know where you stand if he isn't fired, and where you stand regarding telling the women, before you go to HR.

Your second post:
" I'm not afraid of being a snitch, but afraid of losing my job and feeding my family. "
Now:
"... it's the right thing to do regardless of whether I lose my job."

You have given some additional thought to all this, obviously.

Maybe he wanted the photos for blackmail type purposes or intimidation or whatever. Or could there be a legitimate purpose for taking them from their phones- depends on his authority and responsibilities. Do employees know that their phones (company phones I assume) can be accessed in this manner?

If what he did is beyond his authority, and you really feel a duty, and are not worried about your job, talk to HR and tell them you need to know how this was handled for the exact reasons you stated in your previous post (# 12). They could possibly have something in the works because of this incident.
Like monitoring the activities of the ladies and the guy who had the photos, and your talking to any of them could cause HR some problems.

If those ladies knew that their phones could be accessed in that manner, and put those photos on their phones anyhow, they pretty much made their own beds.

As luck would have it, our HR dept is going through its annual Sexual Harassment training. So I put this up to them. Their feeling jived with mine in that as long as you have it covered that you reported it properly through channels, you are good. And that going directly to HR might be putting your boss' job in jeopardy which could affect you.

If you really want to go to HR, do it with the tact that you are just trying to follow-up to find out what action was taken.

(We don't know yet if these were company phones, but I doubt it.)

Your second post:
" I'm not afraid of being a snitch, but afraid of losing my job and feeding my family. "
Now:
"... it's the right thing to do regardless of whether I lose my job."

You have given some additional thought to all this, obviously.

Maybe he wanted the photos for blackmail type purposes or intimidation or whatever. Or could there be a legitimate purpose for taking them from their phones- depends on his authority and responsibilities. Do employees know that their phones (company phones I assume) can be accessed in this manner?

If what he did is beyond his authority, and you really feel a duty, and are not worried about your job, talk to HR and tell them you need to know how this was handled for the exact reasons you stated in your previous post (# 12). They could possibly have something in the works because of this incident.
Like monitoring the activities of the ladies and the guy who had the photos, and your talking to any of them could cause HR some problems.

If those ladies knew that their phones could be accessed in that manner, and put those photos on their phones anyhow, they pretty much made their own beds.


"If those ladies knew that their phones could be accessed in that manner, and put those photos on their phones anyhow, they pretty much made their own beds."

I'm pretty positive that these ladies or anyone that has a cell phone while at work would assume that IT would go in and snoop around their phone while it's docked into their computer.

Would it be safe to assume then that IT at most locations has a right to just look through users phones and take what they want? And if they did that, did the user have it coming because they should have just known that's what happens? I don't think that IT has any right to violate the privacy of an individual's cell phone.
I'm in IT and I take my job very seriously, so if my network admins were sniffing through my phone and took a picture that I had of my wife when I had it plugged into the computer, should I not be upset, because I shouldn't have had that photo of her on my own personal device that I use at work?

Regardless of why he had those photos, whether it was to black mail them or pleasure himself is beside the point that he had them in a hidden folder. That tells me he didn't want them found, but was too stupid and lazy to figure out that we in IT can view hidden folders.

I went through the proper channels by going to my director before I went to HR. If my director is sweeping it under the rug and didn't report it, but told me he did and then deleted the files, why would I be the one at risk of being fired?

When I say I'm not afraid of losing my job, I meant losing my job for doing the right thing. I am afraid of losing my job for doing the wrong thing like hiding unethical behavior.

What kind of screwed up world is this that doing the right thing can get your fired? Sounds like there's a lot of justification for why having those photos in a hidden folder of ladies that are not his wife that are current employees who more than likely don't know that he's got pics of them, is an OK thing to have on his computer. A lot of justification of why invading others privacy rights isn't wrong seems to unethical to me. Maybe I was born in the wrong period of history, but I would think that this is something you should not do...

Well, if private phones, this would be a whole new ballgame, wouldn't it?

Well, if private phones, this would be a whole new ballgame, wouldn't it?

Don't know the answer to that if they are private phones. I would guess that they are, because the company doesn't issue phones out to non-c level employees. These aren't c-level employees, so more than likely these are private phones.

Suppose they are work phones, when does the privacy of an individual stop? What limitations are there on privacy of individuals whether in a public company or a private company?

What if you use company paid internet at home, does IT have the right to log into your home computer and snoop through your computer?

Because you use an ISP, do they have the right to go through your stuff? Your house is being taxed by the city/county/state do they have a right to just bust down your door and take your stuff? Do individuals have rights to privacy? Do individuals have rights?

I want to side with the women, but I think the courts have already decided that there is no expectation of privacy with a cell phone, especially at work.
This type of case has been tested many times because of employer snooping of what goes on on computers at work.
I don't know if this situation is new and different in that presumably private phones were connected to a company computer.

This is separate from the employee who should be fired - but that's not your province.
It's also separate from the right to know of the women. I would tell them.

I want to side with the women, but I think the courts have already decided that there is no expectation of privacy with a cell phone, especially at work.
This type of case has been tested many times because of employer snooping at work.

This is separate from the employee who should be fired - but that's not your province.
It's also separate from the right to know of the women. I would tell them.

"It's also separate from the right to know of the women. I would tell them."

Should I tell them or let HR deal with that, since that is what they are paid to do?

My job is to be sure the company is secure from external threats and internal threats. I identify those threats and move them to whomever makes those hard decisions.

What if I tell HR and they don't tell the women, do I have an obligation to tell the women?

This is why I am doing so much research and asking all these questions. What is my best moral/ethical course of action that is the right thing to do?

Obviously the guy doesn't care about his job or his wife and kids. Otherwise he wouldn't be taking pics of employee and storing them. So, should I be sad for him if he loses his job? What about my boss, should I be sad if he gets fired for not doing the right thing? Would they be sad for me if I was the one doing the bad behavior and they just didn't like me and wanted to get rid of me and now have a reason to?

In reality the only thing that matters is what is the right thing to do. All things will be brought to the light. If I'm doing this out of selfish motive, that'll be brought out as well. I'm no boy scout, but I just put my wife and daughters in those women's shoes and it really makes me upset and want to protect their rights.

What selfish motive of yours?
Your boss isn't going to lose his job.
HR people aren't necessarily trained to handle every ethical dilemma in the workplace, and this is something new under the sun (I think).
You have to make these decisions to some extent and call some of the shots.

I would call a meeting of your boss and HR and tell them that the women have the right to know, that it weighs on your conscience regardless of company policy. The women can demand that the person be dealt with. They aren't going to want to work in the same place as him once they know. If you are stonewalled, then I would tell the women. If you are fired, I would sue.

First, I'm also in IT. My company has a policy about personal cell phone use on the job. If the phone is a company issued phone, then they have no expectation of privacy. Nor should they. If they are using company property in that manner, they are wrong.

That does not excuse this person from snooping on their phones. Unless he is responsible for monitoring cell phone use, then he was, at least, equally at fault. Similarly if these were personal phones. Connecting these phones to the corporate network should be a violation of company policy. But again, that doesn't excuse this person from snooping.

But I like Joy's suggestion. Arrange a meeting with HR and your boss explain that you feel concerned that these women know their private photos were compromised.

And, again as long as you have proof that you follow channels in reporting it, you should be in the clear.

When NSA does their thing, which has been very controversial and in the news recently, they listen to phone calls with the cooperation of the phone companies. The controversy involving Murdock in UK was outright hacking into phones and voice mails, and they could have or maybe did, check out photos stored on those cell phones too.
I am no expert on the legal issues here, but if NSA needs the authority of Federal law (the Patriot Act) just to be able to use phone company equipment to listen to calls, it doesn't sound reasonable that a private company has carte blanche to access all the private data on a cellphone just because it happens to be connected to a company computer at a given moment. I think it is illegal but I don't know how you could even find out, aside from calling the FBI (if U.S.).
BUT, after reading this article, I have no idea.
Can your employer monitor your smartphone? (http://usatoday30.usatoday.com/tech/columnist/kimkomando/story/2012-02-24/work-monitor-smartphone/53221804/1)

Sorry smearcase, but the issue here is ownership. The company owns the equipment, they have a right to control how that equipment is being used. Connecting a non company device to the network could compromise the security of the network. So that gives the company the right to monitor.

But that doesn't give an individual in that company who's job has nothing to do with security to snoop and steal files.

The real problem comes if the people whose photos were stolen try to sue the company. The company lawyer can argue that since they misused corporate property they have no right to sue the company.

But none of that affects the OP and his situation. The employee in question did not have a right to snoop on their phones and definitely did not have a right to copy photos from those phones. By doing so, he compromised the liability of the company.

Scott's take on this, I think, explains their their actions so far. They figured, remove the photos and pretend it never happened.
Raider, if the company has decided to handle it in this manner and if Scott's opinion is correct (I personally think he is right), you will be putting yourself in bad position by bringing it up again. If you talk to HR, and they just tell you it is resolved, you will have no options left except to tell the ladies about it.
And whether the ladies find out about it from you or on their own, the company will assume that you instigated it. For all you know, the perp has been reprimanded.
I want to say--talk to your boss about putting out a memo explaining to employees that they are putting their personal data at risk when they plug their phones into their computers--but if the company has already put this episode behind them, they probably won't be too enthused about doing that either.
You did the right thing already. Quit while you are ahead. You didn't create the laws or the policies. Few of us have never had to hold our nose and just accept what our supervisors have decided to do to handle a particular situation.

'Quit while you are ahead. You didn't create the laws or the policies. Few of us have never had to hold our nose and just accept what our supervisors have decided to do to handle a particular situation.'

It seems clear to me that OP doesn't accept that position, although that's certainly a reasonable one to take when you are supporting not just yourself but also your family.
I am not sure I could work at that company if they didn't fire the person who downloaded the pics. What's he going to get away with next? And again, what if he has the same pics at home, or has put them elsewhere on the net? If I didn't make sure that the women knew about this, I couldn't live with myself. And yes, that's despite the fact that they are naive and foolish.

" If I didn't make sure that the women knew about this, I couldn't live with myself. And yes, that's despite the fact that they are naive and foolish."

I agree that they should know that their photos have been seen. But I don't know how to have it "leaked" to them without taking chances with Raider's career and livelihood. Maybe there are job opportunities for him but we know what companies can do when asked for a reference, etc. Someone once said "Never take the slightest chance at a catastrophic outcome" and we all know the one about "No good deed goes unpunished".
Plus, I have no idea how these ladies might react to learning that Raider saw their photos. That might not give them a warm and fuzzy feeling toward him.
Raider, you have the most knowledge about the details of how your company operates and you certainly know how the data is handled. If you still feel strongly that the "news" has to come out somehow, find a way to have it leak "accidently". I have no idea how you can do that and protect yourself at the same time, but you might. It would be great if the perp himself somehow let the cat out of the bag.

If there is a way for a phone owner to know if files have been downloaded (I would like to think there is, but I don't own a smart phone or even a cell phone - they don't cover my area), the process could be passed around through circuitous means. Or even directly. That way if any of the women want to check, and do see that has happened, they can take steps to find out who did it.

Scott's take on this, I think, explains their their actions so far. They figured, remove the photos and pretend it never happened.
Raider, if the company has decided to handle it in this manner and if Scott's opinion is correct (I personally think he is right), you will be putting yourself in bad position by bringing it up again. If you talk to HR, and they just tell you it is resolved, you will have no options left except to tell the ladies about it.
And whether the ladies find out about it from you or on their own, the company will assume that you instigated it. For all you know, the perp has been reprimanded.
I want to say--talk to your boss about putting out a memo explaining to employees that they are putting their personal data at risk when they plug their phones into their computers--but if the company has already put this episode behind them, they probably won't be too enthused about doing that either.
You did the right thing already. Quit while you are ahead. You didn't create the laws or the policies. Few of us have never had to hold our nose and just accept what our supervisors have decided to do to handle a particular situation.



So, I went and talked to HR about this issue and just came at it from the point of view to update the policy concerning personal devices at work. In the process of the discussion, it was brought up about this particular issue. As I had suspected, the truth was not told and the director tried to sweep it under the rug. HR is glad I came to them and are working on a resolution. The potential consequences of not dealing with it right are the risks being placed on the company by having these individuals who are in charge of the companies policies being the ones doing the bad deeds...

To be continued...

Great. Hope it works out for you, and you get promoted even..
Sounds like at minimum, employees may get some warning about the risks they are taking. And depending on how that warning is worded, the ladies may get a clue, as in Oh, My G!

So, I went and talked to HR about this issue and just came at it from the point of view to update the policy concerning personal devices at work. In the process of the discussion, it was brought up about this particular issue. As I had suspected, the truth was not told and the director tried to sweep it under the rug. HR is glad I came to them and are working on a resolution. The potential consequences of not dealing with it right are the risks being placed on the company by having these individuals who are in charge of the companies policies being the ones doing the bad deeds...

To be continued...

Congrats. I think that was a perfect way to handle it.

Keep us posted please.

(Keeping post active - fell off my list)