VIC Accused of Sending Sensitive Information to Faculty - What to Do?

[Issac Sharon]

Hi,

I work at a small educational institute. When I go to my work computer to search for a file for my class, I constantly find confidential information, particularly faculty members' course evaluation forms. That has been happening in the last 3 years. I tried to delete them but I could not.

One time, I must have pushed print wrongly. Anyway, someone anonymously has been sending these evaluation forms via mail to the different faculty members in the institute. Now the IT dept. is saying that it is me because they track the print outs.

The institute sent me a letter saying that they sent a letter to the police to investigate and they might conduct inquires. I don't understand. Is it my faulty or their faulty to leave sensitive information on my computer? Secondly, the letters sent to different colleagues do not bear my name or my signature. Moreover, some of them even have different signatures that are not mine.

Lastly, why is confidential information (course evaluations, emails, financial statements) left on my computer then they accuse me of sending these letters because of the print outs coming from my computer.

I don’t know about the law but if I were the police, the first thing to ask is - how did anyone get hold of this confidential information (i.e., course evaluations). Am I right? Also, if the police come and ask me, should I submit my fingerprints? Is it a crime? I don’t know.

Appreciate your assistance

 

[Lance]

Hi Issac,

It sounds like a scare tactic to root out the culprit. If you have done nothing wrong I wouldn't stress too much. Unless the course evaluations are somehow linked to embezzlement of a significant some of money or other major crime I'm not sure the police would bother looking at it. Don't stress. Most computer systems can identify who sent what as long as they have adequate security and people maintain personal security around their login details.

Even if someone used your computer to send these documents to other or printers it should identify who logged in and when. The other point to note is that if they had something on you they would have addressed the issue with you, at the moment it sounds like they are fishing for an admission of guilt. Let us know if they threaten you or charge you with something, then someone on here might be able to help.

And I wouldn't worry about fingerprints they should already have the culprits digital fingerprints.

 

[Issac Sharon]

First of all, thanks Lance for your prompt reply. Truly appreciated.

Just to clarify few things: Certainly these evaluations are not linked to embezzlement or any crime of any sorts. I think what occurred was that about 9 months ago, I tired to locate a file on my folder and these evaluations forms popped up again.

I might have printed them out with my other ppt stuff and I picked up my ppt. print outs and forgot the rest of the evaluations, then someone picked them up. Before the Dean sent me this email about the police letter (I copied and pasted the exact email below), she asked me for a meeting and I went there and she showed me a few sent letters and asked me "do you know anything about these?"

I told her no and what all I know is that some colleagues have said that they have been sent students' evaluation forms in the mail and one of my colleague showed me the letter a long time ago."

Then she asked "did you give your passwords to someone else?"

I said "no."

She asked the last question: "Did you find any irregularity on your computer".

I said "Yes, when I try to locate my own files, confidential info. like personal CV's popped up and I tried to delete them but I could not". That was the whole meeting. Then she sent me this exact email about 2 weeks later:

"Dear Issac,This is to inform you that we have sent a letter to the Police about the case of the mysterious letters. They may come to conduct inquiries with people they think relevant."

My v. important question is:

Why are confidential information like teachers' course evaluations, CVs, etc. on my computer? Any college or uni. says "Document Confidentiality: Evaluation documents and materials prepared and gathered are strictly treated as confidential and limited to authorized persons such as the supervisor, the faculty member being evaluated, the Dean, and the Vice Chancellor."

Why they are on my private space from the start and till this moment? Till now, the bloody IT has not fixed the problem and still I get some personal stuff.

Just a week ago, I was looking for a personal file and I got a colleague's personal email exempting a student from some courses. Moreover, even if I print them out, that does not mean I sent them via mail, especially since they don't bear my signatures and the handwritten stuff on them are not my handwriting.

And after this incident I emailed the dean with attachments of private stuff I found on my computer and she replied with: "Thanks, we will have IT look into it".

I totally agree with you on the following:

1. "It sounds like a scare tactic to root out the culprit"

2. "They are fishing for an admission of guilt"

3. "I'm not sure the police would bother looking at it". One of my friends even laughed and said the first thing the police would ask is "how did he manage to get these forms. They are supposed to be confidential."

4. 2 of my friends told me "the police will never ever ask you for fingerprints unless it is a crime. These are students' evaluation forms that were supposed to be confidential and they were left on your private space."

Many thanks Lance for your time. Makes me feel a bit better.

 

[kimsland]

You may have left something out?

Printing forms you have access to, to your own printer in your staff room? Is not breaking privacy/confidentiality laws. Did you email them out of the office to another business or home? Did you print them out with the intention to give to others who do not have that access?

If not, then unless you work for ASIO or the ATO or other such office, then this 'legal' issue is ridiculous and any police questioning you would instantly understand this.

By the way your ignorance defense is not actually a defense. But accidental printing and asking to remove access to these 'confidential files' is obviously the end result of this matter.

Unless you used them to better your (or others) position to gain advantage or money. OR unless you sent them outside to another business, then zero issue in my view. If the police come in I'd be approaching your employer for harassment charges

 

[Issac Sharon]

Many thank Kim. Just a few comments on what you mentioned:

-"Printing forms you have access to, to your own printer in your staff room? Is not breaking privacy/confidentiality laws." I agree. But how about the institute. By leaving these confidential doc. on my computer did not they break the privacy/confidentiality laws. Especially, if there is a policy stipulates that "Evaluation documents and materials prepared and gathered are strictly treated as confidential and limited to authorized persons such as the supervisor, the faculty member being evaluated, the Dean, and the Vice Chancellor."

I am not a supervisor, group leader dean or Vice Chancellor, so why they are in my private space?

-"Did you print them out with the intention to give to others who do not have that access?" Funny, when I asked my colleague to insert some terms in his Search Box on his computer he found the same doc. I'd found . so I assume that the IT's dept is messed up.

I think the only problem is that these teachers' evaluation forms were printed out from my own computer and were sent back to different faculty members. That's why the dean is upset. And again Kim, why from the start leaving these forms on different colleagues' computers?! Besides, why did not the institute take actions against admin. & IT's dept who are supposed to keep these forms confidential?!

During the meeting with the Dean she never mentioned that these forms are supposed to be confidential under the institute's private policy.

-"If the police come in I'd be approaching your employer for harassment charges " Actually, that's what I thought accusing employer of false accusations and get a good compensation for that i even laughed inside when they talk about fingerprints. as Lance said it is all scary tactic for for an admission of guilt. Appreciated your taking the time to reply. have a good one

 

[kimsland]

did not they break the privacy/confidentiality laws.

Being an IT Administrator myself (as luck would have it), are you suggesting that whilst the IT department continue their normal duties of keeping everything up and running and secure, that at any stage they would be blamed by 'Management' (certainly not you) for their role in continuously bettering security measures?

You do know that if anyone truly wanted to hack the local company down the road, it's not like hacking Google Servers possibly worth a billion each! Security is constantly being updated, no IT guy left the doors open, they were just bettering a system that was even worse last year

when I asked my colleague to insert some terms in his Search Box on his computer he found the same doc. I'd found . so I assume that the IT's dept is messed up. I think the only problem is that these teachers' evaluation forms were printed out from my own computer and were sent back to different faculty members. That's why the dean is upset. And again Kim, why from the start leaving these forms on different colleagues' computers??? !!!! Besides, why did not the institute take actions against admin. & IT's dept who are supposed to keep these forms confidential???? !!!!

Obviously answered above. But if you have confirmed a different User also has access then there goes anyone scapegoating you as the culprit. If anything you are helping Management secure their files. You know some companies actually pay people to uncover insecurities like what you did, you should ask for a bonus.[/QUOTE]

i even laughed inside when they talk about fingerprints. as Lance said it is all scary tactic for for an admission of guilt.

As a heads up, no one can fingerprint you without your consent. Oh, unless of course you are being charged with the likelihood of conviction. I understand anyone under say 30 years old does not comprehend privacy with their 24hr monitoring they had by their parents when growing up.

But in reality privacy still exists, so far I have not been fingerprinted through a lifetime of tomfoolery, misbehaviour, adventurous activities, I hope you and even your children don't ever consent to such an invasion of privacy. Maybe they could place an anklet on you to trace your steps to and from the printer

To me this whole thing is outrageous. And your business walks on a fine line to keep this up, even if it all comes out years from now. They should drop it immediately or be in the same boat of those labelled incompetent IT staff (there)

 

[Issac Sharon]

Many thanks. My wife when she heard about it said the same: "To me, this whole thing is F outrageous. Rhey just want to cover their own mistake of their incompetent IT staff and people asking them who managed to get these forms".

Take care.

 

[Issac Sharon]

Another thing Kimsland I really did not like was that when I went to the Dean Office she asked me for my consent to remotely get access to my computer (as we are in different building). She called the IT guy and i entered my password there.

The thing I really hate was that the IT guy or admin. guy played with files and entered some of the things from the forms and voila, they came up in the search box. First he should not have done that without my consent. Second, which is F very funny, was that it shows them how their IT is messed up by leaving these confidential evaluation forms on my system.

Anyway, it is all BS - don't want to start a fight since I need my job at this stage but may be later when I decide to leave for another job. I will raise this issue from different perspectives.

Thanks

 

[kimsland]

First he should not have done that without my consent. (in regards to Remote Assistance)

Well he had access and you consented and you had to consent to confirm this vulnerability in some network path. Actually if you want my opinion, it's likely that a previous IT guy gave you Admin Rights once (to install an application or something) and forgot to remove the access privileges! But its anyone's guess.

You are right in what you say about holding this trump card for the future. If there some harassment that ever comes up (lets say a lot more personal) this experience will only authenticate it more. Obviously the business is a bit careless in more ways than one, but that's just an assumption based on your evidence submissions provided of the matter

Since we all tend to spend a lot more time at work than with our own family (especially if you remove sleep time as not family time either), then I wouldn't want you holding a long term grudge waiting for the day they slip up (again) in future!

According to psychology this may make you go mad eventually and actually cause damage yourself (but this time for real) I might be exaggerating a bit, but those people who go crazy at work must have started somewhere. I therefore suggest you laugh this off as nonsense

 

[Issac Sharon]

Thanks for the last comments. Makes sense