Slashdot Mirror
System Adminstration and Corporate Ethics?
Not-a-BOFH asks: "About seven years ago while SysAdmin'ing for a (then) small software company, I was approached by the CEO regarding a technical issue. He explained to me that he got a bit hot headed at another employee and sent said person an email that he now wished he hadn't sent. His request to me was to dig through this person's email and delete it before he came in that morning. As the SysAdmin, this was certainly possible for me to do, but I've always tried to remain ethical when having such access to sensitive documents. In the case of email, I explained to the CEO that to me it was like tampering with the U.S. Mail, and I wasn't comfortable doing it. Long story short, my boss had no issue with it, and wound up doing it anyway. Looking back now, I'm not really all that surprised that that decision of mine led to my getting fired, but I've always wondered how many other people have had similar situations happen to them, where personal ethics and CEO heavyhanding came into play, and their job security suffered from the clash."
What's ethical about making two people feel really bad? What's so wrong about deleting an offensive message when the sender didn't even want the recipient to see it? I see that as a favor. To say that someone's emotional health is less important than deleting a single email from their inbox is curious, to say the least.
Ceci n'est pas un post
Get off your high horse. It's corporate mail, it's owned by the corporation. You should have just deleted it. Gee someone wrote something they later regreted, there's nothing wrong with deleting the mail in that case.
Most companies have their own internal paper mail system. It's not a lot like the U.S. mail. Internal e-mail seems the same way. If the CEO had wanted to cancel internal delivery of a paper memo, it wouldn't be a problem.
But non-internal e-mail is a different thing altogether. Now, the fact that it is technically legal for companies to eavesdrop on employee email, but not on employee telephone conversations does seem to be very wrong. Email should have some expectation of privacy--with the limitation that writing or reading personal email during company time is as wrong as personal telephone calls.
This sort of thing happens all the time: sysadmins are in an interesting position where they feel ethical responsibilities to their network and the privacy of their users because they associate this with their jobs.
Sadly, I think that is leftover from the collegiate atmosphere where the sysadmin culture evolved--corporations have no such rules or regard for privacy. The fact that most corporations track every metric and move their employees make.
If you are allowed to have the illusion of freedom and fairness as a sysadmin, enjoy it but make no mistake: it is an illusion, and if it interferes with real work, higher-ups or the bottom line these "ethics" are going to take a walk.
Businesses only respect ethics that are enforced by government agency and carry real penalties--manipulating internal email is not one of these.
I have run into simular cases. I am a BOFH, but I have perticular feelings regarding email. Most understanding bosses will understand, and know that they are going to have to write their wrong. I have always held a firm stance regarding service and email. Email has always been something that I don't fuck with. By don't fuck with, I mean, I run mail servers, but I don't go reading people email. Now, thats under normal cases, but I have always been willing to crack open their mailboxes at the first hint of something bad. I respect people's mail boxes, but if they cross the line, the line of only doing good, and goto bad, their mailbox is mine. The same with former employees. I encourage people to clean their mailboxes before leaving a company, I know I do before negotiations, I got fired for doing that a few weeks ago. Well, back to the subject. Once an employee has left the company, I have no problem with cracking open their mailbox, if they had something personal in there, thats their mistake.
These sorts of things are a very fine line. The best thing is to establish your view of things up front when getting the job, but emphasize that if the person is misusing, cheating, lieing, etc. i.e. doing anything bad, their mail is open for review.
I have found that letting your coworkers know your stance on these things can be beneficial to the IT BOFH or BAFH. They will feel more comfortable with you if they are honest. Remember, IT fixes the problems before they are found, past that, IT is damage control.
-LW looking for a job. lw@lwolenczak.net
You should have used MS Outlook, it is the most ethical email system since it has the "Recall" feature. The CEO could have recalled the email without presenting anyone with any ethical dilemas
I don't really understand the full scope of your "ethical dilemma":
1) It's NOT the US Postal Service - it is company email to be used for company business.
2) Most corporate email servers (Exchange, Notes) have a built-in functionality to remove a damaging or sensitive message (and it's reasonably easy, since they store the message ONCE in a database and link it to the multiple recipients). A friend who works at a big law firm recently had this happen - a secretary accidentally released a sensitive personnel memo to the entire firm, and the IT personnel activated this feature to quickly remove it (but not before a bunch of people printed it, forwarded it to their hotmail accounts, etc.).
I used to work for a fairly large company - they managed about $3 billion in investments. The IT department was being run by an idiot. One of the IT managers who left becuase the IT department was being run into the ground sent one of the directors an email revealing what was going on in IT. The director was on holidays for a week, but he never got the email becuase the head of IT got one of the sysadmins to delete the mail from his inbox. I quit the company after 4 months after being dressed down for bringing up serious problems in their trading systems.
Reliable, Great Value Hosting: $7.95/mo 2.4G/120G
Firstly, the assertion that deleting the email was "like tampering with the US Mail" is a bit inaccurate. Corporate email is a corporate asset, and many companies try to make that very clear to their employees (with disclaimers, usage agreements, and the like). The CEO asking you to remove an email is certainly within the bounds of the company's rights.
:)
Is it ethical? Strictly, one would like someone to own up to their own mistakes, so, no. However, if it was an envelope sitting in the mailroom, waiting to be delivered, most people would agree it would be ethical to retrieve the envelope. Even if it had made it to the employee's mailroom pigenhole, I think most would allow the sender to ethically remove it. This situation is just an electronic extension of inter-office mail.
I'd say that people have the ethical right to recall something they've sent out under certain circumstances, and to keep the almost-recipient of their mistaken wrath from receiving the message, especially if they came to their senses right after dropping the message off -- have you ever called someone to chew them out and then hung up right after they picked up the phone? I'd argue that this could be interpreted, ethically, like that.
In fact, some mail systems (Exchange, for example) even let the users themselves recall an email that's been sent out. If the recipient has not yet read it, they never know it was recalled. If they have read it, then I'm not sure what happens -- I think if it's still in their inbox, it gets deleted (and I'm not sure if a placeholder saying "message recalled" is created or not). If it's been copied to another mailbox (particularly to a local folder), it might be missed. I know I've made copies of sensitive messages I've received, on the off chance the sender might try to recall them.
Beyond the ethics, though, is the scary thought that voicing your unease hurt you.
Did this really lead to your being fired? I'd like to think the CEO admired you for standing up to what you believed, and also for ending up helping him out in spite of that, "for the good of the company." On the other hand, maybe he was just a real jerk. (did the firing happen soon after, or years later?)
When I was a sysadmin, I'd been asked to do a couple things that I wasn't entirely comfortable with, ethically, but they were all certainly legally permissable (their network, after all), and my job wasn't to be morals cop, it was to be a good sysadmin. In these cases, I had a good enough relationship with the person making the request that I could voice my concerns, and know that he'd understand them and appreciate my opinion, without fear of recrimination. And, again, I think my ability to show that I had at least considered the ethical implications of what I had been asked to do, coupled with the fact that I was still a good employee and did what was best for the company, strenthened the trust between me and that particular upper-level-manager. So it was a win-win.
It depends on the boss, though, that's for sure.
So, I'd say that it was right for you to raise a concern, in principle, though my *personal* opinion is that you were perhaps oversensitive in this instance. It was also right for you to do what you were told (it is your job, after all). If it really lead to your being fired, then you're better off working for someone who can appreciate your moral compass.
(Note that I'm ignoring cases where the ethical issues are more severe and clear-cut, like a CEO asking someone to do something that, while legal and within his rights, might end up hurting someone else's career or something. Then it becomes MUCH more grey).
Sorry you said corporate so that means that they probably used Microsoft products. (I know I hate the thought too) But in Outlook you can recall the meesage that you sent. And as long as the receiver has not read the message it will delete the mail message and send the sender a note telling them that the recall either succeeded or failed.
...
To do this:
1. Find the message in the sent items folder.
2. open it
3. Go to tools
4. Click on Recall this message.
5. Follow the mini wizard and the it will try to recall the message.
And then optional steps are
6. ???
7. Profit
I am still working on steps 6 and 7 I can never get them to work.
I have been in a similar position before, though for me it was spamming for a company. I was working for this designer lighting manufacturer as an admin and we were definitely feeling some of the effects of the economy at the time (right after the .com bust). So the CEO came to me with the option of gaining customers through spamming. I have never liked spam, and like most right minded geeks, find its existance annoying and unnessessary. However, I am a college student and jobs like this do not come along all the time (decent pay, good coworkers, very flexible), so I went along with it and did a round of spamming. I did try to convince the boss of other methods, but the fact of the matter is the he had his mind set on this. I figured its either my job, or a lot of pissed off/annoyed people who I will never see. I shot out 27,000 spams, not that much next to some, but 27,000 nonetheless. We got a lot of hate mail the next day, it was actually rather amusing in some respects since the rants were often JeffK worthy. So I kept my job, and 27,000 people got spammed. Those 27,000 people have now completely forgotten about that spam, and I have not forgotten about keeping my job. In short, its a dog-eat-dog world, and sometimes you gotta bite the bullet to stay afloat. If you won't do it, some other monkey with a lot less scruples than you will do it, and probably even worst.
"What can a thoughtful man hope for mankind on Earth, given the experience of the past million years? Nothing." -Bokonon
How is this an ethical issue?
You were asked by the CEO to delete a message that the CEO himself sent. If the CEO asked you to delete messages from *someone else*, or to otherwise mess with other communications, that would certainly be an ethical issue, but that is not the case.
The corporate email system is not the US postal service, and deleting an email is not against the law (we aren't talking about tampering with evidence here). In fact, as a SysAdmin it certainly is within your capabilities and duties.
It seems like you were trying to teach the CEO a lesson (don't send hot-headed emails) by refusing his request. Instead, you were the one who was taught a lesson by being fired. Judging by the fact you are Asking Slashdot, it is one you probably haven't yet learned.
Beauty is in the eye of the beerholder.
We make all of our users aware that the corp. systems are owned for the company's business; We don't enforce any "No Personal Business" clauses, but also make it known that there is *no* expectation of privacy on *any* of our systems ...
We even log every message coming and going (the whole message, attachments and all), and I haven't one ethical qualm about it. I would, though, if the users were allowed to assume that "their" email was private.
You want privacy at work? Use Hotmail, etc. or an offsite POP3/IMAP with ssl support. Don't expect me to provide it for you; that is not my job.
Let me break it down to you:
Your boss asked for something.
You said no.
He fired you.
Read the above 5 time real fast, let it sink in nice and deep. Don't make the same mistake twice.
It is all fine and dandy that you want to live up to your ideals. It is your ideals that are flawed. Company server, company time, company resources. You were asked to do something, you did not do it. Fix your ethical issue by realizing that your trying to flex your own muscles.
Once you realize that your just a high tech janitor the better off you will be. Live and learn, but for christ sakes don't think you have any control because you don't. You want control, start you own company and push your ethics out that way.
Neck_of_the_Woods
#/usr/local/surf/glassy/overhead
At most companies (at least all the ones I've worked for: for profit, not for profit, government, etc) Email is the property on the company. That means that a company executive has every right to go and read/change/delete a person's email.
While you may not think it's ethical, it's usually spelled out in the company handbook of some kind. Ours states that computer, email, and phones are property of the company and should be used only for business use. While no one is going to fire me for checking out CNN, we were able to fire some people a few years back for trading some pretty nasty porn through company email.
Two additional points: our current corporate email system (GroupWise) allows a user to retract an email they've sent as long as the recipient has not read it. That gets the admin and his morals off the hook.
The other is that big boss is lucky he doesn't work is a different industry. A certain government-type place I worked at once upon a time has an obligation to keep all correspondance for a very long time, so there is a system that all email goes through -- be it inbound, outbound, or inter-postoffice -- that stores the message in a database for full text searches. If someone were to nuke that, they're next assignment would be turning big rocks into little rocks.
"All I ever wanted was to see Larry Wall give Bill Gates a Perl necklace."
http://www.eisenschmidt.org/jweisen
6. Tell the boss you "programmed" this feature in yourself, and you deserve a raise.
In my years as a sys admin there have been a number of situations where I've prevented a user from reading mail that has been delivered. Two spring to mind immediately. In one case, both a man and his son worked for the same company. The man and his wife were killed in a car accident. This information came out at work before the son could be told. I was instructed to monitor all the son's incoming mail and remove any condolence messages until the son could be found (I think he was traveling) and told about his parents. I could have more easily blocked all incoming mail, but the user would surely have noticed and called the Help Desk about it. So I archived the sympathy messages until he had received the news in person, at which time I returned them to his spool.
The other time someone accidently mailed a bunch of salary information to a large distribution. Thank heaven for single copy message store! I was able to delete it from everywhere fairly quickly. The guys who managed the file servers had a harder job, as they were required to search and destroy any attachments that had already been downloaded and saved.
Since these events one of my qualifications for a mail server is how easily a rogue mail can be excised from the message store.
Basically, I feel like this is one of those things that is part of your job. To say it's unethical is just silly. If the CEO had shoved an envelope under the door of the person's office, and you had had the key to the door, would you have refused to open it?
On the other hand, I totally understand leading users to *believe* that recalling sent messages is impossible. You don't want them to get into the habit of using you as a safety net! When push comes to shove, however, you do your job. Delete the mail and keep your mouth shut.
That said, assuming you were in otherwise good standing they should not have fired you for this. I imagine you could have had a pretty good unlawful termination suit had you been so inclined.
Sarah
I'd delete it. You don't have to read the rest of the guy's mail to do so, and so are violating no one's privacy. The mail system (pick any) doesn't have some sort of unimpugnable integrity. This is pretty much the equivalent of picking a sealed envelope with a pink slip in it up off of someone's desk, before they come into work in the morning, but after HR says they made a mistake.
I'd also tell the boss that in order to fulfill his request, I need a quick look at the original in his sent mail. I would then confirm that there were no BCCs, for obvious reasons.
Otherwise, barring some sort of registered email scheme, you aren't violating ethics or rules of evidence.
Certainly this isn't behavior to encourage in the boss, any more than building a mailserver and recovering a message store in order to recover an accidentally deleted message is. But if the dumb mistake isn't a habit, help both parties out.
As admins, we have to be able _not_ to see things that we shouldn't, and occasionally even to forget that we saw things. When you're helping a user troubleshoot their email, you'll see more about their personal lives than you would ever want to know. Those aren't things I speak about to no-one.
Don't tell me your password!
Assembly is the reverse of disassembly.
This phrase is your friend. I've used it to put off bosses who've asked for things that seemed dubious, like tracking web surfing habits of individuals from our proxy logs.
;)
Bottom line is if you say "I won't", the boss might fire you but, if you say "I can't, because..."[1] - and can be convincing[2] - you can get away with not doing unethical things.
-Baz
[1] eg 'editing the mail spool by hand would invalidate the CRC's on the mail files, and might bring the server down. I could try it, but we could lose everybody's email back to the last backup - its a big risk'
[2] warning - dont try this crap on a CEO who is also a techie
The SAGE Code of Ethics seems useful for this situation.
Canon 2, "A system administrator shall not unnecessarily infringe upon the rights of users", seems to apply to this particular case. The relevent portion is:
"System administrators will not exercise their special powers to access any private information other than when necessary to their role as system managers, and then only to the degree necessary to perform that role, while remaining within established site policies. Regardless of how it was obtained, system administrators will maintain the confidentiality of all private information."
I read that to mean that if there is a site policy regardign email, the ethical thing to do is to follow the policy. Failing the existence of a policy, the ethical thing to do is to not infringe on the rights of the users.
"The purpose of argument is to change the nature of truth." -- Bene Gesserit Precept
One difference between you, dschuetz, and the original poster is the quality of your writing. Simply put, and no offense intended to the original poster, your writing is better than his. If (please note the conditional) writing styles can be used as indicators of overall communication skills, then I am tempted to suggest that the original poster was not able to articulate to his boss his concerns in a way that would not cause offense.
On the other hand, I also think the original poster made a mountain out of a molehill. As others have stated, corporate email is an entirely corporate-owned resource. In addition, the request to withdraw occurred before receipt, not after. So the intended recipient does not own the message, the corporation does. And if the CEO decides that the company's interests are best served by deleting that email prior to receipt, then that is indeed what the original poster should have done.
On top of that, what right, legal or moral, does the intended recipient have to an email message that has not even been received? I just don't even comprehend the moral issue, for which I apologize to the original poster.
On the face of it, the CEO intended to send the email, and then changed his intention prior to receipt. The original poster had the power to enable the overriding intention, but refused, while his immediate superior acceded to the request.
I think that no moral imperative to deliver a piece of email exists. I just don't see that there is some moral good attached to delivering mail, e- or snail-. I see a lot of utility inherent in communication, but no moral requirement for communication in general. I think that some moral good may be facilitated or hindered by communication, but now we are speaking in terms of particular instances, rather than in general terms. So, we must evaluate this particular instance.
In this particular case, the original poster has not specified that there was something in the email message that would have caused or facilitated something morally good. In fact, he specified that the email message was a hasty flame that the CEO, on further reflection, decided to withdraw -- in other words, the message would have hurt the recipient, without justification, thus being a moral wrong.
So, with no a priori moral reason to deliver email, and with the particular message's contents being morally wrong, I conclude that the original poster was, in fact, morally wrong to have refused to delete the email.
Please forgive the descent into philosophy, but that is my background, and I couldn't resist the temptation...
I've been in many of these "CEO wants a bad thing" scenarios, and I have come to belive the best solutions is this:
Clearly explain why you think this is the wrong thing to do. Then do it anyway. There will always be another lackey to do their will. Once you've done you best to persuade them, the ball is back in their court, ethically speaking. And you won't get fired, although they will start thinking of you as "difficult," a fate I have long since accepted.
The all-important last step is to start looking for a job where you are valued and respected as a free-willed entity. If they'll fire you for having scruples, they are not worth the sweat of your brow.
To make it look like it's going to be an all-night job that will take hours of your time and might screw up the mail server.
"I'll start on it now boss, but it's going to take several hours. I don't know what something like this might do to the mail server, it's not really designed to do this."
That alone should scare most people away from it.
If it doesn't, generate some random errors, turn off a few mailboxes and blame it on the 'manual deletion of messages outside of the normal messaging interface'.
Of course, you have to fix it quickly, and then you'll look even better.
At our firm we let new employees sign a letter before they start working that we archive ALL EMails they send. We treat Emails as business correspondence. We file letters that we send in an official capacity, EMails are the same.
Our sendmail server sends all mails going out (and coming in) to a central mailbox.
That said, we also provide peole with TWO addresses, one is private and is never tampered with, the other one is public and is put inthe files. They know this, and can decide which one to use to send the mails. We are also not anal retentive about sending personal mails and phone calls from work. I mean, they are people, not machines.
However, sending business mails under your personal account is frowned upon.
This systems works well and we never had any problems with it. Also, access to the central mail file is the same as access to business files in that only some managers may look into it. But generally business EMails are treated like any other busniess correspondence: filed as it should be.
This policy has helped us a lot when people leave, but they knew beforehand that their mailboxes are open.
The dangers of excessive individualism are nothing compared to the oppressiveness of excessive collectivism
At first glance I thought to myself, "Wow, you got screwed." But then I got to thinking: The courts have seen to it (in the U.S. anyway, just ask M$) that email is not as private as some want to think. When was the last time we got outraged by someone reporting that their employer instituted all sorts of no-privacy policies with regard to corporate email? Not recently, because we've all come to accept that when playing on someone else's network, we have to play by their rules. And more often than not, their rules mean our email is not inviolate, and that sys admins probably can read it anytime they want. From there, it's only a very short stretch to what you described. The only leg you would have had to stand on would be if your former employer had a written policy ensuring the privacy of electronic communications, and I doubt they did.
I am not absolutely sure I agree with you. Obviously, it would be totally unethical to delete a third parties email. But you were being asked to delete an email by its originator - someone who could be regarded as its owner. Obviously (IMO), once the recipient has read and taken in the content of that email, s/he has the right to keep it, if only to produce it as evidence of harrassment. But while they are still unaware of the emails existence, I think that ownership of the email remains with the author. So, if the author is requesting that you delete it and you can do so without (as other people have pointed out) infringing the recipients privacy, it seems to me quite ethical to do so.
As for the "it'll teach him to think before he posts" - I think that lesson has been learned, as far as it can be. You don't thunk an executive *likes* having to plead with a sysadm for a favour?
Consciousness is an illusion caused by an excess of self consciousness.
This establishes a few things. First, it gives them food for thought about the consequences of what they're wanting you to do. Second, it establishes WHAT they're wanting you to do (and let's them know--I'm documenting the fact you're wanting me to do this fucked up thing). And third, it gives you something to fall back on in case they want to fire you for not doing this. By making them look bad for firing you, you have some sort of leverage for court, severance, etc.
I know this doesn't solve the entire dilemna, but it at least protects you in case the shit really hits the fan later.
Remember: you're the piss ant. People in power can (and WILL) fuck you up. Take a few precautions and CYA!