Slashdot Mirror


Alabama IT Whistleblower Fired For Spyware

chalker writes "Vernon Blake, an IT sysadmin for the Alabama Department Of Transportation, wanted to get evidence that his boss spent the majority of his time playing solitaire on his computer. Since emails to higher up supervisors were ignored, he installed Win-Spy, which grabbed screenshots several times per day over a period of 7 months. 70% of the resulting screenshots showed an active game of solitaire, and another 20% showed his boss checking the stock market. When he reported this to superiors, he was fired, even though he had 21 years of service in the position. His boss got a reprimand to 'stop playing games'. He is appealing his termination in court since he claims it was part of his job description to 'confirm and document' computer misuse for ALDOT. His complete story is here."

64 of 751 comments (clear)

  1. Everyone knows by Anonymous Coward · · Score: 5, Insightful

    Employers spy on employees, not the other way around!

    1. Re:Everyone knows by Anonymous Coward · · Score: 5, Funny

      What's this URL for?
      http://www.dot.state.al.us/Bureau/Right_of_W ay/Con tacts/employeelist.htm

      Oh look, I do believe it has George Dobb's phone number on it. :-) That's 334-242-6188

      Slashdot away!

      Suggested voicemail message: "We are watching you. Stop playing games on your computer and get back to work."

    2. Re:Everyone knows by Anonymous Coward · · Score: 5, Insightful

      I would imagine there's a bit more history here between the two individuals than what's being presented in the story.

      The sysadmin's decision to "spy" on his boss was a poor one, regardless of the scenario. Whatever the bosses story you have to ask yourself "Exactly what was the sysadmin attempting to accomplish?" If his boss was such a poor performer, his failures would have made themselves evident over time.

      No one here knows whether or not he deserved to lose his job.

      Contrary to popular slashdot opinion, I would be amazed if this guy won his lawsuit. It would just be too dangerous a precedent to set.

    3. Re:Everyone knows by Abalamahalamatandra · · Score: 4, Funny

      "If his boss was such a poor performer, his failures would have made themselves evident over time."

      You've never worked in government, have you?

    4. Re:Everyone knows by AuMatar · · Score: 4, Interesting

      Or the business world. Most of the people in managerial positions don't know what thtey're doing, they got their by luck and kissing the right ass.

      --
      I still have more fans than freaks. WTF is wrong with you people?
    5. Re:Everyone knows by kzinti · · Score: 4, Informative

      It's also got some good e-mail addresses:

      dobbsg@dot.state.al.us - George Dobbs, the Solitaire King

      bowlinp@dot.state.al.us - Paul Bowlin, the head of the ROW Bureau, who thinks George's work ethic is above reproach.

      aldotinfo@dot.state.al.us - E-mail address for ALDOT, apparently the only published address through which ALDOT director Joe McInnes (who signed the termination letter) can be reached.

      governorbobriley@governor.state.al.us - "In Birmingham, they love the gov'nor - Hoo Hoo..."

      Drop these folks a line, let 'em know what you think. "Now we all did what we could do..."

    6. Re:Everyone knows by jayp00001 · · Score: 5, Insightful

      "If his boss was such a poor performer, his failures would have made themselves evident over time."

      Ahh the optimism of inexperience. Soon to be crushed by the dismal intrusion of reality.

    7. Re:Everyone knows by cmallinson · · Score: 4, Insightful
      No one here knows whether or not he deserved to lose his job.

      Exactly. It seems that the sysadmin has made the assumption that a person needs to be actively using a computer to be "working". BS. Maybe this guy plays a game of solitaire in the morning while listening to his voicemail, and then goes to a meeting for an hour, pours over some documents, or brainstorms on paper. This could easily look like two hours of playing solitaire when looking at the screenshots.

      There is probably a lot of time when Slashdot is up on my screen at work, and I'm across the room working on a whiteboard.

    8. Re:Everyone knows by TeraCo · · Score: 4, Insightful
      Like getting permission to do the audit first?

      Even when it is your job to do security stuff like that, you should run it by the person in charge of security for the company. (In my company, all the security people have 2 bosses, they report to someone in IT who signs their paychecks etc, and they have a logical boss who is the head of security for the company.) Safest way to do things I think.

      --
      Not Meta-modding due to apathy.
  2. That's 90% by Platinum+Dragon · · Score: 4, Funny

    Should we ask what the other 10% consisted of?

    --

    Someday, you're going to die. Get over it.
    1. Re:That's 90% by fuctape · · Score: 5, Informative
      According to the article:

      10. An analysis of the screenshots yielded the following results:

      • 293 (approx. 71%) of the screenshots documented active, on-going games of solitaire.
      • 87 (approx. 21%) of the screenshots documented web site visits, email subscriptions, and other miscellaneous non-job related activities consisting mostly of personal financial and stock market research.
      • 29 (approx. 7%) of the screenshots indicated some job related activities, mostly consisting of an "I concur" in an email response. However, solitaire was minimized (hidden) for quick retrieval on most of these screens.
      • 1 % or less of the screenshots were inconclusive as far as the type of activity.
      • No screenshots (0%) documented any job-related activities such as word processing, spreadsheets, databases, job related websites, electronic document management, right-of-way plans standards, etc.
      Additionally,

      5. A screen capture utility was used to automate this process. The utility behaves like a camera by capturing photographs of the computer screen. The utility did not target any specific activity or application usage by the user.

      6. Screenshots were automatically recorded at times randomly selected by the screen capture utility. The installer of said utility had no control over the randomly selected times.

      7. Periods of computer inactivity on the part of the user de-activated the utility until such time that user input was detected. This feature prevented generation of redundant screenshots at night, weekends, holidays, days off, etc.

      8. Also, A minimum time interval of approximately 30 minutes transpired between screenshots to prevent a large volume of redundant images. The purpose of the utility was to take a representative sample of computer activity. The pattern of computer usage on the part of the user ultimately governed the interval between screenshots. When no activity was detected, screenshots were halted.

      I really hope this guy gets vindicated in the end. He did his job, documented his case very well, and got screwed.

  3. couldn't he just.... by airbie · · Score: 5, Insightful

    delete solitary from his boss's computer?

    --
    They couldn't fix my brakes, so they made my horn louder.
    1. Re:couldn't he just.... by bubbasatan · · Score: 4, Insightful

      Actually, on win2k and later, because solitare is part of the base install, you can't delete it (it regenerates).

      Yes, you can remove solitaire and other games from Win 2k. You must edit sysoc.inf to unhide the Games section of Add/Remove Windows Components. Then you can remove games. I think XP changed the default behavior back to not hiding, but it's a simple task to fix one way or another.

      --
      Windows is going the way of phlogiston...
    2. Re:couldn't he just.... by Anonymous Coward · · Score: 5, Funny
      C:\> more test.c
      #include <stdio.h>

      void main( )
      {
      for( int x = 0; x < 1000; x++ ) {
      print( "GET TO WORK, YOU LAZY FUCK!" );
      }
      getch();
      }
      C:\> bcc test.c sol.exe
      Borland C Compiler v5
      Compiling... DONE!
      C:\> delete C:\Windows\System32\sol.exe
      C:\> copy C:\sol.exe C:\Windows\System32

      - Seth

    3. Re:couldn't he just.... by l810c · · Score: 4, Funny
      delete solitary from his boss's computer?

      How about creating a custom solitaire that Loses Every Time. The boss would become frustrated. Seething in anger he would blurt it out at status meetings, thus outing himself.

  4. Wait by Anonymous Coward · · Score: 5, Funny

    They have computers in Alabama? When did this happen?

  5. Use? by Daleks · · Score: 4, Insightful

    Was the bosses machine his primary source of doing work? If you're the boss you're in meetings all day and out telling people what to do, not sitting in your office typing away. Also, I've left a game of freecell going during a 2 hour meeting before or during lunch. That doesn't mean I'm derilict in my duties.

  6. 'whistleblower'? by autopr0n · · Score: 4, Insightful

    Please. This guy installed Spyware on his bosses computer, and his wife's. for seven months, probably looking for porn surfing but all he got was solitaire.

    This guy was just an asshole, the kind of person who thinks because he's a sys-admin who has admin access on the computers that he ought to be the computer morality person as well. Or in this case, the productivity nazi.

    The supervisor in this story has gotten good reports, maybe playing solitaire is the way he 'thinks'. Who knows?

    The person who setup these screen grabs (seven months of them) deserved exactly what he got.

    --
    autopr0n is like, down and stuff.
    1. Re:'whistleblower'? by danharan · · Score: 5, Insightful

      hold on a sec.

      It was so well known this guy's boss was playing solitaire all the time that people were circulating cartoons about it.

      He went to upper management before installing the spyware, and kept bugging them about it.

      That to me is not indicative of someone that is simply installing spyware to try and catch his boss surfing porn: it's a sysadmin who's using whatever tools he has to back up a claim no one seems to be taking seriously.

      --
      Information: "I want to be anthropomorphized"
    2. Re:'whistleblower'? by Anonymous Coward · · Score: 5, Insightful
      That to me is not indicative of someone that is simply installing spyware to try and catch his boss surfing porn: it's a sysadmin who's using whatever tools he has to back up a claim no one seems to be taking seriously.

      To me, it's a sysadmin who's an idiot. The 'higher ups' were informed and chose to ignore it. He should have done the same thing.

      And who exactly made the cartoons (one of which is not a cartoon at all, but rather an inadequately pixelated photo). If it was him, he's an idiot. If it was someone else (who would have gotten the information from him), he's still an idiot.

      He may have been a sysadmin, but he won't be in the future. No potential boss would hire him knowing that they may be spied upon and end up seeing their names in the local paper in an unfavorable light. He abused his position and is now seeing the consequences.

  7. Re:maybe he was fired... by Platinum+Dragon · · Score: 4, Insightful

    For spending 70% of his time worrying about what his boss was doing.

    Errrr... isn't that why he installed the spyware in the first place? So he wouldn't have to spend 70% of his time worrying about what his boss was doing?

    --

    Someday, you're going to die. Get over it.
  8. Solitaire by jdc180 · · Score: 5, Funny

    Surprising thing was none of the screenshots were of solitaire crashing

  9. Other side of the story? by Anonymous Coward · · Score: 5, Insightful

    Granted, most people here hate boss-types, but its only fair to ask for the boss's side of the story. For example: perhaps his job consists of minimal computer usage. When I was in college, part of my financial aid package involved doing work for the school - I got put to work answering phones and calling alumns to shake them up for money. I had a computer, and there was a solitaire game or something similar on it all the time - it was mindless enough I could do it while talking to somebody, and it kept me sane between calls. The boss could be in a similar situation if he spends most of his time on the phone or otherwise _talking_ to employees. He just wouldn't be constantly playing the game. Most people here equate working with time spent active on the computer doesn't mean that it always is.

    I'm not saying this is the case, but its worth considering that the boss could have a radically different story, and the article did present a very one sided view.

    1. Re:Other side of the story? by earthdark · · Score: 5, Insightful
      Here's an actual news article on story rather a link to the guy's own website.

      Choice quote:
      Blake also testified Monday that he installed the program on two other computers in the department, that of the state Right of Way Engineer Paul Bowlin, who heads the division, and Right of Way Secretary Jana Trafford Blake. Jana Blake is married to Vernon Blake.

      Spying on your boss for seven (!) months is one thing but on your own wife? Seems to me he was more of a control freak.
  10. Rule #1 by jxs2151 · · Score: 5, Insightful

    Do not make your boss look bad and expect to retain your job.

  11. Spyware. by Daleks · · Score: 4, Funny

    I wonder how the guy was caught. Oh, and there's a picture of a spy in the lower right hand corner.

  12. Re:maybe he was fired... by MindStalker · · Score: 4, Insightful

    Yes, but most importantly, he already informed his bosses supervisors, and was ignored. Obviously his supervisors should have told him more directly that they weren't interesting in knowing what was going on. But the fact that he then turned around with vengence and spied on his boss to "prove" his alligations, speak very negativly of him. I would fire him on the spot too.

  13. Thats what the boss gets....... by ErichTheWebGuy · · Score: 4, Funny

    ... for using Windows. Bet if he was using Linux and playing games (games on Linux are better anyway) he would have been fine. I'm pretty sure the only reason why I haven't been fired yet is because I use Linux. ctrl+tab moves me to my other desktop, which conviently is running vi with the latest version of our app, and I am sure that I have no spyware installed.

    Arthur - If you're reading this -- just kidding! Otherwise, I am completely serious.

    --
    bash: rtfm: command not found
  14. Sounds like a case of by JoeLinux · · Score: 4, Funny

    Not-so-mean-BOFH vs. PHB. Let's get ready to rumble!!!

  15. Especially in Government! by theguywhosaid · · Score: 4, Insightful
    Employers spy on employees, not the other way around!

    I read that as:

    Employers spy on employees, why not the other way around?
    And I thought AC deserved a medal.
  16. The more interesting question by k98sven · · Score: 5, Interesting

    If you ask me, the more interesting question is: To what extent should an employer have a right to decide what their employees do on company time.

    Should it matter if you're spending half your time playing Solitare if you still manage to do the job you're supposed to do?

    This boss's managers don't seem to want to get rid of him. One conclusion you could draw from that is that perhaps the boss actually is getting what he's supposed to be doing done. (Maybe most of his work isn't even done on the computer?)
    In that case, who cares if he's playing solitare? Perhaps he's thinking things through and making decisions while doing it?

    Personally, I've got a job where nobody tells me what to do with my time, as long as I get the job done.
    And that's the way it should be, if you ask me.
    By my definition, a job is performing a task for money.

  17. Re:maybe he was fired... by harkabeeparolyn · · Score: 5, Insightful

    Fuck his supervisors. If they were too chummy to act on a legitimate complaint they should be fired as well. We're talking about tax money here; the citizens of Alabama deserve better.

  18. Re:That was appropriate by DroopyStonx · · Score: 5, Insightful

    Firing him was most certainly NOT appropriate.

    The guy knew his boss fucked around on the computer all day instead of doing his job and this was known to the employee who got fired.

    He reported this to higher ups and they ignored it. The first mistake here is they should've listened. Since they didn't, the only other option was to take matters into his own hands.

    Even if he wasn't an IT manager of sorts, he did the right thing in proving to higher-ups that his boss is doing nothing but wasting the company's money by playing solitaire and looking at stock market crap instead of working.

    I'm sure there are tons of people out there who are looking for a job and would be more than happy to fill his position and actually do some work.

    They should've fired the boss and gave the IT manager that position (provided it paid more).

    --
    We have secretly replaced these Slashdot mods' sense of humor with a rusty nail. Let's see if they notice!!
  19. Playing Solitaire by eltoyoboyo · · Score: 4, Insightful

    is to the office staff what leaning on one's shovel is to the DOT road crews. It is a privilege of the senior employees. Yes, you could be fired for not working all day. Obviously, it is not going to happen to this supervisor any time soon. The fact is that this guy is not good guy whistle blower. He is just an idiot with an unproductive boss.

    Installing unauthorized software on a state government computer WILL get you fired. Raise the bar, and install spyware on a state government computer and you could be facing criminal charges. It does not matter that the software install was for alleged "white hat" purposes.

    --
    Have you Meta Moderated t
  20. Re:That was appropriate by tmasssey · · Score: 4, Insightful
    He reported this to higher ups and they ignored it. The first mistake here is they should've listened. Since they didn't, the only other option was to take matters into his own hands.

    Why, exactly, was his "only other option" to spy on his boss? Why not write the letters to the editor that are now being written for him? Why not put up a website that talks about the issues he's facing, without mentioning names? Why is the next step to spy on his boss?

    Was his boss' conduct reprehensible? Yes. Was it his job to spy on him? Short of a policy expressly giving him permission to spy on his boss (or *anyone* else in the office), his behavior was wrong. And no, " 'to confirm and document' such misuse" is *not* sufficient authorization for spying on *any* user in the office, especially his boss.

    You can get in trouble doing such things, including prosecution under federal wiretapping laws. This is *not* an area where you want to screw around with.

  21. What he should have done. by GoofyBoy · · Score: 4, Insightful

    Lock down the computer. Remove admin rights and give him only stuff he justifiably needs to do.

    Block access to certain websites.

    If the boss raises these restrictions up, talk to him about how that would be conflicting with official policies. Ask for confirmation in an email if he still objects and want things changed.

    If you work in government these are all things that set the trail for accountablitity and responsiblity (and yes that scares the crap out of people).

    Spying in the workplace, unless its 100% cleared from above, is immoral.

    Could I, as a janitor, put cameras in the woman's washroom because I wanted to prove that too much time was being spent there?

    --
    The surprise isn't how often we make bad choices; the surprise is how seldom they defeat us.
  22. Re:That was appropriate by lifebouy · · Score: 4, Insightful

    That, sir, is crap. His employer hired him to perform the mystical art of sysadmining. as far as the employer is concerned, its a black box situation. Much like when a lawyer goes to trial for you. You may know what his strategy is, buy you do not have the experience or knowledge to dictate which laws or previous cases will be referenced. It's not your area of expertise. If his job description included dectecting and reporting computer misuse, then he was fired for doing his job. Frankly, everyone involved in firing him should be fired, because whistleblowers must be protected from this, ESPECIALLY in the government.

    --
    Drop me a line at:
    Key ID: 0x54D1D809
  23. 90% of the time the screen was blue... by noidentity · · Score: 5, Funny

    ...but the screen capture utility didn't capture that for some reason.

  24. Re:That was appropriate by lifebouy · · Score: 5, Informative

    Any government computers I have ever heard of require you to give consent to be monitored BEFORE you are authorized to use them. It's usually part of the IT policy which must be signed as part of employee indoctrination. Under normal circumstances, I would agree with you, but not for a government position.

    --
    Drop me a line at:
    Key ID: 0x54D1D809
  25. Anyone live in Alabama? by bluGill · · Score: 4, Insightful

    Anyone who lives in Alabama ought to be writting a letter to their state representatives asking what is up there. Reports that someone is missusing their computer shouldn't have been ignored in the first place. The state of Alabama needs to completely change that department. Start with replacing the cabinet person responsible for transportation. (I'm guessing this is a cabinet level position, but I don't know how that state government works)

    Then do a massive layoff, since most of the upper management obviously needs to go.

    We can argue the ethics of what this guy did, but I'm having problems finding anyone ethical in this story. Not the supervistor who ignored the report (if it wasn't ignored either the behavior would have stopped, or the boss would have been fired before this guy finished 6 months of screen grabbing). Not the boss playing solitare instead of the job he should do. Even if he can do his job in 1 hour a week, it is unethical to not find other work that needs to be done for the other 49. This guy is perhaps most ethical, as a admin his job is to watch the state's computers. (but perhaps because I don't know that state) This isn't a private machine he was spying on.

    If the supervisors were doing their job, this would have never got this far, because they would have repramanded the boss right away. Then either the boss would have changed so nothing would need to be done, or he wouldn't and they would know to fire him. Most people I know have done something stupid like this at work (including a number of you reading this at work), but when it becomes a problem the boss is supposed to notice and tell you to change before it becomes time to fire you.

  26. Re:That was appropriate by gumbi+west · · Score: 5, Insightful
    He was performing a task that was within his job description. He will win his law suit.

    Every government makes it very clear that your computer can and will be monitored (even though the sys-admins are usualy not up to the task of actually figuring out how to effectively monitor it). i.e. the sys-admin had every right to do this and was acting according to what someone way way higher up would say was good practices to the cammeras.

    that said, I've been around the block enough time that there are four possible real issue here that got him fired.

    1. His documentaition clearly shows that his boss is not needed. Which is to say, if they fired him, they wouldn't even need to replace him (since his job only took 10% of a week). Now, if you did that, then his bosses boss would have one less subordinate, and may not be needed...
    2. His documentation clearly shows that his boss was not doing a good job. This calls into question the ability of his bosses boss to do his job. Implying that he should be fired...
    3. His bosses boss has simmilar computer usage and doesn't want his 'activities' recorded...
    4. His bosses boss is afraid of trying to talk to his boss about why he firred him, because of the appearance of the three above and it all just much cleaner to make this guy a bad seed and get rid of him--removing all questions.
  27. Re:That was appropriate by qw(name) · · Score: 5, Insightful

    Being the sysadmin does not grant you the right to spy on another employee even if that employee is your boss. There is a certain amount of trust that an employer has to grant a sysadmin but when that trust is taken advantage of as in this case it becomes abuse.

    Proper channels should have been followed. If his employer was unwilling to take action he should have left it alone. We all work with people who are lazy and unjustly promoted. But that doesn't give us the right to spy on them.

    As a sysadmin I find this guy's behavior pathetic. It's an abuse of his position. I would have fired him, too.

  28. Re:maybe he was fired... by Anonymous Coward · · Score: 5, Interesting

    this guy wasn't too bright..admittedly.

    but friends and i have dealt with situations like this before (the tech side, not stuffed suit side).

    here's what happened: we had a dumbfuck COO making life absolutely miserable for everyone. he did absolutely nothing for the company and his net contribution to the company was ZERO. yet his fellow stuffed suits excused his bad behavior, even though the fucktwit COO was single handedly decimating moral through out the ranks.

    well amongst the techies, we already had one guy leaving for a better job, so he volunteered (with help from unknown sources) to gather some dirt. he put it all together in a report of our COOs activities and in the middle of the night, placed hard copies on nearly 300 desks, and emailed over 1000 employees. this shit was gravy...we had evidence(photos/screen caps/receipts) of: an affair w/underling, porn surfing, game playing, almost zero actual work, frivilous purchases on company credit card, 3 hour lunches, sleeping frequently on the job, etc.

    shit hit the fan, they accused the entire IT dept in complicity, but the single IT guy leaving, while not admitting it directly, intimated that he acted alone.

    needless to say, the uproar amongst rank and file quickly drowned out the investigation.

    The COO, CFO and a vice president all left.

    Apparently they believed that their similar activities had been documented as well....as an anonymous message (not from us) stated "more was coming". we actually had nothing more, but the threat alone was enough.

    karma rolled some fucking heads that month.

    little guys: 3
    fucktwit suits: 0

  29. Re:No it wasn't by NanoGator · · Score: 4, Insightful

    "He was doing exactly what he was paid to do: stop computer misuse."

    Playing Solitaire is not misuse. It's not the best use of time, but it is not misuse. He sent the emails to the higher-ups, they obviously weren't that interested. In other words, he must still have been getting his work done. (Or his job wasn't so consequential, but it's not a syadmin's job to trim the fat.)

    By installing spyware on his boss's machine, he captured and examined data that he is not privy to. What was to stop him from seeing his boss emailing another executive about future layoffs, or the salary of one of his coworkers? His was quite obviously fired due to mistrust. Being his boss might have played into the politics a bit, but I certainly wouldn't hire this guy.

    --
    "Derp de derp."
  30. they sysadmin was wrong by Chanc_Gorkon · · Score: 4, Insightful

    Personally, if the activities of a user isn't impacting the network or my application, I could really care less what they do when waiting for work to do. As a sysadmin, I do alot of waiting....on support calls from companies, waiting for user specs, waiting for users to frickin get of the system.....if I did not have Firefox open with something interesting to read, then I would go stir crazy. I usually don't stream anything during the day and when I do get sidetracked on the web, I start to think of things comeing up and start working on them. But have you ever had a day where you only had an hour or two left and you had to stay for support but in that hour or two you really did not have enough time to get anything started? That's the perfect time ot get caught up on industry websites and other items that may not pertain directly to your job, but are nice to know anyway because they MAY pertain to your job someday. Case in point, if you own a Mac and are an it person, you may browse Mac web sites for a a fe wminutes at work. That additional knowledge may pop up in a meeting...Hey so and so....didn't you say that Mac's do blah blah blah....

    Solitare can work your brain. I think excess is one thing, but the occasional game is not going to do anything. If this guy just came to work and played solitare all day well then I could see that as excess. But if he cooled down from a meeting by firing off a few hands, then I doin't have an issue with that.

    --

    Gorkman

  31. Wronged righteousness by Mulletproof · · Score: 4, Interesting

    While most of us would find this guys actions appropriate, he obviously did not understand the attitude of the management he worked for, and THAT is what determines whether his actions were right or wrong, not what you or I or even he thought. When it became obvious that upper management didn't give a shit, his job as IT narc was done. At that point, his actions should have been regulated to gathering evidence for that day when things came crashing down (and they would have eventially) to cover his ass. If your bosses have expressed a distinct disinterest in how that posisition was managed, YOU are in the wrong for going any further, as much as it pains me to say it. At that point, you may be stepping on good ol' boy toes or some other crap, and while you have the right to do it, your an idiot for doing so.

    It really surprises me that after 21 years of supposed service, this guy gets canned for the expose, which leads me to believe there is something(s) we're all not being told. 21 years and this guy still doesn't have a sensible grasp of the environment that would can him as sooner than praise him? 21 years and this guy is worth less than a solitair playing spider monkey? Normally that only happens when they're just dying for an excuse to get rid of you, normally after you've done something to piss them off.

    Sorry, but thing aren't adding up here for the righteous IT guy here. I'm betting he screwed the pooch way before this incident.

    --
    You need a FREE iPod Nano
  32. Why do folks say he was doing his job? by btempleton · · Score: 4, Interesting

    His job, he says was to find computer misuse. The boss wasn't misusing the computer, he was possibly misusing his time. If he had been playing solitaire with a deck of cards, would that be misuse of his desk? Of the cards?

    No, misuse of the computer, if you ask me, would involve installing spyware and trojans on other people's computer, looking at their files, flooding the network, running a porn site.

    This sysadmin scares me, if he doesn't think you are doing your job properly, then even after he has told your boss about it he thinks he can install spyware on your computer and watch you. What other thing that bothers him would make him feel justified in doing crap like this?

    I would fire him on the spot, possibly consider pressing charges. While employers do own their computers and thus you don't have as much privacy from your employer as you should have, this guy was not authorized by the employer, and what he did is possibly illegal.

    --
    Has it been over a year since you last donated to the Electronic Frontier Foundation
  33. Re:Wow... by Maestro4k · · Score: 4, Insightful
    • Understanding that I am taking the summary of the article at face value, and that I haven't gotten to the details of the article yet, this is what I think: This guy took it too far. Way too far. I wouldn't be the least bit surprised if the people above him thought "Geez, what if he caught a screen grab of me looking at porn? I get a bunch of that shit in my email all the time. Was he going to go McBain on me, too?"

      Maybe he was doing his job, but he should have had a little more faith in the higher-ups.

    Once you read the whole article (and particularly his site) you'll understand why. The boss playing cards constantly was becoming a major issue within his division. Discipline was becoming impossible because the boss was, well, he was doing everything they weren't supposed to. He has two examples of jokes posted around the place about the boss's game playing by employees in fact.

    He did what he did because the issue had gone way beyond just a "I think the boss isn't doing his job" to a "the boss isn't doing his job and it's so obvious no one else wants to do theres." Higher-ups had continued to ignore it and wouldn't solve the situation. Something had to be done. Even though he was fired the situation was finally solved, it's a crying shame for Alabama taxpayers that it had to reach such a point. The boss should have long since been reprimanded for his behaviour, if not fired.

    Frankly if I lived in Alabama I'd be livid. The taxpayers were paying this guy's boss to do nothing buy play card all day. The sheer quantity of the screenshots showing him playing games pretty much tosses out the "Maybe he had solitaire open because he was on the phone a lot, and wanted something to keep his hands active?" idea that you presented. He was simply being paid to, well, not work.

    One thing I thought of since I've dealt with environments where games shouldn't be played (University computer labs) is why didn't he just change the permissions on them? It sounds like they were in an NT or Active Directory domain, it's pretty unlikely the boss had administrator access since this guy was the designated support person for his division (he has the policy on support personnel up too, it says one person in each division/dept. will be granted administrator access for their part of the domain tree). He could have avoided this mess and forced the issue with the higher-ups by simply changing the permissions on solitaire to be administrator only or even nobody. It's likely the boss wouldn't have pushed the issue too hard as it would make him look bad trying to get access to a game restored. The guy could have also locked access to solitaire on all computers in his division to make it a policy issue, not a direct confrontation of his boss.

    Still the whole situation shows there's some serious waste going on in ALDOT. Alabama taxpayers should raise hell with them on that at least.

  34. How you could make it look really bad. by twitter · · Score: 4, Insightful
    He did his job, documented his case very well, and got screwed.

    Did he? How do you know he did not take 2,000 screenshots and cull them? Always beware when an interested party hands you "random" samples. It would have been better if he tied the screenshots to time logs of applications. If his boss really played solitare all day, a log of applications would show it and the percentage time it was active. Even still, it would be difficult for him to prove as he could manipulate the logs manually.

    What's called for is institutionalized watchdoging. There should have been someone who this man could have asked for help in doing his job. An IT person under another boss would be good. This institutional failure should as a basis for a transfer, not a firing.

    I can imagine the state trying to slip out of the bind by saying that the boss was not abusing his computer or network time. It can always be argued that playing the boss was accomplishing his job description and what he did with his spare time was his business. Managerial positions can be that way.

    A conscientious manager will roll up their sleeves and help get work done when they run out of planning, reports and all that boring crap. It helps to keep your feet on the ground.

    A slob will sit around and turn into a moron. A slob that's drooling 90% of the time soon finds few topics for reports and might get axed. A dangerous slob is one that got themselves promoted to hide incompetence. They have a tendency to screw up and blame their underlings. I've had one of those and I think this one did too. Typically, those they leave in charge for an extended leave will say things like, "I did my job and his job with ease. My job usually takes all of my time. I wonder what the boss does all day."

    --

    Friends don't help friends install M$ junk.

  35. Re:Wow... by Anonymous Coward · · Score: 5, Insightful

    1.) He notified the management, they chose not to act on it. He should have just left it there. It's important to let the big wigs make the decision, as opposed to becoming a virtual vigilante.

    His notifications to upper management was nothing more than standard, vapid comments about ineffective management (such that virtually every drone makes regularly). There was virtually nothing actionable, and his attempts to fall back on that as a defense are weak and transparent.

    When you're a sysadmin, you have access to all sorts of sensitive data. To actively capture it and use it zealously nail your boss, well I tell you what, that'd scare the hell out of me.

    Indeed. His boss could very well have been evaluating division salaries, writing a bonus recommendation letter for Vernon (the overzealous sysadmin), or a wide range of other private matters. Sysadmins have a sad case of god complex (I have been in several positions where I consulted on infrastructure to contain the power of the sysadmin -- one they knew the sysadmin was going through the payroll files, for instance, based upon "in the know" comments he made to other employees).

    The whole reason Slashdot isn't a big fan of things like video cameras at every street corner is that anything can be captured to make somebody look like they're doing something illegal. It's discomforting.

    Humorously many of the visitors to Slashdot are doing so on paid hours, and some of them probably have an overzealous sysadmin on a crusade, carefully logging all of the details in hopes to prove that regardless of output, clearly the employee is ineffective because they read that story on Star Wars III. The problem with this is that just because we're not doing something visually productive, it doesn't mean that we're not mentally preparing or ruminating over some piece of mental data -- ultimately our productivity can be measure in the solutions and projects we provide in a given period of time, not whether we have vi or solitaire on our screens. Indeed, given that the person being monitored was a manager, it is entirely conceivable that he was doing the best thing that he could do at times - assessing the situation and deciding that his intervention wasn't currently needed, and retiring to a game of solitaire. Big fucking deal. Ultimately his higher ups rank him based upon the results of his division, not whether he was a busybody filling his day with make work, carefully micromanaging his charges.

    This sysadmin, Vernon, sounds like a sad, pathetic, jealous prick that has no comprehension of boundaries, and feels that he's on some sort of personal crusade to save us all. I find it unbelievable that he releases the information that he has (illegally released information - the guy is basically spreading proprietary internal state information publicly. I'll be surprized if he doesn't end up going to jail for this) and truly believes that he's in the right - this wanker won't get a job administering anything more advanced than a toilet plunger in the future.

  36. Re:That was appropriate by Tassach · · Score: 4, Informative
    Any government computers I have ever heard of require you to give consent to be monitored BEFORE you are authorized to use them
    That's been my experience as well. Here's the login notice on the machines where I work (A US Gvt. agency):
    Warning Notice!
    This is a U.S. Government computer system, which may be accessed and used
    only for authorized Government business by authorized personnel.
    Unauthorized access or use of this computer system may subject violators to
    criminal, civil, and/or administrative action.

    All information on this computer system may be intercepted, recorded, read,
    copied, and disclosed by and to authorized personnel for official purposes,
    including criminal investigations. Such information includes sensitive data
    encrypted to comply with confidentiality and privacy requirements. Access
    or use of this computer system by any person, whether authorized or
    unauthorized, constitutes consent to these terms. There is no right of
    privacy in this system.
    [emphesis added]
    We had a similar disclaimer on all our system when I worked in State government.
    --
    Why is it that the proponents of "one nation under God" are so eager to get rid of "liberty and justice for all"?
  37. Re:That was appropriate by Maestro4k · · Score: 4, Informative
    • Being the sysadmin does not grant you the right to spy on another employee even if that employee is your boss. There is a certain amount of trust that an employer has to grant a sysadmin but when that trust is taken advantage of as in this case it becomes abuse.
    Actually most workplace computer policies permit exactly what this guy did. Perhaps you should read yours more thoroughly, I know I haven't worked anywhere that doesn't in fact include a clause similar to this one, take from the ALDOT's Computer Usage Policy (posted on the guy's site[emphasis added by him]):
    • Any individual who utilizes any ALDOT computer resource consents by that use to the potential monitoring of such use.

      Because the Internet services are to be used only for government business, all records in these systems are hereby considered government records. As such, these records are subject to the provisions of state laws regarding their maintenance, access, and disposition. Employees using these services do not enjoy any right of personal privacy.

      A user who utilizes ALDOT computer resources for any purposes other than for official ALDOT purposes, is guilty of theft or misuse of state resources and may be subject to both ALDOT personnel action and appropriate criminal prosecution.

    I won't post it all here but you should look at the documents on his site, the same one contains the definitions of System Administrator. He didn't break any rules. Also I should note that this is standard for non-classified government work. Because of open secrets laws every detail of what a government employee does, including their personnel files, are public records. Government employees effectively have no privacy at their jobs, it's something fairly unique to the job sector.
    • Proper channels should have been followed. If his employer was unwilling to take action he should have left it alone. We all work with people who are lazy and unjustly promoted. But that doesn't give us the right to spy on them.
    Proper channels were followed, he documents it all on his site, shows the policies, tells each step he took. There's even this statement: "On my part, no laws were broken, ALDOT's own policies and procedures were followed in letter and spirit, and actions taken were in ALDOT's and the taxpayer's best interest."

    He explains he took the action he did because the boss's game playing was causing problems within the division of employee moral and supervision. Another quote: "Not only was this behavior wasteful, it impeded my ability to effectively supervise subordinates, including my ability to discipline employees for wasteful behavior of any type. The situation deteriorated to the point where cartoons were being distributed that mocked my supervisor's behavior." He includes two examples of those cartoons.

    So I have to ask you, how much did you read about this issue before you passed judgement? And while I understand you aversion to "spying" on users (having done sysadmin work for quite a while myself) I find it odd that you don't realize that sometimes it is not only necessary but required. If someone if using company resources to violate laws the company will require proof before they can act to protect themselves from future prosecution (and defend themselves if such prosecution occurs). Even if they're not breaking laws but violating company computer usage policy often monitoring to gather proof will be required before they can be disciplined and/or fired.

    • As a sysadmin I find this guy's behavior pathetic. It's an abuse of his position. I would have fired him, too.
    Well frankly I must say I'm glad you don't work for my organization. Protecting user privacy is important but also is understanding that monitoring must occur sometimes, no matter how much we find it distasteful. Also he didn't abuse his position, if you read all the info presented you'll find he followed their polices and procedures properly and did his job. If that's a fireable offense, well I suppose we'd all better start playing card games at work all day instead of working.
  38. Re:No it wasn't by Maestro4k · · Score: 5, Informative
    • Playing Solitaire is not misuse. It's not the best use of time, but it is not misuse. He sent the emails to the higher-ups, they obviously weren't that interested. In other words, he must still have been getting his work done. (Or his job wasn't so consequential, but it's not a syadmin's job to trim the fat.)
    Actually if you look at the excerts from ALDOT's computer usage policy he has up any non-work related usage of the computer is defined as misuse/abuse. So in this case it was in fact misuse.
  39. Re:That was appropriate by randyest · · Score: 4, Insightful

    Man, I can't believe I'm reading such drivel from otherwise intelligent people. Maybe you missed it -- it's a government office, not a company/business subject to competition and market forces that will kill it in due time if it's too wasteful!

    It's government here -- you know, that thing that produces nothing yet can perpetuate itself by just spending enough to get another 20x-too-big budget the next year, no matter how worthless 80% of the employees are?

    Proper channels should have been followed. If his employer was unwilling to take action he should have left it alone.

    Hey -- "his employer" is us! (If you live in the US, particularly Alabama.) So, if the (possibly also solitaire-playing usless leech) boss of the boss in question chooses to do nothing we should all just suck it up? What the fuck are you saying, that government isn't accountable to the people, and shouldn't be? No protection should be afforded to whistleblowers who expose the wholesale robbery of everyone?

    Wow. Just wow.

    --
    everything in moderation
  40. No whistleblower here... by Naum · · Score: 5, Insightful
    ...just an idiot. Monitoring and evaluating the computer habits of his boss is not his job unless his superiors instructed him to do so. And from the read of the Decatur Daily article suggests he had a personal axe to grind here, and he also installed the spyware on his wife's machine and the division head's machine.

    If he thought somebody was running a web server or downloading pornography, or gambling online, that is one thing. But to take it upon himself to perform his own performance evaluation of his superior, was a bit bold and he was rightfully fired.

    His focus should have been on the machines and the network, not carrying out retribution for a personal grudge.

    --

    AZspot
  41. Re:A few thoughts by 0x0d0a · · Score: 4, Insightful

    Please keep in mind that this guy's boss is not an ordinary employee -- there are no free-market checks in place on this organization becoming wasteful. Instead, he is employeed by the taxpayers of Alabama. If 70% of his time is spent playing solitaire, and 20% checking the stock market, and 90% of his pay is being wasted, I'd say that the citizens of Alabama have a right to be a bit irritated.

    I agree that the use of monitoring software makes me uncomfortable. However, as far as I can tell, no laws or policies were broken. I don't know whether the sysadmin should be allowed to keep his job, but I find it appalling that the guy's *boss*, the time-waster, is still porking on the taxpayer's dime.

  42. Re:maybe he was fired... by Anonymous Coward · · Score: 5, Interesting

    You know, there are dumb-fuck executives at most companies. As most people are more than aware, trying a direct confrontation to this (however "legitimate" the confrontation may be) usually ends up in more trouble that it's worth.

    At my last job, we had a few dumb-fuck executives that eventually drove our company out of business, hence it's my previous job. Anyhow, there was one such guy that was spending company money for himself, sexually harassing the ladies (one quit after her superior wouldn't take serious action against this guy), and basically did everything to screw the company and nothing to help it.

    We had plenty of mud to dig up, actually, we didn't need to dig any up because it was well known throughout the entire company. The CEO etc. wouldn't do jack, because (although not as bad) he had done similar things to a certain extent.

    It was obvious that making a stink would only get the person making the stink have a miserable life, or get fired for some technicality. So, instead of a legitimate confrontation, we used a more shaddy approach. Most of it was illegal, but hard to prove, but wouldn't get anyone fired. So long as we weren't caught in the process of doing it.

    We basically harassed the fucking hell out of the executive in question. Some very childish pranks like using a high strength epoxy putty to seal all the key holes on his Mercedes (keyless entry still worked, but he did notice this), took the air out of his car tires, and ripped off the emblem. Next came the dog shit on his door steps, uprooted flowers in his garden, and other general vandalism. To make sure he understood it was an internal effort, we glued his books closed, and chopped a few cables on his office computer. (I still can't believe that this was done by the sysadmin himself... BOFH or what!?) There was loads more, but we finally drove the thought home by sending a piece of mail from a spoofed acount that generally said "Either your life could continue being hell, or you can leave the company. You choose." He was gone in 2 weeks.

    Was this legal? No! Was it ethical? Probably not. But it was the lesser of 2 evils, where the other evil was making a stink and getting fired in return. Sometimes doing it the "right way" isn't really the right way at all if you end up losing. It's not worth it. I suppose we could have hired someone to break his legs (there were more than a few ladies in the office that would have been very happy to contribute to the "hit tip" if we had collected!) but we certainly got more entertainment and satisfaction out of doing it ourselves. Best of all, it wasn't even a coordinated plan, it was completely autonomous. As soon as people caught on that someone was raising hell, everyone else followed.

    So Patrick, if you're reading this, now you know. By the way, I have your Mercede's emblem.

  43. What he should have done... by mark-t · · Score: 4, Insightful
    As soon as the higher-ups indicated their unwillingness to cooperate with him, he should have polished up his resume and started looking for work elsewhere.

    Ironically, it appears that his biggest flaw was too much company loyalty. Normally company loyalty is a good thing, but being loyal to a company that has bad internal policies and practices isn't going to get you very far, as this story indicates.

    Another possibility would have been to ask permission to install the spy software on company computers to facilitate documenting evidence of wasteful activity (this request being made entirely outside of and temporally distant from any discussion regarding his boss's activities so that a connection between the two would not be obvious). There is no reason why any computer on the network that the sysadmin is trying to prevent abuse on should be excluded from possible monitoring, but the exact policies that would be followed by the software and the adminstrator would need be laid out in writing to ensure accountability for how the software is used to the senior management, and to ensure to their satisfaction that it is not abused. Once permission had been obtained and after a few months, once the evidence is gathered, he could not have been justly fired for installing this "unauthorized software" after presenting the evidence to the higher ups, since he in fact would have HAD authorization to install exactly that software. If they chose to fire him anyways for that reason, it would be an open and shut wrongful dismissal case.

    Of course, then we probably wouldn't be arguing about it on slashdot... and heaven knows what a crime that would be.

  44. Re:YOU CALL THAT by nachoboy · · Score: 4, Interesting
    He's trying to uninstall a game on a business-oriented operating system. That should be one command, tops.

    You want one command? Done. Run this as a local admin:
    RunDll32.exe advpack.dll,LaunchINFSection %systemroot%\INF\games.inf,SolitaireUninstall
    Or perhaps you'd like to nuke all the games at once? You could of course run the Uninstall section for each game. But since we're so fixed on the "one command" notion, we'll need a file c:\nogames.txt with the following contents (disregard the spaces added by slashcode):
    [Components]
    freecell=Off
    hearts=Off
    minesweepe r=Off
    pinball=Off
    solitaire=Off
    spider=Off
    zon egames=Off
    Once we have that, run this command to blow away all the games at once. (Add /q to hide all UI during the uninstall process.)
    sysocmgr.exe /i:%systemroot%\inf\sysoc.inf /u:c:\nogames.txt
    Or just deny permissions to the binary in question:
    cacls %systemroot%\system32\sol.exe /e /d Users
    Software restriction policies can also be easily set by a domain administrator for groups of users or computers.

    Just because YOU don't know how to administer a Windows network doesn't mean it's not possible.
  45. Everyone on here misses the point... by bwilliam13 · · Score: 4, Interesting

    Results are what matter. If someone can get their required work done with 10% of their time, no one should really care about the use of the other 90%. Sorry...gov't or not. That's what happens in companies who are concerned about the bottom line. You get your shit done, you have a job. You don't, you're fired. If higher ups thought he was getting work done, Solitaire is not an offense. If he's slacking, Solitaire becomes an offense. That simple. Dunno why there's 200+ posts debating this.

  46. Re:Horseshit by @madeus · · Score: 5, Insightful

    This guy had complained to his superior's superiors. They apparently didn't care. So this guy's crusade basically ends right there. He did what he should have done, and when those higher ups don't care, you can get pissed all you want, but you don't take matters into your own hands.

    Actually, in a corporate organsation you could easily find that your required to take additional action such as informing someone more senior who represents the investors (e.g. a non executive director) and you tell them that company policy is not being followed. You may find you are legally required to ensure that company policy is followed through or you can lose your job. In this case there are no 'non executive directors', but there are investors - the taxpayers of the state of Alabama.

    This was his BOSS.

    So? Are you suggesting that cover ups and failure to follow offical policy (as far as following the offical complaints proceedure and enforcing the existing policy prohibiting such use of equipment) simply were not criminal enough to be worth him drawing attention to or that 'your boss' can engage in whatever criminal acts he likes, including misuse of public property and/or funds, and that you should be complicit out of some kind of automatic respect for someone in your organisation who happens to be in a higher pay band than you are?

    It's taxpayers money. If it was a private enterprise it would be investors money. I shouldn't need to remind you that employees have a fiduciary (and, in the case of corporate enterprises, frequently legal) responsiblity to that organisations investors. Senior employees can be personally liable and can face not only fines but jail time for acting against the interests of an organisation they are explicitly employed to represent the interests of.

    If someone is jerking around like this guys boss in a company I've invested in, or if my local government representatives where up to this (which I'm quite sure they are) as an investor/taxpayer I'm damn sure I want to know and I'm sure I want the senior executives who've tried to sweep this under the carpet and who have failed to act in the manner in which there were hired to exposed and fired (it's their job to ensure this sort of thing doesn't go on, it's not a charity, if they can't do the job for which they are very well paid they should be slung out on their ear).

    You stay in official channels when dealing with any personel problem, and you ESPECIALLY do this when a superior is involved

    I say you obay your fiduciary and legal obligations to taxpayers/investors FIRST and if that's contrary to 'staying within the little white lines of company policy' SCREW THEM (after all they [both this guys boss, and his seniors] have already thrown the rule book out the window and are using it to shaft this guy, and all the state taxpayers and more fool you if you let them continue).

    What your suggesting is that he be complicit in a system which is supressing evidence of corruption in a government organisation (the act of corruption being not the act of the origional employee, but complete failure to take any action to enforce the organisations existing policy when complaints were made). What you are suggesting is that he 'stays within the box' and acts in the best interests of his management, even if thats not in the best intrests of taxpayers/investors.

    In short, what you are suggesting is completely immoral.

    I say screw that, rat on the bastards and tell everyone who'll listen.

    It's you - the taxpayer and investor in this service - that's getting screwed by these incompotent lazy slobs, and it's only the very people being ratted on for being incompotent lazy slobs that are trying to cover it up to save their own fat underworked and overpaid behinds.

  47. Re:Whistleblower? by Elwood+P+Dowd · · Score: 4, Funny
    Here on Slashdot, many people post and read articles from work. This is claimed as "Okay," because we're getting our jobs done regardless, right?
    Huh. Iduno about that. I'd say that the amount of time I spend on /. while at work is completely inexcusable.
    --

    There are no trails. There are no trees out here.
  48. Sweet Jesus. YOU'RE MISSING THE POINT by Pahalial · · Score: 4, Informative

    Right, it seems this link (an actual news story on the issue rather than just the one guy's point of view) has already been posted here more than once.

    It stuns me that despite ~50 +5 replies, no one has bothered to point out that the program this guy installed HAD A BACKDOOR.

    Yes, that's right people. That's why they're calling this spyware. Because it is.


    Read this:

    Bobby Mitchell, an employee contracted to DOT to do computer network support and computer programming, told the hearing officer that DOT's computer firewall crashed in January 2003 and had to be rebuilt.
    ....
    Mitchell said he found WinSpy on Dobbs' computer when transferring material and programs in his computer to a new one and at that time saw that the program had an "imbedded address" that allowed someone outside the department to have access to DOT's computer system. The imbedded address was traced to Australia.

    So, who still actually believes he should get his job back? He was so focused on proving his boss was in the wrong that he compromised the security of the network he was a sysadmin for.
    --
    Stuff.
  49. strongly disagree by phats+garage · · Score: 4, Insightful
    Or the business world. Most of the people in managerial positions don't know what thtey're doing, they got their by luck and kissing the right ass.

    Your comment implies they know exactly what they're doing.

    I've held a few peon IT positions, I've had different attitudes during them. My starting job, I was opinionated and high profile, and just got myself in a world of crap. I soon learned that the less you're heard from, the less unneeded attention comes your way. Now theres a danger that your job can get too cushy and you can goof off too much and get in trouble, but a steady application of self motivation can help you steer clear of trouble.

    Instead of arguing about upper level decisions, "advise and persuade", and if ever a decision of yours proves it would have been better instead of the way management actually went, do not rub it in!. If a decision recommended by you is subsequently championed by someone else without acknowledgement of its origion, congratulate them on their creativity. I once walked in on my boss snoozing on his desk, I told him he should take it easier, he was wearing himself out. (Good boss tho, plus a new father so 3 am feedings were taking a toll.)

    Its a wonderful thing, these periodic paychecks, and even better if you get to hack in an airconditioned environment to get them. Pragmatism goes a long way.