Ex employee accessing emails

[paoloh]

An employee quit, so we changed the password, not knowing that their Smartphone would still keep them logged in.

They forwarded to some emails to their private email address after leaving the company.

Is this illegal?

[Obiwonkeyblokey]

more than likely breaches your internet and computer policy which they no doubt signed.

[TurricanII]

Computer misuse act 1990 might apply:

A person is guilty of an offence if—

(a) he causes a computer to perform any function with intent to secure access to any program or data held in any computer [F1, or to enable any such access to be secured]F1 ;

(b) the access he intends to secure [F2, or to enable to be secured,]F2 is unauthorised; and

(c) he knows at the time when he causes the computer to perform the function that that is the case.

Is it worth a costly forensically sound investigation and is there any chance of a benefit to the business? If not then a wordy lawyer's letter. If so then call NCC group who I have used before:

https://www.nccgroup.com/en/our-services/security-...

I would keep a server backup tape/drive containing a full copy of any email servers/log files in a locked place and record a chain of custody for that data. I have presented the police with a log file showing attempted hacking and got a blank response (I was hoping for a caution or at least some sort of investigation). If you have to act then a lawyer is, I guess, essential. Check any business insurance for legal cover although I would be surprised if expenses are covered without specialist provisions.

ETA: You might get a good reply in the Computer and Gadgets forum, particularly from Marshalla.

Edited by TurricanII on Wednesday 12th November 22:16

Edited by TurricanII on Wednesday 12th November 22:21

[Kudos]

I recently acted as an expert witness for a company whereby an employee was sending stuff to personal account. Think he was being done for theft or something (not my area).

So, yes there is something you can do. Difficult though. Can you prove it?

[sneijder]

Are you sure he' s still logged in and not guessed / been given the password ?

If I change my address in Outlook, my IPhone won't access new mail, perhaps he can only see old mail ?

[TurricanII]

It could be a Blackberry BES system which would not stop synchronising emails due to a Windows password change. iPhone and Android devices should indeed stop working upon a password change. Did someone competent change the password? Is there an inbox rule to forward email out to external mailbox (which would also survive a password change)? Your IT dept/provider should have some 'leaver' routine checks for such things.

[CDP]

paoloh said:

An employee quit, so we changed the password, not knowing that their Smartphone would still keep them logged in.

They forwarded to some emails to their private email address after leaving the company.

Is this illegal?

I don't know what the legality on his part is but it's possible you've breached the Data Protection Act so action could backfire badly. Were the emails that damaging to your company? (Or would they form a very good basis of an unfair dismissal case?)