Being set up to be sacked.
 

I have recently been suspended from work but expect to be back soon- nothing dodgy at all- but to " allow an investigation to take place".
I have learnt that some people have been 'working' on my computer (work owned) for some 2 weeks during my absence and lordy knows what they are doing.
I have warned that I am being set up to be sacked.
I can honestly state that there was nothing dodgy on the computer whatsoever when I left- but wondered if files could be 'backdated' onto my computer during my absence and then I get blamed and dismissed. If the computer clock and calendar is changed - is this the date shown as installation?
Is there any way to see when files were actually added despite clock etc being changed?
It might sound a tad paranoid- but I have worries.
Is there a way of finding out what's been looked at in the last 3 weeks?
Software?
Is there a way of finding what software might have been added and 'hidden'?

MS windows 7 os.
Thanks in advance.

I'm afraid it's quite easy to alter the timestamp of files using a version of the 'touch' command without needing to alter the computer's clock..

jimgriff,

I'm afraid you're just going to have to let events run their course.

The answer is "maybe, perhaps", but you probably don't have sufficient permissions on a work computer under your username to enable you to do the digging you need. Nor would any digging you do stand up in court because it would not be forensic.

By all means go for the employment tribunal if you feel aggrieved.

Be sure and get the names of any that have been working on your computer (log-ins etc.)

If they all work in the IT dept then there is no need for worry anymore.

If the computer has been compromised allowing the company itself to get hacked, expect the investigation will go much further without your assistance.

I'm not accusing you of anything but there is something you need to consider. If there had been anything on the computer that (in their view) should not have been there, and you deleted it before leaving, there are still plenty of traces of it that the IT guys can find. Could you find yourself in such a situation?

Or did you mean that there has NEVER been anything dodgy on your computer?

Hopefully it's the latter.

All the computers I ever took home from work had something dodgy on them at one time or the other that I wouldn't want IT to find. The best I could do was to keep a low profile so IT wouldn't have to dig deep other than a quick scan and delete.

Of course one could always accidently lose the computer.

I saw a high level manager get a new career assignment once when his computer froze up and IT had to dig deep to find the problem.

In this day and age I would opt to have two computers in my travels . One for work and one for my own use.

Maybe it's your anonymous PPRuNe account that's done it. Some work types just don't have a sense for anything and will be wondering why you don't post using your real name.

Not legally admissible, or at least very much unlikely to be so without a great deal of hard work and supporting evidence.

Booting from USB doesn't prevent you writing to the hard drive, does it !

A decent IT department will block USB boot anyway.

As I said, he shouldn't play detective unless he knows what he's doing. Let events play their course and follow normal procedures (employment tribunal etc) if he feels aggrieved. Leave Sherlock Holmes to those with experience.

It stops anything being written in the event log or registry. FOM.

Says who ?

You can write to the drive, therefore you can tamper with the event log, registry or whatever you like.

Booting off USB/CD whatever is in no way the same thing as a proper hardware forensic bridge.

if you have never been sacked or retrenched the prospect of it is terrifying.
once you have had all this happen though it no longer holds any great emotion.

if that was happening to me I would walk away and get a job somewhere else.

Thanks for responses so far.
It might be worth noting the following:

I have to have my job to pay mortgage- no job- no house.
I have a young family.
I cant just walk into a job that pays as well as this. I have been in post for 14 years.
I have no savings so cant fight them or employ IT forensic service. Its a stand alone PC not a laptop- we don't have an IT department.

Jim - while the usual combatants squabble here, may I wish you good luck. Do you have a union representation?

Yes likewise Jim. I wish you all the best for the future. Whilst it may prove difficult to win the fight to keep your job, I can attest that this development may actually result in opportunities that are an improvement overall.

You will face stress but remember that clouds really can have silver linings.

Keep us posted.

Best of luck
Exeng

I've been fired twice. The first was on a trumped up excuse to replace me with the son of the country GM, an 18 year old youth who wanted to live in CPT, had no experience in the industry, and turned out to be a disgrace to the company. I got a good package of both remuneration and benefits, and went on to far better things.

The second was when I engineered being fired from a company in which I was utterly miserable, and I derived even greater benefits in every sense of the word from the situation. Subsequently they asked me to go back and work for them as a consultant, thus on my terms and conditions, enabling me to continue to enjoy the core activity but not suffer the politics, backstabbing, and bureaucracy which had soured the job.

As someone else said, once it's happened, it holds no fear. Turn it to your advantage.

Unless the law has changed that would come under the heading of contrived dismissal. It matters not whether it is the company or one of their paid staff it still stands.

It will need clarifying but the perpetrator(s) could finish up at a tribunal and if proven could lose their job.

Would be interesting to see who warned you that you were being set up to get the sack. I think it's just employee speculation and nothing more as it is unlikely management would speak that way.

If the worst happens lodge a claim with the work tribunal straight away, you can always cancel later. If you do take it to tribunal you have to be really honest with yourself and expect both sides to come out slightly compromised, with the loser more compromised than the victor - that's how they operate. 14 years does hold significant weight at a tribunal if your record is clean.

In my sacking it came out in the tribunal wash that the HR manager got onto the phone to a lawyer straight away after a homo executive whom I've never seen or met decided he wanted to get rid of me. Of course the lawyer would say sack me as he would make a lot of money out of it - thereafter the rest was just a bogus charade. I received serious legal threats prior to the tribunal which I ignored. During the tribunal the lawyer was clutching at straws who if not attacking my personality would be looking at technicalities in the legislation - he even requested leave (delay) from the hearing. But representing myself I got 'em good and they coughed up loads of dollars - I made the 2% category.

Besides the win over 3 totally useless pieces of !!!! (lawyer, HR, executive), the experience was quite harrowing as I'm an engineer not a lawyer. I was always willing to drop the case had I found employment but my reputation had obviously been tarnished.

The most (apparently) innocent things can come back at you. While working at College, I ran a work safety course which included safety wear and uniforms. I accessed nurses uniforms as part on the project and was banned from my work computer for a week!

Were they wearing them at the time?


:uhoh:

Probably not - but he might have been.... :ooh:

jimgriff.

Good luck.

If it gets really hairy, do pm me. I've done much too much firing in my time, and can normally spot legal stuff vs unlawful stuff.
Plus, I've been fired twice, as has senior daughter. We get used to it in our house.

OK- me again- 9 weeks suspended now and so much illegality as to policy following and procedural errors etc it would be boring to list them here.
BUT-
They have now decided to hold a disciplinary hearing and it transpires that there are two images which are inappropriate on my PC that they are using as part of the disciplinary. There are one or two other issues which can be dealt with by robust and truthful argument- .
There images I hasten to add are NOT pornographic but not the kind of pictures (body piercing of genitlia(not erect)) etc that a civil servant should have on a work PC.
They are suggesting that I down loaded and e mailed them to my home e mail- which is used by my whole family by the way.
I can categorically state that I have never seen these two images ever before and have never downloaded such images- That is the truth.

I have never received the images on my home e mail either.
I guess there are a number of possible scenarios- Trojan/ virus /malware etc, Planted by a disgruntled boss?
My solicitor is writing to ask for a forensic analysis of the hard drive etc but the employer has not complied with any Freedom if info requests etc so far-
As they have been holding an 'investigation' for last 9 weeks they in my opinion should have been keeping a detailed log of who had been using the pc- am I right?
It is also strange that the dates of these so called downloads are after the control of all the server etc was handed over to one of the bosses to develop the website for the employers. Nothing has happened to that but it has all gone out of my control
Can Trojans etc actually do this kind of stuff without users knowledge?
I am very stressed and under strict medical attention for this whole thing and have lost over 2 stone with the worry.
I know that everyone in a similar situation says that they didn't do it- but I really haven't- I knew this could happen as you read in y first post.
Tribunals etc are not an option at moment and my solicitor is writing huge (costly letters) which I cant afford to pay for. We are using the kids savings to pay legal costs so far but that is running out.
Bottom line is that if I lose my job- I loose my house- I have no savings- which which to pay mortgage.
Any help would be handy.
Jimgriff

This is a public sector issue rather than you and a private company ? You might find a newspaper willing to help pay your solicitors fees ! :E

Your solicitor is asking for forensic analysis under the freedom of information act ? Time to change solicitor !

Depending what they've been doing with the PC it might be a bit late anyway, unfortunately. But hard to know without further info.

Trojans can do almost anything without the users knowledge, although the majority of trojans have a primary purpose of collecting personal information.

I wish you the very best, I really do, but there's very little we can do as its a bit of a needle in a haystack without knowing how your work IT is setup to make suggestions.

Do keep us updated.

All you have to do is deny you put the images there and ask them to clearly identify who did. The fact that they live on your computer's hard drive means nothing if your computer is networked.

Remember, the emphasis is for them to prove who put those images on your computer, if you don't know then you don't know, simples. 14 years working for this company is plenty to identify your character and if it's been good then that should count for a lot, otherwise it's a witch hunt which is also a question you are entitled to have answered as to why.

Regarding my own sacking, I just found out the HR manager responsible for it now works in a senior role in a government department servicing the general public. I have began a process asking whether she is a fit and proper person for the role and whether her own judgement is subject to gross discrimination as she had fabricated many lies in her written witness statement as was submitted during my court case. She aint gonna like it one bit but it serves her right - she made her own bed now she can sleep in it.

Just a thought; I bet you can find out when the images arrived on you pc. If they were "planted" then there is every chance the person wot fitted you up like, may not have known your schedule.

Might be worth a check - be a laugh if your schedule established an alibi for you and you could call on witnesses to say you were not online at the time.

Good luck.

BSD.

I don't know when I had the task of being the porn police at a local authority which had just implemented a PIA proxy blocker which blocked the user until they explained themselves. It was a 30min admin role to unblock the retired doctors in sexual health. It was only solved when I blocked the local football clubs website before some special tickets came on sale as per official policy on none council business with high traffic loads. Which then got me access to the head of council (well he came steaming round the door swearing) and he authorised them to be exempt from the proxy server. As he put it "John was my wifes gynaecologist for 25 years the man deserves a Victoria cross" HR were not happy from a policy point of view.

I wish you all the best, the more I hear about office politics in the Civil service the more I think the whole thing stinks.

I would suggest that:

1) Under the 'innocent until proven guilty' tenet, it would be the company that would need to employ an IT forensic service rather than yourself.
2) Any findings they come up with that form any part of a case against yourself should therefore be easily refuted unless they DO employ a forensic service.
3) In many cases, it doesn't necessarily matter what they find as to whether your job is in jeapordy or otherwise, as unless it's blatant misuse you won't get to hear about the reasons (unless you ask the questions and they're open about it all, which they're unlikely to do if it relates to subject-matter in which they're not expert, such as IT).
4) Have you signed a computer use policy as part of your employment? as if you don't have a proper IT dept that important aspect could possibly fall between the cracks. Any dismissal would normally depend upon non-adherence to that policy....which, if you haven't seen/signed one, is a bit of dodgy ground for the employer.

/Have done this from the employer side too many times.
/It's depressing how some employers try to hide behind technology instead of doing proper employee management themselves.
/All IMHO.

Further advice:

- Each file that is written to your hard drive has 4 datestamps. Some are easy/trivial to change, whereas others are considerably beyond the expertise of most users.
- If the PC in question is not solely for your use, and there are others who are capable of logging into it (even if on the same login), then the employer will be facing an uphill battle to prove that you were (a) logged in at the time, and (b) actively at your computer performing the task of downloading the images. For instance, you could have stepped away from the computer to make a cuppa, and someone with a grudge could have downloaded the images and then whistleblown.
- Timestamps of file creation/access are likely to be the key to any 'successful' dismissal of your services here, and if the computer is a standalone with no other IT infrastructure then the chances are that the timestamps retrieved will not be accurate or even bear any resemblance to accuracy.
- If they are alledging you downloaded the images and emailed them to your home email account, request the following:
1) The email address they believe it was sent to
2) The exact date and time stamp on the email
3) Whether the email went through their email systems or not
This should enable you to (a) find out whether the email address IS your home email, (b) find out whether your home email address service actually DID receive the email, (c) find out what time and date they believe the alleged offence occurred on, and (d) find out a lot about their method of investigation

As Mixture says, it sounds very much like your lawyer is crap or you're not understanding the process he's using. I would suggest talking more to him and finding out his credentials in this matter and how engaged he is with the process you're experiencing.

Thanks Mike B- enlightening.
The computer is on a small network of two with wifi access as well. There are newtwok connecting points throughout the building- It is not secured and computer does not have a unique login for every member of staff.
The images were not stored on the PC but were attached to three emails sent to my home e mail address which having checked have never arrived at my home e mail . It is an AOL account which my whole family use- kids and all. The images were found in "sent items" as attachments.- There was no actual message.
The e mail programme is using MS outlook . Any mail sent by anyone from the computer I use has my digital signature on it and my name on top of the address bar of the message.
I was in work on the day that they were sent and the computer was on- It is often left on for days at a time- I have no way of proving that I was in the office at the time.
A number of people use the machine and even more have had free access in the last 9 weeks - including the three that I know are leading this long established harassment campaign against me.
Does this help?
I know everyone would say this- but I really didn't do this.

Maybe I should add that after 9 weeks of suspension I have only just (5 days ago) been told of this 'find' and have been given a date of 5 days time to attend a disciplinary hearing to answer the charges so to speak.
I am going to insist that the matter be deferred until an examination of the hard drive is done or they actually prove that it was me that 'sent' the e mails- which I know I didn't do- which is why I asked if it was possible to be Trojan / virus/ piggyback activity.

They haven't a leg to stand on and if you had a decent lawyer or even union rep they would be sent packing with their tales between there legs.

I also suspect that it in breach of civil service guidelines for internet access as in theory every employer should be able to tell the police who was logged in where if there is any issues with illegal activity.

just stick to refusing to attend until they prove that you sent them. Until they do there is no charges to defend.

Jimgriff, does your office have rigidly enforced policy of locking computers whenever you go for a break, to the loo, or to a meeting? If not, and you did not lock your PC, then anyone could have used it. If, as you surmise, some of those with whom you work, 'have it in for you', they may even have arranged a diversion to get you away from your computer to do this.

From my experience, most employers will ask you to sign an IT usage policy, then, having done so, employees are more or less obliged to break the rules just to get their job done. Several companies at which I have worked have taken weeks, and in one case, even months to get a log-in for me. As a result, I was having to share a log-in of an existing employee, with all the risks that entails for both concerned.

Given your situation, you need to plan for every possible outcome. I would suggest:

1. Join the Union
2. See if your house insurance offers financial support for legal advice
3. Speak to the citizen's advice bureau.
4. Go through all your household expenditure and have a really serious cull of any non-essential outgoings. You need to explain to the family the seriousness of the situation to the family so they will support you.
5. Sell anything you are no longer use or can live without for a while. You need every penny of liquid reserves if you are to keep your house. As is often said, most people are only two mortgage payments away from repossession.
6. Get your CV up to date, Ask someone with up to date knowledge of writing CVs to check it for you (e.g. a contractor), or someone at a job agency. Then get it on as many job search engines and employment agencies as possible (I set myself a target of registering 100 CVs when I'm looking).
7. Be positive. Read books such as 'The magic of thinking big' and 'How to win friends and influence people'. Some people ridicule these books, but you will find successful people appreciate their value.
8. Look upon being suspended from work as a stroke of luck, to give you the time to find a better job and get out of the unpleasant rut you have found yourself in. There are a surprising number of people for whom getting sacked was the best thing that ever happened to them.
9. Do your own research into employment law and keep notes. Once your employer realize you can quote multiple specific cases and run rings around them, they will soon be wanting to settle out of court.

E-mail is one of the most abused and hackable software tools around. It may be easy to set it up but it takes considerable effort to secure an e-mail system and yours looks like it isn't, infact it's woeful. This is not your fault, it's your organisation's fault entirely for being ignorant and not engaging professional experts to secure it properly.

In your setup an unauthorised e-mail in your Sent folder could be achieved without even using your computer. For example, if your e-mails are stored on a central e-mail server, one can simply log into your POP/IMAP server from another computer using your credentials, which are easily discovered, and then send the unauthorised e-mail. Next time you log into your computer and run Outlook it will look like you sent the unauthorised e-mail.

The shoddy e-mail system you have described and the way it is being shared with other staff means it has too many ends open for abuse. Forensic investigation to cover all possible avenues of abuse would be prohibitively expensive, even for the company.

Seems to me you're dealing with @rseholes who just want to do you. Be sure to let them know that their e-mail system is not secured to worlds best pactices ( IT w@nk words) and can be subject to unauthorised abuse.

Funny how values change over time, 15 years ago I introduced this novelty called 'internet' to an organisation, about 4 months later the proxy logs showed that the finance manager was accessing deviant porn sites. I mentioned it to my manager, she had a direct chat with the finance manager, problem never occured again, everybody was happy.

I've been reading JimGriff's story particularly regarding his mortgage and how he needs this job etc.

Well, from what I've read, and unless there is something more serious that Jim hasn't told us about, the most serious offence he is accused of it that he emailed some less than tasteful pictures to himself from a work computer.

Well, f*ck me, give Jim a slap on the wrist and get on with life, did he offend a customer, did he steal anything, did he punch another staff member in the face, all of which might constitute 'gross misconduct' and dismissal.

If the answer to these are "no" then he is only accused of committing "misconduct" thus a verbal or written warning, which Jim can appeal against, is appropriate and Jim returns to work.

2 months suspension for sending oneself a dodgy email or few, this scenario stinks and were I Jim then, regardless of declaring my innocence, I would also fight them that this offence does not constitute "gross misconduct".

I had a scenario a number of years back, my employers had changed ownership and it was a case of out with the old and in with the new and, eventually, I was called in to the office to me made redundant.

It was blatant what they were doing and after a couple of redundancy hearings I told them straight "What you are doing is illegal, you know it, I know it and you know that I know it".

At that point they entered in to negotions of a compromise agreement and a brown envelope being passed in my direction!

Good luck Jim

Stupid suggestion.

Trying to be your own DIY hotshot lawyer based on what you read in some books is bad enough.

Doing so with employment law is asking for trouble and you are only going to embarrass yourself.

Employment law is incredibly complex and ever changing, especially as in this instance we are talking about UK/EU employment law, which is probably some of the most complex in the world !

When dealing with employment law, there is absolutely no choice but to employ the services of a good lawyer with a specialism in employment law and let them get on with the work. Not only will they be able to recite all the case law off the top of their head, but they will also have extensive real world experience.... stuff that you won't find in your library text books.

Everything I have told you is true- I'm not missing anything out.
I work for a council- a corporate body- who so far have not done things (suspension etc) by corporate decision. I know they didn't have a meeting as I have to be present at them all.
I have asked a number of times for minutes of a meeting where the decision was made to suspend me etc under freedom of info and haven't had a single response. - Illegal. There are loys of other infringements of Local Govt act which they seem to ignore.

I was given less than 2 days notice (after a nine week suspension) of a disciplinary hearing which I have called off.
I am in a union but they are slow to respond until things like tribunals etc kick in.
I have employed a specialist employment lawyer (£200+ an hour) but cant afford it.
The images are not illegal or porn- I am a magistrate and know what I am talking about there.- BUT they are saying 'inappropriate images'.
I know that I have never seen them before and I certainly didn't download them.
Of course there are options open to me to blow whistles, make complaints and raise a grievance etc but this would I think start a 'breakdown of trust' scenario where I would be forced to resign. Then claim unfair dismissal in an employment tribunal. IF I won that the compensation would be less than a years salary and I'm still screwed.
All the advice is good so far and some very interesting points raised etc. Thanks chaps and chapesses- keep it coming.

Have you checked all your insurance policies - building, home contents, car etc. - to see if you have legal cover?

It came in handy for us, once - we found we had legal expenses cover under our home contents insurance which enabled us to recover almost £10,000 in damages and expenses that we would probably not otherwise have succeeded in recouping, as we would not have risked the couple of thousand in fees to get advice and bring the case.

FBW

Disagree with you there mixture. I had a lawyer but he was full of sh!t so I got rid of him. What's not to say that he didn't contact the other side and made a deal with them to lose my case in reward for more money under the table - it happens?

So I went about it solo. I picked up the two volume Fair Work Act off the internet and a few other related documents. I downloaded about 10 transcripts of cases that were similar to mine. I spoke to Fair Work councilors for impartial advice. I learnt a lot and it wasn't that hard.

The other part of the law system was learning the formalities. I had marked a day to go see some actual public hearings but never did because I ran out of time.

The ugly and scary bit was dealing with the outrageous lies submitted as witness statements and the threats made by their lawyers including paying their $15K-$20K costs. I can tell you that it is not a comfortable feeling when you have been working hard for several years with obscenely early starts only to be outed on someone's whim, rapidly going broke, and fighting insurmountable attempts at being scorned and drowned.

It was obvious I had a strong case from the loud noise on the other side, for all I wanted out of them was the plain and simple truth for my dismissal - which I already knew was based on prejudice. In my readings I had come across an age old bit of law wisdom - never ask a question that you do not already know the answer to, and with that advice I nailed that bitch to the wall.

But even if you win, you still lose. Tribunals take months to be scheduled (mine took 8 months). During that period what do you tell your prospective new employer? Do you lie and get caught out later, do you tell the truth and fail the short-listing process. After you win and the termination becomes a resignation, how do you then explain the logic of "resigning" from a job to become unemployed? It really is a stinker of a position be in through no choice of your own.

Unlike my sudden and unexpected dismissal where it was the first thing performed by that person after coming back from 2 weeks leave (I was taken off site, denied a support person, codes were changed to be denied access back into the building, and sacked), Mr jimgriff is still lucky to be sitting in his office and should therefore request that he no longer be harassed until they can provide him with absolute and undeniable proof of their claims.

Just to say that the 'innocent until proved guilty' tenet does not apply in employment law. Or so I was told by my union when I was sacked.

In other words the employer does not have to prove 'beyond all reasonable doubt' etc.

Criminal law applies this, but not employment law.


Regards
Exeng

personal e mail privacy
 

As some of you may have read I was suspended from work last September on full pay. Trumped up charge and process for suspension was illegal.
I am to face a disciplinary hearing on Wednesday coming and it has now come out that some of the 'evidence' against me has been found on my personal AOL account.
I was not asked for permission from anyone to access this and am of the opinion that my privacy has been infringed. AOL is not used by my employer and it was my personal account. Password protected. But they have put in a letter to my solicitor that they have been through my personal e mail to get stuff to discipline me with- NOT porn I hasten to add.
Nowhere in the policy from work does it say they can monitor etc and I wonder if I can do anything about this? UK law please. Other countries may be different.
I had work permission to use computer for private use.
Breaches of Human Rights?

I still don't know why you think we can help you more than your solicitor(s). Are they no good??