Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
An employee is using some easy guessable reused passwords well known to Have I Been Pwned.
OUCH.
Something bad happens.
Can an employee be sued?
Option A: An organization does not have password policy.
Option B: An organization has a policy but does not enforce it
Firstly: that depends on the jurisdiction. It might not even be possible at all for employers to attempt to sue their own employees for damages caused by negligence.
Even terminating an employment contract for reasons of negligence is quite difficult in many jurisdictions.
Second, if it is possible, the question is wether such legal proceedings could be expected to be successful.
Employees making mistakes is part of the risk of doing business, and distinguishing a "mistake" from "negligence", "gross negligence" , or "intentional wrongdoing" by the employee ought to place quite a burden of proof on the employer.
To be held negligent in the first place, the employer will have to to prove that the employee was aware of the fact that the password they used was common, well-known and extremely insecure.
Knowledge of which passwords are common and well-known is, unless you are considered a skilled IT security professional, not something that a typical employee can reasonably be expected to know.
Before there can be a case for negligence by the employee, the employer needs to make a strong case that:
It depends (of course). Has the employee been negligent? Did the employee know (or should they have known) that using a bad password was a bad idea?
If the employer had a password policy which they enforced, then presumably the breach would not have occurred. (Although PasswordOctober19! will pass almost all rules but is a very weak password.)
If the organization does not have a policy then it is unreasonable to expect most employees to know that weak passwords are a bad idea (I bet my sister has very little idea of what actually makes a strong password).
If the organization does have a policy but don't enforce it, then I suspect it still unreasonable to expect most employees to know that weak passwords are a bad idea.
However, there might be some other reason for the employee to know that their passwords need to be good. For example, they might be consultants who advise other companies how to go about securing their IT assets. In that situation, a case for negligence might be a lot easier to make out.
Can an employee be sued?
Option A: An organization does not have password policy.
Option B: An organization has a policy but does not enforce it
It would be up to the jury (or judge in a bench trial) to decide based upon the facts in that particular case following an evidentiary trial on the merits. There is no black and white rule of law to resolve the issue in the abstract.
First of all, anyone can be sued by anyone with writing materials and money to pay the filing fee. What people usually mean when they say "can X be sued?", however, is whether there is a valid legal basis for imposing civil liability under the circumstances in a lawsuit against X.
To answer the latter question, the first question that needs to be considered is would be who is suing the employee.
Is it a third-party harmed by the inadequate password policy or the employer?
A third-party could hold both the employee and the company liable for even simple negligence absent a contractual waiver of liability by the third-party, assuming that the third-party were able to learn which employee was at fault. In many cases, however, there would be a contractual waiver of liability, in which case gross negligence would have to be shown (whether or not the waiver purported to waive liability beyond mere simple negligence).
The determination of whether the conduct amounts to negligence, gross negligence or was not negligent would ordinarily be a question of fact to be decided after an evidentiary trial on the merits, for the jury (or in a bench trial, the judge), and not a question that could be resolved as a matter of law prior to trial or on appeal.
The negligence of the employee would be evaluated by the fact finder at trial in the context of a reasonable person in the employee's shoes, while the employer's liability would be broader because it would include the question of whether it was negligent for failing to put a policy in place, or otherwise take measures to insure better security.
I could see this fact pattern going either way, both on the issue of employee liability and on the issue of company liability. It would come down to the jury's sense of what was reasonable, the expert testimony on what was reasonable, and the testimony of the lay witnesses involved in the case.
The legal standard for negligence under what is known as the "Learned Hand test" after the judge who devised it, is that conduct is negligent if the foreseeable harm of not taking a precaution times the likelihood of that harm occurring if the precaution is not taken, exceeds the cost of taking the precaution. (Gross negligence requires that this standard to be met and also for the risk to be such that it is serious, blatant and obvious to any reasonable person even if it wasn't subjectively evaluated in that manner by the person being sued.)
So, while the test of negligence is basically "objective" the facts presented would need to show how foreseeable the harm would have been, and how likely a reasonable person would have believed it to be that the failure to take a precaution would result in a harm of the kind that occurred that was significant.
For example, failure to use care in setting a password that allows someone else to pay a third-party's utility bill might not be serious enough to rise to negligence let alone gross negligence unless that person also had any reason to foresee that it would allow a hacker to hack the third-party's bank account information and clean out their bank accounts.
In the same vein, the case for liability would be stronger if someone clearly warned the company and the employee of the risks and laid out the likely consequences of not doing so, and then that happened, especially if the person providing the warning and the victim of the lack of security were the same person.
(There are some fine questions of legal theory and case law go into issues like if there is negligence liability to fail to take a precaution when the dominant concern of a reasonable person, such as an intentional hack to steal financial account information, doesn't occur, but some far less probable risk, like an accidental deletion of critical files by a baby or cat left unattended at the keyboard, does occur and causes a much less likely but foreseeable harm.)
The existence of a policy would help on the issue of liability, but would not be a complete defense. Having a policy and not enforcing it could conceivably be worse than not having a policy at all, as it would show an awareness of the risk and failure to take reasonable care anyway. But, these would all be questions of fact for a fact finder (i.e. the jury, or the judge in a bench trial) at trial, not a matter of law.
If the employee was held to have liability, the company would have vicarious liability (unless it was a government agency in the U.S.), but the company could have liability other than vicarious liability for failure to have adequate policies in force, or for failing to implement policies that only existed on paper, even if the employee was not held liable.
The theory of relief if the company sued the employee would be different. This would be based upon a breach of a duty of care arising under the fiduciary agency-principal relationship of an employee and an employer. Failure to observe a written policy of the employer would hurt the employee's case, although not as much if the policy wasn't enforced as if it was enforced or emphasized. But, this would still ultimately be an issue of fact to be decided at trial.
This suit would also be more likely to be a bench trial than a jury trial, as the existence of a right to a jury trial in a case like this one is not clear, because internal company matters and disputes between agents and principals were historically handled mostly in courts of equity, and cases that historically were handled in courts of equity are not eligible for trials by jury.
The finder of fact would probably be predisposed to find in favor of the employee, notwithstanding the law it was instructed upon, because it is very rare for employers to sue employees for failing to perform their duties competently, as opposed to merely firing them for failing to do so, in practice, and in light of that background, and the fact that almost all jurors and judges have been employees in their lives, while far fewer have been employers, they would tend to see the issue from the employees perspective. The prevailing understanding in the community about the kind of circumstances when an employee should be liable to an employer has considerable influence on a judge or jury since that person has so much discretion.
Option A: definitely no. There is no possibility for that to happen.
Option B: Maybe. It really depends in what actually the company did after creating the policy.
a) informed the users about it
a.1) have no proof of informing all users --> No.
a.2) have proof of informing all users --> Maybe
b) made all the users sign that have been informed --> YES
So basically, if the user signed of being informed and then did not respect that policy it can be sued for it.
Password123is not a reasonably secure password by any measure, yet it was found over 22000 times in the HIBP database.