1

Hypothetical situation: Miss X, a software developer with 10 years of experience, has obtained a new job. On her first day she logs into her desktop computer and the operating system requests that she chooses a password.

A few minutes later her line manager comes to talk to her and asks her to write the password to a piece of paper, place it inside an envelope, and seal and sign that envelope. He explains that if he needs access to the account when she is unreachable, he will open the envelope and use the password.

In USA, can Miss X legally decline the request for her password?

  • 1
    Of course. And in most places the line manager can fire her on the spot, no questions asked. – Patrick87 Feb 2 '16 at 16:00
  • Is the company in question publicly traded or otherwise covered by the Sarbanes-Oxley Act? – user662852 Feb 2 '16 at 19:55
  • Regardless of legality, this is a very bad security practice. – D M Jun 13 at 21:27
2

If the company in question is publicly traded or otherwise covered by the Sarbanes Oxley Act, the new employee should confirm this is the true corporate policy (maybe it is!) as opposed to the manager going off script.

SOX requires companies to have sufficient internal controls to prevent fraud on public shareholders. If this 10 year experienced software engineer's credentials would grant access to the ERP system, financial systems or underlying databases, I would be deeply surprised if a big-five accounting firm conducting a Section 404 risk assessment signed off on a corporate IT policy of storing paper copies of login credentials in a supervisor's desk. That said, it's the company and their auditors who get to decide, so I can't say this could never be a corporate policy.

2

IANAL, but: as an employee, you are working for a company that owns your work, a manager that manages you, as well as any software/IP you produce, the PC and network you use, etc. So they can require a copy of your login/password to the network.

In a way, the manager and the company as a whole doesn't need a copy of your password; I'm sure the network administrator has root access to all accounts on the network, can access the passwords, and can change them at will to give or prevent your access.

By asking to "write the password to a piece of paper, place it inside an envelope, and seal and sign that envelope," the manager is reasonable in needing "access to the account when she is unreachable," i.e. out for the week, during a network security situation, or after you don't work there anymore.

They may also want some sort of paper trail of your original password rather than depend on the network. That motivation is their own management style, possibly in conjunction with the network administrator, and/or some requirement thought necessary by the legal department.

If you decline, they may tell you the network administrator has your password anyway. But, to decline such a request as a new employee is not a good idea.

2

In USA, can Miss X legally decline the request for her password?

Yes, she can legally decline and the employer can legally fire her.

2

She can decline it but can also be fired for refusing to provide it. She created a password for use on company equipment and accounts; of course it is the company's right to access those things.

It is, however, a bad security practice to have a plaintext password exist, and leaves her open to a risk of someone misusing her login. It also leaves the company looking a little worse in the press (especially the technical press) or a jury if there is a data breach in which employee passwords are compromised, even by phishing or an unrelated means.

So from the perspective of the employee, this becomes more a question of how to navigate the situation professionally than it is a legal one. I would ask how to address the issue over on https://workplace.stackexchange.com/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.