9

I worked as a developer in a company and I had some of the employees' passwords. They are saved in my Google account.

What are the consequences of using these passwords to enter as another person? Assuming that I entered them in a program that I created.

15
  • 7
    Depends on the jurisdiction but unauthorized use of a computer system may be illegal. Either felony or misdemeanor in some US states.
    – doneal24
    Commented Mar 14, 2022 at 22:45
  • 12
    Is this related to your other question? Start talking to a lawyer instead of asking internet strangers.
    – Mast
    Commented Mar 15, 2022 at 6:59
  • 6
    One piece of advice, if that is your real name and photo on your profile, maybe change it... you may not want your past employer to see this kind of question/you admitting you have that information.
    – B-K
    Commented Mar 15, 2022 at 10:43
  • 7
    As a quick heads-up you will want to read this sentence: 46 months in federal prison for using old passwords of a former colleague "to just look at things"...justice.gov/usao-sdtx/pr/… Commented Mar 15, 2022 at 15:48
  • 6
    “some of the employees' passwords […] are saved in my Google account.” Is that your personal Google account, or one belonging to your previous employer? If your personal one, how did the passwords get saved there? Did your employer authorise that, and are they aware? (Or if a company account, are you still authorised to use it?)
    – gidds
    Commented Mar 15, 2022 at 17:42

10 Answers 10

42

I infer from the use of the past tense "worked" that you no longer work for the company in question. Also, from the fact that you are wondering whether there might be negative consequences, I infer that you do not have permission to use the systems in question.

The specific consequences will depend on where the company and its computers are located, as well as on the nature of the systems you log in to and on what you do with those systems, but it's certainly possible to receive a penalty of several years' imprisonment. The fact that you created the system in question makes no difference.

18
  • 21
    @Vasyl Yovdiy Yes for unauthorized access. Commented Mar 14, 2022 at 23:52
  • 19
    @ikenas If I go into your house without permission it's still illegal. If you found me on your couch watching your TV, would you accept my defence that I was "just watching"? That I hadn't damaged anything? That I used a key under the mat to let myself in, so it was therefore legitimate? The law certainly wouldn't, and I think you'd be glad for it.
    – J...
    Commented Mar 15, 2022 at 14:21
  • 11
    @timeskull The question does not seem to be about using someone else's Netflix account to binge some show. It's appears to be about unauthorized access of proprietary company systems for which most reasonable people do indeed find years in prison to be a reasonable response... as evidenced by the criminal laws against it in almost every modern democracy. An unauthorized user having access to a company's IT resources also "puts them at great risk" and that's putting it mildly.
    – reirab
    Commented Mar 15, 2022 at 15:11
  • 26
    @timeskull "Just watching" what's happening in a company's internal IT resources (without authorization) is quite literally industrial espionage.
    – reirab
    Commented Mar 15, 2022 at 15:16
  • 4
    @LinearChristmas I wouldn't agree. I would especially disagree with (1) not constituting espionage on its own. Espionage is the act of collecting the information (without authorization.) How (or whether) it's ultimately used to one's advantage is another matter. I would actually say pretty much the opposite: actually using the information once you already have it isn't espionage. Just collecting it is (according to both dictionary definitions and personal experience... I design software for counterintelligence gear.)
    – reirab
    Commented Mar 15, 2022 at 20:15
22

There is no country tag, but for example in , that would be:

  • 2 years in prison and 60.000€ fine just for getting in.

  • 3 years in prison and 100.000€ fine if you modify anything.

  • 5 years in prison and 150.000€ fine if what you are accessing is state-owned.

https://www.legifrance.gouv.fr/codes/id/LEGISCTA000006149839/

2
  • 3
    Are these additive sentences? Or do they replace each other as you go up the level of sentencing? Commented Mar 15, 2022 at 21:27
  • 7
    @AlexanderThe1st You can be sentenced on multiple counts, however, there is no additive serving of sentences in the French legal system, so you would only do the time, and pay the fine for the highest one.
    – Maxime
    Commented Mar 15, 2022 at 22:18
7

Unauthorized access of a computer system is often treated as breaking and entering, theft, and/or vandalism/destruction of property, depending on what you do while in the system; many jurisdictions have specific laws that reframe those concepts in terms of computer access, such as the Computer Fraud and Abuse Act of 1986 ().

7

The legal portion of this answer has already been pretty succinctly covered by a couple other users. But I wanted to add some additional things to keep in mind.

As @phyrfox notes in their answer, under US law this would be considered a crime under the Computer Fraud and Abuse Act. A few more things to keep in mind for the Computer Fraud and Abuse Act (Personal experience reference, basing the following two points off of what I learned in my Computer Science ethics course):

  • Unauthorized access can mean accessing a system you are no longer allowed to access, even if in the past you were allowed to access it. Think of it like using an old key to get into an office you used to work at; It would have been fine when you were actually still an employee, but if you don't work there anymore then it's just breaking and entering.
  • Unauthorized access can also mean accessing a system you are allowed to access, but accessing it in a way that goes beyond the reasons you were given access in the first place. For example, someone working customer service for a company probably has open access to customer files for the purposes of providing service to customers. If that employee were to access files so they could get someone's number and call them up to ask them for a date that would be a clear violation of the limitations on the access they were given.

In your scenario, the first bullet point is probably the most important. You would be accessing the systems of a company ( or accounts of employees of a company ) that no longer employs you and so you've lost authorized access to that system.

To throw in my two cents as a professional developer, I'd also note that the scenario you've described would be a pretty clear ethical violation and most people would expect you to know that. I wouldn't be surprised if you had signed documents at the start of the job stating that you acknowledge actions like that would be a violation of company conduct policies. This is to say that I doubt any employer or criminal investigator would be sympathetic to "I didn't know it was wrong/illegal".

I'd also be curious why you had employee passwords in the first place. Personally I'm having a hard time thinking of why you would ever need to know the login passwords of other users. If you needed to do something for a user, you should either have had the admin privileges to do it directly in the system or you should have walked the employee through what they needed to do once they are signed into their own account on their own computer. But even if there were legitimate reasons to have them and/or it was normal for your work place, I would think it would have been expected of you to remove those passwords from your account the second you no longer needed them for the relevant task. Again, this brings us back to some of the precision around what constitutes "authorized access" of a system. The legality of someone's actions in your scenario depends on them only using those passwords within the time frame and for the reasons that were specifically expected of them to perform their job.

2
  • 2
    As someone who does IT assistance for an institution: I only handle temporary passwords which become invalid once used and require setting a new password immediately after use. This way I can not know their real passwords, or - on-demand - lock out a user from the system by assigning a password [e.g. if they leave]. Technically I can make permanent passwords, but unless I do so for enumerated reasons, I violate the system integrity rules that ban me from having access to other people's accounts but for troubleshooting and fixing, after which I have to re-assign a new temporary password.
    – Trish
    Commented Mar 16, 2022 at 10:47
  • 1
    Of note: the CFAA applies only to a subset of all computers, specifically those either: a) belonging to the federal government, b) belonging to bank, or c) computers that are used in or that affect interstate or foreign commerce. But that means every computer connected to the Internet is protected under the CFAA, so the only computers that might fall outside the scope are your Arduino chips and your local media server (maybe, MAYBE, your alarm system)
    – moonman239
    Commented Mar 16, 2022 at 18:47
4

What are the consequences of using these passwords to enter as another person?

Assuming the passwords were used in the way described and was unauthorised, as a minimum this would be an offence contrary to section 1 of the Computer Misuse Act 1990, (with emboldened consequences):

(1) A person is guilty of an offence if—

  • (a) he causes a computer to perform any function with intent to secure access to any program or data held in any computer, or to enable any such access to be secured;

  • (b) the access he intends to secure, or to enable to be secured, is unauthorised; and

  • (c) he knows at the time when he causes the computer to perform the function that that is the case.

(2) The intent a person has to have to commit an offence under this section need not be directed at—

  • (a) any particular program or data;

(b) a program or data of any particular kind; or

(c) a program or data held in any particular computer.

(3) A person guilty of an offence under this section shall be liable—

  • (a) on summary conviction in England and Wales, to imprisonment for a term not exceeding 12 months or to a fine not exceeding the statutory maximum or to both;

  • (b) on summary conviction in Scotland, to imprisonment for a term not exceeding 12 months or to a fine not exceeding the statutory maximum or to both;

  • (c) on conviction on indictment, to imprisonment for a term not exceeding two years or to a fine or to both.

Depending on what actions are taken, there are more serious/aggravating offences at:

Section 2 - Unauthorised access with intent to commit or facilitate commission of further offences.

Section 3 - Unauthorised acts with intent to impair, or with recklessness as to impairing, operation of computer, etc.

Section 3ZA - Unauthorised acts causing, or creating risk of, serious damage.

0

If you had your own password, you were at some time authorised to access these computers using your password. It is most likely the case that you are not authorised anymore after leaving your job. If the company messed up and didn't prevent the use of your password, then the fact that you are capable of getting to their computers still doesn't mean you are authorised.

If you had access to other people's passwords, you quite likely were never authorised to use them to get access to the company's computer. (I had access to ONE password of my boss that I was authorised to use for one specific set of purposes - after leaving the company I was absolutely NOT authorised anymore). So here you are just as unauthorised, but it would be much harder for you to come up with a halfway reasonable excuse for using your colleagues' passwords.

So don't use them. Destroy them. On your last day you should have informed the company which passwords you have, and leave it to them to decide if they trust you to destroy them, or to block those passwords. In my case, the password was destroyed on all computers that I have in my possession, and I would not dare even trying to see if the password still works if I hadn't destroyed it.

0

Do you have permission from the account owner?

If yes, the worst you might be guilty of is breaking the website's Terms of Service.

If no, you're breaking the computer hacking laws in your jurisdiction. The exact laws obviously differ from jurisdiction to jurisdiction, but signing into services with another person's account is a universally covered scenario, and almost always comes with criminal punishments (ie: jailtime is a strong possibility)

EDIT: The fact that you saved the passwords of other employees into a personal Google account can also constitute a criminal offense; you almost certainly did not have permission to take those passwords away from company systems.

0

You need to be "Authorised". Depending upon the circumstances under which you came into possession of credentials, and any further binding obligations, you may or may not be "Authorised".

As the facts are stated, you should not even possess these credentials, let alone use them. It is a very serious matter for an ex-employee to be using shared credentials (or their own), even under the table and off the books. Depending upon your jurisdiction your access may be considered de facto evidence of a more serious act of mischief. In any case you will damage the owner of the installation if they are subject to mandatory breach reporting.

...and it is not necessarily what you have done, but what you are perceived to have done.. You would not want to be relying upon "A friend of the court" to clarify the circumstances, or the law, to the technological laity.

Plenty of examples, consider Warren Simondson, a former supplier of McKays Solicitors (Australia). It does not take much.

-2

If it is email accounts then there is the real possibility the company pays and owns the business email accounts and if you have there permission to use it you are not breaking any laws. A lot of private github accounts are also paid for by companies. You are given access to upload your work there but that account is not the employees property. Also, the work pc is not the employees property.

It is unlikely that any work you do from your work pc will be done from accounts that are yours.

-3

Well if you are a developer you might have come across a few licensing agreements to certain software you'd have applied to use before.

depending on the license you have been granted, it either allows you to do as you please or be found guilty of a crime, so it's a 50/50 case also depending on geographical differences

3
  • 2
    Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Commented Mar 15, 2022 at 16:36
  • What would happen if there is no license at all?
    – ikenas
    Commented Mar 15, 2022 at 17:15
  • At some point I had a license to use Microsoft Office for £14; that license was available to employees of companies that had a site license from Microsoft. The license become invalid when I left the company. (So if all your employees had a license to use the software at work, they could get a private license for £14, bound to their employment).
    – gnasher729
    Commented Mar 16, 2022 at 10:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .