Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
I worked as a developer in a company and I had some of the employees' passwords. They are saved in my Google account.
What are the consequences of using these passwords to enter as another person? Assuming that I entered them in a program that I created.
I infer from the use of the past tense "worked" that you no longer work for the company in question. Also, from the fact that you are wondering whether there might be negative consequences, I infer that you do not have permission to use the systems in question.
The specific consequences will depend on where the company and its computers are located, as well as on the nature of the systems you log in to and on what you do with those systems, but it's certainly possible to receive a penalty of several years' imprisonment. The fact that you created the system in question makes no difference.
There is no country tag, but for example in france, that would be:
2 years in prison and 60.000€ fine just for getting in.
3 years in prison and 100.000€ fine if you modify anything.
5 years in prison and 150.000€ fine if what you are accessing is state-owned.
https://www.legifrance.gouv.fr/codes/id/LEGISCTA000006149839/
Unauthorized access of a computer system is often treated as breaking and entering, theft, and/or vandalism/destruction of property, depending on what you do while in the system; many jurisdictions have specific laws that reframe those concepts in terms of computer access, such as the Computer Fraud and Abuse Act of 1986 (united-states).
The legal portion of this answer has already been pretty succinctly covered by a couple other users. But I wanted to add some additional things to keep in mind.
As @phyrfox notes in their answer, under US law this would be considered a crime under the Computer Fraud and Abuse Act. A few more things to keep in mind for the Computer Fraud and Abuse Act (Personal experience reference, basing the following two points off of what I learned in my Computer Science ethics course):
In your scenario, the first bullet point is probably the most important. You would be accessing the systems of a company ( or accounts of employees of a company ) that no longer employs you and so you've lost authorized access to that system.
To throw in my two cents as a professional developer, I'd also note that the scenario you've described would be a pretty clear ethical violation and most people would expect you to know that. I wouldn't be surprised if you had signed documents at the start of the job stating that you acknowledge actions like that would be a violation of company conduct policies. This is to say that I doubt any employer or criminal investigator would be sympathetic to "I didn't know it was wrong/illegal".
I'd also be curious why you had employee passwords in the first place. Personally I'm having a hard time thinking of why you would ever need to know the login passwords of other users. If you needed to do something for a user, you should either have had the admin privileges to do it directly in the system or you should have walked the employee through what they needed to do once they are signed into their own account on their own computer. But even if there were legitimate reasons to have them and/or it was normal for your work place, I would think it would have been expected of you to remove those passwords from your account the second you no longer needed them for the relevant task. Again, this brings us back to some of the precision around what constitutes "authorized access" of a system. The legality of someone's actions in your scenario depends on them only using those passwords within the time frame and for the reasons that were specifically expected of them to perform their job.
What are the consequences of using these passwords to enter as another person?
Assuming the passwords were used in the way described and was unauthorised, as a minimum this would be an offence contrary to section 1 of the Computer Misuse Act 1990, (with emboldened consequences):
(1) A person is guilty of an offence if—
(a) he causes a computer to perform any function with intent to secure access to any program or data held in any computer, or to enable any such access to be secured;
(b) the access he intends to secure, or to enable to be secured, is unauthorised; and
(c) he knows at the time when he causes the computer to perform the function that that is the case.
(2) The intent a person has to have to commit an offence under this section need not be directed at—
- (a) any particular program or data;
(b) a program or data of any particular kind; or
(c) a program or data held in any particular computer.
(3) A person guilty of an offence under this section shall be liable—
(a) on summary conviction in England and Wales, to imprisonment for a term not exceeding 12 months or to a fine not exceeding the statutory maximum or to both;
(b) on summary conviction in Scotland, to imprisonment for a term not exceeding 12 months or to a fine not exceeding the statutory maximum or to both;
(c) on conviction on indictment, to imprisonment for a term not exceeding two years or to a fine or to both.
Depending on what actions are taken, there are more serious/aggravating offences at:
Section 2 - Unauthorised access with intent to commit or facilitate commission of further offences.
Section 3 - Unauthorised acts with intent to impair, or with recklessness as to impairing, operation of computer, etc.
Section 3ZA - Unauthorised acts causing, or creating risk of, serious damage.
If you had your own password, you were at some time authorised to access these computers using your password. It is most likely the case that you are not authorised anymore after leaving your job. If the company messed up and didn't prevent the use of your password, then the fact that you are capable of getting to their computers still doesn't mean you are authorised.
If you had access to other people's passwords, you quite likely were never authorised to use them to get access to the company's computer. (I had access to ONE password of my boss that I was authorised to use for one specific set of purposes - after leaving the company I was absolutely NOT authorised anymore). So here you are just as unauthorised, but it would be much harder for you to come up with a halfway reasonable excuse for using your colleagues' passwords.
So don't use them. Destroy them. On your last day you should have informed the company which passwords you have, and leave it to them to decide if they trust you to destroy them, or to block those passwords. In my case, the password was destroyed on all computers that I have in my possession, and I would not dare even trying to see if the password still works if I hadn't destroyed it.
If yes, the worst you might be guilty of is breaking the website's Terms of Service.
If no, you're breaking the computer hacking laws in your jurisdiction. The exact laws obviously differ from jurisdiction to jurisdiction, but signing into services with another person's account is a universally covered scenario, and almost always comes with criminal punishments (ie: jailtime is a strong possibility)
EDIT: The fact that you saved the passwords of other employees into a personal Google account can also constitute a criminal offense; you almost certainly did not have permission to take those passwords away from company systems.
You need to be "Authorised". Depending upon the circumstances under which you came into possession of credentials, and any further binding obligations, you may or may not be "Authorised".
As the facts are stated, you should not even possess these credentials, let alone use them. It is a very serious matter for an ex-employee to be using shared credentials (or their own), even under the table and off the books. Depending upon your jurisdiction your access may be considered de facto evidence of a more serious act of mischief. In any case you will damage the owner of the installation if they are subject to mandatory breach reporting.
...and it is not necessarily what you have done, but what you are perceived to have done.. You would not want to be relying upon "A friend of the court" to clarify the circumstances, or the law, to the technological laity.
Plenty of examples, consider Warren Simondson, a former supplier of McKays Solicitors (Australia). It does not take much.
If it is email accounts then there is the real possibility the company pays and owns the business email accounts and if you have there permission to use it you are not breaking any laws. A lot of private github accounts are also paid for by companies. You are given access to upload your work there but that account is not the employees property. Also, the work pc is not the employees property.
It is unlikely that any work you do from your work pc will be done from accounts that are yours.
Well if you are a developer you might have come across a few licensing agreements to certain software you'd have applied to use before.
depending on the license you have been granted, it either allows you to do as you please or be found guilty of a crime, so it's a 50/50 case also depending on geographical differences
