As alarming as these findings may seem, according to other IT professionals, this is actually pretty commonplace. Of course many IT professionals think that reading a co-workers love e-mail to his girlfriend is harmless.

But just because the IT admin is not finding the co workers bank account password and snooping around in their online banking doesn't mean it's not wrong. Either way you are invading someone else's privacy!

As unfair as it may see, many It professionals even get paid higher to keep information confidential. You would think people would have higher morals and keep the secrets that their jobs entail because it's their job. But now they're getting paid MORE for doing what should already be part of their job. What is this world coming to?

Perhaps the answer lies in looking for security solutions that are not 100% handled by 1 person. For example, using an in-house server hosted by a security company to encrypt confidential files and not giving the IT admin the keys to decrypt the data.

Personally I believe that unless I have to view the contents of a file in order to fix a problem I have no reason to access that (or any) file. If the file I need to access is a data file then I seek specific authorization to view the required file(s). Anything less is unethical and potentially dangerous to me. Ignoring my ethical and moral obligations to my client, not snooping in what is none of my business if good for me.

Law enforcement organizations encourage snooping, under the guise of "protecting us" so that people will rat each other out over percieved "wrongs", saving energy and money from the authorities actually doing their own work.

Organizations are often guilty of creating the circumstances leading to security breaches because they are interested only in making money with no willingness to spend what is needed to do the right thing. And what is the right thing you ask? Not my problem in this instance because we should ALL be thinking of "What is the right thing to do?".

I'm not sure what batch of criminals were surveyed but I for one do not "snoop" around in my user's personal data even though I could. I think of it like an accountant that handles millions or even billions of dollars in transactions. The vast amounts of money mean nothing, they're just the things that he/she is charged with managing. Same thing for me and IT systems. I pay no attention to personal info on my servers and, in fact, make it a point to not even pay any attention to what I see in someone's inbox when troubleshooting an e-mail client issue. I'll double-click on a message to verify that it opens but I won't give a thought to what might be contained in the message. Also, my users and managers trust me so even if I am put in a position to have to view confidential materials, it is understood that it will remain confidential. Trusting your IT people has to come with the territory. I don't here anyone chirping about how at-risk HR data is because the HR staff have access to it. I'm sure that in any position that requires confidentiality, you will find a percentage of people who abuse their access to privileged information. "Pssst...You wanna know how much the boss makes??"

>>>>>>>>>
But just because the IT admin is not finding the co workers bank account password and snooping around in their online banking doesn't mean it's not wrong. Either way you are invading someone else's privacy!
>>>>>>>

As a sidenote, it's not "Someone's" privacy, it's the company's privacy. Personally, I love employees who use the company's email to send personal email, some harmless and some down right criminal, and then turn around and complain that the company is monitoring and *gasp* even reading "their" email.

IT personnel, or any personnel, are charged with a certain level of professional and ethics and like everyone else, should be discplined when that trust, professional or ethics are broken.

This study was done in England, where it is often illegal to look at personal files of employees. This type of activity is COMPLETELY legal in the US, I believe having been re-affirmed by the courts as recently as a half year ago. The US courts consistently find that a work computer is just that: if a person places personal information on it it is subject to being viewed, deleted, whatever by the company that person works for.

The author(s) should have mentioned this as it is a case of apples and oranges.

For many years I had access to my boss's user directory, as well as those of several other managers. Did I "snoop"? NO!!!! I'd stumble upon things occasionally when asked to fix something, but, like most people who have access to confidential information, I certainly didn't go looking for things or divulging what I knew.

I think the basic problem is a lack of maturity amongst IT professionals today. Reading others' e-mails "because you can" is sophomoric at best and blatantly illegal at worst.

I'm a consultant who works for many small businesses, and for consumers on occasion. My policy is to behave like a physician or psychologist or priest: what's on the machine under examination does not belong to me, and whatever I may happen to see in the course of my work is none of my business whatsoever.

And I've seen some things in the 20+ years I've been doing this, believe me.

To abuse the trust of the people who pay me by actively snooping their data has never crossed my mind, and I am personally outraged that some jackasses feel comfortable enough about their contemptible practices to brag about them. In my opinion, people who get caught abusing their access to other people's data are slime, should be publicly outed and shamed, and should be prevented from working in IT ever again, perhaps by means of registries analogous to the sex offender's registries now so commonplace.

One strike and you're out. This is too important. I understand the dangers of false positives, so due process would have to be designed and implemented, but clearly we need someone to guard the guardians. Unfortunately.

My philosophy on peeking was simple, because I have access to all the keys, I am the first person who is looked at when something leaks. I had full access to everything in the shop and never peeked. In fact, I did not what to know what was in the files. My reward was trust. If that were lost, I would become useless.