Discussion on question by Papermate: How to convince workplace I'm innocent

Feeds

18:27

25

Q: How to convince workplace I'm innocent

I'm in a bit of a predicament. Last week, an e-mail went out to boss and a few others from my e-mail address. It contained a number of rude remarks and strange insults. Of course, I did NOT send this, and never do something like that. I told my boss as much, and I thought he would just let it ...

DJClayworth

Were these "rude remarks and strange insults" specifically about colleagues or the company? Did the email contain anything that makes it look like you wrote it? Or was it just random spewings of insulting profanity?

BSMP

Why did you expect your boss to just drop this? Are you two friends?

OldPadawan

From what you said, IT guys checked the email you supposedly sent. 1. did they really checked the headers to verify any attempt similar to spoofing? 2. were the attacks personal? (meaning, colleagues were clearly targeted and identified, or just random insults) 3. are there real evidence that was shown to you?

keshlam

If you've been hacked, there may be evidence of that on your machine. Offer to turn it over to IT for investigation. They may or may not be competent to evaluate it (see above re spoofing), but that's your best chance of convincing them that this is what happened.

user562904

@DJClayworth it was mostly spewing of profanity, but it did call out a couple of names, like my boss. Other than the e-mail coming from my e-mail address, there's nothing I can think of that makes it look like I wrote it. I've never written anything like this in my life, especially not at work. Most of the insults were stupid and weren't even that intelligible. It looks like a 13-year-old wrote it.

user562904

18:27

@BSMP I expected my boss to drop this, because I told him I didn't write this, and I have been a loyal employee who has never done anything like this. That should be enough.

user562904

@JoeStrazzere yes, I live alone.

user562904

@OldPadawan I have no idea what spoofing is and don't know enough about how about how they determined it supposedly came from my computer. (I don't even know if they're telling the truth about that). The insults were personal, but could have been written by anyone. Like, if I wrote "You're a big, stupid moron, OldPadawan, and nobody likes you!" That's more or less the style of insults in this e-mail.

user562904

@keshlam thanks, that's a good idea. I'll definitely offer to hand over my computer.

OldPadawan

@papermate : that's not spoofing, that's the truth :D

TheDemonLord

I’m voting to close this question because fundamentally, this is not a Workplace issue. This is an IT/Security issue. I work in the IT space and there is a point where if the email originated from your login, from your device at a time when you were working - then regardless of how much you protest your innocence - I'd say that you sent it. Conversely, if any of those deviate, then you have a gray area to say it wasn't you. But as above - this is a technical question, not a workplace question.

Job_September_2020

18:27

Do you use any app that allows coworkers to remotely access your computer and run apps on your computer ? An example of the remote access apps would be TeamViewer. -- BTW, do you know any coworker who may have played this prank (and he thought it were just a funny joke) ? It looks like the person who did this knows the emails of your boss and other workers, and intentionally send the email to them. So, he has knowledge of your team. This seems not a the work of random hacker because a random hacker gains nothing by doing this.

Gregory Currie

@TheDemonLord This is absolutely a workplace question. Even thought some answers may touch upon technical aspects, how the OP responds themselves is quite a different question.

CodeCaster

Are you on medication? Do you use drugs? Do you have a CO detector?

Neil

It would be very easy to find everyone in your company, via LinkedIn, guess their email address ([email protected]), find out the company email service IP address, and spoof an email to everyone in the company to look like it came from an internal PC. If that gets through the email spam filters into everyone's inbox is another matter , but it could certainly be done, without much difficulty.

Joel Etherton

@Job_September_2020 if someone remotely accessed the laptop it would only take reading a few emails to pick out some names and titles to target something like this without context.

MonkeyZeus

Request that the original email be forwarded to you as an attachment. You need to inspect the headers for spoofing. If it wasn't spoofed then your computer or credentials in general have been compromised. At minimum, change your password. You should also request that they specify whether the email was sent through your desktop client or through a web interface like OWA. As far as I can tell, they have not presented enough evidence against you. You might have to take responsibility and flak for having a compromised account but not for calling someone poopy face.

Blueriver

18:27

Are you sure they're blaming you and making a big deal of the rude remarks? If I were your boss and you told me what your question says, I'd confiscate your laptop IMMEDIATELY and start a full investigation. This is potentially a huge security breach, and company data or customers data might be compromised. Only after I was sure everything is ok would I actually consider whether you sent the email or not.

Stephan Branczyk

19:05

I'm with Blueriver on this. The question is. What steps have you taken since the hack? And how long has it been? If you've taken zero steps to scan your computer for malware, or zero steps to change your passwords, or zero steps report the potential breach to IT, or change all your passwords that your normally login from your computer, or change your AMEX card (if your card details were on your computer), then that probably doesn't bode well for your side of your story.

Ángel

21:22

It depends on the company policies, but employee should probably not be attempting to run a malware scan on the company computer. That should be done by IT (who was already informed, apparently, although I would open a request to them, anyway).

And if I were the company, I would probably request the device to perform a forensic investigation. Either to find malware there or to have an evidence that there isn't and the employee did send it (for the time the employee might fight back a dismissal).

Transcript for

Discussion on question by Papermate: …