It is unclear what exactly happened although it does not seem particularly serious. Why do you feel you need to report it? Why not just do what you were asked to and just strip out confidential/personal info?

@teego1967, it appears that no one asked for this - the poster decided to do it on his own. That changes the dynamic considerably.

@Roger, the initial email filtering was "on his own" as well? If so then this is egregious behavior, FAR WORSE than anything like unauthorized sharing of salary info. He should just stop doing it and never mention it again.

In ~20 years of work, I've only know of one situation where employee email was searched en masse. It was a situation where someone leaked sensitive strategic info in a power point to a trade journalist who reported it immediately. That was a decision from the top. An IT guy playing detective... that's just begging to be fired for cause.

Your profile says you're in Singapore, which appears (given my terribly basic research) to not have any laws about intercepting email. In the United States, what you're doing would be incredibly illegal!!!

"A part of my IT job I take upon myself is to sieve through outgoing employee emails" You take it upon yourself? Does this mean this "sieving" was your own idea, and not a directive from your manager? "I wanted to report on misconduct but I am worried about my unethical access. As an IT personnel, I have authorised access to all systems, but I feel I could have consulted with a director before proceeding with the search. I have no idea how the management will think/act if I reveal this." If not directed to do so my your boss, I'd probably fire you.

As much as we don't like what the OP did, I think the question itself is rather important and should not be downvoted. Also there's some interesting nuances here that could be explored like who, in fact, should have the ability to authorize snooping? Just the immediate manager? (I would even be wary of that).

There might be nuances, but the fact is that if the OP was in the UK, what they've done would appear to be a clear offence under Section 1 of the Computer Misuse Act 1990, i.e. unauthorised access to computer material, punishable by 6 months' imprisonment or a fine "not exceeding level 5 on the standard scale" (currently £5000). Given that, I suspect they'd be better off not exploring them!

@GwynEvans, I think the legality aspect is not very interesting from the point of view of this discussion, it may or may not be illegal in the UK or Singapore, or perhaps the company is very loose about what they permit their IT staff to do. Whatever the case, even if laws are strict and the OP caught, tried and found-guilty, the punishment is going to be wildly unpredictable (so it is laughably pointless to quote prison time and fine in £'s). The interesting thing here is the actual ethics of what is going on and the realities of when reading email of employees is acceptable.

@teego1967 "who should have the ability" is veering into contract, and possibly criminal in some areas, law, which is OT here of course.

@RobM, One is always given the advice that there is no expectation of privacy for work email, but there is hardly ever discussion about how and when this (violation of privacy) actually occurs, legally or illegally. That is what I am trying to get at.

And what I'm trying to get at is that discussion of legalities is off topic for this stack exchange. I'm not saying I always agree with that myself and I'm certainly not the ZOMG legal issues police but I see veering this question down that route as a good way to get it closed and delving into it in comments as a good way to get comments purged.

@RobM, I am expressly NOT interested in talking about legality, that was my whole point that you utterly missed. I fully expect the topic police to purge all this shortly. Just wanted to raise point.

@teego1967 I bet you that Singapore has some very rough laws on hacking and computer misuse that could be applied to crucify the op.

@Pepone actually I cannot find any explicitly stated.

This is funny. That would be completly legal on Brazil - Employee e-mail is considered a tool to the job, that is property of the business, not something that the employee "owns". Here, you normally have a explicity no-privacy policy on corporative mail. The reasoning is that if your superior or IT can't look at any given e-mail without express permission, that e-mail probably should not be sent on first place.

You could send an email to all the company through an anonymous email, with attachments of your findings, references or whatsoever.

"A part of my IT job I take upon myself is to sieve through outgoing employee emails" To me this raises an alarm. I'm not sure this is something you should be doing.

Being in IT, having high level access to everything requires a substantial level of discretion that you obviously don't have. If I caught, or found out about, anyone under me doing what you did, they'd be fired on the spot. It's a massive violation of the trust your position carries to go snooping through other employees' electronic stuff with no cause and no authorization. So... I personally hope you tell everyone what you did, as they clearly need to know you can't be trusted with the access you have.

@ThalesPereira, that is very interesting. In general we are universally told to expect that company email is never private and subject to scrutiny by the employer. In this case, however, the OP is being called out (correctly IMHO) for unethical behavior rising to the point where termination or legal action is on the table. The next, more interesting issue, is under what circumstances is "snooping" acceptable? If your boss tells you to do it, is that OK? If you are a manager and you want to see what your reports are doing, is it OK to read their email? Where is the line?

I don't know why everyone's going mental over this. There is no expectation of "privacy" on company servers. The communications you write in company emails using your company email account belong to the company. If you use a CRM like Goldmine all emails can be read by anyone in the organisation, automatically, simply by viewing their record history. I see this level of transparency as a good thing. If you want to make secret or confidential conversations with HR then do so in person, or over the phone. Not email; jesus! There is nothing wrong with IT reading company emails.

@LightnessRacesinOrbit: The issue isn't whether the company has the right to read employee email. Of course they do. The issue is whether an employee who technically has the capability but who has NOT been authorized to exercise it in this fashion does so. That's abuse of power. Quite frankly, there are a HOST of issues with allowing IT to randomly read company emails with no authorization. As a CEO, I would fire this guy so fast it would make his head spin. I'd likely have a serious talk with his boss as well.

@ChrisLively: So you're saying "of course" the employee has the right to read email but should anyway be fired for it "so fast it would make his head spin". Sounds like a pretty awful way to run a business. I would immediately leave an environment with such obnoxiously contradictory policies before you could get the words "you're fired" out of your mouth. And if you did get there first, I'd have you straight down to the employment tribunal. I mean, seriously, talk of "abuse of power"...

@Jake, I'd fire you in an instant.

@ChrisLively: Oh yes, I misread that part. Well, as I said, he absolutely has the right. I do think that sifting through emails "as routine" when it's not your job is likely to get you in trouble, but actually accessing the emails is certainly not grounds for the draconian actions you CEOs seem to think you have the right to take. If you ever acted that way to me, I hope you're keeping a few million spare for the unjust dismissal suit. I think we're seeing cultural differences here, though: I hear the US is pretty cut-throat in this regard. Just another reason you won't catch me working there.

Obligatory related link: bash.org/?258908

@LightnessRacesinOrbit: Others in this comment thread have covered UK law on this. Without specific authorization from management - which he didn't have - then Termination, fine and possible jail time are the very real outcomes.

Well... I suppose that this kind of stuff heavily depends on how you interprets "looking at e-mail". At several companies, the IT must manage every little bit of company e-mails, and yes, that includes sniffing out and actively searching for malicious e-mail. Regular e-mail inspection and audiction is a commom place job for IT. Come on, the IT people must actively act on heavily guarded data all the time. If you can't trust your IT, you are doing it wrong.

The issue isn't whether the company has the right to read employee email. Of course they do. This is not the case in a number of (or most?) European countries which consider e-mail conversations between individuals to fall under standard privacy laws regardless of who owns or operates the e-mail server. Accessing or intercepting communications without consent would be illegal.

A mod should move this entire comment thread to chat by the way...

@ChrisLively: Yeah I saw those comments. They seem totally inapplicable to me. It's disingenuous to suggest that "Unauthorised Data Access" covers authorised data access. Access to the email server and content therein will be an inherent part of the job. And, as I said, the emails are open in a sane company. You will have a very hard time sending someone to jail for reading those when they pop up in a list in your CRM.

@Lilienthal: As actors of a company on official company business using company servers, they are not "individuals" and privacy really does not apply. It is not their communication, but company communication. I'm seeing a lot of legal misinformation on this thread. :/ Disturbing to see so many supposed CEOs getting wet over the idea of firing people over this.

@LightnessRacesinOrbit As long as accounts are in individual names, emails sent to and from them constitute personal communication. ECHR8 covers exactly this kind of (electronic) correspondence but it's validity for corporate e-mail accounts is, in practice, a giant grey area. It seems like a reasonable expectation of privacy might be required for it to kick in (Atkinson v Community Gateway Association UKEAT/0457/12). In other words, unless an employee is warned that his communications might be monitored, he can reasonably expect that they will not be (see Copland v The United Kingdom).

@LightnessRacesinOrbit, what you seem to be missing is this: the mere fact that you're a company employee does not give you the right to act on the company's behalf in any situation that you see fit. I'm a C level employee of my company, but if I took it upon myself to write checks, I would justifiably be fired. This situation is no different; the employee went above and beyond his responsibilities, regardless of any general expectation of privacy re the email system.

@Roger Agreed on that. I am speaking only of the repeated claims in comments that he's done something illegal or that the specific act of reading emails is specifically grounds for dismissal. It's not. The problem is solely that he's stepping outside of his job description and not doing the work he's supposed to be doing but filling some other role instead.

Of course, writing cheques is entirely different. Then your actions may be covered under theft, even: you're spending someone else's money. You have no authorisation to play bank account holder. The same is not true of an IT tech with the company's emails.

With the emails, I'd still stick to a slap on the wrist and a clarification of what the individual's role is. Summarily firing him is juvenile and ultimately self-defeating, and without that first warning step I think you'd find it difficult to justify at tribunal.