Senior engineer, illicit monitoring of emails

Michelle Leonard
Michelle Leonard used Ask the Experts™
on
I work as an infrastructure tech for a uni, and the senior engineer in my office has caused untold amount of issues.

Via HR, we got him to admit his activities, one of which is monitoring staff emails.   (I know its illegal unless it comes from senior management).

However, the uni isn't great, and I still believe he is monitoring emails.

So, to explain, I am in Office 365, but have my AD account.  We also have people on prem with AD accounts, and will be migrated eventually.

We set up a test, from HR to myself and another in HR.  HR are still onprem.  I found the corresponding exchange log, however 30 minutes are missing from this day.

Is there a way I can tell if he is still monitoring?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
yo_beeDirector of Information Technology

Commented:
Personally I think if he was warned and the is suspicion this person is still doing this and you already have evidence that there was snooping why not just fire this clown.

Another option is to remove his right from the mailboxes and appoint someone else as the Exchange admin.
Michelle LeonardInfrastructure Engineer

Author

Commented:
I agree, but its not down to me.  I will talk with my line manager when he is back from hols, but others are worried about what he is doing as well. He admitted it, but I think to fire him, some evidence would be required.
Because he has full admins and is senior to the office, he's the one changing the permissions.   Its a good idea though thanks
Dr. KlahnPrincipal Software Engineer

Commented:
Go see a lawyer before you do anything at all.  Find out what your rights are and where they end, and what you can and cannot do under your employment contract with the university.  The waters are already roiling; you don't want your employer deciding that you need to be disciplined as an example.  Then take at least a week to think it over and decide what you want to do.

Be aware that if you turn whistleblower, this will be the end of your job there -- if not, you'll never see anothe promotion -- and most likely you'll be blacklisted at any other educational or government institution.  So it has to be worth a lot of money to go that route.
Commented:
As for the telling if they are still monitoring.  It depends on how they monitor said mailboxes.  If they connect directly, this event can be audited on the exchange server.

https://docs.microsoft.com/en-us/exchange/policy-and-compliance/non-owner-mailbox-access-reports

-saige-
Michelle LeonardInfrastructure Engineer

Author

Commented:
All very helpful responses, I am already aware of the legal implications, as I am studying courses, so thank you Dr.Klahn for that advise as well.  HR here have updated their policy, whereby the whistleblower if the information is found to be false will be sacked, however he has already admitted his activities, its just the evidence I needed.

Thanks all of you, really helpful

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial