Please can i have some help - just been suspended from work.

[worriedtohell]

Full back story here: www.mumsnet.com/Talk/_chat/1530022-please-help-i-think-im-about-to-lose-my-job

or, in summary, i recived a letter calling me in for an investagatory meeting, last thursday, for an allegation that an indecent image was found on my pc.

The meeting was run by the chairman and one board memeber, who partook and also took mins.

I have not seen the image before, i said that. I said i didnt know how it got there. I stated i knew the policy regarding internet use and said i did use the internet in my lunch break, as allowed in the policy, but that i have not and do no download images.
The image was of a flacid penis and according to the properties was downloaded 6 months ago.
They have said i was the only one in the office that day, though i have not seen evidence to prove as such.
It is a pc that is used/ open to everyone. It is logged onto before i get into work and i logged off by the last person in. Everyone has the log in as it holds the generic email account.

Along with the indecent image there were a few other images, of people, one of a friend which i recognised, the others i didnt. I said as such. I told them i did not know how they came to be on the PC.

The PC has been in daily use since the image has been found, two weeks ago.

I recieved a copy of the minutes last thursday, shortly after the meeting. I emailed some changes i would like to make, following advice on my other thread and never recieved any response.

Yesterday i got home from work to find a letter on my doormat, dated tuesday, suspending me from work, pending further investigating.

I am beside myself.
I am a lone parent, and have worked there for 2.8 years. I CANNOT afford to lose my job. I have NO savings and i rent. The impllications are horrific. I know if i get sacked for grose misconduct, which is what i suspect is going to happen, then i get no notice of pay and cannot claim any benefits for 26 weeks. I do not know what i will do, i wont be able to afford to live.

I am going to call ACAS tomorrow for advice, but would appreciate any help/ advice at all.

bumping for you.

I'm sure ACAS will have good advice and I'm glad to hear you're going to ring them.

Did they give you an exact day, or was it just '6 months ago'?

I have the date, from the properties of the file. However, someone said on the other thread they are not reliable? I am a computer user, not a technical person, so i dont really know.

I also want to know, how, if they PC is being investigated, will they find ' proof' if was me. How can anything prove it was?

Is an image of a flacid penis considered pornographic and worthy of grose misconduct?

What does the policy say?

Do you feel they are using this issue when they actually want to get rid of staff for other reasons?

oh gosh, how awful for you - have they checked to see if it is some sort of virus download? I remember my facebook sending loads of dodgy messages to my contacts onece, i have also had my email hacked. Could someone else in the office have it in for you? Or more likely have looked themselves? The other glaringly obvious question is why would you want to be looking at pictures of flacid cocks? Have you put this to them? i suspect you have - you poor thing. I really hope you get this resolved soon :(

Has the computer been looked at by an IT professional yet?

This really needs to happen, so that more details can be found about when it was downloaded, where from, and in some cases what else was happening on the computer at the time. This can take some piecing together, but it can be done - and seeing what else was happening could prove that it wasn't you using the computer. If the image came from a device, such as a phone, it may also be possible to identify this.

I would imagine that it would be classes as pornographic - it's certainly over 18's content.

Did you search Google using the "Find similar images" to see where it might have come from?

I have very limited knowledge in employment law (but I'm a bit of computer geek!) so hopefully someone with more wisdom will pop in soon. I do know that ACAS can give incorrect advice, so it might be worth posting what they say up here for clarification first, to ensure they are right.

I presume from your post that there is absolutely no way that the image was anything to do with you. Luckily, if there is one computer with one log on and plenty of users who were around that day/could have used the computer at that time, they are likely to struggle to blame you unless they have proof that it came from your phone/emails/etc. Unfortunately, if they sacked you for this, it may be a case of taking it to employment tribunal to sort it out.

Has anyone else been interviewed/asked about the image?

Try not to worry too much for now.

The PC hasnt been looked at yet. Im making an assumption ive been suspended so that can happen, but i dont know for sure. How will they be able to tel what source it came from? Im really hoping it was a spam email from work or something, we do get them, but will they be able to tell from that image?

I did not google the image, i didnt want to go near it or even look at it for fear of it looking worse and/ or making it worse.

They have said i was the only one in the office that day. I Could have checked staff records myself, i was filing timesheets the other day, but i totally didnt realise. So, i will have to take it that i was?

I have not seen the image before. I dont know how it got there.

It might be worth posting in "geeky stuff" too. There are lots of IT geeks there who will be able to give you some concrete facts about what you can and can't find out about the picture.

ok - will do.

Also, have a look on the ACAS website (or phone them) and make sure your work is following all the correct procedures, because if they aren't they can't really dismiss you as far as I know.

Im going to phone ACAS tomorrrow. I expect they are following the correct procedures... Although i would agrue that finding a letter on your doorstep, post full day at work, telling you are suspended, without anyone saying anything to you all day, is rather shitty.

Bumping for you.
Good luck OP. I think you've been treated appallingly, and I can't understand why your work doesn't have seperate logons if there are only 4 of you.
Let us know how it goes.

Horrendous that you have been told by letter - suspension would be reasonable if they think that you may tamper with the investigation but in these circumstances not sure how you would. You will probably be invited to a disciplinary - make sure that you receive all information prior to this ie all IT reports etc.

Image of a penis would probably come under gross misconduct in our company but they need to prove that you deliberately downloaded it to dismiss (IMO). If maybe it came through when you were looking at something else I would be thinking of issuing a written warning. For the future I wouldn't look at anything of a non work nature whilst as work. Good luck x

I just feel so sick, im worried about money, i dont have any savings and live hand to mouth really.

Im worried about how this is going to affect any future roles, who is going to want to employ someone who has been sacked? or with a bad record?

I cant work out if it is better to just quit, resign, and give them two months notice? can i even do that at this stage?

Can they tell from a saved image, where it came from - ie work spam, FB, deliberatley downloaded

It depends. If it's from the internet ( as opposed to copied off a memory stick ) and your company keeps a record of people's web history it may be possible to match the date of file creation to a web address.

But it's unlikely an image file will intrinsically have a record of where it originated or how it got to your PC.

How reliable are the ' created dates and times' and can they be tampered with

Fairly, but they can be tampered with yes, either by changing the date / time on the computer before downloading, or going onto the meta data and changing info there.

How does an image end up in the downloads, if it hasnt been downloaded

Just like any other folder, files can be moved in and out, they don't have to come from the web.

Why is none of my actual work in the downloads file, because i do download/ open attachements, but no actual work is in this file

You can define where a file is downloaded to. If your files don't go to the 'download' folder where do they usually go ?

this fantastic info from mrgin and another from someone else, showing me a software programme that you can download that you can change image created dates, then delete the programme with... this is amazing, Because my pc log in is used and know by everyone in the office, anyone could have done this, at any time.
This discredits any evidence they might find.

HURRAH!!

At this point my only other question is, ive been given 5 days suspension, then they will let me knw whats happening. I understand for a disiplinary to be called,they have to send me all the evidence before the meeting and give me a few days to prepare. by this point i am on annual leave for 2 weeks. Can they call a meeting when i am on leave?

Disclaimer first - I'm not in your country so please take with a grain of salt as the law, etc., is likely different, maybe some of the technology is as well.

Don't have time to read the other thread atm, however wanted to add a few quick things that may be helpful.

Should the employer want to take it that far, a forensic investigation can tell much more than what is on the local computer. This computer is likely connected to a network? The network likely has the capability to show EXACTLY where the image was downloaded from (ie. was it contained in an accidentally-opened spam, vs. downloaded from an intentionally visited website). This is actually not that hard to do with the proper technology and skills.

The properties of the file itself have very limited reliability (quite valueless really), as you already know, but if they have the IT knowledge or hire a forensic audit for the network, a component of the network will likely have the capability of tracking exactly (to the second) when the image came to the PC. With this level of skill and the proper network capability, there are other pieces of information that can be used to identify what was happening on the computer at the time, fairly exactly.

Files can get onto a computer in SO many different ways, depending on your security settings.

The fact that a computer is publicly accessed, or even accessed simply by more than one person, opens the door for a lot of other arguments, which can also be explored once you have the exact date and time the file was really downloaded/placed onto the computer.

Corporate policy has a lot to do with that. If they have a policy indicating that you are responsible to protect the security of your login and password, for example, you could be responsible for anything done under your account if you have shared it - regardless of whether or not you were at the keyboard when it happened.

Do they have a policy expressly preventing personal use of the computer at any time? At specific times?

I have some experience with these types of investigations and can tell you one thing - I personally would rarely rely solely on the contents of the local computer for any employment action (termination/suspension/etc.). Almost anything on the local computer can be altered if someone has the knowledge to do so. You need the computer contents in tandem with network tools to really look at what has come in and out, when, and what else was going on on the computer at the time.

Imo, a proper technology lawyer could rip to shreds any termination based solely on a file being on a computer in a folder, much less a computer that was not secured.

It is, however, standard practise where I live that an employee be placed on leave during an investigation of this nature. It doesn't necessarily mean they intend to terminate you. And yes, where I am, they can call a meeting with you during this leave period.

Again, I'm not in your country so things may be very different, but just some things for you to consider. HTH and good luck.

There are no networks. we are a charity, everyone has laptops, mine is the only pc. There is a shared file area and that is it. No network, no server, just a stand alone pc.

I have to share my login. all staff have their own email and log in, on their own pc's.my log in is just a gereric log in which opens up the pc, it holds the shared files and the shared/ general email address.

thank you, that does help.

They need to give you 5 days notice of the meeting, ensuring adequate time to prepare. If you are on prebooked leave and away it is unlikely that they would call a meeting then.

They don't have to give you 5 days notice of a hearing, they have to give you 'reasonable' notice in time to prepare, and find someone to accompany you if you want that.

I would say trying to make you come in when you're on annual leave wouldn't be reasonable, but do you have any reason to think that's what they are going to do?

Once you get details of the evidence they have, it sounds as though your main defence will be that they don't have nearly enough solid evidence that it was you downloading the images. To dismiss someone you don't need the same level of evidence as you would if it was a criminal case - ie it doesn't have to be 'beyond reasonable doubt', so they don't need absolute proof. However they do need enough evidence to make a belief that you did it a reasonable conclusion to come to.

I don't know employment law but have worked with HR depts on occasions, with regards to disciplinary issues.

If I were you, I'd be asking for proof that no one was in the office that day.
Also, if it's a shared logon id, unless they can 'prove' you were the only one there then they can't prove it was you that downloaded the image - case closed.

Don't be frighted to start standing up for yourself in these meetings, you have every right to push an issue if you aren't happy with what's being said. I also believe that you are entitled to have someone present with you in the meetings, this could be a work friend or a friend that has no connection to the company. Also, start reading up on your rights, if it's a lax hr dept you are dealing with they may be counting on you lying down and taking it. If you start to stand up and be counted, AND know your stuff it might make them think. You'd be surprised how many HR depts aren't that clued up. Ask for a copy of your employment contract along with the IT policy, you should have signed this when you started with the company - if not they don't have much of a leg to stand on.

I've very easy for and IT techie to find out which site an image was downloaded, especially as they are saying the know the date it was downloaded. Again, ASK FOR PROOF!

Sorry was thinking of our org. You should get at least 48 hours of a meeting (usually deemed to be enough time to prepare - depends on how much info they have I suppose). Agree with other posters. Stand firm !

Even if you were the only person in the office that day, it could have still got on the computer without you downloading it. If you were browsing something else (in either an official capacity or a personal capacity at lunchtime) it could have come in as a pop up - I'm sure someone techie will advise of the proper terminology.

What is th policy on personal internet use?

I've just google fb activity log. It's taken me to fb info page and it says on it " only you can see your log". So if they're producing that then they've hacked in to your fb.