I was logged into my personal Gmail account on a work computer, and I forgot to actually log off. A couple days later, another person brought up Google drive on the work computer, and Google already had me logged on. Needless to say, I had some NSFW images and private financial documents on my drive that the individual saw, and reported me for looking at explicit images while at work (which I never did. I would never open my drive myself at work). I do not know how much clicking around my drive they did, but I doubt anything was downloaded. Now, IT is investigating, and I have been suspended. I remotely logged out of all of my Google accounts when I found someone had opened my drive, and deleted any unsafe for work images and private files. However, will IT be able to see what was on my Google drive at the time it was pulled up on the work computer?
-
Were you using the Google Drive application or just accessing Drive within a web browser?– PwdRschCommented Jun 8, 2017 at 19:53
-
Using through a web browser.– lollipopguild39Commented Jun 8, 2017 at 20:03
-
Sorry, I see you actually said you didn't access your Drive yourself, you were just authenticated to your Google account and then someone else accessed your Drive.– PwdRschCommented Jun 8, 2017 at 20:53
-
This person might have copied some of your data as evidence. If you did not open any of your google drive contents they'll not be able to know what was on there, your colleague though has opened some of those files!? in this case whatever was opened an skilled IT person will know what was that!– amrxCommented Jun 8, 2017 at 21:15
1 Answer
There are a lot of things wrong here from an InfoSec standpoint.
- Why are different employees sharing the same workstation login and consequently browser cookies etc?
- Why were you using such an insecure computer to log on to your Google account?
- Why did your coworker not notice they were in somebody else's private files and log out immediately?
- Why is your coworker assuming you were looking at NSFW images and reporting you for it?
- Unless the content was beyond work-inappropriate and legally questionable, or such usage is clearly against the acceptable use policy (AUP), I don't believe it is ethical for your employer to comment on your personal files.. that said, different jurisdictions have different opinions on this.
As for "can they see what's in my drive?" There may be hints in the browser history, cached thumbnails, images or content. Metadata would contain the most recent date and time of the access.
If they were skilled, they might see that Google drive was not used when you were on the machine, but it was used when your coworker and IT was using the machine.
Various enterprise security products can look deeper, but given you're sharing a login, I would be highly surprised if they had anything which could look deeper or record the content of what was seen in your drive. (e.g., Interception proxy or Network recorder)
Despite the lack of these enterprise tools, there's no guarantees of what has been read or changed: an insecure computer with multiple users had authenticated and unsupervised access to your Google account. What was downloaded, copied or looked at is anyone's guess. An enterprise account might have an audit log, but I don't believe any such thing exists for personal accounts.
