The Mistake That Looks Like Misconduct

A file went somewhere it should not have. The logs say the same thing whether somebody made a mistake or acted deliberately, and the distinction determines everything that follows.

The outcome in “The Mistake That Looks Like Misconduct” must rest on evidence that has been checked against context. Data from how employees cheat time trackers, when used for how employees cheat time trackers, can support a chronology of work or project activity, but it should not replace the employee response, corroboration or a proportionate decision process.

Why the logs cannot settle it

They record actions, not intentions.

For a separate perspective relevant to “The Mistake That Looks Like Misconduct”, consult the U.S. Justice Department computer-crime resources. Use it to test the proposed threshold, investigation scope and review process rather than to substitute a generic checklist for the facts of a case.

A large export at an odd hour is consistent with somebody taking data and with somebody finishing a deadline. A send to a personal address is consistent with removal and with wanting to work on the train.

Investigators know this and then reason backwards from the seriousness of the material: important data means it must have been deliberate. That inference has no support and it is the commonest way these cases go wrong.

What actually distinguishes them

Concealment. Deleting logs, renaming files, using an unusual route, lying when asked. Its absence is strong evidence of error; its presence is strong evidence of intent.

Benefit. Was there anything to gain, and is there any sign of it.

Reaction. Somebody who made a mistake is usually mortified and immediately forthcoming. Somebody who acted deliberately has usually thought about what they will say.

Repetition. A single occurrence is consistent with error; a sustained pattern over months is not.

And the ordinary test: does the innocent explanation account for everything, or does it leave parts unexplained?

The cost of grading an error as misconduct

A competent person dismissed or sanctioned for a mistake, which is unjust and frequently reversed on appeal at considerable cost.

The chilling effect: everybody else learns that mistakes are treated as conduct, so mistakes stop being reported. Which means the next one is discovered later and is worse.

That second cost is larger and it is permanent. An organisation that punishes a self-reported error has bought one outcome and lost its early warning for everything afterwards.

The self-reported case

Somebody realises what they have done and says so.

This should be treated materially differently, explicitly and in policy, because the alternative is that nobody ever reports again.

A programme with no stated position on self-reporting is one where the rational choice is silence, and most programmes have no stated position.

Where the error was serious

Consequence and culpability are different. A mistake can cause real harm and still be a mistake.

The response addresses the harm — notification, remediation, retraining, a change to the process that allowed it — without treating the person as having chosen it.

Conflating the two is how organisations produce an outcome that everybody internally knows is unfair, which is corrosive in a way that lasts.

The backwards inference

Important data, therefore deliberate. It is the commonest reasoning error in this work and it has no support: the sensitivity of what moved says nothing about why it moved. Investigators who notice themselves making it usually find the actual evidence of intent is absent.

The self-report that must be treated differently

Somebody who realises and tells you has given the organisation something valuable. A programme with no stated position on self-reporting makes silence the rational choice, and most programmes have no stated position.

What the absence of concealment establishes

Strong evidence of error rather than intent. Recording explicitly that no concealment was found is as important as recording that it was, and it is the entry most often omitted because it does not advance the case.

Consequence and culpability

A mistake can cause real harm and remain a mistake. The response addresses the harm without treating the person as having chosen it, and conflating the two produces outcomes everybody internally knows are unfair.

The chilling effect

Punish an error and errors stop being reported, which means the next one is found later and is worse. That cost is larger than the case and it is permanent.

For the file: Record what evidence would indicate deliberateness and whether it is present. If the answer is that none of it is present, the grading should say so plainly.