At least it’ll be easy to write up the security violation report


Many years ago, Microsoft instituted a new security policy at the main campus: all employees must visibly wear their identification badge, even when working in their office. As is customary with with nearly all new security policies, it was met with resistance.

One of my colleagues was working late, and his concentration was interrupted by a member of the corporate security staff at his door.

Sir, can I see your cardkey?

My colleague was not in a good mood (I guess it was a nasty bug), so he curtly replied, "No. I'm busy."

Sir, you have to show me your cardkey. It's part of the new security policy.

"I told you, I'm busy."

Sir, if you don't show me your cardkey, I will have to write you up.

"Go ahead, if it'll get you out of my office."

All right, then. What's your name?

Without even looking from his screen, my colleague replied impatiently, "It's printed on the door."

The policy was rescinded a few weeks later.

Comments (37)
  1. Misteur says:

    Wow, way to be a douche with an underpaid security agent simply trying to do his job.

  2. Matt Smith says:

    Wouldn't the proper response to a person unable to satisfactorily identify himself be to escort him from the building?

  3. +1 says:

    +1 for having the balls of doing it!

  4. Really, is it that hard to "visibly wear [an] identification badge"?

    Let's hope this has changed, or doesn't apply anywhere near cardholder data:

    PCI DSS requirement 9.2

    Develop procedures to help all personnel easily distinguish between employees and visitors, especially in areas where cardholder data is accessible.

  5. DaveShaw says:

    We have to wear badges at our company and it's worn on a lanyard with the bange in our shirt pocket so they don't flap about. When our team forget them, we simply put a spare lanyard around our necks ending in our shirt pockets. The guard comes in, sees the lanyard, says "thanks" and is on his way.

  6. Danny Moules says:

    The point of those ID badges is the security staff don't need to ask. You wear it, they look. No breaking anyone's concentration required, there's little excuse for it being seamless. The only time the security guard needs to flag anyone down is when they're visibly flaunting the rules, in which case the person should comply or be escorted out of the building.

    The security guard cannot use the name on the door as authentication. It's like your software confronting an user and asking for their public key then accepting the user's response of 'well, my plain text token says I'm an administrator, doesn't it?' as a valid response. It's illogical and if the user isn't prepared to authenticate they should have their privileges revoked until their identity and authority can be properly established.

    We have rudimentary identity checks at my company and my apartment block. Nobody is inconvenienced by them and both of them have a good culture of physical security. If you try to sneak into somewhere you're likely to get challenged. The result isn't just better security – in the case of my apartment block it means far less spam mail too.

    Who needs to hack your software when you can just sneak into an office of an evening and claim your present location as your right to be there?

  7. keith says:

    Put the bathrooms and vending machines in areas only accessible with the key card.  You only forget to have it ready at hand once.  

  8. tsrblke says:

    @McKaySalisbury

    It's harder than you think to "visibly" wear a badge at all times.  If I'm facing the computer do I have to turn it around? what if I'm making reapirs to my cabling underneath my desk.

    The simplier solution is to monitor access to the building and watch all possible access points (i.e. windows) with cameras.

  9. Paul M. Parks says:

    This isn't much of a problem where I work. The daytime security guard at the main entrance has memorized every employee's name and face — that's hundreds of people. He greets everyone by name in the morning as they walk in the door, badge or no badge. I'd say that's pretty effective security, at least until he retires.

    The night shift isn't quite so diligent, sadly. I once pushed a cart full of computer equipment out the front door with only a nod from the guy at the desk. (Yes, I was approved to take it out of the building, but he never asked for proof of that approval.)

  10. Joshua Ganes says:

    I agree with Tom, it's far too easy to game this type of system. Very few people even bother to check the ID tag. Far fewer would notice a reasonably well-made fake.

    You shouldn't just write up a person for not showing ID. If it really is someone trying to break in, you'll look pretty foolish the next day when you show your boss how you wrote up the intruder while he stole all your sensitive information.

  11. metafonzie says:

    Microsoft should install a kinect in every office. It will verify people's gait or some other skeletal metric so there won't be a need to even carry a badge :P ["You are the Controller" => "You are the badge"]

  12. Joseph Koss says:

    Where I work we are supposed to wear badges (which in some cases are actually state-issued licenses) visibly 100% of the time while on the premises. If you forget your badge, a new one is made for you (with the acting head of your department taking you down to security…) and the code on the magnetic strip of the old one is revoked immediately. We employ over 10,000 people and operate 24/7.

    For the most part, this was not enforced anywhere, but I will get into why there was widespread compliance later. About a month ago a man who didn't work for us came in, ate at one of the employee cafeterias, called a taxi cab and then hijacked said taxi cab when it arrived at the front entrance. Needless to say, the security at the front door has been very diligent about seeing everyones badge this past month (even people they surely recognize), although there still isnt any sort of checking going on elsewhere. A new camera has also been installed at the front entrance because apparently none of the literally thousands of security cameras on the premises got a good look at this guys face.

    The reason they are worn pretty much all the time in spite of a lack of real enforcement is that they are needed so often. The only way to log into a computer anywhere is to either swipe the badge, or remember and then input your (mandatory) obnoxiously long alpha-numeric mix password. Some people have access to various restricted areas that use swipe-locks as well. So there is pretty-much uniform compliance to wearing them 100% of the time without any meaningful active enforcement.

  13. hmm says:

    i think people are over analyzing this too much!

  14. joXn says:

    Pshhh, there's no need for physical security on Microsoft's campus at night. It's not as if there's anything — physical or intangible — of value to be stolen there.  Right?

    I worked for a defense contractor and at our security briefing the campus head of security told us a story in which, on the first day on the job, he stopped a woman without a badge, challenged her on it, and escorted her across campus to her office to pick it up. The woman turned out to be the VP of that subsidiary. He got an "attaboy".

  15. mh says:

    This is something of an "airtight hatchway" issue, isn't it?  By the time security ask to see the guy's badge he's already gained access and has been doing nobody knows what for nobody knows how long.  Escorting him off the premisis ain't gonna do much good as – if he was a baddie – he may have already had his wicked way.

    It's like letting you log on as Administrator/root without a password, then only asking you for that password some undetermined time after you've already had access to the machine.  There's a moral in here about computer security.

  16. AP2 says:

    Nowadays, the obvious solution for MS is to give out a Windows Phone 7 to each guard and use facial recognition. Surely it can't be that hard for the MS mobile devs to write a simple app that pulls up the employees' profile (the part that guards need to access, of course, like name, picture and authorized areas) based on their face.

  17. At my previous university they tried to institute such a policy after a girl was assaulted near the chemistry labs. Despite this being a perfectly good reason, no one actually bothered doing it and I don't recall anyone ever getting asked to show their ID to a security guard.

    Security was rediculously lax at that place anyway. Anyone could walk in or out at any time, and the way the alarms were hooked up made it pretty simple to get in even when the buildings were closed (you basically just had to make sure to break in via the fire exit and not the windows; you could then just force all the internal doors, because although they were locked none of them had alarms). We had regular break-ins, and the CompSci building was robbed blind at least three times while I was attending. It's a rare treat when you get to use "every single computer in the building was stolen" as an excuse for missing a deadline.

    Besides the emptying of the CompSci building another infamous break in was somebody who just walked in during a regular week day, set up a ladder, dismantled a €2000 LCD projector for a 10-metre high ceiling in a lecture hall, and walked away with it without every being challenged by anyone.

  18. John says:

    @mh: Security should be layered.  If an intruder makes it past the front door and that's your last layer then you're boned.  At least the badge check has the potential to catch the guy; without it he's going to get away.

    Granted the policy was dumb (he should have been escorted away rather than "written up"), but I still don't see why he had to be a dick about it.  Of course security isn't very high up on the list of things that come to mind when thinking about Microsoft.  Sorry, just had to get that in there.

  19. Anonymous says:

    Reminds me of a place where the instructions on the badge said you should wear it on your chest.

    The lanyard was long enough that the badge naturally went to belly height.

    The obvious solution was to hide the badge on the chest pocket.

  20. Erin Lazzaro says:

    My former employer required picture badges worn visibly.  The guards at the entrance had to check your face against the picture that came up on their monitor.  They were supposed to check both against the picture on the badge, but I don't think that happened at rush hour.

    Security stopped me in the main kitchen and asked, sternly, where my badge was. I looked down, discovered I was wearing an empty lanyard, and replied, "I guess it must be on the floor somewhere between here and my desk." The guard looked confused for a moment (he probably expected me to pull it from a pocket) and told me to make sure I had it the next time I came through there.

    (It was on the floor about three feet from my desk.)

  21. mdw says:

    @ McKaySalisbury: `Really, is it that hard to "visibly wear [an] identification badge"?'

    Depends.  The one I was given came with a holder that broke after a month so you had to figure out a new way of attaching it to the lanyard.  It broke again the month after, so you say `bother to this' and punch a hole in the card itself, and then that breaks after a year.  So you leave your card in your bicycle pannier and it turns out that nobody asks for it anyway.

  22. OtherJohn says:

    We once had a situation where a colleague had forgotten his pass.  The process for that is to go to the security office and ask for a temporary one.  However, there had been cars broken into (we think it was gypsies who were camped nearby at the time) so security were on patrol, and wouldn't let him onto the grounds at all, so he couldn't get to the security office.  Luckily, I walked up, showed my badge and the guard asked if I new the other guy.  I said yes, and he was allowed to go through, but I think there were cases where people weren't so lucky.

    That got stopped after a while (it became too expensive and the main suspects moved camp anyway).

  23. Robert C. Barth says:

    The illusion of security is a great thing; makes people feel all warm and fuzzy. The only places where they actually pay attention to badges and such are places where entrance to the facility requires some sort of cash exchange (e.g. a gym). I literally have a harder time getting into L.A. Fitness if I forget my membership card than I do at work where everything is key-card access.

  24. Job says:

    Correct answer to people who don't want to flash their badge:

    "Sir, then I'm forced to tase you until you do" *spark* *spark*

  25. Tom says:

    This kind of security is theater, not real security.  Unless they're scanning badges and checking biometrics, it's too easy to break.

    (Back in the 1980s, there was a CIA agent who used to go around with an ID card that had his name, but a photo of Muammar Gaddafi.  It worked because security people were merely checking for the *existence* of a badge.  Of course, he could've easily printed a fake ID with his own photo, but he was doing it to make a point.)

  26. Hiroshi says:

    At Microsoft Japan (Chōfu building), we have ID cards. They are primarily for opening doors than actual security, though. However, if you do forget your card, there is a tedious process to go through with security before being able to get to your office. You need to flash it at them when initially entering the building as well. They are to be worn around your neck, but many people seem to attach it to their jeans, so it is not very visible for security checks.

  27. Ray Trent says:

    Having worked on classified projects some 20 years ago, I'll just note that, for really classified projects, ID badges were forbidden. They provide *way* to much false sense of security with *way* too little real security to pay for it.

    When the goal is security theater, perhaps that's not a bad thing. But if the goal is real security, ditch the things.

  28. Cheong says:

    @keith: My ex-company did exactly that, and soon you'd find people keep exchanging their key card in order to get coffee or go to restroom.

  29. Joe Dietz says:

    My group has a long cultural tradition of shooting messengers.  I totally understand the security guard is just doing his job, but I totally would want to force him to write me up.  Its the sort of thing that gets the message back to where it needs to be.  Whatever corporate security flunky thought up the policy is going to be getting all of these reports about me and will try to contact my manager and he will tell said flunky to go away because he is busy….

  30. Worf says:

    Hrm, wasn't there a neat story awhile back on what happened when you don't have your pass? I recall one case where the temporary pass was attached to a hardhat with a flashing light and reflective vest, to encourage people to not forget. And they had to wear the getup for the duration…

    My pass stays in my pocket on a retractor – it's annoying how quickly the pass falls apart so you go get your pass and it breaks. Hurts too. Also, it's interesting to note that the whole lanyard thing's really a white collar thing. Blue collar folks have gear that has a clear pocket for their passes so it's always visible and tucked away neatly so it never flops (dangerous).

  31. Dave says:

    We have to wear badges at our company and it's worn on a lanyard

    with the bange in our shirt pocket so they don't flap about. When

    our team forget them, we simply put a spare lanyard around our

    necks ending in our shirt pockets. The guard comes in, sees the

    lanyard, says "thanks" and is on his way.

    They still do that at IBM?  That was already the practice when I was there x years ago.

    (If your comment refers to the practice at a company other than IBM then please disregard this message).

  32. kog says:

    Did anyone else think when the security guard asked All right, then. What's your name? the response was going to be Bill Gates.

  33. Skyborne says:

    @Danny Moules, at some level, a lock is a signal that says "You shouldn't just wander in here", which is effective against casual intrusion (but not determined attackers) in any context.  Regardless of whether the casual intruders are pre-authenticated for the area around the building.

  34. Dave says:

    >This isn't much of a problem where I work. The daytime security

    >guard at the main entrance has memorized every employee's name

    >and face — that's hundreds of people. He greets everyone by

    >name in the morning as they walk in the door, badge or no

    >badge. I'd say that's pretty effective security, at least until

    >he retires.

    Or until some by-the-book cretin chews him out.  I used to enter the place I worked via a side door that was used by maybe a dozen people every day, and every single day the security guy asked to see my badge.  I was never sure whether he was being an *** or just a strict by-the-book guy.  The checking at the main entrances was far more relaxed.

  35. Danny Moules says:

    "Having worked on classified projects some 20 years ago, I'll just note that, for really classified projects, ID badges were forbidden. They provide *way* to much false sense of security with *way* too little real security to pay for it."

    That's true of high security outfits, not true of low security outfits. You don't call a lock on a door meaningless security for your home but it's worthless if you've just passed through four military checkpoints. Context is important.

  36. Isaac Lin says:

    Once I was asked to produce my badge (I think it was in a pocket), and I noticed that the guard's badge wasn't visible (I believed it was flipped over), and so as per our (usually ignored) corporate instructions to challenge anyone without a badge, I asked to see the guard's badge.

  37. A Softie says:

    My favorite "security theater" around MS is the expectation that every single person swipes their badge on a door reader, even when they are walking (literally) 20 feet from the cafeteria to their building, with a plate of food.  In other words, you walk out of a "secure" place to another secure place, and you're expected to swipe your badge again?  No one, and I mean no one, adheres to this rule.  Don't believe me?  I've had security guards, and even Ballmer, hold the door open for me.  (And no, I'm not an attractive woman, or a woman at all.)

    When the security guys and the CEO disregard the rule, it's meaningless.

Comments are closed.

Skip to main content