Can a company agent look up your work password and use it to log in to your personal accounts?

Question

In other words, if you use the same password for your work email and your personal email, is it within the rights of your employer to somehow 1) Retrieve your work email password and 2) Use it on your personal account?

Finally, 3) What if they use the email issued by them to you along with looking up your password to log into a third party service that you signed up for with the email address they issued to you?

For example, if I made an Instagram account with my work email, does my employer have a right to retrieve my password from IT to get those pictures or even access the account?

Answer 1

Not in the United States. This would violate Federal law, specifically 18 USC 1030(a)(2)(C):

"Whoever ... intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains ... information from any protected computer ... shall be punished[.]"

They do not have authorization to access the email account or third party service (unless the provider gave it to them, which is extremely unlikely).

This would be a protected computer because 18 USC 1030(e)(2)(B) says:

"As used in this section ... the term 'protected computer' means a computer ... which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States[.]"

That would cover pretty much any email service or third party service on the Internet.

Answer 2

First of all, never re-use passwords. Just don't! There are so many better options - I strongly recommend a password storage application, like LastPass or similar - and password re-use is a great way to get bitten, even years down the road. You may have seen the news about Mark Zuckerberg's accounts getting "hacked" recently? That's what happens if you re-use passwords (which is how they got him).

Now, to your actual questions:

1) Yes, your company IT people can absolutely do this. In theory they probably can't do it easily - your passwords should be stored securely in a way that cannot be reversed back to the original password (a one-way function, such as a cryptographic hash, is usually used as part of a password storage system) - but they can do it if they have reason to. In practice, it's probably easy. They are also well within their rights to do so (unless you have a contract saying otherwise; this is unlikely); your account, and indeed your entire access to their computer, is on their terms. Some employment contracts basically say the company IT infrastructure and all data on it or sent through it - including passwords - is owned by, and subject to inspection by, your employer. There may or may not be exceptions for data of a personal nature, approved moonlighting projects using company resources, or so on, but you shouldn't assume so.

2) That would be illegal, at least in the USA. Accessing a computer system that they don't own and haven't been granted permission to access is very much against the law. Law enforcement can (legally) do it if they have a warrant, or possibly without if they're somebody like the NSA, but a non-government business cannot (legally) do so unless compelled to by a government agency. David Schwartz's answer has good detail, here.

3) Same as #2, though it's a little fuzzier there. They own that email address (and do not require your password in order to access it, unless their security is way stronger than I expect; usually a server admin can read all email on that server easily), so if you use it to do a password reset that goes to your work email they could read the resulting reset email. Using it (for a third-party site/service, without your permission) would again be illegal (same caveats as above) but maybe a sufficiently good lawyer could convince people that it's permissible for some reason. In practice, you shouldn't use your work email account for anything that you don't want your employer to have full access to.