# Donutting is bad

**TL;DR** pranking unlocked computers undermines security by providing cover for real breaches and creating a culture of shame that discourages open reporting of security issues.

It's a common rule in companies that employees must [lock their device](https://en.wikipedia.org/wiki/Lock_screen) when it is unattended, to prevent people from using your access in unauthorised ways. Screen locking is a common compliance requirement, and a good security practice.

People new to these company environments can take a while to learn the locking behaviour. It's not an intuitive reaction. There was no ancestral selection process. Most people don't take that level of security precautions with their personal laptop. Seasoned people sometimes forget.

Doughnutting is the practice of seeing that a colleague isn't at their computer and has left it unlocked, then seizing the opportunity to use their device. The classic procedure is to use the internal communication systems to announce a promise to buy doughnuts for the office, but there are similar pranks such as displaying the [Windows 98 update screen](https://updatefaker.com/w98/index.html) or reversing the mouse scroll direction. These pranks are sometimes [celebrated](https://www.sedarasecurity.com/cybersecurity-and-doughnuts-a-sweet-approach-to-office-security/) by security practitioners as a fun way to teach security hygiene.

I'm not claiming doughnutting fails to make people lock their devices. Shame and peer accountability can be a powerful motivator for people to learn
behaviours. But there are hidden costs that I believe make it detrimental overall.

Doughnutting **gives cover to unauthorised access**, the very risk you were trying to address! Imagine catching someone nosing around in someone else's emails - "I was just doughnutting them" gives plausible cover to an actual security breach.

Creating an environment where people are **publicly flagged for making security mistakes** is a bad idea. You want to hear about when people suspect they have been socially engineered or accidentally emailed a sensitive document, but admitting these things is incredibly vulnerable. You want a culture where people can openly talk about security for other reasons, such as people wondering aloud whether a thing they're already doing is secure, or reporting weird events from a colleague's account.

My recommendation is to treat helping people learn to lock their devices as you would handle giving any other piece of feedback. Giving feedback is a big topic on its own[^1] and depends on the recipient and your relationship with the recipient. In general you want it to be private, tactful and in a way that shows you are invested in helping them learn. My guess on the best way to learn is [trigger action planning](https://www.lesswrong.com/posts/W5HcGywyPoDDdJtbz/trigger-action-planning), e.g. practicing getting out of your chair and then locking your device.

[^1]: The best guide I've seen was in [Dare to Lead](https://www.goodreads.com/book/show/40109367-dare-to-lead).

Some people have reported to me that donutting was helpful as a fun, light hearted way to instill security culture and I don't think this is impossible with high psychological safety. But it's easy for people who are setting the security culture to overestimate the overall psychological safety, or underestimate social embarrassment, because they personally feel comfortable. The newer or younger employees that are disproportionately doughnutted as they learn how to work in a corporate environment may be experiencing it closer to a hazing ritual.