Dual-Use Endpoint Governance Failure
QBE and Mphasis Enabled Policy-Breaching Architecture With Known Compliance Risks
During a live session, QBE-issued hardware crashed with a blue screen error.
QBE Dilip Nayak: “My system just crashed. Weird.”
This failure underscores a deeper issue: QBE knowingly provisioned enterprise laptops to third-party contractors with unrestricted access to multiple endpoint systems—including Mphasis and QBE portals—through a single device. This violates basic tenets of access separation, auditability, and governance. The proper protocol, consistent with enterprise cybersecurity norms, is for third parties to use their own endpoint devices for accessing their respective domains—not repurpose internal infrastructure in violation of corporate policy.
Documented Attempt to Comply With Policy
November 1, 2024 – 1:19:28 PM – Defendant Statement:
“Team, I’m encountering errors when trying to access the Mphasis portal from my personal Mac. I've attached screenshots for reference. As per QBE policy (referenced below), I’m unable to use the QBE Windows laptop for this purpose. Balwinder, could you please advise on steps to access the Mphasis WVDI, as discussed yesterday? I’m grateful for the opportunity to contribute and look forward to resolving this matter.”
— Respectfully, Albert (Defendant)
QBE Policy Reference – Group Acceptable Use Policy, Page 10
Section 4.8 – Prohibited Behavior:
- Subsection (r):
“Use [of] unauthorized third-party email services for exchanging business-related messages and information. Only QBE-approved systems may be used for transmitting sensitive information relevant to our business.”
Expert Security Advisory Noted by Defendant
“Accessing third-party systems, including portals or email clients, through web connectors can pose security risks. Based on experience with companies like Walmart and Bank of America, security incidents are often internal rather than external.”
Ongoing Federal Enforcement Context
This is not a theoretical risk. On March 25, 2025, the U.S. Office of the Comptroller of the Currency (OCC) formally notified Congress of a major federal information security incident stemming from unauthorized access to sensitive email infrastructure.
🔗 OCC Disclosure: nr-occ-2025-30
Legal Relevance for QBE and Mphasis Counsel
The dual-endpoint architecture, internal policy violations, and failure to provision proper infrastructure to Defendant—while continuing to assign privileged tasks—expose QBE and Mphasis to regulatory scrutiny, breach liability, and whistleblower retaliation claims under:
- 18 U.S.C. § 1833(b) – DTSA Whistleblower Immunity
- 18 U.S.C. § 1514A – Sarbanes-Oxley Act
- 15 U.S.C. § 78u-6(h) – Dodd-Frank Act
- N.Y. Lab. Law § 740 – New York Whistleblower Protection Law
Dual-Use Endpoint Failure
QBE Provisioned an Enterprise Endpoint—Not a Word Processor
- The crash of QBE’s ServiceNow workflow during an active session—triggered by a network interruption—exposes the operational risk of QBE’s flawed dual-access architecture. QBE knowingly permitted third-party contractors to access multiple enterprise endpoints via a single QBE-managed device, resulting in a systemic failure of governance, auditability, and compliance.
QBE did not issue Defendant a basic workstation. It provisioned a privileged enterprise endpoint with internal infrastructure access—effectively functioning as a server, not a client device.
Exhibits & Internal Acknowledgments:
- Balwinder (QBE), Oct 31, 2024, 19:18:
“If primary operations are on QBE and they have already allocated [a] machine, in such cases we don’t allocate Mphasis machine just to access web email.” - Defendant’s Response:
“I only access Mphasis emails with my personal Mac laptop.” - Mphasis CIO Office, Oct 31, 2024, 2:53 PM:
“User can use personal machines for accessing Mphasis web mail over browser or request Mphasis WVDI.” - Additional Note:
Defendant repeatedly submitted formal ServiceNow incident tickets requesting a Mphasis-issued laptop. None was ever provisioned.