Slashdot Mirror
Protecting Your Company While Protecting Privacy?
"Sure, I'll block a URL here or there but spot checking e-mail? How long until some smartass comes up with a .sig containing all of my keywords?
In general, people are going to be more productive if they take their five minute break at their terminal browsing than screwing around by the coffee machine. Along the same venue, I am not interested in tracking 'abuse' (such as hitting eBay, checking the sports scores, etc.) If someone is using that much time that it interferes with their job, I'll be speaking with them regarding their dereliction of duties in general, and not speaking to them about Internet usage in particular.
So, again, I pose the question: what sort of policy and procedures will protect the privacy of employees' surfing and e-mail, while still protecting my company from liability?"
Will have a clause against use by lawyers. Its only fair, they seem to like doing the same to us.
Tell employees to limit their e-mail to a standard comparable to their telephone calls. Too many personal calls/e-mails is a bad thing. How many is "too many" is a matter of judgement on the part of the employee AND the management involved.
If it's not work, save it until you get home.
Now, get back to work you lazy bastards. ;>
IANAL, and I am looking at this mostly from an employee perspective. some of the ideas suggested either won't work or will cause too much collateral damage.
1. Block outgoing mail? That might be acceptable at some companies, but at most it would cause productivity to nosedive. If you'd rather your employees spend 3 hours playing telephone tag than 5 minutes composing an email, cool.
2. Issue 2 email addresses? An insignificant increase in the time that it takes to read your mail, so it doesn't cost much. But if you say something that gets the company sued, I'm fairly confident that the company will still be on the hook.
3. Filtering software? "It's OK, honey, I've had a vasectomy. The check's in the mail. User friendly. You're the only cutomer that ever complained." Yeah, maybe one day we'll have filtering software that does what it's supposed to, supported by a company with no hidden agenda, but in the meantime I'm keeping it well away from any machine I control.
I like the idea of bringing the employees into the loop before deciding on policy. Given some of the lunatic decisions on what constitutes harrasment, e.g., Sports Illustrated, I suspect that companies really do need to monitor in order to protect themselves. But if they start putting video cameras in the lavatories, I might sue.
BTW, I find it ironic that with some of the dunderheaded decisions that innocent behaviors are harrasment, it can be extremely difficult to collect in cases of genuine harrasment.
Hey, no problem. Of course, we'll be leaving for home one nanosecond after the clock says we can leave.
Oh, you wanted more than 40 hours per week of work out of us? Then start paying us for it, you greedy skinflints.
Where I work most of the remote users change positions often enough that they have userids like cn_ast2 (Property CN, Assistant 2), and they still plenty of personal mail.
The law has determined that you need to be held responsible for the actions of any individual who works for you, which requires draconian privacy invasion in order to protect yourself.
So do it.
However, make sure your employees know why you're doing it. Tell them you have no interest in their activities, but must monitor them in order to avoid very expensive lawsuits. Then give them a list of phone numbers and addresses, and let them know if the liability can be changed, so will your policy. You'd be surprised at how many otherwise disinterested people will take an active role in politics (if only by making sure to vote or writing their congressman every so often) when you bring it home to them how these laws affect them on a day to day basis.
A good way to get them motivated would be to explain that most of these laws are created from the standpoint that employees are pretty much considered to be 'company property', and have no inherent privileges or rights; only those granted by the employer (which is why companies can be held liable for any activities which employees engage in, even sometimes outside business hours).
Do a good job of informing your workforce, and they'll think twice about voting for that yo-yo who says he's only trying to "protect the children".
Non-work-related email can be handled through home accounts, POP3 to an employee's ISP's mail server, web mail, or what-have-you.
This is a much better way to do things. I don't like sending private emails to anyone from my company account anyway. I use a shell account to manage my private mail. It's only draconian if people aren't given an alternative.
Wansu, th' chinese sailor
Most people don't need email access at work.
Huh? I'd say this depends very heavily on where you work. About 95% of the people in my office have to communicate directly with the clients they're working for. This solution would not work at all.
It's not enough to bash in heads, you've got to bash in minds. - Captain Hammer
I am a lawyer, but this is not legal advice. if you need legal advice, consult an attorney licensed in y our jurisdiction.
I assume you mean the fifth, but it doesn't matter: it is about governments. It *does not* apply to individuals. It also does not apply in civil cases--your refusal to testify in a civil case *can* be held against you.
hawk,esq.
I get what you're driving at with your second point, but what about the times when someone is responsible and it's not a case of someone trying to make a quick buck? I say we need should start something along the lines of damage mitigation with immediate disclosure and remedy attempts, though. Possibly punative damages can't result from when a company has publically and effectively acknowledged a defect. Immediate effects (like hospital bills, etc) can be sued to recover, but not punative damages.
--
Ben Kosse
--
Ben Kosse
Remember Ed Curry!
(I'm sure there are other excellent books, too, those are just the ones I can think of which help people to figure out where they want to draw their limits, to recognise warning signs, and to work out any issues of their own, without the company needing to get involved.)
IMHO, this is exactly the same fight that mill workers had with mill owners, at the start of the Industrial Revolution, and has exactly the same answer as Robert Owen determined. An educated and sane workforce works better than a hurting and hurt one.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Seeing as everywhere I've worked has clearly stated that they can examine my email, etc because it's on their systems etc... I've stopped using it for personal stuff. With free services like Yahoo that have a web interface, there really is no need to use company services for personal stuff. I don't know if such an approach shifts responsibilty from a company when there is abuse... I'm just more concerned with my own privacy.
How much do You trust your Boss?
Point being is that a LOT of companies are already using these tools and that majority of them do this with no intent to spy on their employees. But there have been many cases in the news about employees being fired for their "browsing" habits by various companies. Which only means that some companies ARE spying on their employees. And that boils down to how much do you trust your company?
Ex-Nt-User
Personally, I don't think so. All it is saying, if you are running a side business, don't do it at your main job. Don't make them pay your expenses and your time for that side job.
Don't use company resources for the sole betterment of your own enterprises. It's common sense to me. Your addition makes it a little clearer though.
Annoyingly, IANAL either.
Unfortunately, putting something on the Internet is being legally interpreted as "publishing" - and this applies to e-mail as well. (much e-mail ends up forwarded and put on e-mail list archives, etc)
That a conversation can be recorded doesn't mean it automatically is.
Do you have a responsibility, as a business owner, to see what you are "publishing"?
Unfortunately, the answer seems to be "yes".
You're beginning to touch upon why business is starting to fight for effective instant messaging.
But, people don't resent an "open" solution if they know it's there. Nobody minds a camera posted over their head if it's obvious, especially if they can SEE what's being/has been recorded.
Your grasp of reality fails here. Several unions have been known for "accidentally" destroying biometric readers because they didn't even want their *fingerprints* recorded, let alone their words, thoughts, and actions.
Look up the wars, incidentally, regarding audio recordings on security videos.
--Dan
Stop.
This presumption that all emails can and should be logged comes from the presumption that emails are equivalent to official memos from the corporation.
They're not, and shame on anyone who would argue differently.
The fact that harassing comments may be spoken at the water cooler does not obligate the company to install an audio recorder at that cooler. The fact that harassing comments often are spoken over telephone lines assuredly does not obligate a company to record all calls made to and from the office building. The fact that E-Mail can occasionally lead to harassing comments as well does not obligate the company to violate the privacy of its workers.
Now, given an active suspicion(usually brought upon by an aggrieved party commenting to his or her manager), it's justified ethically to verify the charge by watching traffic in a limited manner. We wouldn't want someone to lose their job without their sins being proven.
But to say that employers are mandated by government to spy on everything their workers do obscures the fact that the government itself is mandated a privacy violation infrastructure be built into every single workplace in the name of "protecting us from ourselves."
Yours Truly,
Dan Kaminsky
DoxPara Research
http://www.doxpara.com
You can't eliminate risk. You thus work to mitigate it as much as possible.
Thanks
Bruce
Bruce Perens.
Bruce
Bruce Perens.
Thanks
Bruce
Bruce Perens.
Bruce
Systems Use and Privacy
In order to facilitate communications and business operations, the Company uses a number of devices, objects and systems. This includes but is not limited to mail, e-mail, telephones, desks, common areas, cabinets, files, computers, networks, passwords, voice mail, etc. Access can be made by the company to any or all of these items or systems at any time. Employees should not assume that contents of messages are confidential and will be only reviewed by the employee.
The Company does not guarantee the security of the Company's systems, computers or telephones. If you need to communicate in a secure fashion, do it outside of Company buildings and without using any Company equipment or facilities. We employ technical experts who are able to read your computer data and tap your phone.
Members of the executive staff, the employee's supervisor, or another employee at the direction of a member of the executive staff, may access, monitor and act on any message or communication or data in any system at any time and may view and consider and act on the contents of any item provided for use in the normal course of company business.
None of this, however, conveys authorization for any employee to eavesdrop. The email, files, and other communications of your co-workers are not your business and you are to avoid situations that would expose you to them unnecessarily. "Snooping" is unethical and you are liable to be terminated if you engage in it.
Our systems are never to be used for pornography, email spam, ethically questionable or unprofessional activities. Internet service is widely available outside of the Company at low cost. Do not consider us to be your "Internet provider": our Internet facilities are only for work. Internet communications that are not part of your job should be carried out using an outside internet provider, a non-Company email address and non-company URLs.
In a nutshell...this means don't be doing nasty or illegal things in the office or on our networks. Respect the fact that your co-workers have access to information on the network and the computers and they would like to be able to respect you in the morning. The Company reserves the right to inspect information and work environment at any time, with or without notice
No Personal Businesses On-Site
It is understandable that many of the Company employees are entrepreneurs and may have one or more companies or separate enterprises, outside of their interest in the Company. It is our desire to nurture and respect the mindset of the entrepreneur. However, under no circumstances shall any employee of the Company run their own company at or through the Company. The use of the Company resources to conduct said business is strictly prohibited. All such enterprises shall be conducted completely off-site and shall not in any way be connected to or interfere with the normal operation of the Company
It is understood and accepted that occasional phone calls will need to be made or taken with regard to personal business. However, there shall be no routine phone calls. There shall be no connections with your personal enterprises and the Company. You are not authorized to use computers, addresses or other Company property, licenses or identification numbers to conduct your personal enterprise. In addition, you shall not use to the advantage of your personal enterprise any business information acquired on the job, at the Company.
Bruce Perens.
I don't pretend I don't screw around during the day (for instance...now), but I think I am entitled. I work faster than average. I implement job-lightening scripts and procedures. My ultimate goal is that I implement a system that merely requires me to be somewhere in town if something goes wrong.
So, if I'm endlessly reducing my workload (as part of my job), why wouldn't I have time for personal "stuff".
If, however, I were doing illegal activities, it would be my own issue, and if it became apparent, then I should be terminated.
Send your friends messages of love at fuck-you.org
Shouldn't the law be the same regardless of the marital status of the secretary?
I see even classic Slashdot is now pretty much unusable on dial up anymore.
Even if you monitor what are you monitoring for? Who does this protect? While it may afford the company the excuse that they can go after an employee it does not protect the company from anything per se. Moreover if you have an official policy of monitoring AND ALSO filtering then the company is setting itself up to NEVER send out anything that is in violation of the policy. That is, if you claim you are in compliance then you in fact HAVE TO BE in compliance and you may be exposing the company to even more trouble. In this case the liability is clear regardless of who sends out the offending email. Therefore you again have not actually protected the company from anything unless you the email admin can guarantee the process.
You need to consult an attorney. You may also want to investigate some kind of business insurance to cover litigation and damages that may result.
The problem with this is that it places an unnecessary burden on the employer to police and spy on its employees. Come on now. If I write a threatening letter and drop it in my company's outbound mail box is it really the company's fault? Why then should the telephone or email be any different? If I have an illegal website running from my apartment, should my landlady be responsible for that as well? What ever happened to personal responsibility and the idea that we are presumed innocent until proven guilty?
JET Program: see Japan, meet intere
It would be great if we could put the onus of responsibility taking care of email on the users, as in the example SEWilco raises. However, email is not currently regulated by the same set of laws. I believe that postal mail is protected from tampering in the U.S. by federal statue, e.g., it's against the law to read postal mail not addressed/delivered to you.
Why is email treated differently? Email is not handled exclusively by federal employees. Does that mean that Joe User should trust their local postal employees more than their email admins? I suppose that depends on the employees and their email admins, but while immoral and probably subject to civil court, it is not a federal crime to read someone else's email.
If you don't like it, write your senators, representatives, and everyone else who can affect a legal change.
This could be construed as a non-compete clause. In many states, these are unenforceable. You probably want to amend this to reference "trade secrets" and/or "business practices" instead. You can't tell me that as a web developer if I learn CSS or Javascript on the job I can't use that knowledge elsewhere. The whole point of employment is building your career and aquiring new skills. That statement is contrary to this basic principle of employment, and would be legally unenforceable, if not ethically questionable as well to request.
Now, using the same analogy, if as a web designer a company I worked for designed a new dynamic backend to deliver for, say, news content, and that backend contained alot of new ideas and features not found elsewhere in the industry and where knowledge of that (if aquired by competitors) would cause material harm to the company, then yes.. such knowledge should be protected. However that should be done in a seperate document and made explicitly clear to employees both at the time of employment, and at periodic intervals afterwords (if it is that important, you should take great pains to ensure everyone knows this - due diligence).
Yes, I know you don't mean this to be a legal document, but as a policy document for a company, it could be used in legal preceedings, however IANAL.
We have the opposite problem here. There's one guy that surfs pr0n sites during the weekend, yet gets lauded in company meetings for putting in long weekend hours. We've provided proof (HTTP sniffer logs) to HR and management about this, and they keep turning a blind eye. Whats our next recourse against this guy?
When companies have to pay millions for dirty jokes/etc, we end up in this draconian state that we have now.
Common sense is no more, so laws are passed to regulate it.
You may resume your daily illusion.
-Brook Harty
If your company is liable for any email originating from it, then a logical solution is to block outgoing email from most users. Give the company a few official contact people who talk to clients directly, and act as go-betweens for other work-related email.
Non-work-related email can be handled through home accounts, POP3 to an employee's ISP's mail server, web mail, or what-have-you.
This is draconian, but it does virtually eliminate the problem of liability for outgoing email. Internal email management is left as an exercise to the reader.
On an even more pedantic note, I know of no country in the West where women are a "minority", no matter how much the gender gap at your CS classes might tell you otherwise. And to put the icing on the cake, I believe "lewd" speech is as much protected as prayer is.
--
Information wants to be beer, or something like that.
No matter how much the religious right may have impregnated on people's minds, "free speech" doesn't protect speech against a government one doesn't like particularly, it protects all speech, even the proverbial "fire in crowded theater" cliché (the difference being the legal consequences of said speech).
Unless we have a large disagreement as to what lewd means (incidentally, it meant "lay, laical" originally) you are way off base here, my friend.
--
Information wants to be beer, or something like that.
I don't think monitoring is feasible. In fact, it may you expose to even more liability because it puts you in the position of being able to discover problems, and the presumption then may be that you knew about a problem but chose to ignore it.
I'd prohibit any personal use of company E-mail (there is no need for it--web-based mailers provide an excellent alternative), have a clear policy on how employees can get help with problems, and indicate to external recipients of E-mail messages (in a header or signature) who they can contact in case of problems with mail they received. But if it really worries you, why not talk to a lawyer?
Explain to your employees what you've said - any mail going out with @mycompany.com exposes the company to liability, etc. Encourage them to keep the company name off personal business. Maybe also as part of your employment contract, make the employee indemnify the company against personal unauthorized actions which expose the company to liability, and explain this in interviews and when the employees start. If you explain to people why you have certain restrictions, and the explanation is reasonable, they're much more likely to comply with them.
In the situation I described a self-incriminatory situation. But what if they said that the use of encryption they didn't control was in and of itself wrong? Can you bounce an employee just for sending "hello world" with a private pgp key?
What about policies regarding the use of strong encryption in the office? For example, what if I do my "off limits" business at work in a completely encrypted fashion, but for whatever the reason the light of suspicion falls on me. If I refuse to reveal my key(s) which can then reveal the evidence against me, should the company be able to fire me because of that?
In other words, should there be an organizational policy on encryption? Such as something like:
"Only organizationally issued [and hence escrowed] encryption software and keys may be used to secure communications. All other encryption may be construed as evidence of prohibited behavior." or some other kind of legalese.
To me this seems more draconian, but at the same time if the stated goal is maintaining comapany control over the computers and the data, I can't see how you could allow an encryption free-for-all without causing problems.
Actually, almost all mail that I receive at work (which is very little) is opened by the secretary long before it gets to me. And that's good too, since she usually can recognize junk mail and throw it away before I see it.
If it's personal (e.g. all those love letters from Morgan Fairchild), it is sent to my home, not my place of employment.
---
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
What they need is "work" mail as opposed to personal mail. Perhaps this can be fixed by giving them a boring mail address such as sales05@company.com or support@company.com instead of joeschmoe@company.com. That might help keep other parties from thinking that it's appropriate to use that address for chatting about Joe Schmoe's girlfriend's hemmoroids.
---
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Most people don't need email access at work. Just like most people don't need access to letterhead or a company credit card.
You'd still be letting them access their personal email from work -- so it's not THAT draconian.
And they can still communicate via email internally.
So, what if the B's mail server logs only a checksum/hash of all outgoing mail? Then B would have evidence that could counteract A's account, but would not need to be intrusive or store huge amounts of email forever. While having each user PGP sign their documents would serve the same purpose (and be more reliable, since it would provide definite proof of a forgery), this system would be much easier to implement on a companywide basis.
Keep a copy of all email sent, but make it clear that company policy is not to search it unless there's a complaint of abuse. Hopefully, the consequence would be that the employee realizes there's a record kept of everything they send, and that will make them more responsible.
I know this sounds a little bit like those stupid voluntary privacy policies that people like doubleClick have. But you're not them. You're a small business concerned about balancing privacy with responsibility. You might be able to handle it.
Also, I really think that with the number of ways that someone can send and receive email today on the net, use of a company account for personal business is really not a must.
Tweet, tweet.
---
This sig has been temporarily disconnected or is no longer in service
In any event, all of her e-mail which leaves the office has a tag attached to it, identifying it as the sole property, expression and views of the writer. The same sort of disclaimer should be applicable in your case.
I find it curious how you in the US differ so much on this subject (privacy) from us in Europe (with the exception of the UK wich is to all purpose a police state).
Our freedom of speech is not as pronounced as the US version, for example we can not legally promote hate like nazism.
But we have a lot more protection when it comes to privacy, regardless where we are.
Only after a company is informed that their systems are being abused can they start to investigate, usually under very strict rules and conditions.
For example here in Holland the elected employees committee has to approve of the methodes to be used.
Although the law is not quite clear most people expect the same protection against reading of their E-mail as there is against the unauthorised opening of ordinary mail, WHY NOT?
When an employer needs the tool of tabs on internet and phone use to assure their employees are puting in their money's worth of work there is something rotten in the system.
Modern companies set productivity targets and when people are meeting them it's rather unimportant what else they do!
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
What if I use a web interface to something like hotmail to send personal email? Is the company still liable because I've accessed my webmail on a company workstation?
Never trust a man in a blue trench coat, Never drive a car when you're dead
Do you believe that the fact that email is more informal means that they require more monitoring? If we applied that policy to phone calls, which are just as informal in nature, then companies should be monitoring every phone call an employee makes in case they, "say something inappropriate."
Never trust a man in a blue trench coat, Never drive a car when you're dead
No, I'm certain the paper mail is simply delivered to your desk.
Not at my company. We are heavily regulated by the goverement, so most paper mail that goes in and out of the compnay is scrutinzed very closely.
The responsibility with paper mail is with the individuals.
Why change things for electronic mail?
Because, unlike paper mail, electronic mail can last forever. It is very easy for me to write a letter by hand, then send it away with instructions to be destroyed by the recepient. The only copy is gone, with no record that it ever existed.
Email is different. All those bits get backed up on a regualt basis, and then can be used in a court of law. I offer Microsoft as an example of this. What might seem like a personal message, could have significance in a harssment or wrongful termination case.
The welfare of the people has always been the alibi of tyrants. - Albert Camus
Being in a similar situation, I have also pondered this koan, and believe it truly unsolvable. You want to to only monitor true abuses, not minor nit-picky transgressions, and respect privacy as much as possible.
Can't be done.
You need must monitor every email is you're to catch those creating true liability. You must log every page view if you're to catch the porn surfers. If you sample these things, those you catch can accuse you of singling them out. If you smple, you might miss some doosies. And as the filter companies have shown us, these sampling and filtering methods do not work (yet?).
Perhaps what you need is a modest plan involving user education, a written policy protecting user privacy and agreeing to full disclosure when it must be violated in the course of some investigation, and enough documentation to demonstrate due vigilance wrt these issues in case a suit arises.
In the end, those who want to bad enough will screw everything useful up for everyone. The trick isn't on preventing it so much as being able to prove that you made every reasonable attempt to prevent it.
Why are you looking for a good way to comply with a bad law? The problem is the law--fix it! Yeah, yeah, "I can't afford court fees", etc, etc, etc. Write your congress-critters (federal and state), talk to city/county councils, get your voice out there! These things can be fixed without resort to courts and expensive lawyer fees.
Better yet, pay attention to current bills being considered. An ounce of prevention....
--
Linux MAPI Server!
http://www.openone.com/software/MailOne/
(Exchange Migration HOWTO coming soon)
Why not give your employees email adresses in a subdomain? For example: user@private.company.com
Combined with a note on your webpage, company terms and so on, this could be a legal wrapper against such 'attacks'.
>Why change things for electronic mail?
You'd have to ask the courts. They are trying (and succeeding) to reinvent the wheel.
If 2600 had 'merely' printed the code in an issue of their magazine, there would be no case.
Jesus was all right but his disciples were thick and ordinary. -John Lennon
They might be a smartass, but they would be a bright smartass. Someone cognizant enough of their situation to try to change it. That person should quite probably deserve more responsibilities.
/. would do something similar just out of boredom?
I'm not saying they aren't a malcontent. But how many smart people on
Jesus was all right but his disciples were thick and ordinary. -John Lennon
Nowhere did I imply that gaining millions in a civil suit is either easy or necessarily possible. But in a legal climate where nearly every claim, regardless of its absurdity, is given time in a court, it is impossible to predict what a court will force me to pay to defend. And this is not simply monetary costs. The costs due to a loss of reputation, and the time involved could possibly be devastating.
/., I'm afraid that it will always be viewed as a fringe group with fringe opinions.
As far as having intelligent employees, yes, that is the bulk of our staff. However, when unemployment rates are as low as they are, finding new staff that is competent (and by this, I mean that they can alphabetize) becomes increasingly difficult.
We have phone policies. We have fax policies. But if you reread the original question, you'll see that the purpose was to garner what seemed to be a reasonable policy regarding the internet and email (not yet implemented in our office for a variety of reasons).
With few exceptions, I have gotten few, if any, reasonable responses to my question. It is very easy for slashdot to bemoan the practices of companies. Yet when I asked for a policy that takes into account both their needs and those of the employer, the responses seem to be:
Screw 'em. You gotta cover your own ass.
-or-
It's your job, not mine.
As long as that is the mentality that exists when one tries to get the opinions of
I must also state that I'm quite dismayed that Mr. Katz has not chimed in. (or at least he hasn't yet been modded up. Perhaps a recheck is in order). Despite his constant protests of the hegemony of the American Corporate Culture, when given a chance to voice constructive criticism, he is nowhere to be seen. Perhaps those who denigrate him are correct. He is a reactionary with little to offer to the conversation.
But on slashdot, it seems he is not alone.
(btw, for those who must flame, the mail server is at olg.com)
Jesus was all right but his disciples were thick and ordinary. -John Lennon
This is probably what we will do in conjunction with some other ideas. The problem is that the company is right around 50 employees. At that point, with the facilities available to us, things start to get difficult to handle. As a matter of fact, most of the problems are due to the fact that we are large enough to need more formal management, but not large enough to afford it:)
Jesus was all right but his disciples were thick and ordinary. -John Lennon
I used to work for a state agency (judicial branch), and the entire agency was completely ridiculous about both email and internet access. (No joke, the head of the agency initially did not want us to have email because he thought that meant that people could randomly hack into our Word files and read protected documents.)
Before we were allowed access, we had to sign two or three pages of disclaimers and such stating that we were aware that we "had no reasonable expectation of privacy" in our email or internet usage, and that the agency could peek into it at any time, with or without cause. It also stated that email and internet access were for work only, and had some language stating that minimal or occassional usage for personal reasons was okay.
Yes, the policy sounded insane, and most of us were pissed off. Grudgingly, we signed anyway. (Refusal to sign mean no internet access or email, period.)
To my knowledge there have not been any "issues" involving email or internet usage there (save for a problem with some silly Christmas card program that took up huge amounts of space on the server). The more savvy employees got Yahoo accounts for their personal usage. And for the most part, everyone lived happily ever after.
If a problem did arise, at least the agency feels protected by the lengthy disclaimers. Obnoxious or not, they would hold up in court.
No, I'm certain the paper mail is simply delivered to your desk. The same way outgoing paper mail is handled, and interoffice paper mail. The mailroom leaves the responsibility with the individuals involved.
If you remember your business letter standards, how you sign your letter is also an indication of whether you are speaking for the company or not. The responsibility with paper mail is with the individuals.
Why change things for electronic mail?
TG: Erm, Mr. Boss, sir, I have that Internet policy you asked for. (Offers PAPER to BOSS.)
BOSS (inspecting PAPER): It says here that we won't read our employees' e-mail.
TG: Erm, yes, sir.
BOSS: So if I suspect that one of my employees is embezzling, or selling our secret formula for Slashdot Cola to my competitors, or tipping off friends about likely changes in our stock price, I can't look at files on the computer that was bought with the stockholders' money to find out?
TG: Erm, well, sir, I don't want to play Big Brother.
BOSS: Then go work at the Mickey D's drive-through. You're fired.
(MY OFFICE, one week later. TECH GUY #2 enters, holding another PAPER.)
TG2: Erm, Mr. Boss, sir, I have that revised Internet policy you asked for. (Offers PAPER to BOSS.)
BOSS (inspecting PAPER): It says here that we won't read our employees' e-mail unless we reasonably suspect that they're doing some forbidden thing.
TG2: Erm, yes, sir.
BOSS: So if I suspect that one of our employees is embezzling, and I find out that he is embezzling, and I fire him, he can still sue us for breach of contract, alleging that even though he really was embezzling, I didn't have enough information to form a reasonable suspicion that would allow me to look at his e-mail? Which, by the way, is stored on the computer which was bought with the shareholders' money?
TG2: Erm, well, sir, ...
BOSS: Thanks so much. You're fired. Have a great day.
(MY OFFICE, one week later. TECH GUY #3 enters, holding yet another PAPER.)
TG2: Erm, Mr. Boss, sir, I have that second revised Internet policy you asked for. (Offers PAPER to BOSS.)
BOSS (inspecting PAPER): It says here that we can read our employees' e-mail for any reason at any time. Won't our employees think that we're playing Big Brother, and be angry and resentful?
TG3: I'll blather on to them about EEOC guidelines. Besides, all our competitors have the same policy. What choice do our employees have?
BOSS: You'll go far in this company, Jenkins.
In general, you cannot escape legal responsibility for your agent's bad acts by willfully blinding yourself to them.
Not true.
I'm a consultant, and at my current client site, the lawyers have deemed that no email shall live more than 30 days. If it needs to live longer than that (some does, like contracts and product research), then it quite clearly becomes the user who is responsible (and who gets sued), and not the company, for anything that goes wrong from having that old email lying about. There's still ways of copying email outside the system, but POP and IMAP have been disabled on the servers to prevent local copies of email from accumulating.
:-)
Keeping logs doesn't really protect you. All logging does is simplify a post-mortem, and provide a method for digging into someone's past and turning a non-event into something nefarious. If the data isn't collected, you can't turn it over to someone.
And the user can still send inappropriate email using any form of encryption such as, oh, any non-English language. Seriously. Are you going to spot check the emails written in French? Hindi? Farsi? Obfuscated Perl? How about keyword filtering in those languages?
About the best you can do is use the same policy you have in place now for phone use. If it gets out of hand, you, or your co-workers will know (or will rat on the guilty). Make Human Resources play the part of bad guy, and have them deal with these personnel issues. Publicize the policy, and have a two infraction limit. First warning, a week without pay. Second warning, you're fired. Zero exceptions (including VP's and CEO's).
Finally, I'm happy to see that you realize it's not that you're going to get 2,000 hours of perfect work out of an employee per year, but that the value of what they do during a year is greater than what you pay them each year.
I've documented similar experiences at: http://www.robertgraham.com/pub s/firewall-pr0n.html
I want to kick it!
Yeeeeeeaaaaaaaaaaaaahhhhhh!!!
I'm no lawyer but AFAIK this idea would work:
Become a "private ISP" of sorts. Charge a nominal, required fee for use of the e-mail system. That way you could use some of the legal prtections ISP's have.
Web:
- No Web access without full officer approval (a bank.) Every move you made on the web was logged and tracked, plus "undesirable" sites were blocked out.
- Very little logging, but a proxy server filtered out things like Playboy, Dilbert, etc. (huge insurance company.)
- Unrestricted web access, very little logging (firewall logs blocked port attempts, etc.) This is in my current gig with a huge worldwide systems company.)
Email:- Internal email only...no outside access at all (including blocking of Hotmail, etc.) except in certain, tightly restricted departments such as PR, customer service, etc.
- Full outside access, but everything was logged and passed through a word/content filter. I've seen many a sneaky sales manager get gently escorted out the door after they found that he was emailing files/kiddie porn/MP3s to his buddies. Very strict policy for if/when you screw up.
- No email filtering as far as I know.
Now, here's what I have always used to govern my personal Internet use at work:- Nothing, and I mean nothing, of a personal nature goes through my work e-mail account. My ISP lets me read and send personal mail via the web, so I'm at least not wasting the company's mailqueue space.
;) Besides, if some goof from the outside sends me spam or a "restricted" piece of material, I certainly don't want it coming up to haunt me. Besides, I already get way too much email in my work account. :)
- As for the web, it's the company's nickel you're using to browse. I try to keep personal browsing to a minimum, but most employers I've seen understand that blocking really isn't the answer. The only thing I'm guilty of overusing (other than reading Slashdot) is downloading stuff like patches and service packs for programs (I have 56K at home...try downloading W2K SP1 over that!!) It's just too dam nconvenient to download, burn to CDRW and take home.
Now, if I ran the network (at least the external services end...) I would do the following:Er...your job must really suck.
Disclaimer: I helped write their keyserver.
This document has a number of good links related to this story.
This page lists a few more lawsuits from company liability about email. To limit liability in such cases, they suggest:
It is the growth of the nanny state. Personal responsibility has become inconvienient. Why worry when the gov't will take care of it for you, of course never mind that in the process you lose your freedom.
My Weblog
From what I've read in the media, I think if anything you are not worried enough. I personally would suggest that you write up an email policy for your company, and make it part of the employee handbook. I would include an acceptable use standard that limited what personal email was allowed.(who they could email ie family and how much person email they could send maybe a few a day). I would then add an enforcement policy that basically said that you would do spot checks and investigate complaints, and then say that the punishment could be anything up to termination. I would also come up with an email deletion policy. Basically saying email will be deleted if it is more than x monthes old.
Why this is a bit draconian, it would give you some protection in lawsuits. Basically what you've done for your employees is given them some guidelines. It helps them know what you will allow and won't, most employees will likely appreciate this. If you do develop a policy make sure you enforce it. At my former employer we had a few morons who liked to mail internal confidential documents to trade rags. For their effort they got fired. If you have a clear policy on this stuff it makes it easier for you to protect yourself. Oh btw, I am not a lawyer
My Weblog
And it comes out later that they were away from their desk and someone else visited that site from their PC, or someone sets their PC to the victim's IP when the victim's PC is down, or ..
I've seen this happen before. Of course browsers keep logs of accesses including the time. So some security guard who wasn't smart enough to clear the browser cache got fired for looking up porn at 3:30 AM
My Weblog
I'd make that "deal with ALL abusers promptly.
In far too many companies, middle and upper management are allowed to get away with things that would get the wage slaves on the factory floor on in the cubicle farms fired on the spot.
Such policies only work (and only protect companies from wrongful dismissal suits) when they are enforced equally.
Well said, sir!
IANAL
You are better off establishing a clear company policy and enforcing it when violated, this is how you protect your company from hostile workplace/sexual harassment suits. While recently reading many company handbooks, most clearly stated that email and web access was for company business only, not private use. Sexual harassment policy was also clearly stated as well.
Monitoring or blocking can actually be a bad thing, because then you may become liable for failure to detect offensive email or to properly block sites. If you are monitoring, an employee could claim that you had knowledge of the conditions but did not take immediate action to correct them as stated by your policy.
This just sounds like a defamation lawsuit waiting to happen... IANAL, but anything more than "Bob violated the posted Internet policy" will be challenged by somebody, then the company will need to prove why it released personnel details on a terminated employee
The fact that you visited www.livenudegoatpr0n.com at work is not a personal detail. It's information that the company can release to anyone it bloody well chooses because the entire transaction took place using company equipment and property and on company time. That means that it wasn't a private act, but a public act within the company. So you can't bitch that your company announced that you were fired because you were filling up the companies hard drive with pr0n.
Kintanon
Check out JoshJitsu.info for Brazilian Ji
And it comes out later that they were away from their desk and someone else visited that site from their PC, or someone sets their PC to the victim's IP when the victim's PC is down, or ...
That is a risk. A possibly expensive risk.
I don't think you understand how corporations work, they aren't going to just notice hits to pr0n and fire the guy and announce it. They are going to notice the hits, set up some more intrusive monitoring on his machine, and find out everything they need to know to be sure it's who they think it is. Then discuss it with them, and continue monitoring. Corporations are VERY cautious because they don't like wrongful termination suites any more than any other kind of lawsuit.
Kintanon
Check out JoshJitsu.info for Brazilian Ji
Dude, do you even know how SMTP works? The full address of the receiver is sent to the SMTP daemon... "RCPT TO: "
POP and IMAP can trivially deal with this as well by having the user login with a full email address instead of a username, i.e. "user@sub.domain.com" or just "user@sub".
It depends on your company size.
Sometimes, in a smaller company with 100 people - it is possible to work closely with the employees to ensure they understand the company standard practices. I have seen cases where in general meetings, the COO has tabled the issue and has asked for a consensus among the employees about how the company as a whole should deal with this issue.
That is not really practical in a larger context. I work in an information services department with more than 4000 people in a largish corporation. For us, here, (and Im not the person who enforces these policies here) there may not be really any other way out rather than blatant denial/interception.
Whatever way you choose - it is wise to use understanding and care when dealing with such violations.
Legally, I'm not sure they can monitor workplace phone (voice, not modem) communications -- ISTR that some law prohibits this, but it's worded in such a way that it doesn't extend to network data communications.
Only the dead have seen the end of war.
It's another one of those prickly problems, I guess, if the law is going to have that little disregard for the idea of "responsibility". But in the end, it sounds like it's going to come down to some kind of monitoring scheme, right?
And maybe I'm hopelessly naive, but it seems like what you need to do is find a way to involve your employees in the process. Tell them what the problem is. Ask what kind of monitoring they'd find acceptable, and what they'd find intrusive. When you figure out what precisely your options are, ask your employees what they think of all of the different possibilities.
And when you figure something out, tell people as EXACTLY as you can what you're doing, and how it works. Tell them what you expect of them; tell them what limits you are going to respect (and then respect them, of course).
I'm sure some people will be a little put out, no matter what you come up with, but given that one can get all kinds of free e-mail accounts and that most have abundant access to the net, some restrictions on what one does at work shouldn't be too onerus.
Happy Premise #3: Even though I feel like I might ignite, I probably won't.
Man! I can't imagine being so addicted to pr0n that you just have to get into it at work when the company policies so specifically forbid it (and it's NOT hard for your employer to check). Just seems dumb. I mean, I feel bad enough reading slashdot for an hour at a time, but at least that's not (specifically:) against company policy.
Can Ford be sued for creating a hostile workplace if someone sees an offensive porn site on a computer that they provided for their employee (in their employee's home?). Is snooping necessary legally to prevent at home porn browsing on company provided computers?
-----
I work as a mail admin in a big company in Spain. One of the latest tasks has been to implant a "mail firewalling" policy to avoid harmfull attachments reach the company network (EXE files, Scripts, etc.). They are now considering restrincting more things like big Jpeg attachments and even scan mails in search of potential "threats" (porn, violent content, etc.)
With the current software we are using we could obtain very detailed information about what are employee doing with corporate e-mail, but management knows something for sure: they will go as far as the cost of doing it is inferior to the cost of "improductivity" that e-mail activity produces.
It is just too expensive to chase people around... It is a matter of money!
So aside from the obvious privacy concerns about checking my POP3 email using another service, if I send an email from my cell phone (never touches my standard SMTP server) or access one is the company that provided the service liable?
I don't know.. Maybe it's a stupid question.
This is a double-edged sword, in that I am effectively exempt from any restrictions placed on web browsing (as I post this at 4PM CST), but I am also to some extent responsible for creating and enforcing those restrictions.
Personally, I reserve my potentially objectionable web activities to my personally owned machine, be that a laptop tunneling to an external proxy, a ssh connection to a box with Lynx, or just waiting until I get home to download MP3s and pr0n.
I do not deploy Linux. Ever.
It's not the employee's fault if the employer's too stupid not to make a policy against sending PGP-encrypted messages.
---
IMHO, of course.
May the SOURCE be with you.
1) They can have all the e-mail and web surfing at home that they want. Even for free.
2) You paid for the computers and the internet connection. You get to dictate terms of use. If they want to "represent" the company they need to abide by your rules.
3) If they screw up and get you sued, you can fire them. You, however, can lose your business. Being the one to put your neck and reputation on the line by starting a business means you take more risks and can get more rewards. Don't let someone take that away from you because they wanted to "show you".
Overall, if they are adults, they should realize the responsibility that they have to their place of work. If they want to violate your policy and expose you to risk, then someone else can hire them and take the risk. Or, they can become self-employed. Then they can see what it is like to have themselves exposed to risk.
All my programs have a purpose. This one, for example, takes the contents of RAM and places it in a file called 'core'.
Depending on the nature of your company, you might not want to strictly monitor such communications -- but be sure to create guidelines that all who are employed by your company can understand without legal council.
If suspicion is strong enough, maybe monitoring communications minimally. Many companies do allow (without acknowledging) some personal activities to slip through the cracks, so long as the employee is doing their job. But I don't know about many professions and how easy it might be to get compulsively sidetracked, but I'll bet many companies that don't deal with consumers often don't always promote the most comfortable work environment in the name of saving money!
Of course i'm wrong, so comment accordingly ;-)
The way I hear it, however, is that users are responsible for their own workstations' security and the integrity of their password, and anyone having access to their workstation would hence fall under their responsibility, too (not too nice if you use Win9x). This is in addition to another respondent's assertion that a company would attempt to find a trail of similar indiscretions. In an era of firewalls/logging, and with the repetitive nature of pr0n-surfing behavior, it's pretty easy to completely track down someone using company equipment for such uses.
Keep in mind, as well, that even with failsafes such as "at-will" employment[1], it can be difficult to fire someone and not worry about an expensive lawsuit. To get HR moving in many cases, you need hard evidence and a trail of it. This mostly handles the IP spoofing situation, but, yes, there might be some situations where repeated PC outages could be used as a smokescreen for this type of behavior. I think we're describing a teeny percentage of the cases, and in most instances, it's the user not paying attention to policy/consequences.
It is tough for me to understand that your average user doesn't get this, however, and that so many still do surf porn sites on company time/equipment. Bandwidth is pretty cheap/available.
1. "at-will" employment is a clause in a company's sign-on contract that states that an employee may leave for any reason, with or without notice, and a company may terminate the employee under the same conditions.
Email is intended to be an informal correspondence tool to assist in the employee's workday, as well as a vehicle for research and communication with clients and vendors. It is not supplied as a replacement for conventional business communications (i.e. written memos, phone conversations, meetings), but as a supplement and enhancement to them.
Personal use of email should be restricted to the following conditions:
Email should never be considered private, all messages are property of the company.
Unsolicited email or questionable file attachments should be reported immediately. Running executable file attachments is not allowed.
Sending the following types of messages is explicitly forbidden: chain letters and their ilk, virus warnings, messages containing sexual content, messages containing threats or abusive content, "spoofing" (impersonating another user), messages containing confidential company information.
Tips
Email can be misdirected, forwarded to someone else, and replies may go to more people than you realize. Do not put something in an email message that you would not want read by everybody.
Never, ever execute an email attachment and never run a file someone has sent to you. Save the attachment first, open it with the application that it's intended to use.
At this point in time, the most destructive viruses will appear as friendly attachments in messages from reliable sources. Be smart.
Check the file size on that attachment you're sending! Limit distribution of attachments to smaller files, or compress files before sending them. Large attachments (1MB+) may be rejected by outside mail servers.
Email takes up disk space, so delete messages you no longer need. The messaging servers are not file servers, and are not intended to be archives for your mail. Save messages to a local or network drive, or delete messages.
Email can be junk mail in the eye of the recipient. Be conscious of your audience! Be sure that your message concerns them directly. Avoid forwarding messages unnecessarily, and use distribution lists with discretion. Never send to everyone in the address list.
Avoid complicated backgrounds or non-standard fonts. Your recipients may have less powerful workstations or be on a dial-in line. Plain text is encouraged.
There are no nuances in email, no facial expressions or tone of voice, so there is a greater chance of misunderstanding. Here are some tips on bridging the digital gap:
One exception: Chicago's Soldier field during a soccer game.
Standard Disclaimer: I am not your lawyer.
The fact is, if you have a business of more employees than you can count on one hand, you should probably have policies regarding personal use of the phone, Internet, and other office resources.
This does NOT mean just write them down and stick 'em in a file cabinet. That's how you get in serious trouble with plaintiff's lawyers. What you SHOULD, do is this:
Your employees are not stupid. You can explain that a flirtatious UPS driver, or even going out for drinks with the office after work, are different from employees making frequent sexual comments about other employees, different from turning a blind eye to employees who send sexually explicit URLs around the office or spend time at work surfing those sites, and different from employees who hit on other employees and give them worse work assignments after being rejected.
That last thing -- that's where most employers who get nailed in lawsuits really get nailed. People who end an on-the-job romance (or refuse to have one in the first place) shouldn't have to worry that they're going to get lousy assignments, no more promotions, or lose their job as a result. As an employer, you need to see to it that those things don't happen.
These opinions are my own. My employer is not aware of them, does not endorse them, and is not responsible for them.
I sympathize with the question. In terms of laws which regular employers, those pertaining to sexual harassment are some of the worst. I'd tend to suggest an application layer monitor that checks keywords, and completely ignores messages which do not contain them -- carnivore, anyone?
Really, we need an adjustment of the law. The judicial interpretation of the law has led to some amazing rulings regarding sexual harassment. Not only has it wrongly cost many companies money, time, and employees, but it has trivialized the truly evil sexual harassment which still goes on everywhere. It should always be the case that a company has a chance to rectify a situation after the fact. Any large company should have a contact person in HR who can receive a complaint, and companies should not have liability unless they fail to respond to a complaint. Anyone who can file a lawsuit can surely take a complaint to HR first; otherwise, I'd say they are motivated by greed and/or spite, and not just the desire to have a healthy workplace environment.
Of course, it won't come as any surprise to slashdot readers that the country is in love with litigation, but the longer I work, the more I witness incidents where the spectre of litigation protects only the wicked, as it were.
There are laws against rude behavior designed to protect select privaliged minorites: women, negros, homosexuals and to a lesser extent, hispanics. Ignored are unfavored minorities such as Asians. These are the laws that the poster claims are forcing companies to snoop on their employees.
These laws are useless and un American. Oh, I hate rude people but my company is not responsible for this. Lewd speach is not protected, but just try to fire someone for being rude. Good luck.
Friends don't help friends install M$ junk.
The best compromise I've seen for this situation is to have full access to monitor everything your employees do. Then just don't use it. You aren't really intruding into your employees' privacy, because you aren't watching what they do. But you have everything in place in case you do need to start checking up on them. The important thing is that you explain this to your employees, so they know that a)they shouldn't be doing anything that can get them in trouble, because you could be watching, and b)they shouldn't worry about their privacy because, as long as they behave themselves, you won't be watching.
I am guessing from the sounds of it this is a fairly small company. If not then ignore this and use managers etc. Try and hold a company wide meeting and let them know your concerns. Then maybe tell them in general what you are thinking of and ask them for ideas. At least that way if you do have to resort to big brother they will be aware and won't try and sue you for invasion of privacy or some crap. Too many lawsuits. Oh well Good luck.
I am 31337 or something.
There's a book about policies you can implement to protect your company... "e-policy"
http://www.amazon.com/exec/obido s/ASIN/0814479960/
kick some CAD
What if both yo-yos say that? Then vote for the Libertarian candidate; he or she will NOT be saying that.
Technology is not going to protect you from lawsuits because technology did not cause the lawsuits. Just because it is easier for employees to keep in contact with people from outside the office throughout the day does not mean that your chances of getting sued increase. When it was fax machines and snail mail, wasn't there also still butt-slapping and memo-boards? The situations in which a sexual harrasment or other company damaging claims could occur weren't able to be stopped by technology back then, and they aren't going to be stopped by technology now.
Some of the solutions were already in your question. (1) Hire dependable, hard-working, trust-worthy people. (2) As your company grows don't let them lose touch with each other or resources for help in case something does happen to them. In other words, get a strong, honest, HR director or department, someone your employees feel is on their side and not the company's. (3) Talk to a good consulting firm that handles HR issues like workplace grievances and see what they recommend (4) and since it will happen someday, get a good team of lawyers.
The solution to the issue of unwanted lawsuits lies not in controlling outside contact, but strengthening contacts inside the office.
In a previous life I was one of the head administrators of a very very large e-mail network for a very very large company. 300+ servers, 60 countries, etc, etc.
E-mail policy was a huge issue for us. The technical team and the legal team looked at it from several sides. First, thing we thought of was the cost of monitoring e-mail and what problems it may cause. The biggest problem was actually monitoring e-mail caused far more issues than not.
It was far more likely that we would be sued for terminating someone over an e-mail rather waiting and responding to a complaint about said e-mail. The biggest factor in this was dealing with low level management. Frankly, the low level is there to watch the clock and fill out reports. The probability that a manager making under 30K a year of correctly handling the situation was quite low as well.
Further more, by opening mail up to be read we risk disclosing information that would break NDA's, and FTC rules. For instance we wouldn't want mail about a merger or sell off to be made public until it was legally correct to do so.
In the end the mail policy was set up so that monitoring of e-mail would only be allowed in the case where a VP level or higher authorized viewing the mail. Any other complaints we be handled via HR channels.
At least they should be considered so.
My company has a simple policy - pretty much open internet. Some sites throw up red flags and are blocked (such as playboy.com).
We publish the companies internet usage policy on the intranet home page. No one has the ability to change that home page. They are required to bide by the rules of internet usage.
If they don't, the rules are simple - termination.
And we make a big deal out of it. Terminations are not announced (the rumour mill takes care of that...), but when employees are convicted of having soft/hard/child pron on their machines, a letter of explanation goes out from the company president.
It's amazing to see the internet usage ramp down for a few weeks!
"History doesn't repeat itself, but it does rhyme." Mark Twain
Should have read the RFCs first.
<O
( \
XGNOME vs. KDE: the game!
Will I retire or break 10K?
ARIN is no longer giving out IPs for individual subdomains, and the mail protocols don't work with name-based virtual hosting. How would this be implemented?
<O
( \
XGNOME vs. KDE: the game!
Will I retire or break 10K?
"Thank you for your recent message to customer support. Please be advised that there will be a seven to ten day delay while our legal department reviews our customer support staff's reply. Thank you for your patience while we reduce our legal liability."
This litigious culture is largely the result, not of over-zealous individuals, but of a political system unwilling or unable to directly regulate the conduct of corporations. To use one of your examples: the states sued the tobacco companies because, even though smoking causes epidemic-level health problems, Congress was so compromised by Big Tobacco money that the only viable option was to sue.
Social policy today is set in courts, not in congress. If you are unhappy with this, don't just blame people suing. Blame a system of representation that is largely broken, broken by corporate money. Not suing people is not going to help much, but working to change the system of representation, and electing people willing to change it, will.
I am the mail/network admin for a midsized company. We have limited capital, and therefore limited bandwidth (the big pipes cost big money).
Because of this and to protect ourselves from the liability mentioned above, we monitor email in a way that we consider to be reasonably fair. All incoming, outgoing and intercompany emails are scanned for a set list of words and phrases (that was an interesting day, keying in all of the offensives words I knew), in addition to being virus scanned, checked for size, etc.
Incoming mail that throws a lexical violation (contains enough of the words/phrases to red flag it) gets bounced with a polite messge regarding innapropriate business content. Outgoing and intercompany mails which we might be liable for that throw a lexical violation are forwarded directly to the head of HR, who determines if it is necessary to take any action. 9 times out of 10, nothing is done.
Regarding the web, we catch every single URL that gets keyed in. We do restrict and filter content, more to reduce bandwidth usage than any other reason. On the other hand, as the guy who had to search the logs, I can tell you definately there were people surfing porn. I'm not talking about an occasional glance either, I'm talking an hour long porn fest. The software we use allows us to tailor a surfing policy for different groups of users. Data entry personnel who don't need the internet for business use simply don't have access. My company pays for the pipe. They pay for it so the business can grow, no to provide an ISP to employees.
As a final note, I saw someone talking about smartasses who put all of the offensive words in there sig. Yes, it's very cute, and it happened to us several times. I've found that after an extended conversation with both HR and th Manager of Information Security they find better uses for their time.
I gotta get a tight tension on...
I know there's no easily solution to this whole employee privacy/employer responsibility issue but I think you first have to consider how much time employees are spending on the Internet.
I agree, a five-minute break checking eBay for a limited edition CD or something like that is pretty trivial and employees shouldn't be having a heart attack over it. But if an employee is spending so much time on the 'Net that it's really screwing up their productivity then something has to be done. Although it has to be said that monitoring individual employee keystrokes, keywords and opening their email goes over the line and if that's what's happening at your workplace then do something! Which brings me to my next point.
The most important thing in this entire issue is that employees know where they stand rergarding privacy issues. If an employee doesn't know what the regulations are regarding the privacy of their communications then it just creates an atmosphere of distrust and suspicion and that is when you feel that Big Brother is watching you.
Self Bias Resistor
"Imagination is more important than knowledge." -Albert Einstein
----------
When the pin is pulled, Mr. Grenade is no longer our friend.
Haven't we conclusively proven already that one lawyer can cloud legal judgement, and a committee can completely kill the publicly accepted standard of common sense? You most likely allow your employees to use their break time to telephone a loved one from work; If they are instead using their lunch time to call their ex, whom in this scenario has a restraining order against them, are you laterally responsible for providing the telephone at your workplace?! If an employee puts THEIR stamp on a piece of personal mail, and drops in in the company's outgoing mail chute to save a trip to the post office, are you responsible for it's content? I could only hope that if an employee were using your company email to send or recieve objectionable material, the parties involved in any subsequent legal action would be.. the sender, and the receiver. You are running a company, employing adults, not running a day-care center. If your IS manager came to you and suggested that SOMEONE on the network was sending/receiving an inordinate amount of email, it would warrant a short conversation regarding the limitations of personal usage. What is being discussed here, in abstract, is the problem with the US legal system and society as a whole, that being the Death of Responsibility. It's always someone else's problem, isn't it?
THIS SPACE INTENTIONALLY LEFT BLANK.
"I manage a small business and am well aware of how bizarre the EEOC and others can get when it comes to sexual harassment, racial quotas, etc." The EEOC does not and cannot mandate or enforce anything resembling "racial quotas." Like many aspects of American Law, equal employment opportunity laws state a general principle but are (a) very vague about what constitutes compliance, (b) weak on enforcement mechanisms, and (c) usually allow professional organizations (consultants, personnel departments) to determine what compliance means. Throwing around phrases like "racial quotas" is plain wrong and very misleading.
There is one gigantic difference between e-mail and phone-- an employee's phone conversation is not temporarily stored on an employer-owned machine prior to being sent. E-mail is. And the incoming e-mail is stored on company machines indefinitly. This changes things quite a bit. It makes e-mail much more similar to business correspondance on letterhead. The phone is a poor analogy for e-mail in a business setting.
1984 was supposed to be a warning, not an instruction manual.
When an employer needs the tool of tabs on internet and phone use to assure their employees are puting in their money's worth of work...
That's usually not the issue. Ordinary productivity goals/yearly reviews are good enough for that. The reason to archive/be able to review e-mail records isn't to make sure the employee is working, it's to make sure the employee isn't using the company hardware to do something illegal for which the fscked up US justice system could break the company.
Although the law is not quite clear most people expect the same protection against reading of their E-mail as there is against the unauthorised opening of ordinary mail, WHY NOT?
Erm, I'm not sure about Holland, but in the US if a letter arrives addressed to me as Me, Agent of My company, My Company's address, it's company mail and while it wouldn't normally be opened, if the company wanted to, it could. It's NOT ordinary mail, it's company correspondance. And any mail I send out on letterhead is company business, and is normally photocopied before being sent.
I don't know for sure, but if you work for the government, all that mail may be subject to Freedom of Information rules that not only let your employer read it, but everyone else who asks.
Modern companies set productivity targets and when people are meeting them it's rather unimportant what else they do!
Well, in the US, modern companies have a reasonable fear of multi-million dollar lawsuits if an employee abuses the company resources. I don't care how productive you are, if you do something to get the company sued into bankruptcy, you're not meeting your productivity target. And it's so trivially simple to prevent these things by keeping personal & public e-mail separate. I don't even make personal phone calls on the company phone any more-- the cell phone is mine, paid for by me, and all my personal calls go through it, unless it's an emergency. It costs a little more, but it sure keeps life simple.
1984 was supposed to be a warning, not an instruction manual.
There are a few simple things you can do to cover your end and make employees life easier:
1) Have a written internet policy. Work it over carefully. And have every employee who gets a internet-connected computer sign that they've read, understand, and agree to abide by the agreement.
2) Business e-mail is the same thing as letterhead. Employees don't use letterhead for personal correspondance, they shouldn't use business e-mail for personal purposes. Hotmail, yahoo! mail, go mail, there are a hundred free e-mail services out there that work just fine. Simply make policy that the business e-mail is business use only. Period. Help users setup hotmail/yahoo/whatever if they want. Bingo! You have no ethics problems with full logging/reading every e-mail that goes through. There are no personal/privacy issues to deal with. If an employee gets caught using it for personal purposes, there's no reasonable expectation of privacy since you've already stated that it's business only and will be logged.
3) Make policy on personal web-browsing. Make it clear what is not acceptable. And deal with abusers promptly.
4) Sexual harassment: this is only a real problem if something is brought to your attention and you fail to act on it. If the delivery guy is being inappropriate, you ought to be on the horn to the local delivery office immediately if not sooner! As soon as you mention "sexual harassment" and "we're discussing this with legal" the guy will be on notice, and if it happens again, he'll be fired. Guarenteed.
1984 was supposed to be a warning, not an instruction manual.
- A. Keiper
The Center for the Study of Technology and Society
Washington, D.C.
Securities and Exchange Commission (SEC) rules mandate some restrictions on e-mail for brokerage firms.
Just because it CAN be done, doesn't mean it should!
Then again, a lot of lawyers become judges, so much of what you said holds true in that case also.
Just because it CAN be done, doesn't mean it should!
I feel that you can't be too overprotective or you run the risk of alienating your employees and infringing on their privacy. At my company we have systems in place where we can monitor individuals but it takes a very high order to do so. This way if we get in a situation where there might be a problem we can then monitor individual people. This let's people have their freedom and still protects us as well.
--And sektor spoke and said unto the people. Hey, buttwipe hand me the cheezeos.
If I write a threatening letter and drop it in my company's outbound mail box is it really the company's fault?
If it uses the company's letterhead and logo (company domain in e-mail address) then it IS the company's responsibility. The employee is then acting on behalf of the company. If a telemarketer calls your house and cusses you out, do you call the telemarketer at home or do you call the company manager? (assuming you know their names) You (should) call the manager because that telemarketer is representing the company. When you are at work, you ARE the company. Act accordingly.
Wouldn't it be nice if this were TRUE?
Unfortunately, putting something on the Internet is being legally interpreted as "publishing" - and this applies to e-mail as well. (much e-mail ends up forwarded and put on e-mail list archives, etc)
Do you have a responsibility, as a business owner, to see what you are "publishing"?
Unfortunately, the answer seems to be "yes".
But, people don't resent an "open" solution if they know it's there. Nobody minds a camera posted over their head if it's obvious, especially if they can SEE what's being/has been recorded.
Here's what I would do:
1) Provide company e-mail addresses to those employees that need them.
2) Provide PRIVATE e-mail addresses (hosted at an outside ISP) for personal use. Maybe even include dial-up access as well. (cheap, what, $15 or less in most areas?)
3) Filter in only those messages originating AS an internal user.
4) Make a local web-page that lets everybody inside the business SEE all e-mails that have been sent in a "revolving door" deal. Also allow anybody to view e-mails by user, date, recipient, etc.
Like with software, we're finding more and more that the best policy is the OPEN one...
-Ben
I have no problem with your religion until you decide it's reason to deprive others of the truth.
First, let me say this: If a company expects me to be at work anything above and beyond what is recognized as a standard work week, they can fuck themselves if they don't want me using company resources to rearrange the rest of my life to suit them.
Back to company policies. The company for which I work has RFC1918 addresses for internal systems, NATted out through a firewall which only allows outbound on 80 and 443 for almost all systems.
Being non-stupid, I set up an SSH daemon on port 443 on an outside box and set up tunneling, but that's beside the point.
Point is that my company chose to place restrictions such that using external non-webmail accounts was impossible (well, for the 99% who tend to lack clue). MSIE is set up here by default to use their proxy, and settings on the workstations are locked down.
Were their choices better because they were diligent in limiting use?
Were they worse, because by not allowing SMTP, POP, SSH, telnet, and unproxied FTP, they encouraged the use of company applications and company servers, and not just company connectivity?
Since I can tunnel everything including web traffic (got me a proxy outside) they can't even see anything but one really long connection to a single host which comes up with nothing when they pop it after https://.
Reliability suffers, and my TCP/IP stack on this damned Windows box blows up too often with all the forwards, but have they won, have I, or neither?
Storing the information without looking at it until a complaint is filed should be perfectly reasonable legal protection. Even if you look at the e-mail your employees are sending out, the mail has left the building before you see it. So, either way the damage is already done. In the same sense, a company wouldn't be expected to bug employees they send out together on business trips to make sure they don't harass each other. They wait for a complaint to be filed.
As far as web browsing, the company really shouldn't care what the employee is looking at as long as it doesn't disrupt their project completion, and no one complains as to the material on their computer screens.
Basically, companies have gotten so worried about the idea that their employees might be cought doing something wrong that they want to catch them before the even do anything. Even the police don't do that. They come in to clean up after the fact.
Companies should provide two Email addresses. One for internal (business) and one external (personal). Monitor the internal. Make back up logs of the external, but do not open them unless required by a judge to.
Or, by the same lines, stop blocking sites like Hotmail off. If people want to send personal EMail, make them use that, and then it is totally the responsibility of the user.
-------------------------------------------------
Actually, it reminds the employees' friends. The employees never see it.
The reality is that lawyers go after the companies because, me friends, that is where
the money is. And as everybody knows, Money is what makes the monkey dance.
Dem is the real rules of the game. You might then ask, "gb, Why do the laws agree with this
false assumption of guilt by employment?" Probably because the people who make the most
money off of this kind of crap, THE LAWYERS, are the ones who make the laws.
Historically, the claim of consensus has been the first refuge of scoundrels.
They see it on replies when their email is autoquoted back.
.sig by policy, they do see it in their outgoing email.
Or, if it's made part of their
A lot of banks and law firms (who are most vulnerable to liability) automatically append boilerplate disclaimers to the bottom of all outgoing email. Is it irritating? Yup. Does it work? Maybe. But it certainly reminds employees that liability and responsibility are issues that they should keep in mind.
Most importantly, it may be able to save you the ugly mess of an email screen.
This one came about by default, owing to so seriously loopy system design and purchasing decisions. We use Groupwise here in the office, with everyone's permissions set to full. It's useful, because a lot of our business (lawyering) has to be done right now - the fact that someone's out of the office, tied up in a meeting all day or asleep at the switch won't wash with the clients.
/. between drafting contract clauses.
The upshot is that everyone can read everyone else's email. The web isn't logged or monitored, but the office is open plan. So everyone can see that I'm posting to
Total openness and good old-fashioned embarrassment mean that nothing untoward goes on.
Whether this system would work in an environment that didn't consist of a majority by weight of lawyers is left as an exercise for the student.
-- AndrewD
A Maze of Twisty Little Laws, All Different.
I've always felt that when you give people all the information, they often can be trusted much more.
When I was in college, I was involved with a school program that was being threatened with being shut down because incoming students would complain that they were pressured into drinking. However, there were 400 students involved in the program and there was no way we could police them all. The students in charge of the program appealed to the other students, explained the problem and explained the consequences and we had almost no problems. A couple of years later, it had become a "rule", and it's now a problem again. My point is that when we explained the situation, they wanted to help and were able to.
As far as the UPS person flirting with a receptionist, if you receptionist has some sort of way of getting help or discreetly calling someone into the room, the flirting will not be a problem. I would think any judge would look at that and realize the company had done all it could. But then, IANAL.
If your employees are forbidden from sending email that is not encrypted, then you can't monitor their email.
There are a ton of other reasons a policy like this makes sense; indemnifying yourself from such lawsuits is just a convenient side effect.
Browser? I barely know her!
What can be done to keep employee privacy, while keeping your company from being sued from a mysterious 3rd party. Outsource your email. Outsource it to havenco.com if you want privacy. As far as web browsing, I don't see how that's any of your business. There is no company liability in web browsing. You cannot stop someone from downloading or uploading anything... no matter what you do. So, it would be common sense that your company is not liable because you provided netscape with your OS. I, personally, had my boss reading through my and my associates email because he felt like it. Under the current laws he can do that. But, guess what. I don't use the company email system now... for anything. And, so, either provide your employees with privacy in browsing and email, or outsource or eliminate both. Either that, or you'll be supporting an impotent and non-functional "network". It's your choice.
Well said, slam smith.
"..don't you eat that yellow snow."
This "Big Brother" happens to be the owner of both the machinery and the man-hours involved. Is it abuse for the purchaser of these resources to know the process and the end of the investment?
"..don't you eat that yellow snow."
What to do? I would say:
---------
It's a very hard problem for the Lab I'm sure, pitting the need for open exchange of ideas between researchers against the need to protect the security of what we were working on.
Anyway, now that there are programs that can monitor web usage, could we write a program that could warn users? Or, are all web hits archived so they don't have to monitor in real-time. If this were the case such a warning would be useless.
Also, is it any suprise companies are reading email, it's as simple as:
root> cat ~"user"/mail/inbox | grep "insert offensive language here"
If you have a published policy against unlawful acts in email, and enforce the policy in all reported cases you should be ok...
Consider this, did you think you needed to limit phone use or monitor all phone communications? The liability is the same. You are generally not liable for things employees do outside written and enforced policy.
If the company is liable for what goes out under email, then really, they have a good case for having to monitor it.
And if your company is looking at your/their email account, so what? This may have been a bigger deal 6 years ago, when many people's ONLY email account may have been their academic or employer's accounts (that was the case for me, then). However, you've got at least 50 ways to move your mail now, pal. There's enough free email out there to kill mid-sized mamals. Doing personal business at work? Get a free email account.
Libertarianism is rich wolves and poor sheep playing gambler's ruin for dinner.
The problem is all inside your head, he said to me
The answer is easy, if you see it logically
I'd like to help you in your struggly for privacy
there must be
50 ways to move your email
Get Yahoo, stu...
or Hotmail, Gail..
there's freeshell, Del,
Just listen to me
go get Hush, Gus,
we don't need to discuss much
and get PGP, Lee
and set yourself free
(I don't want to slashdot freeshell, but if you look hard enough, you can find them)
Libertarianism is rich wolves and poor sheep playing gambler's ruin for dinner.
Welcome to the wonders of the two-party system.
To understand what's right and wrong, the lawyers work in shifts ...
Okay, for one thing it all depends on what kind of company we are talking about here. Quite obviously, if the company is involved in computer software, you are going to have a much higher percentage of people who really know how to work a computer, as opposed to (as an example) a real estate agency that is on the 'net. You have to consider the capabilities of the average User of your company. If that capability is not very high (i.e. they know how to web surf, write text files and send e-mail) then you will most likely have to take many less precautions then when dealing with a company full of people who write their own apps for fun.
You also have to consider the number of people who will have access. If you only have two web-capable terminals, then it is that much easier to keep a hold of who is doing what on the 'net. For most businesses, it is usually more involved. One option is setting up a firewall to protect your system from spam-mail, as well as limit who has outside access for e-mail purposes. Another option is to dramatically limit what web-pages employees can get to. In 99.9% of the cases, having employees viewing porn sites while at work is defintelu not productive, so a good web filter helps. (Just make sure that it doesn't get rid of Slashdot.)
Finally, it is a good idea to store all e-mails on one of the computers and limit the access to the storage server to a very few people. That way, if you need to, you can see what e-mail they are sending out, but you don't have nearly as many problems with privacy or "expectation of privacy" issues. Be sure to make it publicly known to your employees that this exists. Paranoia will probably keep them from abusing the e-mail system.
Kierthos
Mr. Hu is not a ninja.
Some have posted that you should be working on changing the laws. While that's fine, if you operate a business in a country with draconian laws, you might be better off moving your business elsewhere.