Slashdot Mirror
UK Employers May Read Employees' Mail
Martin Spamer writes: "The BBC reports that today the UK introduces Controversial new regulations (RIP)
giving employers sweeping powers to monitor their workers' e-mails and Internet activity. Campaigners say the rules, under the new
Regulation of Investigatory Powers Act, are an assault on personal privacy." I guess I just don't see it. If I was gonna bad mouth my boss, I'd use my domain as the e-mail address, and PGP crypt the message. It's not so simple when you're using, say, a corporate laptop on your couch at home on a Saturday night tho.This bill was passed a while ago - but this is the day it takes effect.
...and make decrypting it a violation of the DMCA.
"Ancillary does not mean you get to rule the world." --U.S. Circuit Judge Harry Edwards, speaking to the FCC's lawyer
I'm working for an UK ISP, so the odds of my emails etc being checked without me knowing are incredibly low. However, this might turn out to be a real pain if we get told to start checking our customers emails...!
ManicHawk - Just because you're manic doesn't mean the walls aren't bouncy
Actually, it came into force yesterday.
Have you thought about patenting that idea?
;)
sounds like a good one
Price, Quality, Time. Pick none. What, you thought you had a choice?
"Campaigners say the rules, under the new Regulation of Investigatory Powers Act, are an assault on personal privacy"
How is this an assault on PERSONAL PRIVACY? You are sending mail and surfing while on company time and you whine because your employer wants to see how you are using it's resources. If this were the government monitoring it's citizens I could understand, but not a company monitoring it's employees.
So I think it's okay to say whatever on your own time, but it seems like an *okay* step to take in work matters, as long as such a law is never evvvvvvver passed for normal home use/personal use.
Acting stupid isn't much fun when there's someone around who knows better
Can't they force you to hand over your key if they suspect something is amiss? So you can either give them access to your encryted mail or walk out the door...
Being at work or using corporate equipment to do - whatever... is like being a guest behind enemy lines. Regardless of the company tells you, you're always under suspect and someone will always be watching you. As the poster mentioned, the only way to really be safe is to encrypt anything you have to say that the company might not like. Then again, can they ask you to decrypt whatever it is you send when they find the message?
I'm always amazed that people are surprised that an employer is reading their mail. Users need to realize that the computer they use at work belongs to their employer, as does the network, the internet connection, and the service to keep it running.
Given that, I've never been anywhere that just checked everyone's email. The person they check on has been doing other things that make the employer suspect something is up.
But be warned, there are plenty of applications out now that scan email for keywords whether it be naughty words or things that may be confidential to the company.
I believe e-mail and internet usage can be monitored by US employers, but only if they notify the employees that montoring is taking place.
However, I seem to remember the outcome of the Steve Jackson Games case was that the govt. treats e-mail just like postal mail (i.e. court order required), but since the machine that sends/stores e-mail is owned by the company, they have the right to do with the contents as they please. This allows companies to monitor e-mail.
My Vote's On This Doofus
great comedy company.
the company I work for already does this (or so they claim). In the employee policy manual, it specifically states that my employer can read my e-mail, listen to my voicemail, and monitor my internet activity. What's the solution? Use PGP e-mail. Most PHB's don't know what encryption is and are too naive to think their's someone in the company smarter than them. Use anonymizer to surf the web for any non work related stuff. It's that simple.
"You'll die up there son, just like I did!" - Abe Simpson
There is no reasonable defense against an idiot with an agenda
:wq
What on earth could you be sending to other employees while at work, that it would matter what you're sending? Anyone, who at this point, is not aware that email is not in the least bit secure, should get what they have coming to them. Personally, I hate it when other employees send crap they download from AOL, thinking they are witty or clever, and that I'd be interested in this droll humour. Chances are, I've probably already seen it anyway.
Has anyone ever noticed it's the technopeasants who send you this stuff (as if they discovered some untapped corner of the internet).
I honestly don't understand why this is even an issue. If you're on company time and using company equipment, then yes, your boss has a right to monitor what you're doing. Go back 20 years ago. If you're typing something and your boss walks over and starts looking over your shoulder, did you tell him to quit invading your privacy?
Just wait until you get home to send those personal emails or download mp3's or look at pr0n or whatever else it is you want to do. That way you'll keep your privacy AND your job.
...employees of backbone service providers? If you send an email badmouthing your boss (you work at, say Sprint or MCI) and it travels through a Sprint or MCI portion of the backbone, even if you sent it from another provider, can they then still read your email, because you work for Sprint or MCI?
People who trash their employers via company email.
People who trash fellow employees via company email.
Executives who say damning things about their company behaviour around a live mic or in email.
How often this sort of thing finds its way public
I'm not surprised at how many dumb people there are int he world, just disappointed.
--
A feeling of having made the same mistake before: Deja Foobar
I personally avoid using work email for anything beyond work correspondence, and while certainly not draconian, I feel that it's a responsibility to my place of employment to minimize the use of email for personal business.
Now, if the rules extended to any email/activity from any account even outside of the company's control, then it becomes a free speech issue. (i.e. use hotmail or other web-based emails if you really want personal email at work).
"Pinky, you've left the lens cap of your mind on again." - P&TB
"I can see my house from here!" - ST:
(Hobbesian = compliant with the social philosophy of Thomas Hobbes [i.e.: paranoia regarding the "inherent wickedness" of people and their tendency to do bad things when out of the scrutiny of authority])
"Ancillary does not mean you get to rule the world." --U.S. Circuit Judge Harry Edwards, speaking to the FCC's lawyer
Everyone who's screaming about personal privacy being violated, please repeat after me. "The machines my company gives me do not belong to me. I have no rights to privacy on company machines. I cannot do whatever I want to company machines. I cannot install Linux on company machines if they don't tell me I can. I can be looked at any time to see what I am doing on a machine that the company is loaning me to do work for them. If I want privacy and the ability to do things to machines, I can do them to machines that I actualy own. Otherwise, I will not whine."
Now keep saying that until you grok it.
now if only I could find a free ssh program that supported port forwarding/tunneling for Windows...
-- Soruk
...in case a law like this is passed in the US.
"Ancillary does not mean you get to rule the world." --U.S. Circuit Judge Harry Edwards, speaking to the FCC's lawyer
I do that the DP act states that employers should not subject employees to continual monitoring of their private affairs.... this includes emails, telephone calls etc - whether made using employer resources or their own.
Having said that I don't see the problem, I use my works email for *personal* use during the day, but personal use does not include bitching about my boss, distributing porn etc. If you can't be sensible then you probably will lose your job anyway.
--- Users are like bacteria -> Each one causing a thousand tiny crises until the host finally gives up and dies.
> If I was gonna bad mouth my boss, I'd use my
> domain as the email address, and PGP crypt the
> message.
Not enough! The RIP requires you to hand over your private keys if asked to by the Home Secretary (or some designated by him, so realistically any policeman) or face imprisonment.
Frankly it amazes me that Jack Straw can't see the contradiction between passing legislation like the Human Rights Act on one hand, and the RIP act on the other.
its always been on military computers. As I look at my monitor right now, I see a big fat sticker that says 'consent to monitoring, use of this computer constitutes consent to monitoring at all times ' etc etc etc. I dont see what the big deal is. Its the same principal in the corporate world as in the military.... you have access to potentially damaging material (if it gets in the hands of the wrong person). If your doing anything to put your org at risk, well then you lose your rights to 'privacy'. also, its _their_ equipment. Thats why I never send personal email from my work box. as far as Web surfing, etc, dont go to any sites that may not shine in yoru favor. use common sense.... ...
"sex on tv is bad, you might fall off..."
I lost my concept of community when my community lost all concept of me.
Dear Jane
After having started on my new job today, I'm afraid I have some bad news to tell you. The work I am doing here is very challenging which might cause me to do some real overworking. The fact that the boss is a really nice guy obviously has something to do with this. I seriously suspect him to have been a sergeant-major at least in Her Majesty's service, as the charisma and leadership of this man is unrivaled by any previous employer I have worked for. It seems as though this is the place where I belong. The job I have been looking for all this time. I must stop now, as I feel it is inappropriate to take more than 10 minutes of breaktime a day.
Sincerely yours,
me
People replying to my sig annoy me. That's why I change it all the time.
I guess if it's that critical that you send email at work get a laptop and one of those really expensive wireless links and just bulk send all you written email at once.
Respond to s
The bottom line is that HMG doesn't get I.T. At all. It's sickening really; we have Smilin' Tony telling us we want to be at the forefront of the e-revolution, and then a sickening bunch of has-beans toadying along behind coming up with crap like the R.I.P. bill and this load of old tosh.
The extent of the problem was highlighted on the BBC Breakfast news when the self-styled e-minister Patricia Hewitt said that although yes, the Government was allowing employer snooping, it was only for "reasonable" uses. To paraphrase the good lady "Employers shouldn't pry. We trust them not to go looking at messages that are private". e-minister *blech*. Bet she wouldn't know a website from a kick in the teeth, let alone exactly what barrel of worms she's just opened. "reasonable use only".... nice. Let's see someone get a legal definition of that one; it'd be like nailing jelly to the wall.
What's worse is that Her Majesty's Opposition is just as technically inept, if not more so. I don't mind so much the boneheadedness (hey; I'd make a crap politician so why should they make good geeks?), but I am fed up to the back teeth with smiling baby-kissers telling me all about how great the technology is and how they know *just* how it needs regulating.... Oh, and then hold 1 week unannounced "review" periods for public consultation, then trumpet their spawns-of-satan legislation as "widely approved of by industry and public".
The thought of actually going out and *asking* people what legislation they need (other than the police, of course, who have predictable knee-jerk reactions hence RIP), and *listening* to them instead of patronisingly telling them what they want could never occur to this bunch of rabid style-over-substance image-is-everything inept sheep. I mean... not towing the party line? showing evidence of independent thought? not being "On-message"? Heaven forbid.
TOh dear did I really type that load of tripe? Ah well, it's off my chest now. Just scroll down a bit will you? There is nothing to see here. I'm going to go and lie down with a cold towel and maybe lay off the coffee for a bit.
--
I'd rather have a bottle in front of me than a frontal lobotomy
Sorry to be posting such a blatant ad, but I've begun to use hushmail.com for just this reason. Its web based, but done in a java applet, so that every byte that travel over my employer's LAN is strongly encrypted. Nervous folks in the UK may find it useful. Hushmail
In the U.S. an employer is fully within its rights to monitor e-mail, phone calls and what have you so long as employees are informed that it may happen (not required on a per-call basis). There are some requirements to stop listening/reading once it is clear that you are dealing with purely personal material, but the cat is often out of the bag by then.
While annoying, it doesn't seem completely unreasonable. One should hope that nobody could stay in business investing the kind of resources to meaningfully monitor everybody's every move.
At the same time, one would like to think that employees who threaten others, conspire to steal, etc. could be monitored and apprehended.
In the United States we have basically established that email is the property of them employer. It is basically to be regarded in the same way as any other tool you would use. At work you are part of the company machine and all that matters is company privacy. In the home you are an individual and have more rights to personal privacy as well as family privacy. This shouldn't be seen as employers snooping into private matters. To every thing there is a season and work is not the time for personal privacy and concerns. :)
> ..and make decrypting it a violation of the DMCA
Content-Type: exttay/yptocray; arsetchay="us-ascii"
Hi Sue. How's work today. Mine's a real itchbay, so I'm idinghay down at Jim's office, and just kind of uckigfay off instead of trying to fight the ullshitbay that it takes to get anything done around here. My new boss is a a real oronmay, and I'm "this close" to telling him to isskay my ass. I'm going to brush up on my resume tonight, and get the hell out of this itholeshay.
How 'bout an afternoon quickie? I was going to eaksnay out early today anyway.
Sheesh, evil *and* a jerk. -- Jade
ssh tunnels to a shell outside the employer network. They can't monitor what they can't read, and they can't seize what you don't have in your possession. -f
Irrellevant. It's UK. The RIP bill actually specifies that taking measures to intervene with decryption for monitoring purposes is a crime. If you are asked for your keys you must hand them off.
Baker's Law: Misery no longer loves company. Nowadays it insists on it
http://www.sigsegv.cx/
This is to report that "those bastards" have killed Kenny. I know that this is unusual for children to be repeatedly killed and brought back to life each week, but in this case, we thought in unavoidable.
Sincerely,
Bryan Boytano
tagline
... hi bingo
Nice one Mr Straw!
It is now possible in the UK to get locked up for two years for failing to provide a key to an encrypted email (for example), even if that key has been lost/forgotten.
The UK is heading back towards the Dark Ages and I want no part in it.....now, how do you get one of those Green Card thingys?....
----------------------------
-----------------------
Moderator's essentials
This resulted from a misguided attempt to give employees the right to email privacy in the workplace. This caused such an uproar from employers (like me) that the government had to reverse the legislation. Employers pointed out that it's *their* email system, not the employees, and that they have no right to privacy over snail mail that they send on the company letterhead.
And now the best bit: the UK government has given itself the right to read *everybody's* email by forcing all major ISPs to instal interception equipment. How is that for good, old fashioned, British humbug?
Except if they were monitoring corporate traffic. Then it wouldn't matter whose domain you were using.
Encryption? Just use traffic analysis ("Hmm... it appears Rob is sending email through his own domain, instead of the company's domain. Why?")
- I don't care if they globalize against free speech. All my best free thoughts are done in my head.
> Content-Type: exttay/yptocray; arsetchay="us-ascii"
> How 'bout an afternoon quickie? I was going to eaksnay out early today anyway.
Well, my usbandhay, whom you refer to as your oronicmay ossbay, is taking the afternoon off, so we can't oitday here this time. How 'bout if I just come to the office, and we'll give the old oomclosetbray a try?
Sheesh, evil *and* a jerk. -- Jade
RIP authorizes employers to monitor employee emails, yes, but the scope of the bill goes far beyond snooping on dimwitted employees who haven't the sense to use discretion on the job.
This is from the Guardian Unlimited
(links, info on http://www.fipr.org/rip/index.html)
So those suggesting PGP are SOL.
In addition, RIP
Freedom of the Press (including its ability freely and privately to communicate with its sources) is a much more serious matter than Freedom of the Employee (to slander his boss, reveal corporate secrets or merely waste company time and bandwidth).La via sola al paradiso incommincia nel inferno
how often did you have to do latrine-duty because the serge thought you were Slashdotting on the job. Nothing personal, just curious.
People replying to my sig annoy me. That's why I change it all the time.
I was thinking of an insanely complex algorithm, with key upon key upon key upon key upon key. And the keys themselves are polymorphic, keyed to a specific time and day (by the Julian calendar), etc., etc.
"Ancillary does not mean you get to rule the world." --U.S. Circuit Judge Harry Edwards, speaking to the FCC's lawyer
You could but it wouldn't help matters. The RIP bill makes it illegal to encrypt things without registering your private key at a "trusted" third party key escrow agency. Claiming to lose your key if you don't won't work because it is up to you to prove your innocence not the powers to prove your guilt. You can face up to 2 years in jail it you have forgotten your private key and cannot prove it.
I for one will be moving all my email and crypt offshore and will be reading it over one-time encrypted channels such as SSH/SSL. I suggest anyone else who uses crypto in the UK to do the same. They can't do jack about it if its not on UK shores.
Sealand (Haven Co) anyone??
Why aren't these people being judged on their productivity? You pay them X dollars (or pounds, in this case). They produce results worth Y. If Y is greater than X, they are an asset. If Y is less than X they should be fired. (Alternatively, you could say "Your Y is less than X, we will have to fire you if this doesn't change in 3 month" and let the employee decide whether to bump up the ol' productivity).
(Don't bother bringing up "porn == sexual harassment" because that is orthogonal to tracking and mail-opening)
Now, I realize that tracking an employee's worth in actual dollar figures can be difficult, but any manager worth a damn knows if she is getting bang for the buck out of her employees. Telling an employee that he should spend his 15 minute coffee breaks in the break room reading a book as opposed to emailing his wife to complain about his cow-orkers is just micro-management.
--
An abstained vote is a vote for Bush and Gore.
Non-meta-modded "Overrated" mods are killing Slashdot
(Hey Ryan! Here's your proof!)
What's the problem here? Does it matter really if your boss or the government is reading your e-mail? After all, I'm already reading it!
Yes, I know the results of your purity test! I know that you subscribe to half of the ZDNet Newsletters out there! I saw that you got a new login name for the Stileproject forums! I know that you got a e-mail receipt from "Internet Billing Company" regarding your "new subscription"... and that you did it during work hours!
By the way, that sick, sad love letter you sent to Jacquie from electronicwhore.com? I know your girlfriend wouldn't like to see that! (Judging from the nasty response you got back, I see Jacquie wasn't too thrilled about it either)
You see, at least the government or your company won't extort you if they read your e-mail...
Leave $200,000 in the white mailbox under the Cooch's Road bridge by 10pm Wednesday night and I'll THINK about keeping my mouth shut...
I wonder how many .co.uk hits /. will loose ;)
And no that is most definitely not off-topic, on either count.
My bosses won't be monitoring my mail - they wouldn't know how. They are all too stup...
£^(*&%%$£&*^^ - Carrier lost...
If you moderate me down I shall become more powerful than you can possibly imagine.
If I receive a personal phone call from my girlfriend, is it fair they listen? Is it fair they inform my wife, if she works in the same company? Or if not? When I take a break and use the corporation toilet, is it fair they videotape everything? Run chemical tests on the urine I pass there to monitor my stress levels? To monitor drug abuse? To screen for markers of inherited diseases or tendencies? If one day they get this mind-reading machine, is it fair to read my mind to detect if I am about to leave? about to be unhappy with the company? think private thoughts on "company time"?
In Murphy We Turst
I worked for a company a while back in Louisiana and they read everyone's email. I jokingly drew a picture of our HR guy as hitler with the nazi uniform and sent it to a co-worker... i was later informed that my mail was inappropriate by the HR guy and he demanded an appology. So is this just in the UK? Is it illegal here in the US?
...like shortening the TLD of sunsite.doc.ic.ac.uk to something a little easier to remember?
"Ancillary does not mean you get to rule the world." --U.S. Circuit Judge Harry Edwards, speaking to the FCC's lawyer
Unless the company is registered with the Data Protection Registrar
AND the employee specifically authorises the company to store their personal data on the monitoring computers
AND the employee specifically authorises the use of that data for monitoring purposes
AND the employee has full rights to know WHAT is stored, at ANY time
AND the employee has full rights to ammend or correct data that is stored, at ANY time
they would be breaking the law to monitor their employees e-mail. I'm not exactly keen on the idea that employers have the right to snoop on employees - whistle-blowers need protection more than corporate executives - but provided the DPA is given sharper teeth to tackle abuse, I think that this might not be such a terrible thing.
(It's only an invasion of privacy if the DPA is essentially rendered worthless for this. You always need checks and balances, and the DPA is the only check your average Joe Bloggs has, right now, to handle computer misuse by corporations.)
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
One for business- open to your bosses;
One for personal.
What then if you read your personal account
on a work computer?
same issue
managers...why god invented purgatory
As far as employers reading email, this has been the de facto case in U.S. for a long time. As has been stated before, the servers are the employers, the software is the employer's, they have control over the all data that passes and is stored on those devices. It may suck, but I don't see the realities changing any time soon.
When I did personal email on a corporate machine outside of the corporate network (i.e. a laptop at home), I used my personal ISP. Not a free email account that one logs into through the corporate ISP, but a bon fide personal ISP. I don't think one can complain about being caught using the corporate ISP for net sex at home. It is also important to use an email client in which one can quickly change between email accounts. This is one of the main reasons I stick with Eudora. I get to choose the account I will use with each outgoing message. This may not seem important but with many ISP still not as secure as they should be on their outgoing mail, it is useful. I know many people who use Outlook and the corporate ISP in an effort to save a buck. This is certainly a false economy.
This law doesn't need to be passed in the US. US employers pretty much already have this right. In fact, the law in the United States seems to support business in depriving you of what would otherwise be your civil rights. Some employers already engage in search and seizure of actual persons and personal belongings. Many employers require that you submit body fluids for testing. Video surveillance of employees is rampant (and is often done covertly, just as much as video surveillance of customers is done-- in fact, monitoring one often makes it trivial to monitor the other). Employees seem to be able to deprive you of your ability to sue the company by requiring "mediation" for all disputes. They frequently deprive employees and contractors of their ability to build a career through dead-ending tactics like non-compete clasuses.
I fully recognize that civil rights are about government and not business, in fact that's what I'm complaining about (such a myopic view of rights in modern society), so please, no flames about the semantics!
I do not have a signature
At my school (which my parents pay a lot of money to send me to), they have banned web mail access, and force us to use the school exchange server. The admins then read our mail if there are any swear words, teachers names etc mentioned. So is this a violation of our personal privacy? Especially since we are not allowed to use personal, non-school accounts. However, I wrote an outlook vba plugin that encrypts text in 40 bit encryption based on a passphrase. Now none of the messages are picked up by the admin.
semper vi
I would hope that the employees handling that mail were allowed to say 'hmm. This parcel's ticking. Maybe I really ought to tell someone about it'. The personal privacy argument is that it's none of their business, and I should be allowed to get on with it.
If there's something you don't want your employer to know about, don't use the company's resources. Don't put your letters to the STD clinic in the company mailbasket. And don't use their computers for e-mails they wouldn't approve of.
I see lots and lots and lots of people saying
"Hey, you're on your companies cpu, network, and time; you shouldn't be doing this anyways!"
...and to those people I ask: Are you at work?
(I'm on lunch break, personally)
hey, just curious
This smacks of nothing more than blind paranoia.
It's actually Facist - like reporting your neighbour to the cops if you see 'suspicious behaviour'
Anyway, I think the office workers will make there own rules anyway - they always do !
A slashdotting - you get the stick first and then the carrot !
I am married and I communicate through email with my wife.
We happen to exchange, say, 3 or 4 mails during the day. which is not that much.
We consider it private and would be quite pissed off if anybody decided to monitor our conversations, even though they remain "soft" because I am here at work and not prepairing tonight festivities.
I admit English accept this rule, because they're so.
But I take this story as a warning not to accept my next job in England because if I am considered as brilliant by my colleagues, I also admit I use the corporate network to coimmunicate a bit while working. It is necessary for me to swap between tasks.
I then should be considered as somebody who's working habits are shocking ?
what about my work, what I am here for ???
If this law was about to pass in a Latin country (France, Italy... even here, in Switzerland) most people would refuse it because I am far from alone in this case.
--
Trolling using another account since 2005.
Why, how can you possibly not understand this. The computer is theree, therefore I'm entitled to privacy. In fact, I'm entitled to have my employer provide a computer to use for my personal matters during working hours. Not having one just isn't *fair*.
Furthermore, my employer has absolutely no right to question what I do with its property that it provides me. It's not like it has any right to control the use, nor that it amy get sued for my use of company property.
Why do they think I'm here? to do stuff for *them*???
Furthermore, I demand full privacy screens to protect me from them
monitoring me . . .
*********
Given that the employer has absolutely no obligation to allow personal use, there's no privacy issue. Personal use is only permitted on these terms. Don't like them?--demand your money back.
hawk, esq.
Just because it would be stupid to bad mouth your company using company e-mail doesn't make it right for them to snoop on you. This is no different than if it were OK to wiretap our work phones. This kind of legislation moves us closer to a reality where we are all slaves to our employer - where everything we think or do is not our own.
When I first worked for a big financial company, I found out that the contract I signed warned that my boss could read my e-mail. I was slightly worried, went to him, and asked about it. He started to laugh and couldn't stop for like 5 minutes. I asked what was so funny, he said that if in addition to his 80-hour workweeks he were also spending any amount of time reading his employees e-mail instead of drinking beer or going home to his kids, he should've been shot for being an idiot...
So stop being so-o-o paranoid. Plus, you can always use yahoo or even your cell phone to send e-mail, so what the fuck is the big deal?
After reading some of the posts.. here's a thought.
Someone brought up the point about personal snail-mail at work. Your employer does not have the right to open your mail, so why should they open your email? Well.. here's why, although a bit abstract.
There is, due to long-standing law, as well as the fact that something is in a sealed envelope, a reasonable expectation of privacy when you send mail in the post office. (Recall, if you sendt a post card, with no envelope, there is NO expectation of privacy; anyone can legally read it.)
The internet at-large is basically a *public* network. Yes, it's 'public' in a different sense than we usually use, but the fact that you have no real contorl of where your data goes after it leaves whatever you DO control.... that makes it public. THat, coupled by the fact that you don't know the policies of every network your message will pass through. Sending unencrypted mail ils as good as sending a bloody postcard! Yes, you can be reasonably sure the whole world cant' read it, but anyone who happens upon it legally CAN (the postman, your boss, the guy in the mailroom). This equates to things like: The IT staff, your boss, etc...).
Think about it.
If your boss wanted, he could say 'I want to see ALL snailmail coming into the building. Now.. he *CAN*, I believe, do this. He cannot make you open your mail, but he can see the volume/where the stuff came from. After all, the mail was addressed TO HIS BUSINESS.
Use encryption. Seriously. Otherwise, it's like complaining about people using scanners on your cellphone calls (well, the US *DID* legislate against that, funny enough> Canada didn't.). Canada said 'well.. it's going with standard modulation over public airwaves... what did you expect? No expectation of privacy'. Of course, if it was *encrypted*, there is an expectation of privacy, and a scanner that could decrypt it may be illegal.
I used to be a sysop of a WWIV board and I would read user's mail all the time. My system, my phone line, mine mine mine. Same situation applies here.
:)
//MAILR is good clean fun.
BilldaCat
The whole point of the RIP Act is that they can demand that you decrypt on demand from law enforcement. Failure or refusal to do so is an offence with even greater penalties.
Any company's email system belongs to that company and therefore is the sole property of that company. The bottom line is that you never send or receive personal email on a company's time. That's not what they are paying you for. They pay you to do what's related to your job. I'm head of security for the company I work for and if I want to monitor an employee's email I can do so because everything inside the company is the property of that company and not the individual end user. We have sniffers placed throughout the network on every subnet that listens for certain data to come across. Our Exchange servers and Internet connected SMTP servers also monitors all email for content. We use Trend Micro's VirusWall with Email content management plug-ins for stopping spam and other email security violations. We are located in the US and our legal staff have already confirmed that Companies can deploy content management and control over their email systems and can also read any email that passes through the company's network. Also we don't need employees wasting time doing personal things at work and we don't need them using up Company's resources since the resources are costing the Company money.
It is no big deal. Just common sense. If someone pays your salary and provides you telephones(e.g. voice mail) + computer equipment the use of that equipment is their business and the use of your (time during work hours) is their business.
I don't employ anyone, I just live under these conditions and they are okay with me. When I want to badmouth someone, I do it on my own time from my own PC.
--- -- - -
Give me LIBERTY, or give me a check.
UK Employers May Read Employees' Mail
;-)
When I read that headline, I first thought it meant that it was refering to snail mail.
Apparently it only refers to e-mail.
(Or should I say "email" ?)
Is there anyone else who really doesn't give a hoot about email monitoring? If your company respects you, they're not going to be a snit about personal use of email and web surfing, unless of course, you're obnoxious about it. If your company acts like the Gestapo, well, find yourself a new employer. It is the company's resources, after all. And if you're divulging secrets or bad-mouthing other employees, well duh! you moron, of course you're going to get smacked.
I myself keep job inquiries in my inbox, just as a warning to any snoopers: mess with me, and I can walk in a heartbeat.
What too many people seem to forget though is the imbalance of power in this situation. Your email is suspectible to snooping by upper managment, but how many of you have the oppurtinity to snoop on their personal doings at work? And before all your submissive lap-dogs whine about "it's not your job to know what they're doing", remember that a great many wokers in the tech sector are stockholders in the companies for which they work. I have just as much desire to see the company succeed as the suit with the inflated salary, and I have a right to know that he isn't wasting my money.
But alas, that's the corporate republic for you. It's feudalism, not democracy.
--
OK, no problem.
What's the population of California, 30 million or so?
There were 60 million of us at the last (1991) census, so given the influence of CA in, e.g. and topically, Presidential Electoral College, or the House of Reps, we'll be your very own 900lb Gorilla of a State. Just try electing a non-British president once we're in...
Total domination of one remaining superpower. The Empire Strikes Back?
TomV
Agreed, sort of. It's long been traditional since I grew up reading unix sysadmin books by O'Reilly that employers should be able to track stuff, certainly in the case of abuses of the system.
.|` Clouds cross the black moonlight,
Where all the modern fad of calling it a breach of privacy has come from, I dunno.
How much mileage is there in the view that "freedom of speech is fine, but abuse it and lose it"?
~Tim
--
~Tim
--
Rushing on down to the circle of the turn
They are using our bandwidth to send personal mail--so we should be allowed to read it!
They are using our phone system to make personal calls--so we should be allowed to listen in!
They are using our parking lot to park their cars--so we should be allowed to search them!
They are using our plumbing to take personal dumps--so we should be allowed to watch!
They are using our lighting to illuminate personal activities--so we should be allowed to monitor!
They are using our air molecules to vibrate with personal spoken messages--so we should be allowed to eavesdrop!
All of these things are "environmental". Presumably there is value to the company to provide them to all employees. If an individual employee is being unproductive, fire him. There's no need to read his mail, search his car or test him for drugs. If the mail system (or parking lot) as a whole is costing more than it provides, de-install it. There's no need to read everyone's mail or search everyone's cars.
Remember during the Olympics and how everyone squawked about how the FBI was reading the email from the kiosks? But the kiosks belong to some company or government--can't they do what they want? I'm using my ISP's bandwidth, does that mean they can cc all my mail to the FBI? No, dammit!
--
An abstained vote is a vote for Bush and Gore.
Non-meta-modded "Overrated" mods are killing Slashdot
(Hey Ryan! Here's your proof!)
In the USA, land of the free, home of the brave, the constitution, etc...employers have the right to scan all the transmissions on the wire, read your emails, whatever.
Just thought you'd like to know.
The last place I worked didn't delete ex-employees mail accounts, preferring to harvest and read what people sent them months/years after the employee left.
Treatment, not tyranny. End the drug war and free our American POWs.
See my user info for links.
Why would they want to join our sorry nation? We think Miller Lite is beer, after all, when it's just slightly malt-flavored carbonated water.
Glückwünsche, haben Sie Slashdot ermordet, indem Sie zum korporativen Druck beugten und Subskriptionen einlei
like the average /. reader knows what the carrier is
It's a kind of Pigeon. See, I do know how email works!
If you moderate me down I shall become more powerful than you can possibly imagine.
We also signed up to the European Bill of Human Rights recently which should offer the right to privacy. So the RIP bill may be illegal and is probably challengeable in court.
I work at a small company, so we've got better things to do than spy on everyone's communications regularly. However, i'd like to know how much encrypted communications are allowed at bigger corps.
Is encrypted e-mail allowed? SSH tunnels? I've heard of a lot of big corporations don't allow a lot of certain web access, including Yahoo mail, etc.
So what sort of bosses like to see what their underlings are up to. Do they themselves believe they should be monitored also?
A while ago our head salesman logged on to check his shares, only to find a porno site had taken its place (temporarily). Those photos were in his cache whether he liked it or not, and our proxy logged the accesses. As it happened we were working in a small office and we all had a good laugh about it.
How would things be in a larger organisation where the monitor may be unable to see (or appreciate) the context? Would it matter if our head salesman was a junior instead?
-- Hob - Java Spectrum Emulator
Not sure I can agree with the concept of "abuse it or lose it" when it comes to freedom of speech, but then that is an unrelated topic. The issue here is whether an employer can track what you do and say with their equipment or on their time. I don't have a problem with that and it sounds as if you don't either.
:)
Where all the modern fad of calling it a breach of privacy has come from, I dunno.
Superficially the claim feels valid. But as the courts are showing, it does not stand up to close inspection. I think this fad comes from the entitlement thinking that people can do whatever they want whenever they want and misusing company equipment or embezzling time are not considerations.
--- -- - -
Give me LIBERTY, or give me a check.
There are things I do not understand.
If I want to say that my boss is a stupid idiot, can't I do that?
If I say that he'll kill me or that I'll kill him for the extra work he is giving me, I'm NOT saying that I or he will died. This is just a way of expressing my frustration.
Such comments are not intended to hurt the feeling of my boss. They are not even directed against my boss. They are expression (=release) of something that I had into me.
Anyway, this is a private conversation between me and someone else and should not be taken out of context.
I beleive I am the right to say what I want if I do not offend publicly someone, if I do not offend the person receiving the email.
Lawyers may say that this is not how things work, but I do not care what lawyers can say.
They should think a bit and realize that there are many more ways to hurt and insult people in a civilized and educated way! People that really want to hurt someone else would use this subtle lawyer-proof way and not a more direct one.
At one workplace, where I was a union representative, there was an issue where someone was being victimised by their immediate supervisor. The HR department were quite enlightened, and were pleased to have evidecne that said boss was responsible for the alarming rate of resignations. It was a large site with open-plan offices. Private phone calls to HR were impractical. Note, all parties concerned were workers at the same organisation.
In general, a private channel is often very helpful in intra-organisational disputes.
Stephen
A cautious person does not leave embarrassing voice messages or send inappropriate emails from work regardless if the law says the employer cannot look because technology enables them to look anyhow.
Whether their lawyers advise them to keep the peeking quiet is secondary to the fact that they may find things you don't want to share.
--- -- - -
Give me LIBERTY, or give me a check.
(Sorry, Martin. I know it's "Spamer", and you probably don't even spam people, but I couldn't resist.)
What would be good, IMO, would be to pull out of the EU (but remain in EFTA) and join Nafta. The treaty of Rome states that we are not allowed to make any trading agreements with countries outside the EU, in contravention of the Geneva Convention, I think, so this would be necessary. Still, damn the undemocratic, protectionist, backward EU! We should become a globalist looking power.
KTB:Lover, Poet, Artiste, Aesthete, Programmer.
There is no
Lose 2 marks for bad reporting again, somewhere along the line.
This bill does not specifically give UK employers more access in terms of monitoring their staffs email.
This bill gives the UK government + police services, access to monitor *ANYBODYS* email, for any reason, even if you are not under suspicion of having committed a crime. It's not even email either - they can demand the ISP feed traffic in general their way.
If it was just work mails I wouldn't really care - it's their bandwidth, but the fact is that the RIP bill is in fact there purely to give the authorities unprecedented power to intercept the communications of the general populace, to demand their decryption keys (or face prison), and other such lovely fluffy things. It's big brother, approved by a government with no clue whatsoever.
If anyone offers me a job in the US, I'll move..
--
ALL YOUR BASE ARE BELONG TO US!
>I guess I just don't see it. If I was gonna bad
>mouth my boss, I'd use my domain as the e-mail
>address, and PGP crypt the message.
PGP encrypting it would do you no good, RIP gives the government powers to demand that you hand over your encryption key(s). And if you don't comply, or you've lost the key, or something? 2 years in the slammer.
There's an interesting article about RIP and what people can do to avoid it at http://www.fipr.org/rip/RIPcountermeasures.htm
And also the toilet belongs to the employer. So don't be surprise to find a video camera on it.
MOD THE CHILD UP!
I was worried about this for a while (thinking about leaving). Simple solution, use www.hushmail.com. Alright for the super paranoid there's still keystorke monitorig, but come on.
However I have a friend who is afraid to send an email saying "I had fun at the movies Sunday, let's do it next weekend too" because her company has made such a big deal about personal email on company pcs. That company already blocks all web access (so no webmail), and put every new hire on probation for 6 mos. She's almost done with that, but she's still paranoid.
and yes, she should get another job, but it isn't that easy for her. And I am concerned about the attitude of companies that basically assume that their employees are going to screw around on the job such that they block web access and monitor emails to 'keep employees in line'. That speaks to something being wrong in management right off.
It's all fine and good for you to use your own server and domain, but there are millions of other internet users who can't afford or will not get that luxury. Are their rights to privacy less important than the rights of the internet elite?
You go to work to do what?
I hear an AC in the distance, calling out... WORK.
I agree that it _sounds_ like invasion, but you have to remember that you, the network, the computers, etc, are all assets of the company. The company has a right to know how its assets are being used and has the right to control how those assets are used. A reasonable manager may allow some non-work related activites (helps to reduce stress, makes people happier, etc) but they have the absolute right to know whats going on with their property.
If you don't want your manager reading your e-mail, talk with him/her first. If you aren't happy with the result - work elsewhere and don't bitch about your loss of privacy.
PEOPLE, afaik this is not the government coming into your home for information or allowing them to peruse your personal e-mail. It simply lets buisnesses control what goes on at work.
Now, on to the encryption thing. I don't agree that you should be forced to divulge encryption keys for any reason except if you are using buisness resources. If you send an e-mail over the compnay network (when you should be working), I believe that the company has an absolute right to know what the contents of that message were. If, however, you are at home and sending encrypted messages to friends or whatever, you should not have to reveal the keys to that stuff (regardless of the subject of the messages).
Just my $0.03 ($0.02+tax)
Verbatim
Price, Quality, Time. Pick none. What, you thought you had a choice?
Weren't you supposed to be on vacation, impostor?
Some of the spy programs operate at tail end of transmission- that is, dump your screen perdiodically, say every 30 seconds. Private accounts and encryption would fail here. This spying is popular inside the home, but may be unwieldy in a company.
They always have been.
Send some plain test mail with certain kinds of threats in them and you'll be hearing from somebody. This trivial to do in the current internet.
If you want to make a call on company time do you
a) use a mobile
or
b) dial 9 and have your boss foot the bill?
Pleenty of business routinely record *ALL* phone calls. Banks, for example, will record calls so that they have evidence if a trade goes pear shaped.
If you want a private, personal call, use your own private, personal equipment.
If your email can't wait until you get home to use your own equipment (assuming you can't SSH into your account via your work machine) then suck it up and exchange expedience for privacy.
Or go and become your own boss.
Besides which, most companies aren't interested in snooping - they're too busy staying afloat!
--
"I do not speak for my employers, though they are controlled from my Teddy's huge pulsating brain."
It was only a few months ago I picked up a copy of "Professional Manager" magazine or some such drivel discarded on the train. The feature article of which was about the European Human Rights Act and how it was -
;-)
a) going to stop public bodies intercepting personal emails
b) going to outlaw public bodies drug-testing employees
And other stuff which basically boils down to caring more about people and their privacy than the dictatorial whims of some corporate or another.
The article did say that these clauses only apply to "public bodies" (implying government-run I guess) but said the term was sufficiently broad for your average "Professional Manager" to be concerned.
How does this fit in with the RIP act? I notice that the Human Rights Act specifies that the laws within are only enforced "unless they are prevented from doing so by statute".
Which, all in all, seems a bit pointless. Anyway, looks like those Managers didn't have too much to worry about... its we "Unprofessional Citizens" who should be worrying
Si
How would you feel if laws were passed allowing you boss to plant hidden microphoens and cameras in your office? Its really not very different.
You receive a private email during work hours because that is when it was sent. It doesn't matter that you were actually going to look at it after work - it is on your machine now, so your employer can legally look at it.
This is seriously crap. Luckily I configure/play with the security on my company network so I am vaguely okay.
PGP good, but they can stick us in jail for not handing over our keys. This sucks.
Steganography better - if they don't know we're encrypting, they can't force us to handover keys:)
Frog51
If this is a concern, why can't you just use your own systems? ssh (telnet) in to your own box and use mailsystem stuff there. No files, etc. are kept on your (company owned) computer. And if security is a real concern, do use a mail name/nick that is not obviously you for when the company scans through other people's acocunts you may have been sending to.
:).
The only items you need to do this is a smtp/mail-handler, a domain (check out www.dyndns.org for dynamic IP's) and a 24/7 account of some sort. There are HOWTO's for setting up sendmail, qmail, etc.
Plus, you don't have to worry about a mail quota
- Sig
At least in the U.S. - phone calls are offered a remarkable amount of protection compared to email. Even if you are at work, your employer would have to jump through a bunch of legal hoops to wiretap your phone without consent.
Of course, you'll notice more than a few companies nowadays (esp on their support lines) - saying something like "To ensure the highest quality service, this call may be monitored". If you continue with the call at that point, you are consenting to eavesdropping.
With email (apparently), privacy protections go out the window. And while I agree that you should be using company resources for company business, it seems like we should try to come up with a common standard for eavesdropping on communications of any kind.
Best regards,
SEAL
Well, if reading your employee's mail is OK I guess this means that all Brittish Citizens, who together employ every Member of Parliment, have the right to read the email of their employees. Not sure the best way to read the email of any given MP, sniffers? Carnivore? Any ideas?
...but your email can and will. Your post is hardly a refutation. The point being made is that misusing company resources is wrong; not that you have no right to privacy at work. What you say is completely irrelevent.
You cannot apply a technological solution to a sociological problem. (Edwards' Law)
In the UK we have a law called "The Official Secrets Act". This is a catch all law designed to protect state secrets (and bent officials). With the RIP this Act no longer has any value. For example if I am an employee in a defence company I could have access to information with a high security clasification. Who knows it might be provided by the DOD. If then a person who claims to be an official either from the police or appointed by the Secretary Of State then approches me with a piece of paper that says I am being served with an order under the RIP leglislation. I cannot check if the order is genuine without risking two years in prison (by a court sitting in secret). Therefore I have to:- 1. Hand over the information and encryption keys irrespective of the security classification of the data. 2. I must keep the fact that I have handed over the information secret from EVERYBODY. I cannot tell my employer, the police, a judge, any member of the security services. If I do I can get two years in prison. The net result of the RIP in Britain is not only to make E commerce a joke but to mean that any East European spy (or whatever) can personate a UK official and walk away with any information no matter how high the security rating, whilst knowing that the victim has to keep quiet. Sorry guys all data in the UK is now up for grabs. BTW I have contacted my MP (member for parliament) who initially gave me a standard blurb from the minister. When I brought up the security implications there seems to be a much longer delay in getting a reply. Surly if this legislation had been properly thought out there should be an instant answer!!!! Yet again the UK is a leaky basket for its own and US secrets.
The RIP bill actually specifies that taking measures to intervene with decryption for monitoring purposes is a crime. If you are asked for your keys you must hand them off.
But luckily for the inhabitants of this Land Of Big Brother there is a new European law protecting your rights. Of course jurisprudence is not yet available to prevent this gross invasion of privacy. When a company has a problem with an employee they can question him/her, there is absolutely no need for blanket snooping. No wonder the BBC reported yesterday? that the Brits are the most miserable-feeling people in Europe......
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
The policy manual stated that if you snoop around a collegues file system (including e-mail) unauthorized, this was considered snooping in his desk drawers and could lead to immediate termination, no questions asked.
It was the same company that refused to drug test any employee with the exception of people working for defence contractors and the piss tests where required by the US gubynmynt and then only with due notice.
They had set up a couple gay and a couple of AA members only conferences on the huge internal network. I' m neither gay nor do I have too much of a drinking problem. But since it's a save assumption that you had ten thousand of each group working for DEC at that time, I figured this to be an incredible asset.
It was a matter of respect, dignity and trust.
Values that don't seem to carry much merrit when a crappy box assembler with it's main focus on marketing can just buy a piece of computer history and kill it off.
ich bin der musikant
mit taschenrechner in der hand
kraftwerk
We had a few words to say when the legislation was going through.
http://www.ripserve.com/rip/
Basically, they can't use any of the evidence in court, most of the government's intelligence targets are exempt, and honest companies will end up paying. But at least we get to sniff staff email - I thought that was sysadmin's job. With governments like this... No, it's been said already.
This is superb, and probably the best reason for running my own company. I can monitor all the secretaries email, find out when they are vulnerable and what their weaknesses are so I can chat them up successfully, and if they let slip any *real* personal details to friends I may even be able to blackmail them into sleeping with me.
As for that civil rights b*stard in my office, if he makes any trouble I still have his email concerning the trip to Brighton, the donkey and the turnip...
Of course, if anyone doesn't like the email-snooping policy here they can always get a job elsewhere. But if we can all get away with it then we are all going to do it. The sucker will never work in this industry again muauauaua.
f*ckedBritain.com
PS It's not *just* the RIP bill that is driving all e-commerce activity out of Britain, the government has a raft of disasterous policies
Property for sale in Nice, France
1) Obligation to surrender encryption keys
2) Obligation for ISPs to install monitoring equipment. (cf Carnivore !!)
see: http://www.fipr.org/rip/index.html
The UK has no history or tradition of freedom of information and first amendment rights. The RIP bill as originally proposed was extremely Orwellian. (The burden of proof was reversed for example on encryption keys - You had to prove that you had forgotten the pass-phrase for that that to be a defense).
The privacy at work issue is a smoke screen IMHO -it's your companies equipment & infrastructure so don't use it for personal use.
P.S. I work for an investment bank and I know for a fact ALL telephone calls (in and out) are recorded and stored for seven years.
P.P.S. The security guys usually have access to all the interesting security videos - usually at 20 GBP per tape :-)
Every account on the LAN had a blank password, which we were not allowed to change. The purpose of this was to allow the boss access to any email account when he pleased. Security on the network just didn't exist.
What was really annoying was that this was an isolated office network. Email access to the outside world was via a separate PC, situated next to the boss. If we needed to access a web-sire or news for support work purposes we had to do it from home.
Whilst I worked there one collegue had some personal mail delivered c/o the office, as he didn't have a permament address in the area. The boss opened this private mail and read it. I should have walked out then - I was already pissed off by the fact that I'd been standing outside in the rain for 45 minutes, waiting for the boss to turn up to open the place.
I only worked there for 2 days (I'd have not come back from lunch on the second day if I hadn't left some possessions in my desk). It was the work place I'd ever worked at.
> I think this fad comes from the entitlement :)
.|` Clouds cross the black moonlight,
> thinking that people can do whatever they want
> whenever they want and misusing company
> equipment or embezzling time are not
> considerations.
Agreed. I think "freedom of speech" needs to be justified rather than pulled out of the hat every time something goes slightly wrong.
People will want entertainment. Entertainment is not hacking. Entertainment is a zero-quality plain waste of time, IMNSHO.
~Tim
--
~Tim
--
Rushing on down to the circle of the turn
I've got far better things to do than trawl through your mailboxes.
Of course, anyone who does ask does pique my curiosity, but why do they believe that I'd want to see their latest JPG's of "my 2nd cousins best school friends mother in laws new grandchild".
sigh
--- This meme is memory intensive