UK Employers May Read Employees' Mail

Martin Spamer writes: "The BBC reports that today the UK introduces Controversial new regulations (RIP) giving employers sweeping powers to monitor their workers' e-mails and Internet activity. Campaigners say the rules, under the new Regulation of Investigatory Powers Act, are an assault on personal privacy." I guess I just don't see it. If I was gonna bad mouth my boss, I'd use my domain as the e-mail address, and PGP crypt the message. It's not so simple when you're using, say, a corporate laptop on your couch at home on a Saturday night tho.This bill was passed a while ago - but this is the day it takes effect.

Comments

Just encrypt e-mail with a proprietary algorithm..

[AFCArchvile]

...and make decrypting it a violation of the DMCA.

I don't understand

[_UnderTow_]

"Campaigners say the rules, under the new Regulation of Investigatory Powers Act, are an assault on personal privacy"

How is this an assault on PERSONAL PRIVACY? You are sending mail and surfing while on company time and you whine because your employer wants to see how you are using it's resources. If this were the government monitoring it's citizens I could understand, but not a company monitoring it's employees.

Re:I don't understand

[11223]

Yes, but (on your break) do you use company equipment to send email? Is it not their perogative to monitor any usage of equipment they own? Go take a walk to the local library and then send your email, okay?

Re:I don't understand

[Xugumad]

Does it use their resources? Certainly, if someone was having significant amounts of personal mail (as people tend to, with e-mail) arriving at work, then I would expect employers to quietly ask the employee just what was happening.

I'm sure infact, that if employees were getting 5-10 personal letters arriving at work (I'm guessing based off my own e-mail quantities), a similar bill would probably follow shortly afterwards, for personal mail.

If you want to keep it private, don't involve work in it!

Re:I don't understand

[ShieldWolf]

American's confuse me in this respect: why is it that you are so paranoid of goverment intervention in your lives, yet you don't think twice of CORPORATE influences?
I mean, your country and your values are being sold down the crapper to big business and you don't even seem to care. Snooping is wrong NO MATTER WHO DOES IT. If I call my Sister on the phone at work it doesn't give my employer the right to record the conversation. There are laws against recording conversations here (Canada) where the recording party is not present in the converstation. The same should apply to email. If I don't write my boss he shouldn't be able read my mail. HOWEVER, he _should_ be able to read the headers to know _where_ I am sending my mail because indeed it is a work resource and he should know if I am wasting my time. I just have a big problem when people assume that because your company owns the equipment and resources you are suddenly in 1984 where you have no rights to privacy. This is wrong.

-Shieldwolf

Re:I don't understand

[nlvp]

I see your point, but I don't agree.

If someone is in an office, and receives an email from their doctor, giving them information about an appointment, that information should be private, as it is none of the company's business (at least in most cases).

The fact that the company owns and controls the vector that is being used to communicate the appointment is, in my opinion, irrelevant in any reasonable moral context. They may own the laptop, but they have no right to the proprietary information flowing between me and a third party. Because email leaves a trail, it is inherently less secure than paper mail - if I use a company pen to write a letter, they can't snoop on it, even if it's written on their paper, but because with email they can, they do...

A related point is that The RIP bill, as far as I understand it, means that they can do this without informing you of their intention to do it prior to the fact, so someone a little less clued up than your average Slashdot reader may be writing in the belief that it is private.

And what makes you think the library isn't snooping? Or the Cybercafe? Or your ISP? Or your telephone company?

Whichever way I look at this, I don't like it.

Re:I don't understand

[mindstrm]

And they won't.. as long as you aren't using THEIR equipment and THEIR bandwidth to do stuff.

Re:I don't understand

[TomV]

How is this an assault on PERSONAL PRIVACY? You are sending mail and surfing while on company time and you whine because your employer wants to see how you are using it's resources

Because RIP is not the only new legislation bearing on this matter.

It's going to take a fair bit of fighting in the courts to establish what takes precedence - this aspect of RIP, or either of...

• The latest cut of the Data Protection Act, under which it's a criminal offense for the employer to monitor personal communications without the consent of both parties, so long as there's sufficient evidence that the communication is personal (e.g. "[personal]" in the subject), and..
• The Human Rights Act, which (at last!) gives us, amongst others, the right to Privacy, and to private personal communications in the workplace.

As was in fact mentioned in the (broadcast) BBC reports on this story this morning on Radio 5. Just before their loopy debate on whether email actually serves any useful purpose whatsoever.

TomV

Re:I don't understand

[hawk]

>If someone is in an office, and receives an email from their doctor,
>giving them information about an appointment, that information should
>be private, as it is none of the company's business (at least in most cases).

1) then don't get it at work.
2) if it's just the time to come, and you go during office hours, it *is*
the company's business.

>The fact that the company owns and controls the vector that is being
>used to communicate the appointment is, in my opinion, irrelevant in
>any reasonable moral context. They may own the laptop, but they have no
>right to the proprietary information flowing between me and a third party.

??? And you get to decide what goes between the "do not look" veil? This
makes industrial espionage just too easy.

And again, you have no "right" to use the company's machines in this
manner anyway.

hawk, esq.

Re:I don't understand

[Bug2000]

In the case of emails, why not marking personal emails as 'Personal'. Those emails would not be legally accessible by the employer. And if an employer sees that there are 50 personal emails a day for an employee then he is fully entitled to say he has a problem with it. Privacy is preserved and company working time is monitored. In the case of internet access, I believe that employers should be allowed to say that it can only be used for work purposes and therefore have full right to monitor their employees' navigation. Sort of meeting behalves...

Re:I don't understand

[nlvp]

??? And you get to decide what goes between the "do not look" veil? This makes industrial espionage just too easy.

No - there's no decision to make - they never look, they have no right to (well, until yesterday I guess).

Industrial espionage 101 :
1. Get confidential documents
2. Photocopy confidential documents
3. Put photocopies in envelope
4. Send letter to competitor
5. Return originals to cupboard

This has been possible for decades. Email didn't rewrite the rules, it just happens to be a vector that *can* be controlled, therefore they pass laws taking away rights that have been taken for granted for generations.

Industrial espionage has always been easy, email didn't rewrite that rulebook.

And again, you have no "right" to use the company's machines in this manner anyway.

Even if that were true (which it isn't unless that happens to be explicit in the terms of your contract or the general terms of employment), once you have sent the message using their equipment, regardless of whether you had the right to or not, they still should not have the right to intercept and read it - they should only be allowed to discipline you for using the company equipment in an unauthorised way. Now, whether the use of the computer was permitted or not, they can still snoop - you have lost privacy in the workplace, which I think is very serious indeed.

Re:I don't understand

[DaveHowe]

How is this an assault on PERSONAL PRIVACY? You are sending mail and surfing while on company time and you whine because your employer wants to see how you are using it's resources. If this were the government monitoring it's citizens I could understand, but not a company monitoring it's employees.
Personally? I start work at 8:30 am, finish well after 7pm, five days a week (weekends optional). No-one (with the possible exclusion of you, it seems) honestly believes you can cut that big a chunk out of your life, totally excluding any personal business, especially if you are married with children. Excessive personal time during working hours is usually frowned upon, but arranging doctor's appointments, being contacted by your offspring's school and/or arranging your weekend's entertainments is usually accepted as a small overhead for being in business. Employers may well expect such things to take second place to working practices, and in particular outgoing calls should be in breaks rather than while on duty, but it *should* be deeply suspect if an employer decided to pass over an employee for promotion, based on the twice she has phoned her doctor to arrange a pregnancy test.....
--

Re:I don't understand

[Weh]

It's ironic, in Holland the government just passed a law that makes it illegal for a person to read e-mail not sent to that particular person. It falls under the same law as written letters (the constitution is going to be changed to cover electronic commucication). If they read your mail, you can sue them... (of course you'd have a hard time proving it.) I think it's a great law and it shows that 'our' government has at least some sense when it comes to new communication technology.

Re:I don't understand

[Lord Kano]

That's why it pays to be in the higher eschelon of your company's IT pyramid.

LK

Re:I don't understand

[Robert S Gormley]

I don't think anyone thinks that. The issue is with people who whine about doing something they (in *most* cases) technically shouldn't, and being harangued about it.

Re:I don't understand

[hawk]

simple? I suppse this is.

There's no entitlement to use the company computer. THe simple solution for the company is "absolutely no personal use," at whcih point there is absolutely no objection available to the company reading anything on there.

The next step from here is the company offering limited yuse with conditions. If you don't like those conditions, don't take that limited use.

*nothing* in here suggested that companies could read email on personal accounts, or tap personal phones.

This is really about the company being able to control its assets.

Fair enough, though

[Red Moose]

OK, a lf of folks here might shout and scream about privacy, etc., but the fact is that email or web browsing on corporate time should only be for corporate purposes. There were quite a few articles a few years back about email wasting employee time and such.

So I think it's okay to say whatever on your own time, but it seems like an *okay* step to take in work matters, as long as such a law is never evvvvvvver passed for normal home use/personal use.

You can't assume privacy in a corporate env.

[Gendou]

Being at work or using corporate equipment to do - whatever... is like being a guest behind enemy lines. Regardless of the company tells you, you're always under suspect and someone will always be watching you. As the poster mentioned, the only way to really be safe is to encrypt anything you have to say that the company might not like. Then again, can they ask you to decrypt whatever it is you send when they find the message?

Employee Mail

[NetJunkie]

I'm always amazed that people are surprised that an employer is reading their mail. Users need to realize that the computer they use at work belongs to their employer, as does the network, the internet connection, and the service to keep it running.

Given that, I've never been anywhere that just checked everyone's email. The person they check on has been doing other things that make the employer suspect something is up.

But be warned, there are plenty of applications out now that scan email for keywords whether it be naughty words or things that may be confidential to the company.

Re:Employee Mail

[radja]

>Users need to realize that the computer they use at work belongs to their employer, as does the network, the internet connection, and the service to keep it running.

so is the toilet.. how'd you like a camera there?

//rdj

Re:Employee Mail

[henley]

actually a lot of company toilets do have CCTV

Heh, so if I use too much TP does that count as pilfering office supplies?

oh please oh please oh please let that one go to court....

Re:Employee Mail

[sulli]

Well, of course the employer owns the computer, so the employer has certain rights. But that doesn't make it good practice to do so. I know that if I had reason to believe that my employer routinely monitored my email for anything other than patently criminal activity, e.g. stock manipulation or corporate espionage, I would quit.

Good employers know how to treat their workers. It's up to the employee to choose a company that treats him/her right - particularly in this tight job market.

Re:Employee Mail

[gle]

Ok, so I can't use the toilet during the break because that would be abusing the company's property.
I guess I can't shit on my chair also.
Is this the solution, then?

____________________

Re:Employee Mail

[Robert S Gormley]

Then you shouldn't be creating that (personal) data at work, should you?

Re:Employee Mail

[NetJunkie]

No. Because YOU pay for that service. Your company pays for the service at work. Big difference.

What can they be sending?

[empesey]

What on earth could you be sending to other employees while at work, that it would matter what you're sending? Anyone, who at this point, is not aware that email is not in the least bit secure, should get what they have coming to them. Personally, I hate it when other employees send crap they download from AOL, thinking they are witty or clever, and that I'd be interested in this droll humour. Chances are, I've probably already seen it anyway.

Has anyone ever noticed it's the technopeasants who send you this stuff (as if they discovered some untapped corner of the internet).

Re:What can they be sending?

[empesey]

As you say, it's rare but it happens. Even if there was no law passed, I believe that each of those could be dealth with, as a simple matter or corporate turpitude. If a company got wind of a coup against the company, it could always argue that since the computers and everything on it are property of the company, that all correspondences are as well. There'd be a pretty good chance the court would side with the company, since after all, the participants of the email were up to no good. There's always the plea of corporate self defense .

I think more often, the companies would use the newly enacted law to fire people who are passing off-colour jokes or sending those annoying joke exe files - espcecially if the exe files have a virus attached to them. At the very minimum, they could use it as leverage to save some money at evalution time (i.e. no raise for you).

What about...

[11223]

...employees of backbone service providers? If you send an email badmouthing your boss (you work at, say Sprint or MCI) and it travels through a Sprint or MCI portion of the backbone, even if you sent it from another provider, can they then still read your email, because you work for Sprint or MCI?

Re:What about...

[JurriAlt137n]

doing a good job. My employer will neither check my e-mail nor whine about what I'm doing on the Web as long as I get the job done. Period.

If I'm going to piss on anyone

[ackthpt]

I do it over the phone, or from home using my personal email account. I'm so amazed at examples of the following:

People who trash their employers via company email.

People who trash fellow employees via company email.

Executives who say damning things about their company behaviour around a live mic or in email.

How often this sort of thing finds its way public

I'm not surprised at how many dumb people there are int he world, just disappointed.


--

Their servers, their rules

[Masem]

As I commented on in the Linux in the workplace article, the email servers and network connection are there because the companied is paying for the equipment and upkeep of that, therefore they make the rules. Not all companies are draconian on email/internet activity restrictions, so if you don't like that company's rules, get a job elsewhere.

I personally avoid using work email for anything beyond work correspondence, and while certainly not draconian, I feel that it's a responsibility to my place of employment to minimize the use of email for personal business.

Now, if the rules extended to any email/activity from any account even outside of the company's control, then it becomes a free speech issue. (i.e. use hotmail or other web-based emails if you really want personal email at work).

Re:Their servers, their rules

[Detritus]

Not all companies are draconian on email/internet activity restrictions, so if you don't like that company's rules, get a job elsewhere.

I get the impression that many slashdot posters have never lived through a severe recession or depression, where jobs are scarce and getting a job elsewhere is not a practical option. They are going to be in for a shock when their employer unilaterally cuts their pay, and imposes new duties and rules. You don't like it? Quit. There are 100 people waiting in the HR office who would be happy to have your job.

Re:Their servers, their rules

[Masem]

My comment is made considering the IT market today -- if jobs are so scarce, why do we need more H1 Visas?. I know that 5 years, we just might be in a recession, and the market might soak up. Or in my case, the market for chem eng is sufficiently tight that job jumping isn't as feasible in IT at my particular education level. But for most that read slashdot, the employee's market is still very very strong.

Encryption is no protection

[Jez]

> If I was gonna bad mouth my boss, I'd use my
> domain as the email address, and PGP crypt the
> message.

Not enough! The RIP requires you to hand over your private keys if asked to by the Home Secretary (or some designated by him, so realistically any policeman) or face imprisonment.

Frankly it amazes me that Jack Straw can't see the contradiction between passing legislation like the Human Rights Act on one hand, and the RIP act on the other.

Re:Encryption is no protection

[Kiss the Blade]

It will be intersing to see just what effects the Human Rights Act is going to have on UK law. It seems to me that much of British Legislation is built on the assumption that the government is fundamentally composed of good people (stout fellows). This is the tradition that the RIP act comes from - 'okay, it does infringe on peoples rights, but we're British, Dammit! We don't abuse peoples rights by nature' - this seems to be the general attitude.

However, the Human Rights Act comes from an entirely different tradition, that of continental Europe, where they don't trust the government, and with good reason, given their history. This means that the Human Rights act will probably clash will all sorts of surprising parts of British Law, and I don't think this will be a good thing

An example might be in Scotland, where traffic speed cameras may have to be removed thanks to the Human Rights Act.(the idea is that they can identify the speeding car, but not the driver, so it's stupid to prosecute the driver of a car caught speeding)

I'm not saying that I agree with the RIP bill, because it seems to abuse the most fundamental of British Traditions, that of innocence until proven guilty, but I am wary of the different directions that British Law is being pulled at the moment, on the one hand by Jack Straw and his blatantly idiotic laws (bye bye trial by jury), and on the other by the alien edicts and ethics of European law.

I think it's about time we ignored all these foreign infringments, and realised that British Law should be dealt with within it's own traditions as it always has.

Mail to my wife

[JurriAlt137n]

Dear Jane

After having started on my new job today, I'm afraid I have some bad news to tell you. The work I am doing here is very challenging which might cause me to do some real overworking. The fact that the boss is a really nice guy obviously has something to do with this. I seriously suspect him to have been a sergeant-major at least in Her Majesty's service, as the charisma and leadership of this man is unrivaled by any previous employer I have worked for. It seems as though this is the place where I belong. The job I have been looking for all this time. I must stop now, as I feel it is inappropriate to take more than 10 minutes of breaktime a day.

Sincerely yours,
me

Her Majesty's Government doesn't get it

[henley]

The bottom line is that HMG doesn't get I.T. At all. It's sickening really; we have Smilin' Tony telling us we want to be at the forefront of the e-revolution, and then a sickening bunch of has-beans toadying along behind coming up with crap like the R.I.P. bill and this load of old tosh.

The extent of the problem was highlighted on the BBC Breakfast news when the self-styled e-minister Patricia Hewitt said that although yes, the Government was allowing employer snooping, it was only for "reasonable" uses. To paraphrase the good lady "Employers shouldn't pry. We trust them not to go looking at messages that are private". e-minister *blech*. Bet she wouldn't know a website from a kick in the teeth, let alone exactly what barrel of worms she's just opened. "reasonable use only".... nice. Let's see someone get a legal definition of that one; it'd be like nailing jelly to the wall.

What's worse is that Her Majesty's Opposition is just as technically inept, if not more so. I don't mind so much the boneheadedness (hey; I'd make a crap politician so why should they make good geeks?), but I am fed up to the back teeth with smiling baby-kissers telling me all about how great the technology is and how they know *just* how it needs regulating.... Oh, and then hold 1 week unannounced "review" periods for public consultation, then trumpet their spawns-of-satan legislation as "widely approved of by industry and public".

The thought of actually going out and *asking* people what legislation they need (other than the police, of course, who have predictable knee-jerk reactions hence RIP), and *listening* to them instead of patronisingly telling them what they want could never occur to this bunch of rabid style-over-substance image-is-everything inept sheep. I mean... not towing the party line? showing evidence of independent thought? not being "On-message"? Heaven forbid.

TOh dear did I really type that load of tripe? Ah well, it's off my chest now. Just scroll down a bit will you? There is nothing to see here. I'm going to go and lie down with a cold towel and maybe lay off the coffee for a bit.

Re:Just encrypt e-mail with a proprietary algorith

[Black Parrot]

> ..and make decrypting it a violation of the DMCA

Content-Type: exttay/yptocray; arsetchay="us-ascii"

Hi Sue. How's work today. Mine's a real itchbay, so I'm idinghay down at Jim's office, and just kind of uckigfay off instead of trying to fight the ullshitbay that it takes to get anything done around here. My new boss is a a real oronmay, and I'm "this close" to telling him to isskay my ass. I'm going to brush up on my resume tonight, and get the hell out of this itholeshay.

How 'bout an afternoon quickie? I was going to eaksnay out early today anyway.

Re:Just encrypt e-mail with a proprietary algorith

[arivanov]

.and make decrypting it a violation of the DMCA.

Irrellevant. It's UK. The RIP bill actually specifies that taking measures to intervene with decryption for monitoring purposes is a crime. If you are asked for your keys you must hand them off.

Re:Luckily for me...

[arivanov]

If you are porviding business mail hosting as some UK ISPs do you must brace yourselves to be ready to order such service. In both technical and moral terms. The employer is entitled to read the business mail of its employees. This is valid only for hosted business email though. Not for personal.

Taco's solution

[Fervent]

I guess I just don't see it. If I was gonna bad mouth my boss, I'd use my domain as the e-mail address, and PGP crypt the message.

Except if they were monitoring corporate traffic. Then it wouldn't matter whose domain you were using.

Encryption? Just use traffic analysis ("Hmm... it appears Rob is sending email through his own domain, instead of the company's domain. Why?")

Re:Taco's solution

[Fervent]

I have one on both sides of my Windows2000/Linux box. If anyone needs help setting up their own... :)

Re:Just encrypt e-mail with a proprietary algorith

[Black Parrot]

> Content-Type: exttay/yptocray; arsetchay="us-ascii"

> How 'bout an afternoon quickie? I was going to eaksnay out early today anyway.

Well, my usbandhay, whom you refer to as your oronicmay ossbay, is taking the afternoon off, so we can't oitday here this time. How 'bout if I just come to the office, and we'll give the old oomclosetbray a try?

Re:PGP?

[arivanov]

Minor correction.

You do not walk out of the door. If you do, they can sue you for misconduct and than you should give the key to the police which will lawfully request it as a part of the investigation. If you refuse to do so it is 2 years in jail.

That is what RIP is all about.

Clockwork Orange and 1984 all the way.

Here's what *I* don't get

[OlympicSponsor]

Why aren't these people being judged on their productivity? You pay them X dollars (or pounds, in this case). They produce results worth Y. If Y is greater than X, they are an asset. If Y is less than X they should be fired. (Alternatively, you could say "Your Y is less than X, we will have to fire you if this doesn't change in 3 month" and let the employee decide whether to bump up the ol' productivity).

(Don't bother bringing up "porn == sexual harassment" because that is orthogonal to tracking and mail-opening)

Now, I realize that tracking an employee's worth in actual dollar figures can be difficult, but any manager worth a damn knows if she is getting bang for the buck out of her employees. Telling an employee that he should spend his 15 minute coffee breaks in the break room reading a book as opposed to emailing his wife to complain about his cow-orkers is just micro-management.
--
An abstained vote is a vote for Bush and Gore.

Only if they know how...

[brunns]

My bosses won't be monitoring my mail - they wouldn't know how. They are all too stup...

£^(*&%%$£&*^^ - Carrier lost...

Who draws the line, and where?

[heikkile]

Many have said that the companies are supposed to be allowed to monitor what they want. That employees should have no expectation of privacy when using company equipment. To some extent I agree. But then again, how far is reasonable?

If I receive a personal phone call from my girlfriend, is it fair they listen? Is it fair they inform my wife, if she works in the same company? Or if not? When I take a break and use the corporation toilet, is it fair they videotape everything? Run chemical tests on the urine I pass there to monitor my stress levels? To monitor drug abuse? To screen for markers of inherited diseases or tendencies? If one day they get this mind-reading machine, is it fair to read my mind to detect if I am about to leave? about to be unhappy with the company? think private thoughts on "company time"?

But are they registered?

[jd]

Unless the company is registered with the Data Protection Registrar

AND the employee specifically authorises the company to store their personal data on the monitoring computers

AND the employee specifically authorises the use of that data for monitoring purposes

AND the employee has full rights to know WHAT is stored, at ANY time

AND the employee has full rights to ammend or correct data that is stored, at ANY time

they would be breaking the law to monitor their employees e-mail. I'm not exactly keen on the idea that employers have the right to snoop on employees - whistle-blowers need protection more than corporate executives - but provided the DPA is given sharper teeth to tackle abuse, I think that this might not be such a terrible thing.

(It's only an invasion of privacy if the DPA is essentially rendered worthless for this. You always need checks and balances, and the DPA is the only check your average Joe Bloggs has, right now, to handle computer misuse by corporations.)

separate email account

[peter303]

One for business- open to your bosses;
One for personal.

What then if you read your personal account
on a work computer?

Re:Isn't this the same as in the US?

[peter303]

<I believe e-mail and internet usage can be monitored by US employers, but only if they notify the employees that montoring is taking place.>

No. Numerous court cases have said the employer has a defacto right to intercept all communications- letters, email, telephone- that use company resources- address, time, facilities.
However, in this tight labor market it is stupid for an employer not ot be upfront about it,
because people do quit when they find out.

Re:Just prepping up for the future...

[ichimunki]

This law doesn't need to be passed in the US. US employers pretty much already have this right. In fact, the law in the United States seems to support business in depriving you of what would otherwise be your civil rights. Some employers already engage in search and seizure of actual persons and personal belongings. Many employers require that you submit body fluids for testing. Video surveillance of employees is rampant (and is often done covertly, just as much as video surveillance of customers is done-- in fact, monitoring one often makes it trivial to monitor the other). Employees seem to be able to deprive you of your ability to sue the company by requiring "mediation" for all disputes. They frequently deprive employees and contractors of their ability to build a career through dead-ending tactics like non-compete clasuses.

I fully recognize that civil rights are about government and not business, in fact that's what I'm complaining about (such a myopic view of rights in modern society), so please, no flames about the semantics!

Cultural issue

[mirko]

I am married and I communicate through email with my wife.
We happen to exchange, say, 3 or 4 mails during the day. which is not that much.
We consider it private and would be quite pissed off if anybody decided to monitor our conversations, even though they remain "soft" because I am here at work and not prepairing tonight festivities.

I admit English accept this rule, because they're so.
But I take this story as a warning not to accept my next job in England because if I am considered as brilliant by my colleagues, I also admit I use the corporate network to coimmunicate a bit while working. It is necessary for me to swap between tasks.
I then should be considered as somebody who's working habits are shocking ?
what about my work, what I am here for ???

If this law was about to pass in a Latin country (France, Italy... even here, in Switzerland) most people would refuse it because I am far from alone in this case.
--

Re:Cultural issue

[mirko]

You don't seem to understand the point : even though I know this *is* possible, I don't want it to be considered as *legal*.
I want to have the right to contest such practices.
--

It's the "gimme" generation

[hawk]

Why, how can you possibly not understand this. The computer is theree, therefore I'm entitled to privacy. In fact, I'm entitled to have my employer provide a computer to use for my personal matters during working hours. Not having one just isn't *fair*.

Furthermore, my employer has absolutely no right to question what I do with its property that it provides me. It's not like it has any right to control the use, nor that it amy get sued for my use of company property.

Why do they think I'm here? to do stuff for *them*???

Furthermore, I demand full privacy screens to protect me from them
monitoring me . . .

*********

Given that the employer has absolutely no obligation to allow personal use, there's no privacy issue. Personal use is only permitted on these terms. Don't like them?--demand your money back.

hawk, esq.

Re:It's the "gimme" generation

[Scooby71]

A couple of points.

In the UK the employer does have an obligation to provide a phone, free from monitoring, for personal use. This is in recognition that people do need to take care of personal business in working hours.(For Americans who see any employee rights as an affront to the sacred cow of free enterprise, I have never seen a complaint from a business that this is unreasonable)

Email is becoming widespread, but many people do not have access at home, therefore use it at work. In moderation this will have minimal impact on effectiveness, but personal email may contain information that you would wish your employer not to know - that job offer, or that test for a serious disease.

Yes, you should use other methods, regardless of the legal status, but this enshrines the employers right to snoop.

Re:It's the "gimme" generation

[ColdGrits]

"In the UK the employer does have an obligation to provide a phone, free from monitoring, for personal use"

Umm, no they don't. Kindly point to the relevant piece of legislation - what's that? You can't? I wonder why...

My thoughts.

[mindstrm]

After reading some of the posts.. here's a thought.

Someone brought up the point about personal snail-mail at work. Your employer does not have the right to open your mail, so why should they open your email? Well.. here's why, although a bit abstract.

There is, due to long-standing law, as well as the fact that something is in a sealed envelope, a reasonable expectation of privacy when you send mail in the post office. (Recall, if you sendt a post card, with no envelope, there is NO expectation of privacy; anyone can legally read it.)

The internet at-large is basically a *public* network. Yes, it's 'public' in a different sense than we usually use, but the fact that you have no real contorl of where your data goes after it leaves whatever you DO control.... that makes it public. THat, coupled by the fact that you don't know the policies of every network your message will pass through. Sending unencrypted mail ils as good as sending a bloody postcard! Yes, you can be reasonably sure the whole world cant' read it, but anyone who happens upon it legally CAN (the postman, your boss, the guy in the mailroom). This equates to things like: The IT staff, your boss, etc...).

Think about it.
If your boss wanted, he could say 'I want to see ALL snailmail coming into the building. Now.. he *CAN*, I believe, do this. He cannot make you open your mail, but he can see the volume/where the stuff came from. After all, the mail was addressed TO HIS BUSINESS.

Use encryption. Seriously. Otherwise, it's like complaining about people using scanners on your cellphone calls (well, the US *DID* legislate against that, funny enough> Canada didn't.). Canada said 'well.. it's going with standard modulation over public airwaves... what did you expect? No expectation of privacy'. Of course, if it was *encrypted*, there is an expectation of privacy, and a scanner that could decrypt it may be illegal.

Re:My thoughts.

[mindstrm]

No.. not the same thing at all.

Recorded music/media/whatever, the issue is all about copyright, NOT about privacy at all. They may have a sense of ownership, but that's a completely different beast.

Traditionally, laws regarding mail (and other communications, such as cellular phones) were based around whether or not the parties involved had a reasonable expectation of privacy.

ie: Conversations and eavesdropping. If I'm in the middle of a field whispering to my friend, and you use some sort of listening device to amplify my conversation so you can hear it, you would be doing an illegal act.

If I am in the middle of a field yelling at my friend, loud enough that you can hear it with your plain ears, and you use some sort of device to amplify it a bit and record it.. you are NOT breaking the law. I had no reasonable expectation of privacy if I was yelling.

Same used to be (and still is in Canada) with cellular phones. It's not whether you had an expectation of privacy, but whether you had a *reasonable* expectation of privacy. Yelling loudly and saying 'I thought nobody was around' is not reasonable. Taking steps to make yourself not heard IS reasonable'. As with cellphones.. transmitting over public airwaves in the clear (the airwaves are *all* public), even though you may be ignorant to the physics of it, does not give you a reasonable expectation of privacy (under canadian courts, anyway). You are broadcasting something that can be picked up by any capable radio receiver.

Copyright has nothing to do with privacy. The DMCA (not that I'm defending it) is about copyright. Making it illegal to break a copy protection mechanism is NOT equal to the act of violating a privacy protection mechanism, though both MAY use encryption.

This takes me back to the BBS days..

[BilldaCat]

I used to be a sysop of a WWIV board and I would read user's mail all the time. My system, my phone line, mine mine mine. Same situation applies here.

//MAILR is good clean fun. :)

So what?

[0xdeadbeef]

Is there anyone else who really doesn't give a hoot about email monitoring? If your company respects you, they're not going to be a snit about personal use of email and web surfing, unless of course, you're obnoxious about it. If your company acts like the Gestapo, well, find yourself a new employer. It is the company's resources, after all. And if you're divulging secrets or bad-mouthing other employees, well duh! you moron, of course you're going to get smacked.

I myself keep job inquiries in my inbox, just as a warning to any snoopers: mess with me, and I can walk in a heartbeat.

What too many people seem to forget though is the imbalance of power in this situation. Your email is suspectible to snooping by upper managment, but how many of you have the oppurtinity to snoop on their personal doings at work? And before all your submissive lap-dogs whine about "it's not your job to know what they're doing", remember that a great many wokers in the tech sector are stockholders in the companies for which they work. I have just as much desire to see the company succeed as the suit with the inflated salary, and I have a right to know that he isn't wasting my money.

But alas, that's the corporate republic for you. It's feudalism, not democracy.
--

Re:It's been like this in the US forever

[PigleT]

Agreed, sort of. It's long been traditional since I grew up reading unix sysadmin books by O'Reilly that employers should be able to track stuff, certainly in the case of abuses of the system.

Where all the modern fad of calling it a breach of privacy has come from, I dunno.

How much mileage is there in the view that "freedom of speech is fine, but abuse it and lose it"?
~Tim
--
.|` Clouds cross the black moonlight,

That's right! Nail the bastards!

[OlympicSponsor]

They are using our bandwidth to send personal mail--so we should be allowed to read it!
They are using our phone system to make personal calls--so we should be allowed to listen in!
They are using our parking lot to park their cars--so we should be allowed to search them!
They are using our plumbing to take personal dumps--so we should be allowed to watch!
They are using our lighting to illuminate personal activities--so we should be allowed to monitor!
They are using our air molecules to vibrate with personal spoken messages--so we should be allowed to eavesdrop!

All of these things are "environmental". Presumably there is value to the company to provide them to all employees. If an individual employee is being unproductive, fire him. There's no need to read his mail, search his car or test him for drugs. If the mail system (or parking lot) as a whole is costing more than it provides, de-install it. There's no need to read everyone's mail or search everyone's cars.

Remember during the Olympics and how everyone squawked about how the FBI was reading the email from the kiosks? But the kiosks belong to some company or government--can't they do what they want? I'm using my ISP's bandwidth, does that mean they can cc all my mail to the FBI? No, dammit!
--
An abstained vote is a vote for Bush and Gore.

Hi, there's no protection in the USA

[small_dick]

In the USA, land of the free, home of the brave, the constitution, etc...employers have the right to scan all the transmissions on the wire, read your emails, whatever.

Just thought you'd like to know.

The last place I worked didn't delete ex-employees mail accounts, preferring to harvest and read what people sent them months/years after the employee left.

Re:Hi, there's no protection in the USA

[WillSeattle]

Very true. We in the USA have much lower protections than exist even after this law goes into effect in the UK.

We sold our privacy rights to corporate interests and they gave us promises of shiny baubles. And now our government tries to arm-twist nations that have higher privacy rights than we do into "opening the market" and reducing their consumer and employee privacy protections.

Boss Profile

[nigelb0]

So what sort of bosses like to see what their underlings are up to. Do they themselves believe they should be monitored also?

A while ago our head salesman logged on to check his shares, only to find a porno site had taken its place (temporarily). Those photos were in his cache whether he liked it or not, and our proxy logged the accesses. As it happened we were working in a small office and we all had a good laugh about it.

How would things be in a larger organisation where the monitor may be unable to see (or appreciate) the context? Would it matter if our head salesman was a junior instead?

It's becoming so complicated !

[Anonymous Coward]

There are things I do not understand.

If I want to say that my boss is a stupid idiot, can't I do that?

If I say that he'll kill me or that I'll kill him for the extra work he is giving me, I'm NOT saying that I or he will died. This is just a way of expressing my frustration.
Such comments are not intended to hurt the feeling of my boss. They are not even directed against my boss. They are expression (=release) of something that I had into me.

Anyway, this is a private conversation between me and someone else and should not be taken out of context.

I beleive I am the right to say what I want if I do not offend publicly someone, if I do not offend the person receiving the email.

Lawyers may say that this is not how things work, but I do not care what lawyers can say.
They should think a bit and realize that there are many more ways to hurt and insult people in a civilized and educated way! People that really want to hurt someone else would use this subtle lawyer-proof way and not a more direct one.

Talking to HR about your incompetent boss

[judd]

At one workplace, where I was a union representative, there was an issue where someone was being victimised by their immediate supervisor. The HR department were quite enlightened, and were pleased to have evidecne that said boss was responsible for the alarming rate of resignations. It was a large site with open-plan offices. Private phone calls to HR were impractical. Note, all parties concerned were workers at the same organisation.

In general, a private channel is often very helpful in intra-organisational disputes.

Stephen

It's NOT just work email! (repeat: NOT)

[JamesGreenhalgh]

Lose 2 marks for bad reporting again, somewhere along the line.

This bill does not specifically give UK employers more access in terms of monitoring their staffs email.

This bill gives the UK government + police services, access to monitor *ANYBODYS* email, for any reason, even if you are not under suspicion of having committed a crime. It's not even email either - they can demand the ISP feed traffic in general their way.

If it was just work mails I wouldn't really care - it's their bandwidth, but the fact is that the RIP bill is in fact there purely to give the authorities unprecedented power to intercept the communications of the general populace, to demand their decryption keys (or face prison), and other such lovely fluffy things. It's big brother, approved by a government with no clue whatsoever.

If anyone offers me a job in the US, I'll move..

Encryption is no protection from RIP

[Danj2k]

>I guess I just don't see it. If I was gonna bad
>mouth my boss, I'd use my domain as the e-mail
>address, and PGP crypt the message.

PGP encrypting it would do you no good, RIP gives the government powers to demand that you hand over your encryption key(s). And if you don't comply, or you've lost the key, or something? 2 years in the slammer.

There's an interesting article about RIP and what people can do to avoid it at http://www.fipr.org/rip/RIPcountermeasures.htm

encryption fails for screen-dump interception

[peter303]

Some of the spy programs operate at tail end of transmission- that is, dump your screen perdiodically, say every 30 seconds. Private accounts and encryption would fail here. This spying is popular inside the home, but may be unwieldy in a company.

Re:NSA everywhere

[peter303]

They always have been.
Send some plain test mail with certain kinds of threats in them and you'll be hearing from somebody. This trivial to do in the current internet.

Consider this...

[catseye_95051]

How would you feel if laws were passed allowing you boss to plant hidden microphoens and cameras in your office? Its really not very different.

Re:Consider this...

[fishbowl]

>How would you feel if laws were passed allowing
>you[r] boss to plant hidden microphoens [sic.]
>and cameras in your office?

Actually, a law would need to be passed forbidding this. It is legal today. Consider
the convenience store with the hidden microphone
and camera? How is that workplace different from
"your office?" How would you, as a lawmaker, word
the bill to make a hidden camera legal in one
workplace but not another?

HACKING Parliment now Legal?

[gnarly]

Well, if reading your employee's mail is OK I guess this means that all Brittish Citizens, who together employ every Member of Parliment, have the right to read the email of their employees. Not sure the best way to read the email of any given MP, sniffers? Carnivore? Any ideas?

Your body wastes don't affect the business...

[devphil]

...but your email can and will. Your post is hardly a refutation. The point being made is that misusing company resources is wrong; not that you have no right to privacy at work. What you say is completely irrelevent.

Re:Uh... shells, people.

[Tassach]

Who says you have to run ssh/sshd on port 22? On the external machine, run 'sshd -p 80'. While it is possible to set up a firewall that examines traffic at the presentation/application layer to be able to distinguish between a http and ssh, rather than doing simple blocking at the session/transport layer, in practise this would not be feasible except in the most security consious enviornments.

In most circumstances, your privacy will be safe due to the ineptitude of your cow-orkers. Even if your network administrator is an uber-geek, just find out what he uses to secure his email.

Hmmm.

[shippo]

I live in the UK. I had a boss who did this (and more) 2 years ago.

Every account on the LAN had a blank password, which we were not allowed to change. The purpose of this was to allow the boss access to any email account when he pleased. Security on the network just didn't exist.

What was really annoying was that this was an isolated office network. Email access to the outside world was via a separate PC, situated next to the boss. If we needed to access a web-sire or news for support work purposes we had to do it from home.

Whilst I worked there one collegue had some personal mail delivered c/o the office, as he didn't have a permament address in the area. The boss opened this private mail and read it. I should have walked out then - I was already pissed off by the fact that I'd been standing outside in the rain for 45 minutes, waiting for the boss to turn up to open the place.

I only worked there for 2 days (I'd have not come back from lunch on the second day if I hadn't left some possessions in my desk). It was the work place I'd ever worked at.

Re:It's been like this in the US forever

[PigleT]

> I think this fad comes from the entitlement
> thinking that people can do whatever they want
> whenever they want and misusing company
> equipment or embezzling time are not
> considerations. :)

Agreed. I think "freedom of speech" needs to be justified rather than pulled out of the hat every time something goes slightly wrong.

People will want entertainment. Entertainment is not hacking. Entertainment is a zero-quality plain waste of time, IMNSHO.
~Tim
--
.|` Clouds cross the black moonlight,