Slashdot Mirror
63% Of Corporations Plan To Read Outbound Email
John writes "Aviran's place reports that a recent survey of 332 technology decision-makers at large U.S. companies reveals that more than 63% of corporations with 1,000 or more employees either employ or plan to hire workers to read outbound email, due to growing concern over sensitive information leaving the enterprise through email."
I believe trillian pro supports jabber. I'm not sure about the free version though.
Assuming you can get to Gmail from work (not a given), note how you log in as https://gmail.google.com/stuff but after you enter your username & password, it becomes just http://gmail.google.com/stuff?
Well, here's the trick. Log in normally (not much choice), but after you do, change that http://gmail.google.com/stuff to https://gmail.google.com/stuff again. It'll give you the "loading" crap again, but afterwards, you're using Gmail normally but now it's encrypted.
Assuming they're snooping on you (you should figure this for a given, even if they're not--it's just good habit), now all they've got is the HTML from your inbox. If you're like me and filter all your normal email into various labels and have it "archived" (skip the inbox), they see hardly anything at all.
Yeah, I know. Some are convinced that Google is saving your email for a zillion years (they're not, but deletion is a "lazy" operation, and the computer might not get around to it for a day or two after you actually delete things), but unless you leave it on Google's servers after you need it, you don't have much to worry about. Especially not compared to your employers who probably ARE reading it whether you want to or not.
Sadly, I don't know of any way to do this directly from Hotmail or Yahoo. I guess you can set up a tunneling proxy at home and encrypt the traffic through it, but if you just want to shield your email, what I just said is the easiest way I know of to do it.
[For the clue-impaired, don't try clicking on those links Slashdot insists on making. Just log into Google & look at the URL in the address bar it sends you to.]
On the other, this just means smaller companies will get better employees who don't want to be drones. That's one of the reasons I started my own - I hate oversight, and am bad at playing employee.
On the gripping hand, ethics are important. And they're hard in large companies. To some extent, if you're a large corp, you need process in place of understood ethics, because the former is enforcable and the latter much less so. I still think the balance tips to small corps. But then, we can't turn out replacement Apple CPUs, so our role is constrained.
I forget what 8 was for.
login using https://gmail.google.com instead of http://gmail.google.com
Believe or not there are actually at least four different bases on which you could (but probably won't be able to successfully) argue for a right to privacy with regard to email communications sent from work:
(i) The Fourth Amendment to the U.S. Constitution, which reads: "[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures" -- but which only applies toward government action (although some pretty surprising apparently private actions can qualify as "governmental");
(ii) the Electronic Communications Privacy Act (ECPA), which covers email, and prohibits "(1) unauthorized and intentional 'interception' of wire, oral, and electronic communications during the transmission phase, and (2) unauthorized 'accessing' of electronically stored wire or electronic communications." -- but allows exceptions for companies which provide internet service, and does not apply if the employee consents to ECPA violations;
(iii) State statutes, which obviously vary wildly from state to state. The article that I'm using as my primary source notes that " Members of state legislatures have attempted to pass bills that would strengthen the protections of workers against electronic monitoring in the workplace, but they have generally failed because of sustained and effective corporate lobbying." (*mweheheheheh*).
(iv) Common law (which also varies from state to state) which sometimes recognizes an "actionable right to privacy" -- but under different caveats in each state.
Ummm . . . so yah -- it's complicated, so much so in fact that it's an open question in various states whether or not its legal. Also -- not surprisingly -- the legality of the monitoring will often depend on the purpose of monitoring, the purpose of the communication, sometimes even the industry you're working in, etc. Good luck figuring it out -- especially if you signed a (now practically standard) agreement allowing your employer to snoop through your work emails at will.
Generally, when the law is this fuzzy, corps will do whatever is in their best interest, and count on their lawyers being better than your lawyer if you sue. They're generally right. So assume that your workplace email communications are being monitored. We are the point now that it is never a good idea to send via email something you wouldn't mind all your colleagues seeing. Use Yahoo! or Gmail and at least make it a challenge for BigBroCorp to keep tracking of your on the job dicta. Of course, sending risque stuff from your workplace email may be your chance to be famous. Hehe.
Regards,
Moiche
I work for a life insurance company and just wanted to point out that any information systems that contain or have access to EPHI (Electronic Protected Health Information) are bound by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) which specifies in more than one part that measures must be taken to ensure EPHI is kept confidential. This INCLUDES monitoring outgoing e-mail. My company is small, our IT department consist of 4 programmers, a network admin, 2 help desk people, a production operator, 3 business analyst and a manager. We don't want to be bothered with this crap, but we are obligated by law.
Actually, it's to ensure that such confidential information isn't going out over such unsecured media (google Gramm Leach Bliley -- the financial industry is heavily regulated, and privacy is no exception). If it's encrypted (and being sent to someone who otherwise has a legal right to the information, i.e. customer or legitimate business partner), then it's generally fine.
The SEC also gets rather in a huff if traders are not closely monitored for violations of sections 16 and 20 of the Securities Exchange Act, both of which mainly apply to insider trading.
No. If you actually login by going to https://gmail.google.com, the entire session remains encrypted.
Keystroke logging ? SquirrelMail has a perfect
9
:)
plugin for that kind of things...
http://www.squirrelmail.org/plugin_view.php?id=15
Of course you got to have your own webmail, but without it, security is pointless
What does it mean, "appended to the end of comments you post"
No, but the keystroke logger still picks it up.
"You're never ready, just less unprepared."
To have privacy, you have to find some obscure Unix distro (Red Hat isn't obscure enough; they have that covered too) and use it.
Two words: hardware keylogger.
It's official. Most of you are morons.
Definitely worked to email people I know whose work email spam filter was over-enthuriastic about things like "scunthorpe".
"For a successful technology, reality must take precedence over public relations, for Nature cannot be fooled"
Anyone using someone else's communications technology should not expect their communications to be private from the owner of the technology. This includes phone, email, SMS, etc. I take it for granted that if I'm on the phone with someone there may be a lineman down the block testing the phone lines and may overhear part of my conversation. I don't believe my employer is currently reading my email, but I totally believe in their right to do so.
The only reason there aren't more employers monitoring email is simply due to a lack of manower to do it.
Bottom line: never assume privacy. Only assume better privacy by actively employing measures yourself. (pgp etc) And of course if you're using pgp on on your employer's computer, isn't that a major false sense of security? (if it's not owned by you, consider it 0wn3d)
I work for the Department of Redundancy Department.