Slashdot Mirror
Keystroke Logging Declared Illegal in Alberta
Meshach writes "The Globe and Mail has a story about how
keystroke logging has been declared illegal in Alberta Canada. The ruling applies to companies using logging as a means to track employees." From the article: " The employee, who was not named, worked as a computer technician for six months in 2004. Ms. Silver said it was a job where productivity was hard to measure. 'We thought that using an objective check through the computer would be the most fair and objective way to do that,' she said Wednesday."
Six years ago, I was contacted by a stock brokerage company in New York. They were looking for ways to track the computer use (of their developers, I believe. I think they were concerned about Internet Surfing) Like a dummy, I rambled off some ideas that could help them track usage without the employees noticing it. At the time, I thought it was a very strange call! Why would anybody secretly want to know what their employees were doing? Didn't they trust them? I never heard back from the people, and I always thought that I had "given away too much" by specifiying the programming during the interview.
Now that weird scenario has become all too commonplace, and it's just as secret as I feared. FTA, "When the employee discovered that he had been monitored, he lodged a complaint with Alberta's information and privacy commissioner."
The guy didn't even know the software was there. Now it's one thing to tell people "We're watching you. This will go on your evaluation" It's another thing entirely to do it secretly.
In the present day, clients are modeling their business practices more and more, and would like a way to track metrics. I'm all for it: if I were a businessperson or employee, I wouldn't have a problem with my boss measuring how long it took to do my work. Where I surfed during my lunch hour? Forget it. But my productivity? Sure.
Welcome To My World
Logging > counting, if you want wpm just count the # of clicks, not record the content.
It *will* be abused and there is no ifs, ands or buts about it. CS-
Sounds reasonable. Except for one thing. Why did they hire some one for this job? What problem needed to be solved? Did that problem get solved?
Presumably the problem was that not enough people were typing. So they hired some one to type, and measured the typing, right?
They should've hired some guys off of IRC. They type a lot.
SCO employee? Check out the bounty
In addition to writing software for the company I work for, I am also the system administrator. And I have been working in the IT world for about 6 years now. In that time, I have never read another persons email. I have never gone through their personal files. This is, of course, unless asked to do so by the owner of said objects. And to this day, I still find it completely ridiculous that anybody would find it necessary to spy on their users/employees by means of logging all keystrokes.
I believe that if a person cannot be trusted to perform the operations (s)he was assigned to, that they have no business working in the same company as me, in the first place. Maybe I'm too trusting. I don't know. But what I do know is that I am respected by my coworkers for being fair and not letting my power go to my head.
Having said that, I wish key logging were illegal in all states. IMHO, certain people need to lighten up.
My lame blog.
The idea of needing to secretly log keystokes on an employee is ludicrous.
If you, as an employer, manager, etc, cannot trust the people below you to do the work you put before them, then why are they your employees?
When it comes to computers at work, I might need to fetch files from home, they'd log my personal passwords, and all other data; that's not only unnecessary, but unfair. I trust them to not snoop my personal data that may be transmitted through a work computer, and they trust me to get my work done.
Error 407 - No creative sig found
The problem with keystroke logging is how completely pervasive it is.
It's one thing to say "We'll read all your e-mail, and any files you save." That's reasonably "what you're doing on the company network."
On the other hand, suppose you get a phone call on your cell with fairly personal information. Your doctor's phoned you up to tell you the name of the clinic to get your AIDS treated at, for example.
It's not reasonable to say "employees shouldn't take calls like that during work," because doctor's offices run the same work hours as everyone else. So you take the call, you have to write down the name of the clinic. Ok, so you pop open notepad.exe to do it. You're going to write it down after, but the doc's talking fast enough, you don't have the writing skill to do it on paper.
You *know* it would be stupid to save this file on the company network, or e-mail it to yourself. But with a keystroke logger, even though you haven't saved it, it's recorded.
There are a hundred things like this. Who hasn't gotten a phone call from his or her boss, some extraordinarily irritating interference, and typed into his or her code "I would strangle this man if he weren't in charge of my paycheck..." then deleted it?
Finally, and most importantly, keystroke loggers intercept passwords. While it may be fine to check up on what your employees are doing at work, it is abhorrent to destroy their security on every single site they might visit.
Moreover, that information is not magically placed in the hands of "The Company." The Company is not a person. The administrator is a person, and while you as an employer may trust that administrator with corporate records, your employees have a right to have their bank account passwords kept out of that administrator's hands.
Computers are, at this point, far too much an extension of our minds to log every single keystroke. It's just too detailed, too internal. There are far too many easy ways to check employee productivity without resorting to this intimate spying.
In almost all cases, you can check employee productivity by watching out for sol.exe, checking the weblogs for things like slashdot or porn, and seeing whether the employee's work actually gets done.
The ends don't justify the means in this case. Keystroke logging is insane.
Keystroke logging means recording your keystrokes, not simply counting them. I would say that if company policy was "your computer use may be monitored", they should be able to do so -- if you won't like this clause, you don't have to work there. Persumably this will lead to a compromise, especially if workers negotiate their contracts jointly.
As a brother post says, this is more-or-less the situation in the US, but not in Canada. There, privacy is a constitutional right which even private businesses have to respect. However, note that the ruling doesn't say that all logging is wrong -- just that in this case, there were less intrusive ways to evaluate the performance of that employee. Government regulation is another way to balance the competing concerns of the company and the individual.
Well, when deciding between a business and the government, i'll trust the government long before i trust a business. And I never trust the government.
Could you reasonably be expected, as part of your job, to purchase something and then be reimbursed by the company? For example, might you have a business lunch?
In order to pay for that business lunch, might you have to log into your bank account?
In the perfomance of this work-related duty, is it fair that the network admin for your company now has your bank id and password, which would allow him, if he liked, to take your life savings and those of fellow employees who did the same, then run to Aruba?
Keystroke logging records passwords. No matter how scrupulous you are about not discussing your sex life on work time, any non-work passwords must remain sacrosanct. Keystroke logging goes over the line.
By no means should anyone think that keylogging is an "objective" way of measuring performance. Because employee A takes care of all her work and has some free time so she gets online and chats on IRC and employee B spends all day working on the same issues (and still doesn't get them fixed), employee B is not more productive then employee A.
We need to understand that a productive worker is one who makes sure the job is done, and it doesn't matter what he or she does in their downtime. Want to measure the productivity of the tech at the library? Are the computers he is responsible for functioning properly? If yes, he is a productive worker. If it seems like he has too much free time, give him more resposibility. If he struggles with it, can him or lighten his workload.
The Internet is generally stupid
It's not funny when all the PCs in your department have NiceSoft installed. I call it KGB software. http://www.nice-soft.com/product/nicespy/index.htm
Note: Our network will be upgraded to gigabit due to the bandwidth saturation that this program causes. Also, the central capture server will be upgraded too.
Life is not for the lazy.
I appreciate your impression that a Corporations only interest is money. This is often true if the company is actually trying to work. When they sink into Keylogging etc they have shifted from money to "power" and the frame of reference has shifted from the company to some individual within the company.
Actually there is a common misconception that money is the objective. It works pretty well in defining the interests of simple and mid to low range economic strata function. Higher than that the whole issue shifts to power and there even money will not buy the issue. The powerful will forego money to keep power. The sad reality is that the powerful rarely consider the "common good" or other values
I wish companies operated reliably looking for money. That way we could control them quite effectively. (Mods get a life if you disagree we are discussing here)
Never Politically Correct ~ I prefer the facts If you don't like what I say, get a life, or comment yourself.