Keystroke Logging Declared Illegal in Alberta

Meshach writes "The Globe and Mail has a story about how keystroke logging has been declared illegal in Alberta Canada. The ruling applies to companies using logging as a means to track employees." From the article: " The employee, who was not named, worked as a computer technician for six months in 2004. Ms. Silver said it was a job where productivity was hard to measure. 'We thought that using an objective check through the computer would be the most fair and objective way to do that,' she said Wednesday."

Comments

monitoring

[Quasar1999]

I don't much mind if an employer of mine monitors what I'm doing at work while being paid. In my specific line of work, sometimes I'm asked to stay late to finish a project or meet a deadline. In exchange for doing this, I expect (and receive) a reasonable tolerance of doing personal things (like surfing to slashdot) during normal working hours. But if I started doing no work, and the employer didn't have to wait until my project got screwed, and the deadline missed by months before realising that I'm not working, then I say it's well worth it. Even more so if they get one of my coworkers, since that saves me work in the long term... Privacy be damned, as long as it's not abused, I welcome it.

Re:monitoring

[zulux]

My company is works the other way:

My employees work for 6 hours per day - they're paid for 8.
In exchange for having 2 hours of time to spend with family, avoid rush hour, and walk in the park, I expect no screwing around. Period.

It works! They're productive and happy at the same time. I think I'm actually getting a bargain, because they work *hard* during those six hours. They get to go home and have a life.

In response, companies have switched to...

[Enigma_Man]

taking screen captures every 5 seconds on any employee computer under surveilance.

-Jesse

Re:In response, companies have switched to...

[DigiShaman]

It's not funny when all the PCs in your department have NiceSoft installed. I call it KGB software. http://www.nice-soft.com/product/nicespy/index.htm

Note: Our network will be upgraded to gigabit due to the bandwidth saturation that this program causes. Also, the central capture server will be upgraded too.

Six Years Ago

[DanielMarkham]

Six years ago, I was contacted by a stock brokerage company in New York. They were looking for ways to track the computer use (of their developers, I believe. I think they were concerned about Internet Surfing) Like a dummy, I rambled off some ideas that could help them track usage without the employees noticing it. At the time, I thought it was a very strange call! Why would anybody secretly want to know what their employees were doing? Didn't they trust them? I never heard back from the people, and I always thought that I had "given away too much" by specifiying the programming during the interview.
Now that weird scenario has become all too commonplace, and it's just as secret as I feared. FTA, "When the employee discovered that he had been monitored, he lodged a complaint with Alberta's information and privacy commissioner."
The guy didn't even know the software was there. Now it's one thing to tell people "We're watching you. This will go on your evaluation" It's another thing entirely to do it secretly.
In the present day, clients are modeling their business practices more and more, and would like a way to track metrics. I'm all for it: if I were a businessperson or employee, I wouldn't have a problem with my boss measuring how long it took to do my work. Where I surfed during my lunch hour? Forget it. But my productivity? Sure.


Welcome To My World

Re:Could be ok

[Asgard]

Logging > counting, if you want wpm just count the # of clicks, not record the content.

heartless bastards

[0110011001110101]

And I thought clearcutting and logging of our national forests was bad....

Take up arms! Our nations keyboards are in jeopardy due to these evil logging tactics, soon our keystroke supply will exist only in preserved forests and small wildlife areas.

My work day keystrock log...

[ArsonSmith]

http://slashdot.org/
(refresh clicked)
(refresh clicked)
(refresh clicked)
(refresh clicked)
(refresh clicked)
(refresh clicked) ...
(refresh clicked)
(refresh clicked)

There in lies the rub..

[Chris_Stankowitz]

Privacy be damned, as long as it's not abused, I welcome it.

It *will* be abused and there is no ifs, ands or buts about it. CS-

Hard to measure productivity?

[wfberg]

"We thought that using an objective check through the computer would be the most fair and objective way to do that,' she said Wednesday."

Sounds reasonable. Except for one thing. Why did they hire some one for this job? What problem needed to be solved? Did that problem get solved?

Presumably the problem was that not enough people were typing. So they hired some one to type, and measured the typing, right?

They should've hired some guys off of IRC. They type a lot.

No keystroke logging where I work

[back@slash]

This doesn't affect me one bit. I know that there is no keystroke logging where I work. The sys admins here are complete idiots and have their heads so far up their ass they wouldn't know how to implement key logg&*%$^

!NO CARRIER

US centric thinking?

[www.sorehands.com]

In the USA this type of activity is permitted in most situations. Canada has privacy protections for individuals which seem to limit this type of monitoring.

[sarcasm]Why not let the employer and police monitor everything you do? You only have something to hide if you are a criminal.[/sarcasm]

Re:US centric thinking?

[sp0rk173]

Well, when deciding between a business and the government, i'll trust the government long before i trust a business. And I never trust the government.

Re:US centric thinking?

[cluckshot]

I appreciate your impression that a Corporations only interest is money. This is often true if the company is actually trying to work. When they sink into Keylogging etc they have shifted from money to "power" and the frame of reference has shifted from the company to some individual within the company.

Actually there is a common misconception that money is the objective. It works pretty well in defining the interests of simple and mid to low range economic strata function. Higher than that the whole issue shifts to power and there even money will not buy the issue. The powerful will forego money to keep power. The sad reality is that the powerful rarely consider the "common good" or other values

I wish companies operated reliably looking for money. That way we could control them quite effectively. (Mods get a life if you disagree we are discussing here)

Re:Could be ok

[Strange_Attractor]

the toilet belongs to my company, and I don't want them watching me pinch a loaf

So, you ARE against monitoring vis a vis logging!

Re:Questionable results...

[mellon]

Remember, kids, if keylogging is declared illegal, soon only criminals will have keyloggers....

Don't believe it.

[ShaniaTwain]

clearly the 'productivity' excuse is just a smoke screen, and their real goal is finding good free porn.

I want the job where they have no measure of your days work other than the number of times a key was pressed:

1.turn on key repeat
2.leave heavy book laying on keyboard
3.take rest of the week off and PROFIT!

From An Administrator

[SenFo]

In addition to writing software for the company I work for, I am also the system administrator. And I have been working in the IT world for about 6 years now. In that time, I have never read another persons email. I have never gone through their personal files. This is, of course, unless asked to do so by the owner of said objects. And to this day, I still find it completely ridiculous that anybody would find it necessary to spy on their users/employees by means of logging all keystrokes.

I believe that if a person cannot be trusted to perform the operations (s)he was assigned to, that they have no business working in the same company as me, in the first place. Maybe I'm too trusting. I don't know. But what I do know is that I am respected by my coworkers for being fair and not letting my power go to my head.

Having said that, I wish key logging were illegal in all states. IMHO, certain people need to lighten up.

Just as odd as wiretapping laws

[Digital_Quartz]

You can't tap a phone you "technically own" either, not even in the US. If you want to record a phone conversation, you have to let both parties know. Nothing odd about that.

The Issue is Trust

[agent dero]

The idea of needing to secretly log keystokes on an employee is ludicrous.

If you, as an employer, manager, etc, cannot trust the people below you to do the work you put before them, then why are they your employees?

When it comes to computers at work, I might need to fetch files from home, they'd log my personal passwords, and all other data; that's not only unnecessary, but unfair. I trust them to not snoop my personal data that may be transmitted through a work computer, and they trust me to get my work done.

You should mind

[Anonymous Coward]

The problem with keystroke logging is how completely pervasive it is.

It's one thing to say "We'll read all your e-mail, and any files you save." That's reasonably "what you're doing on the company network."

On the other hand, suppose you get a phone call on your cell with fairly personal information. Your doctor's phoned you up to tell you the name of the clinic to get your AIDS treated at, for example.

It's not reasonable to say "employees shouldn't take calls like that during work," because doctor's offices run the same work hours as everyone else. So you take the call, you have to write down the name of the clinic. Ok, so you pop open notepad.exe to do it. You're going to write it down after, but the doc's talking fast enough, you don't have the writing skill to do it on paper.

You *know* it would be stupid to save this file on the company network, or e-mail it to yourself. But with a keystroke logger, even though you haven't saved it, it's recorded.

There are a hundred things like this. Who hasn't gotten a phone call from his or her boss, some extraordinarily irritating interference, and typed into his or her code "I would strangle this man if he weren't in charge of my paycheck..." then deleted it?

Finally, and most importantly, keystroke loggers intercept passwords. While it may be fine to check up on what your employees are doing at work, it is abhorrent to destroy their security on every single site they might visit.

Moreover, that information is not magically placed in the hands of "The Company." The Company is not a person. The administrator is a person, and while you as an employer may trust that administrator with corporate records, your employees have a right to have their bank account passwords kept out of that administrator's hands.

Computers are, at this point, far too much an extension of our minds to log every single keystroke. It's just too detailed, too internal. There are far too many easy ways to check employee productivity without resorting to this intimate spying.

In almost all cases, you can check employee productivity by watching out for sol.exe, checking the weblogs for things like slashdot or porn, and seeing whether the employee's work actually gets done.

The ends don't justify the means in this case. Keystroke logging is insane.

Re:You should mind

[Casca]

A lot of good points. It should also be noted that a keystroke logger will destroy completely the ability to have a valid audit trail. The guy reading the keystroke logger can become anyone because they capture passwords. That should terrify pretty much anyone, especially managers.

Re:Could be ok

[l2718]

There are times when keystroke logging could be appropriate, like if you are in data entry- and they need to see how many wpms you are at.

Keystroke logging means recording your keystrokes, not simply counting them. I would say that if company policy was "your computer use may be monitored", they should be able to do so -- if you won't like this clause, you don't have to work there. Persumably this will lead to a compromise, especially if workers negotiate their contracts jointly.

As a brother post says, this is more-or-less the situation in the US, but not in Canada. There, privacy is a constitutional right which even private businesses have to respect. However, note that the ruling doesn't say that all logging is wrong -- just that in this case, there were less intrusive ways to evaluate the performance of that employee. Government regulation is another way to balance the competing concerns of the company and the individual.

You're not thinking about what privacy means

[AllenChristopher]

Could you reasonably be expected, as part of your job, to purchase something and then be reimbursed by the company? For example, might you have a business lunch?

In order to pay for that business lunch, might you have to log into your bank account?

In the perfomance of this work-related duty, is it fair that the network admin for your company now has your bank id and password, which would allow him, if he liked, to take your life savings and those of fellow employees who did the same, then run to Aruba?

Keystroke logging records passwords. No matter how scrupulous you are about not discussing your sex life on work time, any non-work passwords must remain sacrosanct. Keystroke logging goes over the line.

Re:You're not thinking about what privacy means

[drsquare]

If you're going for a business lunch, then the company should pay for it. If not, then get the money from a cash machine. I don't see how logging onto a bank account at work gets you your money, unless your computer is connected to a note forger machine.

If you don't want non-work passwords to be logged, then don't enter non-work passwords on work computers. Key-logging is perfectly acceptable. In my company we put loggers on all the computers to see what the employees are up to. I don't see how this is any worse than watching them on a camera or going round in person watching them. Is standing behind someone whilst they work an invasion of privacy?

Keylogging is not objective.

[interstellar_donkey]

By no means should anyone think that keylogging is an "objective" way of measuring performance. Because employee A takes care of all her work and has some free time so she gets online and chats on IRC and employee B spends all day working on the same issues (and still doesn't get them fixed), employee B is not more productive then employee A.

We need to understand that a productive worker is one who makes sure the job is done, and it doesn't matter what he or she does in their downtime. Want to measure the productivity of the tech at the library? Are the computers he is responsible for functioning properly? If yes, he is a productive worker. If it seems like he has too much free time, give him more resposibility. If he struggles with it, can him or lighten his workload.

Re:Keylogging is not objective.

[interstellar_donkey]

Red Forman said it best...."Work isn't supposed to be fun...If it was, they wouldn't call it work....They'd call it "fiddle-dee-dee""

That kind of attitude will all but guarantee you lose any quality employees. IT workers, like anyone else are human beings. This is not 1915, and this is not a coal mine.

I don't work in IT (anymore). But I do work on contracts for a number of organizations, many times hourly. Yes, I get downtime while I'm on the clock, and I'll use that downtime to talk with my friends on the Internet, look at webpages, or absent a computer play games on my cell phone. It usually turns out to be pretty good; being away from a particular issue for a period of time and goofing off often gives me a new perspective to approach it, and it usually pays off in the end.

About 2 1/2 years ago, I dealt with somebody like you. Seeing me in front of a computer terminal looking at CNN.com, my immediate supervisor told me to do some menial filing work. I explained to her that this is not what I do, and not why I'm here. She said that essentially she was "ordering" me to do it. I hate confrontations, so I walked out the door, went directly to her boss and told her flat out that I am here to do a particular job, which I'm doing quite well, on time and on budget. I am not a file clerk.

I didn't wait for her to try to rectify things. The job was only for a few days, and I saw no reason to get into a dispute. I left.

I had a lot of crummy, menial jobs while I was in college and grad school. Among other things, I bussed tables in a coffee shop. I did mindless data entry in front of a terminal all day. I've filed thousands upon thousands of documents. I even spent a summer pushing rocks around in a quarry. The reason I continued my education was so I wouldn't have to do that anymore. And I won't.

However, where I have seen your kind of management, where the "as long as you're on the clock you're our bitch" mentality rules supreme, was in the Army. For the most part, all this accomplishes is a "You're doing good as long as you look busy" mentality. One of the first things soldiers learn when it comes to doing drone labor is that you don't do it quickly. It doesn't matter if you do a bang-up job while buffing the floor. It can, however, get you in trouble if there's a sparkling floor you can eat off of and you've popped outside for a smoke. So, take forever to do it. Watch as your NCOs see you laboring over that floor buffer and say "He's such a hard worker!" despite the fact that you're purposely lagging.

Incidentally, I learned from a friend at the company I talked about that the particular woman I had the altercation with was sacked. Her department kept going downhill and the company received so many complaints about her from the employees they replaced her about a year after I had that experience. He told me that the employees in her department are a lot more relaxed now, and efficiency has increased dramatically.

Work should be fun. There's no law on the books that said it shouldn't. While the dot com companies failed miserably due to a lack of a solid business plan, I find it interesting that treating the employees like human beings and not worker drones compelled them to put in 80 hour work weeks without a fuss. A happy worker is a productive worker. A drone worker may be busy all the time, but he's hardly productive.

If my boss seriously asked me to rummage through the recycle bin for reusable paper, then demanded I send him an email chronicling it, I would in all honesty and sincerity tell him to go fuck himself. Life's too short to waste your life away working under a tyrant.

Re:Questionable results...

[Intron]

Nowhere in the article does it say that keystroke logging was "declared illegal". That's just the usual /. hyperbole. The case was about logging on one employee without telling him which raised privacy issues. That's why in the US, they always have announcements like "your call may be monitored" on hotlines. They make it clear not only to you, but also to their own employees that someone may be listening in. Also, most companies tell their employees that email and web surfing may be monitored.