Slashdot Mirror
Keystroke Logging Declared Illegal in Alberta
Meshach writes "The Globe and Mail has a story about how
keystroke logging has been declared illegal in Alberta Canada. The ruling applies to companies using logging as a means to track employees." From the article: " The employee, who was not named, worked as a computer technician for six months in 2004. Ms. Silver said it was a job where productivity was hard to measure. 'We thought that using an objective check through the computer would be the most fair and objective way to do that,' she said Wednesday."
I don't much mind if an employer of mine monitors what I'm doing at work while being paid. In my specific line of work, sometimes I'm asked to stay late to finish a project or meet a deadline. In exchange for doing this, I expect (and receive) a reasonable tolerance of doing personal things (like surfing to slashdot) during normal working hours. But if I started doing no work, and the employer didn't have to wait until my project got screwed, and the deadline missed by months before realising that I'm not working, then I say it's well worth it. Even more so if they get one of my coworkers, since that saves me work in the long term... Privacy be damned, as long as it's not abused, I welcome it.
---
Programming is like sex... Make one mistake and support it the rest of your life.
It *will* be abused and there is no ifs, ands or buts about it. CS-
The problem with keystroke logging is how completely pervasive it is.
It's one thing to say "We'll read all your e-mail, and any files you save." That's reasonably "what you're doing on the company network."
On the other hand, suppose you get a phone call on your cell with fairly personal information. Your doctor's phoned you up to tell you the name of the clinic to get your AIDS treated at, for example.
It's not reasonable to say "employees shouldn't take calls like that during work," because doctor's offices run the same work hours as everyone else. So you take the call, you have to write down the name of the clinic. Ok, so you pop open notepad.exe to do it. You're going to write it down after, but the doc's talking fast enough, you don't have the writing skill to do it on paper.
You *know* it would be stupid to save this file on the company network, or e-mail it to yourself. But with a keystroke logger, even though you haven't saved it, it's recorded.
There are a hundred things like this. Who hasn't gotten a phone call from his or her boss, some extraordinarily irritating interference, and typed into his or her code "I would strangle this man if he weren't in charge of my paycheck..." then deleted it?
Finally, and most importantly, keystroke loggers intercept passwords. While it may be fine to check up on what your employees are doing at work, it is abhorrent to destroy their security on every single site they might visit.
Moreover, that information is not magically placed in the hands of "The Company." The Company is not a person. The administrator is a person, and while you as an employer may trust that administrator with corporate records, your employees have a right to have their bank account passwords kept out of that administrator's hands.
Computers are, at this point, far too much an extension of our minds to log every single keystroke. It's just too detailed, too internal. There are far too many easy ways to check employee productivity without resorting to this intimate spying.
In almost all cases, you can check employee productivity by watching out for sol.exe, checking the weblogs for things like slashdot or porn, and seeing whether the employee's work actually gets done.
The ends don't justify the means in this case. Keystroke logging is insane.
Could you reasonably be expected, as part of your job, to purchase something and then be reimbursed by the company? For example, might you have a business lunch?
In order to pay for that business lunch, might you have to log into your bank account?
In the perfomance of this work-related duty, is it fair that the network admin for your company now has your bank id and password, which would allow him, if he liked, to take your life savings and those of fellow employees who did the same, then run to Aruba?
Keystroke logging records passwords. No matter how scrupulous you are about not discussing your sex life on work time, any non-work passwords must remain sacrosanct. Keystroke logging goes over the line.
By no means should anyone think that keylogging is an "objective" way of measuring performance. Because employee A takes care of all her work and has some free time so she gets online and chats on IRC and employee B spends all day working on the same issues (and still doesn't get them fixed), employee B is not more productive then employee A.
We need to understand that a productive worker is one who makes sure the job is done, and it doesn't matter what he or she does in their downtime. Want to measure the productivity of the tech at the library? Are the computers he is responsible for functioning properly? If yes, he is a productive worker. If it seems like he has too much free time, give him more resposibility. If he struggles with it, can him or lighten his workload.
The Internet is generally stupid