In EU, Internet Use From Work May Be Protected

athloi wrote with a link to an Ars Technica article on a case involving the right to privacy on the internet. "A Welsh university employee has successfully sued the UK government in the EU court of human rights over monitoring of her personal internet use from work. According to the complaint, the woman's e-mail, phone, Internet, and fax usage were all monitored by the Deputy Principal (DP) of the college, who appears to have taken a sharp dislike to her. The woman claimed that her human rights were being abused, and pointed specifically to Article 8 of the European Convention on Human Rights, which governs private and family life." The courts agreed; despite a lack of a notion of 'privacy' in English law, the EU convention forced their hand. The ruling doesn't try to dissuade employers from monitoring employees, but does encourage them to inform employees about surveillance.

Comments

I for one

[Bloke down the pub]

I for one am welcoming our new internet monitoring overlords, isnit.

Re:I for one

[Anonymous Coward]

We know you are. Now get back to work, or you're fired!

Re:I for one

[Anonymous Coward]

Shut it you bluddy saesneg, or it's over there I'll come and bloody whack you one, lookyou.

What companies don't tell you they are watching?

[Realistic_Dragon]

I have never worked at a place that didn't have an AUP that wen't roughly along the lines of:

Do anything that would get us sued and you will be fired. Don't do your job and you will be fired.

Since the former covers porn (respect at work acts) and the latter covers goofing off all day, unless you happen to be so good at your job that you can still manage to get everything done *and* goof off, then all eventualities are covered.

Uh.. I thought that was the law.

[tecker]

I thought that when you began monitoring someone you were to inform them that there was a chance that they could be under monitoring or could at any time be monitored.

Eh. What do I know. I signed up for a monitoring service when I entered my college Dorm and brought my computer to "Operation (screw over you) PC" on move in day.

Different society, same problem

[redelm]

The Eu directives are quite stark and member nations can't easily bypass them. Or at least, not without consequences of appearing to throw out the whole union.

In this case, the snooping would appear to be more than warrented by employee productivity or asset/network integrity. Very targetted, and unarguably an abuse of employer power. Something dreaded in the EU and prohibited by a whole host of laws.

I would hope that even in the US this sort of inter-personal grudge nursing would be similarly identified as malfeasance. The snoopers boss ought to fire her for abuse of company assets and damage to reputation. Snooping is never free.

Re:Different society, same problem

[Cederic]

I believe there is case law in the UK that you can't fire someone for the same activities accepted as the norm within the company. Or more specifically, if it's quite normal for people to use the phone and email system for private matters, then that ceases to be a sackable offence, even if it's against the defined policy.

I'm sure excessive use would still be an acceptable reason, but that's rather more difficult to prove.

Incidentally, as the article mentioned, the snooping is far from prohibited by law. Indeed, in the UK it's commonplace, and everywhere I've worked has stated clearly that not only the email headers (as in her case) but also the email contents are not private and are subject to monitoring.

I could share war stories, but I'll leave that for the people that actually do monitor email for a living - I just hear these things second-hand.

Re:Different society, same problem

[julesh]

The Eu directives are quite stark and member nations can't easily bypass them

The European Convention on Human Rights is not an EU directive; it is an international treaty governed by the Council of Europe that predates the existence of the EEC by 7 years and the EU by 25 years. There is no requirement that EU members be signatories, AFAIK, although it happens that all of them are (all European countries other than Belarus are).

Re:What companies don't tell you they are watching

[mungtor]

The company I work for now has no AUP. None at all. I think it's insane, but they don't see the value in it.

However, anything you do using your employer's equipment using services paid for by your employer is audit-able by your employer. Should not be a surprise.

I suspect there's more to this. Most likely she's one of those people who spends most of her day on IM and making personal phone calls instead of doing her job. Or posting /.

Trolling headline

[Red Flayer]

FTA:

Because the woman had not been warned that she might be monitored at work, she had a "reasonable expectation as to the privacy of calls made from her work telephone." Internet usage received the same protection. In 2000, the UK did pass legislation that gave businesses certain rights with which they could monitor the e-mail and phone usage of their employees, but the law had not come into force when the surveillance in question took place.

Sure, getting people to read article/comments is important, but perhaps a little accuracy in headlines is appropriate?

It is still quite legal for an employer in the EU to declare that its computers, phones, etc are for business use only, and that correspondence will be monitored. This does not contravene Article 8, since only *private* correspondence is protected by Article 8; use of company machines for correspondence therefore makes such correspondence not private.

Re:Trolling headline

[gbjbaanb]

I think most terms of employment make this clear (somewhere in the 50-page employee handbook :) ) that the facilities provided by the company for you to perform your work on may be monitored at any time. If not, remember to put one in yours if you ever start a company or you may end up paying someone to surf porn all day.

Re:Trolling headline

[Red Flayer]

I wondered how many dorks were going to pick up on the fact that what she was doing isn't private given that everything she's using is the company's.

Actually, at the time of the monitoring, the court found she did have a reasonable expectation of privacy, since then-current law and lack of disclosure of monitoring gave her no reason to believe that private correspondence was not allowed.

Re:Trolling headline

[Anonymous Brave Guy]

It is still quite legal for an employer in the EU to declare that its computers, phones, etc are for business use only, and that correspondence will be monitored.

That's a very bold statement. Care to back it up with sources?

We should also note that there is a difference between monitoring and intercepting communications. In essence, the former is looking at things like where an e-mail going from and to or the addresses of web sites visited, while the latter involves observing the content. This ruling seems to refer only to monitoring communications.

For those who are interested in the UK, the Information Commissioner's Office publish a rather detailed Employment Practices Code (caution: large PDF) that gives a lot of guidance to employers on the relevant laws and guidelines. The topic of intercepting electronic communications such as phones and e-mail is covered in a fair bit of detail.

Re:Trolling headline

[jez9999]

You shouldn't really need to monitor their browsing/e-mail unless they're not getting the results required. I'm a strong believe that employees should be judged on what they achieve, not how they achieve it. If they can view port 80% of the day and be acceptably productive, so be it.

Re:Trolling headline

[zippthorne]

But the court is wrong. At least in any reasonable, non-lawyer, interpretation of the law. The Company has a reasonable expectation that its equipment is used for company use, up to and including monitoring that equipment. She should've assumed that unless given explicit permission to use that equipment for personal use that it was not allowed, and potentially monitored.

Re:Trolling headline

[yuna49]

We should also note that there is a difference between monitoring and intercepting communications. In essence, the former is looking at things like where an e-mail going from and to or the addresses of web sites visited, while the latter involves observing the content. This ruling seems to refer only to monitoring communications.

The article explicitly states that this is precisely what happened. The contents of her communications were not monitored, but their destinations (telephone numbers, web sites, etc.) I know people on Slashdot don't like to hear this, but I don't have any problem with this at all. People working on their employer's premises using their employer's systems should not have free rein to surf to their hearts' content, chat with dozens of friends on IM, or send emails to all their closest friends. Now most employers I work with tend to ignore such activities when it doesn't interfere with working or put the employers at risk. On the other hand, one of my clients recently fired someone who worked the night shift and spent his time downloading porn onto one of the machines in the office. I have no sympathy for such people.

Re:Trolling headline

[Fred_A]

Not in Europe, sorry. Even in the UK it's not an Orwellian society yet.

Re:Trolling headline

[zippthorne]

You've got some weird views about property rights if you think employees should have a right to use company resources for personal use.

Re:Trolling headline

[McDutchie]

American fundamentalism about "property", especially property of corporations, is just one reason why I'm mighty glad I don't have to live there.

Re:Trolling headline

[zippthorne]

Funny, I'm glad you don't live here for exactly the same reason...

Re:Trolling headline

[fyngyrz]

I have no sympathy for such people.

I, on the other hand, have no sympathy for people who view porn as some kind of unnatural interest, somehow lower than, for instance, an interest in needlepoint or mythology.

It is highly unfortunate that the socially retarded contingent that fears and attempts to regulate sexuality has managed to get their attitudes enshrined into law in many venues. Just one more despicable aspect of mommy-style government.

Re:Trolling headline

[Red Flayer]

You've got some weird views about property rights, too. Even in the US, unless an employee is informed that there is no expectation of privacy, then the expectation of privacy exists.

Not all employers are as hard-nodsed as they get, some have even found that it pays off to let employees use company property for personal use. That is, of course, until they get burned in a liability case.

Re:Trolling headline

[a.d.trick]

I wondered how many dorks were going to pick up on the fact that what she was doing isn't private given that everything she's using is the company's.

When I go to the bathroom, I'm using the company's facilities; but that doesn't give them the right to invade my privacy while I'm doing my "business".

Re:Trolling headline

[zippthorne]

That's perfectly alright. It's just that the employee shouldn't expect to use company equipment unmonitored or for personal use unless explicitly stated by the company. Well, except for the lavatory of course, but any code for determining the morality of a situation should be able to differentiate between the restroom and a tabulating machine.

Re:Trolling headline

[Red Flayer]

I'm not sure we'll ever come to agree on this, but:

It's just that the employee shouldn't expect to use company equipment unmonitored or for personal use unless explicitly stated by the company.

I think there's some cultural conditioning there. Legally, the opposite is true -- we've just come to accept that almost all employers explicitly disallow it.

Re:Trolling headline

[zippthorne]

It all comes down to who funds the companies. If you believe question mark guy on late night TV, who wants to find "free money" for you to get a degree, or a GED, or work on your invention! then I suppose you have a point. In any society where property rights mean something, you have to be able to distinguish between what belongs to the company and what belongs to the employee. By definition, it doesn't belong to the company if the company cannot decide how it is to be used.\

Frankly, I find any assertion that using company resources for non-company related tasks without specific approval to be somewhat vile. I consider it akin to theft. I understand that some people might want to watch pornography, download "free" music, and browse slashdot on the company dime, but that doesn't mean you should assume you can simply because the company hasn't thought to tell you you can't. I'm suggesting that the assumption should be the other way, regardless of what the law says right now.

Re:Trolling headline

[Cederic]

If they view something that can be interpreted as sexually, racially, or some otherly discriminatory then anybody else seeing it on their screen can raise a grievance about it.

If they're doing non-work things for 80% of the day then unless they're a security guard sat a desk waiting for someone to break in then they're highly unlikely to be acceptably productive. They may have completed all the work, they may do as much work as their colleagues, but if they're that good, give them more work to do.

Finally, monitoring tends not to be on a per-individual basis unless/until that individual draws attention to themselves. High bandwidth use is picked up and identified as a cost saving opportunity, abusive emails may be flagged by keyword tracking and investigated, many companies have a flat 'no online gambling at work' rule so visiting casino sites draws immediate ire. All these things involve monitoring but aren't initially targeted at any specific individual.

Re:Trolling headline

[polar red]

This type off comment makes me pissed off ! You are NOT payed enough to be considered a SLAVE. If you are doing your job fine, then the company shouldn't be able to consider you a criminal.

Re:Trolling headline

[VON-MAN]

Bah, and you actually give the impression you haven't read the article. Because, you entirely seem to miss these important details (FTA):

"According to the complaint, the woman's e-mail, phone, Internet, and fax usage were all monitored by the Deputy Principal (DP) of the college, who appears to have taken a sharp dislike to her."

And:

"The woman alleged that the DP began a campaign back in 1999 to discredit her. This campaign involved phone calls to numbers that the applicant had called in an attempt to find out who she had been speaking with, and apparently extended even to reading faxes that she sent to her solicitors from the office."

So that is very different from "only monitoring communications", as you claim the article "explicitly states". The big, obvious, difference here is, that the deputy general singled out this woman for his campaign, which (if i read the article correctly) might have taken quite a while.

"I know people on Slashdot don't like to hear this, but I don't have any problem with this at all."
Sure, but I have a problem with people not reading the article and then posting strong opinions about it, not with strong opinions.

Re:Trolling headline

[Bloke down the pub]

My understanding is that they could have monitored her if they'd notified her. A technicality perhaps, but that's how it works.

Reading between the lines it seems the supervisor had some kind of grudge against her. Maybe this was the right result, even if the reason's wrong.

Re:Trolling headline

[gbjbaanb]

they may do as much work as their colleagues,

I think that measuring an employee's productivity against their peers is a bad idea in this instance - if the employee is goofing off 80% of the day, yet still keeping up with the colleagues, then there's a very good chance that they are also goofing off all the time too!

Re:Trolling headline

[VON-MAN]

Uncredibly, you used the word "reasonable" twice and don't seem to understand what it means.

So, i'll explain. Reasonable means that the woman (of course) was allowed to phone home and stuff, using company (or in this case university) equipment. And reasonable also means that other employees don't go redialing phonenumbers you just called to check upon them. And reading other peoples' faxes usually is called unreasonable.


On a sidenote, to me this really jumped out:
"But the court is wrong. At least in any reasonable, non-lawyer, interpretation of the law."
Are there maybe words for this kind of interpretation of the law? As in vigilante law?

Re:Trolling headline

[Anonymous Coward]

If I do the work I'm expected to (as much as my colleagues) in less time than them,
why should I be punished by having to do more than them?

(For the good of the company and thus theoretically myself, of course. But that doesn't stop it from feeling like punishment for being fast.)

Re:Trolling headline

[OriginalArlen]

You shouldn't really need to monitor their browsing/e-mail unless they're not getting the results required. What about filtering mail for spam and malware? What about filtering HTTP for malware and other badness, come to that? This (the scenario in the article) is a corner-case, in that someone was clearly going out of their way to breach another individual's privacy. It remains to be seen which way the courts will jump on mass surveillance of everyone, disclosed in Ts& Cs, and where it's done by automated systems rather than humans.

Do you have a "reasonable expectation of privacy" when using work email for personal use, even though your employment contract specifically says you may be monitored? Apparently the answer is YES in some EU countries (notably,m Germany and Switzerland.)

Re:Trolling headline

[shutdown -p now]

if they're that good, give them more work to do.

I think there are words "and raise their pay" missing from that sentence of yours somewhere. Otherwise why should they do more work?

Re:Trolling headline

[Anonymous Brave Guy]

I know people on Slashdot don't like to hear this, but I don't have any problem with this at all. People working on their employer's premises using their employer's systems should not have free rein to surf to their hearts' content, chat with dozens of friends on IM, or send emails to all their closest friends.

Perhaps not, but you imply a black and white classification where no shades of grey exist. There are options in between people freeloading all day and people having no access. For example, if I telephone my bank (a call I can only make during working hours) from work then I do not expect my employer to object, and I certainly do not expect them to log any passcodes or similar I have to type into the phone keypad to use the service. The same applies, for exactly the same reasons, if I visit the web site of a financial services provider during my lunch hour. One can make similar cases for dealing with health organisations, making urgent arrangements for dependents, dealing with legal representatives while moving house, and countless other areas.

Such use of office communications facilities is not only reasonable and occasionally necessary for the average person, it is also fundamentally private and something my employer has no need to know. Now, perhaps to you business is a 100% commitment, but to me, employees are still humans rather than robots, and the law should require that businesses acknowledge this.

Re:Trolling headline

[julesh]

If they can view port 80% of the day and be acceptably productive, so be it.

Viewing it isn't the problem. It's if they start drinking it you need to worry about them.

Hmmm

[emor8t]

Part of me says employers shouldnt be able to watch employees internet actions for this very reason (targeting specific employees) The other part of me says, if your that worried about it, why are you doing it at work?

Re:Hmmm

[HomelessInLaJolla]

The point is that, if a person in a priveleged position takes an interest (with whatever motive) in a subordinate employee, the very ability to monitor their computer usage at a near moment-by-moment screencap level is separated from aggravated stalking by nothing more than the definition of the law with respect to employer-employee relationships. Being able to spy on an employee, even if they know you are spying on them, gives the aggressor an enormous advantage should they have an interest in manipulating the target--for love, money, lu5t, political position, social control, or whatever other motive.

I have no problem with my employer monitoring internet usage to make certain that I'm not sabotaging the business. At the same time I think there is a reasonable expectation that no one employee is monitored any more closely or hounded any more severely than any other employee. With the way AUPs and employee agreements are currently written (completely one-sided) one can be working in an environment where 4 hours of casual use/day is allowed but woe to the one employee who is targetted should they check their e-mail even once.

Giving free reign to employers to selectively enforce a zero-tolerance policy justified by any arbitrary excuse is a recipe, an open invitation even, for abuse--to the level which would be considered aggravated stalking in any other environment.

Re:Hmmm

[iminplaya]

In my dream world a well organized work force will dispatch the problem quite swiftly. In the real world the fight will drag on with uncertain results.

Re:Hmmm

[gideon85]

The whole issue being brought forth by this posting is private rights versus public rights specifically business and job related. When you are at work what you do, say, and how you act all impact you. Without businesses being able to monitor employees they couldn't protect their rights properly and since your supposed to be a fundamentally good employee anyways you should want your business to be able to protect itself. I have worked for a huge corporation and everything I did at my workstation was monitored and stored and I was aware of this. However, it never bothered me or made me give my work a second thought because I WAS ALWAYS DOING MY JOB. The people that worry about these things are the people surfing porn 8 hours a day and getting payed for it. I do agree that monitoring of peoples home and personal use of the internet is a bit much. Just look at some things that have happened; the teacher that had nude pics posted got fired from her job (pics were posted publicly for all to see though), the man who sent his video resume and it got e-mailed all around the big law firms for a joke and he sued (this still applies because it is an issue of privacy), and finally the man who had the facebook account and got fired for some inappropriate material displayed on his account. All these acts make you question how much of you is actually judged by work? The anwser is every part of you. These people want to know what you do in your spare time, sometimes those things speak to people's character. Bottom line sum up is when your at work you should act accordingly, when at home you should still maintain some restraint for your sakes, however if someone is attempting to blackmail or "force your hand" with this information that is illegal; and you can simply take the offensive, unless you were doing something you shouldn't have in the first place.

Re:Hmmm

[Anonymous Coward]

Take a look for yourselves, the deeper you dig in this guy's profile, the more apparent it becomes that he is a troll.

Whoo Hoo

[insanemime]

Score one for our "surfing porn at work" bothers and sisters!

Re:Whoo Hoo

[merikari]

Never really understood this whole "surfing pr0n at work". What's the point? Is it the thrill of possibly getting caught or what?

Re:Whoo Hoo

[fyngyrz]

What is the point? Seriously? Well, do your hormones turn off at work? If so, how do you accomplish this? If not, well then, you should understand the point. People indulge in sexuality all the time at work. They stare at each other, they think sexual things, they date each other, they cop feels, they occasionally retire to the stockroom or home or a motel and relieve each other's tensions. They meet, they date, they swap around, they marry. All perfectly OK. And so on. Porn is just one vector of sexual interest, and like most other vectors, it is in no way a "bad" thing unless you get maniacal about it to the detriment of your other goals and responsibilities in life. The attempt to sterilize the office / work environment of sexuality is a social sickness, one we can lay the responsibility for directly at the feet of the mentally unsavory.

Proper corporate policy: "Sex on your monitor is perfectly OK. Unless you fall off."

Re:Whoo Hoo

[merikari]

No my hormones do not turn off at work. And of course sexuality is perfectly ok at work. However, surfing for porn at work is just something I have never understood. If you cannot wait until you "get off" from work to surf porn, I think you should really meet some people instead of drooling over the monitor in your cubicle.

And as a corporate policy there are a few reasons why surfing for porn should not be allowed. The most important of which is that most p0rn sites are full of malicious scripts.

Maybe I just have more important things "at hand".

Re:Whoo Hoo

[fyngyrz]

However, surfing for porn at work is just something I have never understood. If you cannot wait until you "get off" from work to surf porn, I think you should really meet some people instead of drooling over the monitor in your cubicle.

Lady at work used to send me really funny porn pics; a lady with an n-gauge train driving up her coochie; a lobster (no, really) half-inserted, claws out, a coochie made up to look like two lips, smoking a cigarette - probably 30-40 of these pics, arriving sort of randomly attached to various emails over quite a few months. Same person joined my martial arts class and one day she retired to the back of the room during a workout, citing a headache. At a later break in the class (I work them very hard, so they need recovery time), I walked back to check on her and asked her, "how's your head?", and she said "I've never had any complaints...", deadpan. We've been a couple for over a decade now, and she's a black belt as are two of her three sons. Hooray for porn at work, sexuality at work and in class, and boo to anyone who thinks repression is the way to go.

And as a corporate policy there are a few reasons why surfing for porn should not be allowed. The most important of which is that most p0rn sites are full of malicious scripts.

Not a problem here. We only use Macs and linux. So no reason for such a policy. Such malware is a Windows problem (and Windows is a corporate problem - best thing we ever did was to get rid of it entirely as a working environment. Windows only runs at the hands of our engineers, in non-networked sandboxes on Macs, as a testbed for bug reports on our legacy Windows products.)

Maybe I just have more important things "at hand".

You have more important things on your mind than sexuality? Are you really old? Or crippled? Or in jail? :-)

Re:Whoo Hoo

[merikari]

You have more important things on your mind than sexuality? Are you really old? Or crippled? Or in jail? :-)

I was not talking about sexuality in general. As I mentioned, sexuality is ok at workplace, but I do have more important things to do than watching porn at work.

She used employer provided electricity

[140Mandak262Jamuna]

She should have faxed some electricity before going to work.

Re:She used employer provided electricity

[Anonymous Coward]

Oh, ghod, that stands out as a geeky joke even here!

Of course there aren't any line powered fax machines, not that that matters.

Re:She used employer provided electricity

[140Mandak262Jamuna]

Credit goes to Scott Adams. I dont have the strip saved. The pointy haired boss yells at Dilbert for surfing the net at work. Dilbert says it was his lunch time and points out that his surfing does not cost the company anything. Boss says, "But you used company provided electricity!". Dilbert says, "I faxed myself some electricity from home". Dont know how many know Dilbert strips to this level of detail.

Re:What companies don't tell you they are watching

[gurps_npc]

Note, I, and many of us here, are in fact so good that we can still manage to get everything done and still goof off.

Otherwise, we would not have time to post at Slashdot during the day.

Just turn it off

[Orig_Club_Soda]

Most people dont need web browsing. Just turn it of. Turn off everything but email and IM.

Re:Just turn it off

[Anonymous Coward]

Employees *need* IM?

Re:Just turn it off

[Sobrique]

Actually I've found that IM can be an extremely valuable communications tool, when working in a mobile/distributed workplace. Email/telephone are good, but IM is a really excellent substitute for the 'hey $name, which server was it that went baffy last night?' that you'd ask across the office.

Anyone who says that communication isn't vitally important in teamwork is in all ways wrong, and IM is just as effective a tool as business commmunications as it is for personal commmunications. The only downside is 'personal use' but frankly that's _always_ going to happen. I reckon every employer should include a 'don't take the piss' clause in AUPs and that'd be fine :)

Re:Just turn it off

[Orig_Club_Soda]

I wouldn't say IM is any less necessary than email access.

IM is very useful with or without telephone conversations because data and reference material can be shared without the recipient having to try to transcribe the information into notes. Communication over distance is made "local". Unlike email, IM is rather instantaneous as if speaking through a cube wall.

Privacy in the workplace?

[Anonymous Coward]

Isn't this more of a case of a woman being harassed or stalked rather than having her "privacy" invaded?

How can you have any expectation of privacy when using company resources to have your private communications? Just step out of the work place, use your private cell phone, and conduct your private business.

Re:Privacy in the workplace?

[hey!]

Privacy is extraordinarily poorly defined for something we value so much.

There is information privacy; things about you that you just don't want known. There is decisional privacy; decisions that are yours to make (e.g. US court reasoning in Roe v. Wade and other "substantive due process" cases). I think many people experience spam and pop ups as a kind of privacy issue; you might call it "attentional" privacy -- the right to focus on what you want to focus upon. While you have no right to keep your movements in public places secret, it doesn't mean people can intrude on your going about your business.

I have read a number of philosophical papers on privacy, many of which raise interesting points. But of all the one who came closest to getting it right in my opinion was Justice Brandeis who famously defined privacy as the "right to be left alone".

All privacy concerns at their root entail the ability of the individual to maintain his autonomy and separateness from the group. It may even be the right of the small group to maintain its autonomy in the face of the larger group. Brandeis errs in one respect: we often don't want to be left alone, we want to be involved with other people. We just want to have a fair and equal role in setting out the terms of involvement.

The issues we label as "privacy" are closely related to the idea of "liberty". We cannot have liberty without enjoying at least some minimal level of privacy.

I have proposed the following definition of privacy: Privacy is the right to be free of unreasonable involvement in your affairs by others. "Reasonable" means that which is rationally necessary to your relationship with the outside party.

Legal thinking places too much emphasis on the nature of the information involved, whereas what actually matters is how the information is used, and its effects both intended and unintended. This is a particular problem in US law, which depends on an artificial and subjective distinction between private and non-private information. This often leaves us in the logically inconsistent position of having to admit that certain actions are objectionable and unjust towards an individual, but asserting that nonetheless none of his rights are violated.

For example, if the AUP of your work place says you may not use the web for private use, and, with advanced informed consent your web browsing history is examined for non-work uses, that is not an invasion of privacy. It is rationally necessary to do so to carry out a prior agreement. If a supervisor uses the same sources of information in order to stalk or coerce a subordinate, that is an invasion of privacy, even though we are talking about disclosure of the very same information to the very same person. However, in such a case the supervisor might well claim that the individual had neither a legal right to privacy nor an expectation of privacy.

While the "expectation of privacy" test is very useful in flagging actions that violate norms of behavior with regard to privacy rights, it doesn't really capture the interests of the individual that are at stake. Equally bad, it does not establish the rights of others in the face of an individual who wishes to assert a privacy interest. The "expectations" test has no real fundamental justification, in fact it is not entirely clear what the phrase means. Can the police put cameras in everybody's house and say, "There, nobody expects to have privacy any more?" Does "expectation mean the expectations we ought to have if everything was just, or the expectations we do have in light of what people happen to be doing? Or (as seems to be the case) a mixture of both?

Re:Privacy in the workplace?

[Anonymous Coward]

Contrary to the believe of several people on slashdot, privacy is commonly not considered as "within your own four walls", but (paraphrased from M-W) usually "freedom from unauthorised instrusion one's right of being apart from company or observation".
Hence, stalking is a form "... of invasion of a person's privacy in a manner that causes fear to its target..." source.

The rules simply judged, that employers are not automatically authorised to monitor their employees.

Re:Privacy in the workplace?

[Fred_A]

How can you have any expectation of privacy when using company resources to have your private communications? Just step out of the work place, use your private cell phone, and conduct your private business.

Not to mention that she was already using company oxygen to fuel her private thoughts, what a petty thief !

The European outlook on this kind of thing is very different from the US one. People here are actually allowed to be called at the office or to call home (or wherever) every now and then as long as they don't spend all day doing it. The idea is that companies don't want to completely alienate the people who work in their offices. Reaching a sane equilibrium is in the best interest of everybody. I regularly send personal emails to business addresses and nobody cares. OTOH I don't send multi megabyte archives of my vacation pictures there.

Places that have full restrictions on phone/mail use are pretty much unheard of in Europe. Of course users can't install software anywhere any more but that's basic IT security nowadays.

Why is there no policy covering this?

[RESPAWN]

What I don't understand is why this university doesn't have a policy to cover this sort of monitoring. Most places that I have worked have had a policy that specifically states that the employee's use of corporate communication assets can and will be monitored, and the employee has to sign stating he read this policy. Basically, it's the company's way of covering their arses. Granted, the actions supposedly took place in 1999 and I am too young to comment on the state of corporate communication policies in 1999, but I would think it would have been naieve for any business entity not to have covered themselves legally with some sort of "you might be watched" policy.

That said, if the university didn't have such a policy, then I don't see a problem with the woman suing. Especially in light of the fact that the person monitoring her actions went so far as to call back numbers she had previously called to see who she was calling.

Anyway, lawsuits like these are why companies today have aceptable use policies.

Re:Why is there no policy covering this?

[Husgaard]

Please note that the ruling here is based on human rights. For some reason (left as an exercise to the reader), you cannot sign away your human rights.

So a "you might be watched" policy would not help here, even if signed by the employee. The European Court of Human Rights would simply throw out suct a contract as illegal.

But it might be possible to have a policy saying that the employee must not have private communications or do anything private on the employer's computers and network. This way the employer can monitor under the assumption that nothing private will be found. I would however be very surprised if such a policy could be implemented at an university.

Re:Why is there no policy covering this?

[Anonymous Brave Guy]

Anyway, lawsuits like these are why companies today have aceptable use policies.

Which are worth very little if the employee is found not to have agreed to them willingly (e.g., because they were part of an employment contract and the employer and employee did not have equal bargaining power in its negotiation) and even less if they are found to contravene the employee's inalienable human rights (as was the case here).

Remember, boys and girls: just because you say something in a contract, that doesn't mean it will stand up in court, particularly if what you're saying is an obvious attempt to screw the other party in an unreasonable way.

Re:Why is there no policy covering this?

[Kijori]

While you can't sign away your human rights, that isn't the issue here - the article only covers communications with a reasonable expectation of privacy, so signing a declaration of consent to monitoring would render the article impotent.

Re:Why is there no policy covering this?

[RESPAWN]

While I understand that you can't sign away your human rights, I took the article to mean, that the complaint was that she was unaware that she was being monitored. I think the court may have ruled differently had she been appraised of the fact that her communications were being monitored. It would be nice to think that one could do whatever they wish from their computer at work without fear of reprisal, but I have a hard time seeing that ever happening. (Nor should it, the computer is owned by the company and, as such, should not be abused like any other company resource.)

Re:Why is there no policy covering this?

[RESPAWN]

My cynical nature chooses to believe that US courts would not decide in this way. A prospective employee always has the option not to take a job, should he not agree with an AUP. In a sense, that option could be construed by the courts as the employee's bargaining power. If the corporation wanted the employee bad enough, they could always attempt to waive the AUP. I have yet to see a prospective employee challange one, though. I would really like to see it happen, but I think it would be a losing battle for the employee.

Re:Why is there no policy covering this?

[cdrguru]

Remember, you are being screwed by having a job - you are being paid to work at someone else's direction and for their benefit. Obviously, this is interfereing with your freedom and should not be tolerated.

I certainly would not want anyone working for me that felt oppressed and screwed. They can leave anytime they want. And just feeling oppressed and/or screwed "by the man" is grounds for termination.

You are either going to be a slave (employee) or you are going to be a free man. Choose.

Re:Why is there no policy covering this?

[Anonymous Brave Guy]

You might be right. I don't know enough about US employment law to even take a guess. But remember that the general framework for employment in the US is very different to the EU (at least for most US states vs. most EU nations). For example, in the US employment is mostly "at will", whereas in the EU, notice is normally required from both employee and employer if they want to terminate the employment contract. That alone makes employment a bigger commitment by both parties than it would be in an "at will" state.

Re:Why is there no policy covering this?

[RESPAWN]

For example, in the US employment is mostly "at will", whereas in the EU, notice is normally required from both employee and employer if they want to terminate the employment contract. That's not necessarily a bad thing for the employee. That would at least provide some measure of job security for the employee. In the US, I think it's generally just considered courtesy to give notice. At a prior job, I received approximately 2 months notification that my job was being outsourced. While still scary, it was nice to know that I had at least some time to begin hunting for jobs. That said, I've had friends walk in to work one day, be sat down, and summarily be "let go" with no clue that it was going to happen. Sure, they usually received a severance package, but not always, and that doesn't really make it any easier for my friend. Does the EU also have any laws regarding severance packages and whether or not they are required?

Re:Why is there no policy covering this?

[Anonymous Brave Guy]

I'm not aware of anything EU-wide regarding severance packages, though I'm not an expert on this subject so that doesn't mean there isn't anything. However, individual countries often have their own laws in this area.

In the UK, for example, employers have to be careful that they have legitimate legal grounds to fire someone, such as genuine redundancy. An employer can't just let someone go because they don't like them; if they do, they can be called before a tribunal. In any case, there is a certain amount of redundancy pay required. Typically in the UK, the amounts of money involved with either redundancy or a tribunal award aren't worth much to those in the better paid professions, but they can provide a worthwhile safety net to those at the lower end of the salary spectrum.

Of course, if a business that works in something like software development gets a reputation for being a bad employer, the financial cost is the least of their worries. It is a small world, and if you live in a high-tech city as I do, one bad mistake where staff are treated unreasonably can be enough to pretty much turn your reputation to mud within days. Good luck getting any really good people to work for you after that...

Re:Why is there no policy covering this?

[Anonymous Brave Guy]

Sorry, hit the wrong button while previewing and posted before I was done. I meant to conclude by saying that because of the reputation issue, in practice many employers have redundancy policies that are far more generous to staff than the legally required minimum. Something like a week's salary for every year of service, with a minimum of four weeks, is pretty typical in the software development world. This is usually in addition to any statutory or contractual notice period, during which the employee must still be paid as normal even if they are sent home on garden leave after they've been given their notice.

This is not an EU convention

[Husgaard]

Just to set things straight: The European Convention on Human Rights is not an EU convention as the summary says. The European Convention on Human Rights is a lot older than the EU, and a lot of non-EU countries are bound by it.

And in case you wonder why we have a special european human rights convention when we already have the UN Universal Declaration of Human Rights: This is similar, but goes a bit further in the areas where it was impossible to gain international concensus in the UN in 1948. For example, see article 8 in the european human rights

Article 8 - Right to respect for private and family life1

1. Everyone has the right to respect for his private and family life, his home and his correspondence.
2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.

and compare this to the corresponding article in the UN human rights:

Article 12. No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks.

Re:This is not an EU convention

[arivanov]

You missed to state one more point.

The current UK government loves to wave articles of the convention at random so you cannot rely on this convention as being useable. Oh we do not like this one, that one and that one. We shall not be bound by them regardless of the fact that we have ratified it. Human rights Antonio Bliar style at your service.

Not that the Tories are any better as there was a point where they had leaving the convention as a part of their pre-election propaganda (not that this helped them with getting anywhere).

So unfortunately this convention is used in the UK where it does not really matter that much. Where it matters and where it sets the actual moral standard of what is right and what is wrong the current UK govt has roughly the level of respect to it that the talebans had to historical monuments and human rights.

Re:This is not an EU convention

[Klaus_1250]

Not sure whether to laugh or cry. Article 8 section 2 names just about every excuse a "public authority" can have to arbitrary remove and infringe upon basic human rights.

Re:This is not an EU convention

[drinkypoo]

I compared the two and came to the conclusion that they say the same thing. The first one says that there shall be no interference except as necessary. The second says that there shall be no arbitrary interference, which I take to mean either "uncontrolled or unrestricted by law" "decided by a judge or arbiter rather than by a law or statute" in this instance. So if you pass a law that says that you can do it... then both permit the same level of bullshit.

Re:What companies don't tell you they are watching

[afidel]

Not only that but Slashdot is actually work related for many of us. I know I was ready for the recent ANI fix because of the article here at slashdot. The MS site didn't really have anything until after the patch was already released.

Re:What companies don't tell you they are watching

[ookabooka]

I have never worked at a place that didn't have an AUP that wen't roughly along the lines of:

Do anything that would get us sued and you will be fired. Don't do your job and you will be fired.

You didn't say anything about them watching you. It's one thing for a company to make that statement, its another for them to monitor every single resource you use (without notifying you) to ensure you are complying with that statement.

Re:What companies don't tell you they are watching

[Anonymous Coward]

Not only that but Slashdot is actually work related for many of us. I know I was ready for the recent ANI fix because of the article here at slashdot.
Reading slashdot for the vunerability announcements is like buying playboy for the articles.

Your thoughts

[HomelessInLaJolla]

What do you perceive to be the problem?

Re:Your thoughts

[iminplaya]

Simply a group of people who seem to be incapable of speaking with one voice. I do accept the premise that when on company time and using company property, you give up many rights you would have at home or on public property. So if the workers want better accommodations, unity is the way to bring it about. The workers, like the customers, have the power to set the rules. I am uncertain as to whether that has occurred to them yet. And it won't matter whose property they're on. The worker simply must state that if the company wishes to use their services, these are the conditions. Presently everything is done precisely backwards. We have given up our authority to the company. We are letting them set the rules. The servant has become the master. The real problem is that they(the workers, all of us actually) put their self interests ahead of the group interests and are so easily distracted by petty, useless things. So what you get is a lot of bickering with few results. It would appear that I'm complaining about nature itself, because I see nothing unnatural here.

Re:Your thoughts

[HomelessInLaJolla]

What you've described is the system of divide and conquer. A group of employees cannot divide and conquer their management as easily as the management can isolate and destroy the lead employees--the rest fall back in line very quickly after watching one or two token sacrifices (which have all the more impact if the best and the brightest are chosen to be the recipients of a brutal demonstration of managerial and corporate authority). All of this is made possible only by ensuring that the company always has control over the resources which the working class need: namely, finances. An $8.8 trillion dollar federal debt which shows no signs of going away does a fantastic job of ensuring that there will perpetually be a significant class of people who are constantly in need of financial resources. Once that $8.8 trillion dollar debt is in place it doesn't take any more than the most rudimentary system of generalized price fixing (on real estate, mortgage, rent, car payment, insurance, pump prices, etc.) to ensure that those people who are currently designated "slave class" will remain, perpetually across generations, as slave class.

The unnatural part comes with the artificial shortage of wealth. There is no shortage of wealth in this nation. Debt is explicitly and artificially created simply as a means of heavy-handed social and political control.

Re:Your thoughts

[Anonymous Coward]

Ah, unionization. Totally the solution to society's ills. Talk about self-interests ahead of group interests and petty, useless things.

Re:Your thoughts

[iminplaya]

A group of employees cannot divide and conquer their management as easily as the management can isolate and destroy the lead employees--the rest fall back in line very quickly after watching one or two token sacrifices...

Yes, that is an easy exploit. Dependence on a single leader is a weakness. It is by the lack of this that some groups are able to survive despite the odds and the opposing strength. The workers need to adopt and be able to continue without the "generals". Seeing a companion go down should strengthen their resolve.

The unnatural part comes with the artificial shortage of wealth.

Yes, in light of the fact that people are capable of producing and transporting anything they need or want, that is absolutely true. But the motivation to create those shortages is quite natural. It's how the alpha male stays in that position and subjugates the others, all the way down to the right to mate. I can't think of any particular instance, but I believe you can find somewhere in the animal world you will find the exact same behavior, where one will hold out on another to get what she wants. Well yeah, the girls aren't THAT easy. No roll in the hay until you build me a nest. While we may be perverted, we are not unnatural. You yourself brought up a really good point about natural defense mechanisms in another post. It was very right on. The exact thing applies here also. "You and me baby, we ain't nuthin' but mammals..."

Where you might have a real problem is that so many people live a very soft life in the city and few of them even see each other, even when they bump into them. The vast majority don't want to make waves. In part because they are so dependent on BIGCO. Hell, I got pretty comfy myself. Now I live much closer to the food and water supply in eternal summer, so it's a bit easier for me to tell them to screw off.

Re:Your thoughts

[HomelessInLaJolla]

the animal world you will find the exact same behavior...I got pretty comfy myself The comfort level is also quite possibly quantifiable and linked to our genetic makeup as animals. In base animals this behavior is regulated such that the lead animals never overexploit their fellow pack members. In humans, with our abstract notion of currency, and the fact that never before in history has our daily life been so easily and thoroughly quantified into money, the overexploitation is carried out through the automated collection of taxes and with almost no resistance at all. An alpha animal cannot subject his fellow animals to slavery. The ruling class in humans, however, can quietly keep us all in financial slavery while rigging together a system large enough to maintain plausible deniability,"It's your own fault."

This guilt trip works wonders in ensuring that the working class is psychologically at a disadvantage in any bargaining position: negotiating working conditions, a raise, a home loan, a car loan, insurance rates, almost everything--including politics.

Re:Your thoughts

[iminplaya]

In base animals this behavior is regulated such that the lead animals never overexploit their fellow pack members.

That is because they are rigidly controlled by their environment. That is no longer true for us. We can produce and transport anything anywhere anytime. That throws a very big wrench in the balance of power and does pervert things a bit. And you pointed out the only real difference between man and beast(I always liked that phrase) that I can think of. Maybe our methods aren't always as similar as the motivations behind them. The billion year old fear of "there's never enough" weighs very heavily.

An alpha animal cannot subject his fellow animals to slavery.

Slavery is a very human conception. If you follow the behavior of the pack, everybody does follow the alpha male's lead, except for the not so occasional challenger. He is the first to eat. He might be the only to get laid. That would really stink in a human society.

This guilt trip works wonders...

You bet it does. But here again, they are exploiting our weakness. We just need to wise up to these age old tricks. It's our defeatism that keeps us where we are today.Defeating them is easy. Convincing your neighbors that not only is it possible, but also very likely that they can win is quite another story, and that's where the real work is. The moment they turn their backs on them, it'll be a walk in the park. So I won't concern myself with who's at the top doing whatnot. My aim is to limit their power and influence. I feel it's more important to focus on the basics of accomplishing that than all the little details of who did what how. It is a given that anybody you put up on that pedestal will act precisely the same way.

What I'm trying to point out, and maybe rather poorly, is that all the things you describe are the result of something else. While most are only looking at the human aspect of it, I'm trying to say it goes much deeper and way beyond than any puny human reasoning which completely fails the test of motivation.

Re:Your thoughts

[HomelessInLaJolla]

all the things you describe are the result of something else Well, yes, of course, but realizing it and acting on that knowledge hasn't doing me much good. =/

In poker, if you call the other player's bluff, they're supposed to show their cards and you win the hand (if it was truly a bluff). In the real world, when you call their bluff, they have you removed from the table, rudely thrown outside (with you money still at the table), and then they continue playing with your money.

Re:What companies don't tell you they are watching

[spun]

Yes, but telling your boss you read slashdot for the vulnerability announcements is in no way like telling your wife you read Playboy for the articles. Your boss will probably believe you.

English law in Wales...

[Anonymous Coward]

English law in Wales... theres the problem.

Hmm...

[Anonymous Coward]

Doesn't every employee handbook basically contain something that says "anything you do at work, using work resources, can be monitored and archived at any time, for any reason, by the company?"

Re:Hmm...

[toriver]

Well, obviously not in this case.

Re:Hmm...

[Anonymous Coward]

Both off you didn't read the article, nor did you read any off the comments above. You must be old here.

Rubbish Management

[Ash Vince]

I have read quite far down the discussion and very few people seem to consider the fact that the manager might be incompetant and stupid.

Normally in business incompetent people reach a point where they fuck up and get fired. Or they fuck up and get demoted, however this was a council.

That means that the manager was probably fairly useless anyway (or she would have got a proper job, not working for a council). On top of this the manager did not run what she was doing past the legal team or the organisations HR officer. If she had we would not be discussing this as it never would have ended in a stupid legal fight which has probably cost the british tax payer (me) more than the pair of them's wages for ten years combined.

The reality is that most councils seem to have a high turnover of high quality staff as the good people leave when they have done enough time for it to look good on their CV. The crap people can't get sacked as nobody ever gets sacked so they just end up in positions of management by default as nobody else wants to stay that long. The manager in question was probably victimising this member of her staff for two reasons:

1) She was too stupid to find something she could sack the employee for.

2) The employee was actually good at her job and was making the manager look bad in comparison.

Re:Rubbish Management

[VON-MAN]

I fully agree. However, in this case the manager fucked up and has since been suspended, heh :-).


OT:

Normally in business incompetent people reach a point where they fuck up and get fired.

I think the Laurence J. Peter said is better: "In a hierarchy every employee tends to rise to his level of incompetence." http://en.wikipedia.org/wiki/Peter_principle

No privacy in British law?

[Anonymous Coward]

despite a lack of a notion of 'privacy' in English law

What does privacy have to do with it? British law is quite explicit on the subject of whether it's legal to monitor people's communications. The much-maligned RIPA begins with the pretty straightforward statement

It shall be an offence for a person intentionally and without lawful authority to intercept, at any place in the United Kingdom, any communication in the course of its transmission by means of (a) a public postal service; or (b) a public telecommunication system.

The said lawful authority can be acquired by ensuring that the person being monitored has given their consent; monitoring without consent is permitted only in very limited cases, such as where the police need to do it to prevent serious crime (and even then, the results are never admissible evidence in court).

I'd say UK law has pretty good privacy provisions compared to, for example, US law, where all your personal data can be sold to anyone who wants it, and the government can tap your phone illegally and nobody even loses their job when they're found out.

You can have both

[houghi]

Forbit your employees the use of the network for private mail. This should not be too hard to enforce. By all means, you can't use the posting service for private use as well.

Then as a nice gesture, you can put some boxen on a seperate subnet for people to use during their lunchtime.

The next thing you can do is make a whitelist. Block all and everything and only allow those sites for those departments/people who actualy need it. Some people might need access to certain sites. Some even to all sites, but the majority does not need interentaccess at all, or only to very few domains.

The way many companies go about it now is by blocking e.g. hotmail. When that happend with us, it took about 10 minutes till everybody had an account somewhere else.

Anyway, I don't care, I just ssh home and run mutt. Andf the times that was not possible, I just waited till I was home and read my mail then. I say, block it. You are on a payroll.

Re:You can have both

[vidarh]

In my case, and this is the case for everyone working for me too, I'm salaried. My work does not pay by the hour. The legal distinction between those two in most places is that a salaried worker need to have reasonable control of their own working schedule, as they bear the responsibility themselves for ensuring their tasks get carried out in a timely manner. That is why salaried workers are generally not entitled to overtime.

If I want a break, I take a break, and I make up for it when I feel more productive. Generally I end up working far more than the hours I am paid for, and the hours I do actually work are more productive than they would have been if I had worked uninterrupted from 9-5 every day.

If you are paid by the hour, then yes, you have an argument. For salaried employees you don't. If your employers can't be trusted to set their own schedule and/or you are unable to follow them up to make sure they do their job, then they shouldn't be given the responsibilities that come with being salaried.

I don't believe in policing much except where we see potential problems. If someones performance is dropping and we suspect it's because they spend excessive time surfing I'd confront them about it, and warn them we might monitor them if things don't improve and they don't have a valid explanation. If we run into bandwidth problems, I'd look at aggregate traffic and determine if there is cause to send out some warnings. We might look at aggregate traffic to make sure people don't do anything really stupid we might get liability for (such doing filesharing from the office network).

That's about where I draw the line. Turning work into prison won't do much good for performance and work satisfaction, and it will give those of your people who can easiest switch jobs an incentive to look for better employers.

Re:You can have both

[houghi]

I have not indended to take away your choice of working hours. If you want to take a 10 minute break each 5 minutes, then please do so. But don't use your working PC for that purpose. Use the PC that is placed somewhere for that purpose.
If you do not use a PC from the company, then most likely you have a portable. Unplug the PC in the 'free surf zone' and plug yours in.

This is not so much about policing your work. This is about standard network security. People can slack work by reading a newspaper as well.

Collective monitoring makes more sense anyway

[Toe, The]

As an IT director, I am responsible for ensuring connectivity and bandwidth for my company. As part of this job function, from time to time, I turn on "monitoring" on my firewall. This doesn't tell me who is doing what... it just tells me what sites are being hit.

This is a great way to do statistical monitoring without intruding on one particular person's privacy. If I notice that more than a little of our traffic is going to MySpace or the porn flavor of the day, I re-send out a reminder of the AUP to all staff. (I also remind people that, with VNC, I can observe their screen directly (not that I would, except for tech support-related issues, but I want them to know that anyone in IT could)). After that, the non-work traffic dwindles to next to nil.

Isn't that a better way of doing it all around?

P.S. FWIW, my firewall is a ZyXel, and that behavior is the default functionality. I would have to install separate software to log what each individual is doing, and... why would I want to? The real issue (at least from an IT perspective) isn't who is abusing company resources... only that the abuse stop.

--
Government of, by, and for ALL the people.

Re:Collective monitoring makes more sense anyway

[MrSteveSD]

After that, the non-work traffic dwindles to next to nil.

No, that's when they grumble under their breath and just plug in their Wifi USB sticks and use a nearby network :) It's not difficult to cut the company out of the loop when you have Wifi access.

There are so many annoying restrictions at work, that a few people I know just take their own laptops. They then just plug in the monitor and keyboard to the laptop so that everything looks normal. I don't really like the idea of people being able to remotely look at my screen. You may as well just put video cameras behind everyone and remind people that "we can switch to your camera at any time". Just because technology makes snooping easier, it doesn't mean we should take advantage of it.

Re:Collective monitoring makes more sense anyway

[Toe, The]

Third-party networking cards and outside laptops are both locked out on my network. It's really easy to do. :)

But on the plus side, I'm hardly draconian about non-work surfing. As long as I have bandwidth to spare, I'd rather my staff be happy than oppressed.

Re:Collective monitoring makes more sense anyway

[scottv67]

There are so many annoying restrictions at work, that a few people I know just take their own laptops.

And if you bring your own laptop, how do you access resources on the corporate network? Please tell me that you're not connecting your network cable to your laptop while your wifi connection is enabled.

Every time that Internet usage monitoring comes up on Slashdot, all the k00l kidz post their solutions for getting around tools like Websense and restrictive firewall policies on outbound traffic. As fun as "pulling one over on The Man" can be, violating the AUP is grounds for termination. Complain all you want about being fired but at the end of the day, you'll still be unemployed.

To head-off the "Oh yeah, I'm tool l33t to work at a square company with draconian fw admins like that dude!" comments, please know that we can't afford to have people like you on the payroll. Your methods of skirting URL filtering and/or firewall policies will get the organization sued, get us into the newspaper or both. We can't afford to have that happen.

I've been there and seen it happen. Once your organization is in the newspaper for something unsavory, that kind of damage to the credibility of the organization is hard to repair. The old saying goes "There's no such thing as bad publicity." Well, there *is* bad publicity and it can be quite costly.

Re:Collective monitoring makes more sense anyway

[Toe, The]

I don't really like the idea of people being able to remotely look at my screen. You may as well just put video cameras behind everyone and remind people that "we can switch to your camera at any time". Just because technology makes snooping easier, it doesn't mean we should take advantage of it.

VNC saves my butt all day long. Instead of schlepping to every computer every time there is a problem, I simply say, "OK, I'm going to look in on your screen now," double-click their name (Apple Remote Desktop is da bomb, in this respect), and take it from there. And no, that's not just me being lazy; it is me being more efficient. I can do more work in a day because of VNC.

And as an interesting aside, my company is all-Mac. All of our new laptops have cameras built right into them. So I have a camera pointing not at their screen, but at their face! To be fair, Apple ties the power to the camera to a LED, so they can tell if the camera is on... and I don't have off-the-shelf tools to hook into that camera, but... it is there. Weird, eh?

To be honest, I'm not sure that privacy and the future are compatible. I have yet to see someone prove to me that privacy can be maintained by other than artificial (ie, legal... and therefore transient) means.

Re:Collective monitoring makes more sense anyway

[vidarh]

A company I did consulting with years ago posted a "top ten" list of sites they considered unsuitable for work ordered by amount of traffic.... It very quickly killed off the porn surfing without even reminding people about any possible consequences, even though the list was completely anonymous and none of the people with access to the firewall data ever tried tracking someone down (to my knowledge anyway).

Human Rights?!?@

[nurb432]

WTF, internet useage at work isnt a 'human right'.. geesh..

Re:Human Rights?!?@

[madcow_bg]

... but privacy is.

Re:Human Rights?!?@

[nurb432]

Not in the workplace its not.

Re:Human Rights?!?@

[91degrees]

Unless we stop being human once we get to the workplace, it is. At least within reason. The exact level of privacy we can expect is a matter of opinion.

Re:Human Rights?!?@

[vidarh]

So I assume it is ok for your manager to insist on cavity searches, and on following you into toilet stalls to monitor what you are doing then?

We all expect some level of privacy even in the workplace, and the question isn't IF privacy is guaranteed in the workplace, but how much. Generally most countries allow quite a lot of monitoring, but very few allow singling out specific employees for harsher treatment or not informing employees of what types of monitoring may be used.

Re:Human Rights?!?@

[VON-MAN]

At the coffee machine:

Employee #1: Damn, that HR. They tortured me all morning over those stupid photocopies.
Employee #2: I warned you about that. Management has been asking questions about all that copypaper.
Employee #1: You did, eh? Well, could you also open the creamer then? They pulled my fingernails.

Re:Human Rights?!?@

[nurb432]

You arent forced to work there. You agree to the treatment.

Some companies do cavity searches.

What if it's the boss?

[Anonymous Coward]

Yeah. My CEO surfs porn all day (no, not kidding). What am I supposed to do about that??

Re:What if it's the boss?

[zippthorne]

Short the company stock?

Re:What if it's the boss?

[Anonymous Coward]

Yeah. My CEO surfs porn all day (no, not kidding). What am I supposed to do about that??

1. Have a good laugh at his goat-fucking predilections.
2. Capture URLs, browse and print them at home, then drop them off in his printer when he's not looking so he thinks he's going crazy and printing them off by accident/Freudian slip.
3. Cap the URLs then rig a system that sends the URLs to his wife/partner via IM. In real-time.
4. Tell him that you've uncovered his surfing habits during a routine log inspection but it's OK cos you're into that stuff too and then show him where the really vile porn can be found.
5. Send him an HTML email loaded with webbugs to really horrible porn, then arrange for another tech to do a "routine" log inspection. Chuckle as the police tell him how Megan's Law is going to be a real big part of his life from now on.

Of course, if you did any of these things (apart from maybe 4) you'd be a bad person. Could you live with yourself?

Whoops

[Toe, The]

I just got fired for reading this article.

:P

Re:What companies don't tell you they are watching

[acidosmosis]

I'm one of those ;-). Although corporate is starting to filter out message boards and sites of that nature. In most of those cases all I have do is hit "continue" to view the site anyway.

I work in IT as a Network Administrator and most of the time I am able to fix what goes wrong in five to 10 minutes while in charge of rougly 200 computers, five server rooms, application servers, support about 160 employees...a lot of the free time I have I spend reading articles online (mainly RSS feeds).

What about harassment?

[Pointy_Hair]

OK.. looks like the privacy issue has been beaten to death. Using company owned equipment for personal business and all that.

As a manager who has to deal with HR/legal considerations, it strikes me that there would be more of a case with a "company policy" only being applied to one person. Every manager has to face a habitual line stepper on their team at least once in their career. The first thing out of HR mouths is always to question whether policy/process is applied uniformly or is singling someone out for corrective action.

Seems like more of a case of employer harassment than a privacy issue.

Obligatory

[Anonymous Coward]

In Soviet Union, Work May Be Protected From Internet Use!

Re:Obligatory

[renegadesx]

No, In Soviet Russia, Work from Internet Use protects YOU!

Re:What companies don't tell you they are watching

[DarkDaimon]

Reading slashdot for the vunerability announcements is like buying playboy for the articles. Shhhh! My boss is watching.

Good and Bad

[JackMeyhoff]

Now companies will want a COMPLETE BAN for fear of being sued.

semi-offtopic aside on language

[drinkypoo]

In this case, the snooping would appear to be more than warrented by employee productivity or asset/network integrity.

First, s/warrented/warranted/

But that's a minor nit. What I am actually writing to complain about :) is the use of the phrase "more than warranted". In English this means that it is not just warranted, but completely warranted. (And in English, these phrases mean different things!) The phrase you want is "more than is warranted".

HTH, HAND.

In 5 years this will all be solved...

[stud9920]

...when everyone will be permanently connected to cheap internet with affordable subnotebooks.

Try 2 months...

[Anonymous Coward]

...when the iPhone comes out. :)

Re:Try 2 months...

[stud9920]

The iPhone will take more time to become popular than the iPod did

Re:Try 2 months...

[Anonymous Coward]

Only time will tell, but... you are SO wrong.

Screwed if you do... Screwed if you don't...

[RexRhino]

I understand that in this case it was a University... but the decision applies to all employers, public or private. What the courts have created is a situation where a company can't possibly avoid being the bad guy.

The courts have ruled that companies are responsible for the actions that their employees take with company resources... That if an employee uses the company email to send out harrassing messages, for example, even if the company did not authorize it and even if the company punished the behavior, the company would still be liable because they have an obligation to police their own resources to prevent such things.

On the other hand, if the company actually tries to police their own resources, that is a "violation of human rights", and they can be held liable for that too.

Don't worry folks, there is a solution... Move the office to a country where the legal system isn't structured into a catch-22 designed to destroy everyone. I am sure you don't have to worry about that kind of stuff if you open an office in India and China. China might be a police state, but unlike England they aren't a self-destructive police state... they aren't going to police away their own economic base.

Re:Screwed if you do... Screwed if you don't...

[VON-MAN]

You _really_ should read the article, before you're off to China.

Re:Screwed if you do... Screwed if you don't...

[Anonymous Coward]

Twit. CURRENT UK law permits monitoring of employee activities (Lawful Business Practice regulations, to be specific). This case predates the law, but even if it occured today, in this case the manager was essentially performing surveillance without justification, which is quite different to monitoring, and is a breach of the employees privacy, even with regulations allowing monitoring. This case has absolutely no ramifications for how businesses monitor their employees, except as a wake up call for anyone else abusing their powers.

Posting as AC because I can't be assed remembering my username

What?

[fyngyrz]

Playboy.... has articles?

"I read Slashdot for..."

[lamber45]

During one interview for my current job, I stated that I read Slashdot for the news of new technology, and I still got hired. Not that I read it regularly at work or anything...

Re:What companies don't tell you they are watching

[johansalk]

unless you happen to be so good at your job that you can still manage to get everything done *and* goof off, then all eventualities are covered.

Ahhh. I wish it was that easy. The matter of the fact is that everybody goofs off and then they have to stay in late to finish the work they should've done during the day, and then they don't even finish it and act all stressed out and such bullshit. You, Mr "so good at your job" on the other hand, who gets everything done and dusted on time, will get the trouble because you'll "appear" to not actually be working! You'll soon hear complaints about you from colleagues whom you'd thoughts were friends and you'll hear management having issues with you 'cos you're not appearing serious about your work, you're not seeming to care about it, you're not seeming stressed out by it, you're not being inefficient enough so that you'd have to stay in late in the office, and so on. The matter of fact is that if you're good, everyone around you will conspire to shoot you down. Either through deliberate bitchiness or sheer natural unconscious bitchiness. Leave this fucking loser company you say; well, sure, but good luck getting references from them, or, in fact, this tends to be the situation wherever you go. Corporate culture just doesn't seem to encourage you to be good at your job, but, instead, to keep up appearances, just like executives keep up appearances that they actually matter when most of what they do in fact consists of somehow gutting the company any way they could for a little extra cash they could get away with.

What about medical?

[burnitdown]

I can call my doctor on my cell phone, or call my lover, but now much of that is done with the net. If I get one thing wrong on one project at work, this empowers my employers to know too much about me, and use it against me. It's as if Big Brother was a corporation not a government.

Property vs. people

[demon driver]

In any society where property rights mean something You mean, in any society where property rights mean more than anything else, where civil liberties and even basic human rights must succumb to the property fetish?

The EU court decision mentioned in TFA strengthens what should be considered universal consensus. Although reality often looks different, at least employees themselves are not to be regarded as property, and they do not rid themselves of everything private by entering their workplace. Most EU courts accordingly and sensibly rule that a sensible amount of private communication is to be tolerated at the workplace, and that the use of the workplace computer is ok to be used for it, except when employer and workforce explicitly ruled that out by contract. Reason: the matter-of-courseness of using computers, wherever they are, for everyday personal communications.

It's the old question of property vs. people, how much power over (other) people should property (owners) be allowed to get. BTW, some constitutions actually contain the phrase "property obliges" (the owner). No property owner is ever absolutely free to do what he pleases with his property - only as long as his doings do not interfere with the rights of others.

Slave vs. free man

[demon driver]

You are either going to be a slave (employee) or you are going to be a free man. Right, but, in absence of great wealth, "free man" tends to come down to either being slave to oneself, to one's own entrepreneurship or freelance existence, or poverty.

Wait?

[remmelt]

Playboy... has women?

Re:Wait?

[fyngyrz]

No, just pictures. Sorry about that.

Re:What companies don't tell you they are watching

[OriginalArlen]

This may come as a shock to you, but national and supra-national law trumps pseudo-legalistic "Ts & Cs", AUPs, local security policies etc etc.

Local DACH privacy laws already prevent companies from, eg., doing automated spam-filtering on their employees' makil accounts. Mad as toast? yes I agree, but that's the law.

Are we reading the same article?

[VON-MAN]

Strange, when i read the article, i got the impression the woman was singled out by a vindictive colleague who misused his position in the university to try to build a case against her. To me it sounded very much like harassment and very little like abusing resources.

But there's more in the friendly article: article 8 of the European Convention on Human Rights says: "everyone has the right to respect for his private and family life, his home and his correspondence." And European Court case law also says "telephone calls from business premises are prima facie covered by the notions of 'private life' and 'correspondence' for the purposes of Article 8.".
And, OF COURSE, people need to be able to contact home, when at work, for all the obvious reasons. Now, if you were talking of downloading porn, i'd agree with you but this isn't simply a case of abusing company resources.

Re:What companies don't tell you they are watching

[Sobrique]

More truth in that than I care to thing about. You will be thought much more highly of for 'working hard' filling in a 5000 line spreadsheet, one line at a time, for 2 weeks, than you will for writing a shell script that does it in 10 minutes, do almost 2 weeks of work, and slack off a bit on the last day. When you point out that you accomplished the same amount as the guy at the next desk in the same period of time, then clearly you are being obstructive and critical of fellow employees.

Re:What companies don't tell you they are watching

[asc99c]

Go look for a job at a small company. Part of the problem is that for a large corporation, unless you're high up the chain there, nothing you do or don't do is likely to affect the overall results of the company that much. The company has to have a really good set of people in charge watching the real contributions made by everyone or there is just no way to tell if you're good at work or good at appearing to be busy.

The place I work has under 100 people and a decent profit share scheme. I know everyone by name and at least say hello to the top management every day. A few uni friends work at similar places and have similar experiences.

I have to set these rules for a living...

[Anonymous Coward]

And I am as anxious as anyone that a reasonable work environment is achieved, that people can celebrate in their workplace, work at their own speed in their own way, not feel constantly oppressed.. etc.

However, you also need the power to pull an employee up if they are taking unfair advantage of the rules, and if necessary sack them if they are causing unacceptable problems.

One additional line I have found useful is that an employee can use corporate services for non-corporate use so long as

it's legal
it's for the private use of employee
it's authorised by the line manager
it isn't excessive
it doesn't disturb the smooth running of the company or bring it into disrepute.

Note that sitting around with your feet up scanning slashdot when there is a visitor on the premises falls foul of the last of these. Thats why I have this shrunk to a very small window at the moment!

How much privacy does this give me?

[ukdiveboy]

Rediculous concept if you ask me. You're being paid to work ... arguably as a University employee she is not being paid very much and what she does barely constitutes work :)

But in principle when you're at work you are not on their own time, you _belong_ to the employer while at the office.

Where does this stop? If my wife comes to the office at lunchtime can I insist my office mates give me some privacy and look the other way while we "get it on" on the floor of my cube?