Slashdot Mirror


Where To Draw the Line When Punishing Email Snooping?

CWmike writes "While it might seem like a practical joke or a harmless, furtive glance, e-mail snooping could land you in more hot water than you'd ever expect — you could be charged with a federal crime. The recent case of a Philadelphia TV news anchor charged with breaking into his co-anchor's e-mail accounts shines a light on the seriousness of such snooping. Scott Christie, a former federal prosecutor who headed up the computer hacking section at the U.S. Attorney's Office, said, 'You look over someone's shoulder and read a personal letter and that's not a crime, so how can it be a crime to access someone's e-mail? It's not the same thing, of course... What you're doing when you're accessing e-mail is affirmatively exceeding your access to electronic documents and systems.' He adds: 'Usually, you're doing that by pretending to be that person to break into their account.'" It's worth noting that the Philadelphia man accessed his co-worker's email over 500 times, and his use of the information he found was hardly harmless. However, the rules and conventions for email privacy are much less familiar to most people than the laws regarding snail mail. At what point does a privacy breach demand punishment?

124 comments

  1. Privacy? by BSAtHome · · Score: 4, Insightful

    At what point does a privacy breach demand punishment?

    Wasn't privacy declared dead some time ago? So, no punishment, I guess...

    1. Re:Privacy? by KingSkippus · · Score: 3, Insightful

      Good point.

      When companies systematically reads our e-mail, we've gotten desensitized to the point where we just don't care any more. When your cubicle neighbor does, though, they (literally) make a federal case of it.

      Privacy? What privacy? It's just one more person knowing all the stupid little nitpicky details about my life. The best idea is to simply hole up somewhere and live the life of a hermit.

    2. Re:Privacy? by causality · · Score: 4, Insightful

      At what point does a privacy breach demand punishment?

      Wasn't privacy declared dead some time ago? So, no punishment, I guess...

      It certainly is dead if we don't stand up and demand it and if we choose not to punish those who violate it. We do have a choice in the matter, you know. We don't have to just sit back and do nothing and watch it slowly erode.

      Of course the other angle is that there is plenty you can do to make your communications and your systems much more difficult to compromise. You can use encryption, you can refuse to use free services like Hotmail and Gmail for sensitive data, you can follow good security practices for how you administer your computer. You can also assume that someone somewhere really might target you, which that co-worker mentioned in the summary almost certainly did not do until it became evident that this was the case. Privacy is very much like freedom; the price is vigilance.

      --
      It is a miracle that curiosity survives formal education. - Einstein
    3. Re:Privacy? by perlchild · · Score: 3, Insightful

      When a company does it, it's "usually" not without your knowledge. (As in, you've agreed to it) You can also quit over it, but would you quit over it if they don't fire the cubicle mate that reads your email?

    4. Re:Privacy? by TFGeditor · · Score: 1

      I wonder what this portends for mail server admins? I am admin for my small company's server, and therefore have access to everyone's mail. I do not snoop, but I could. Is "I was just doing my job" a credible defense?

      --
      Ignorance is curable, stupid is forever.
    5. Re:Privacy? by dgatwood · · Score: 2, Insightful

      And even if it is without your knowledge, the federal government won't lift a finger because that's a civil issue between you and them. Translation: we'll only help you protect yourselves against invasion of your privacy by individuals because they aren't as generous with their lobbying dollars. The government these days is pretty thoroughly in the back pockets of the corporate world. Expecting them to do anything to defend you against their buddies is like expecting the corporations not to sell your personal info if it will make them a quick buck.

      --

      Check out my sci-fi/humor trilogy at PatriotsBooks.

    6. Re:Privacy? by Leading+Stoker · · Score: 1

      The government these days is pretty thoroughly in the back pockets of the corporate world. Expecting them to do anything to defend you against their buddies is like expecting the corporations not to sell your personal info if it will make them a quick buck.

      That's why we're all in the situation in the first place. Corporate and Government need each other, and feed off each other, which each vying for more power. Every day some right that was so fought before to keep, is relinquished to be part of the herd (e.g., "everyone else is doing or doing it so often, who cares?"). It's no wonder workplaces resemble pastures, complete with mud pies. :/

    7. Re:Privacy? by Provocateur · · Score: 1

      The best idea is to simply hole up somewhere and live the life of a hermit.

      You left out '...and come back when the wisdom and mad skillz of the Jedi are needed once more.'

      Makes it more attractive to this demographic in particular. Well, I *did* have a brush with Marketing.

      --
      WARNING: Smartphones have side effects--most of them undocumented.
    8. Re:Privacy? by rtb61 · · Score: 1

      I think you will find it reflects a run around in privacy. Politicians and the rich are realising that the privacy invasive tactics they use to exploit others can also be readily used against them, hence, there is a major change in attitude developing towards privacy. While this change in attitude has been some what schizophrenic due to the RIAA and the MPAA, as well as, lobbyist paid for by privacy invasive companies, oddly enough while those self same lobbyist are desperately trying to keep their own activities hidden and private, just as those companies invading other peoples privacy want to keep their activities secret.

      So private email is not a postcard and those googlites who believe so could find them selves at variance to future far stricter privacy laws and social sites will find them selves increasingly under scrutiny and when it comes to invading the privacy of minors who can not make legally binding contractual agreements.

      With this is of course is the distinction between work email and private email, email received and sent on company equipment during company time is the property of the company and not the individual sending or receiving it, especially as the individual has been paid to create, send and receive said email.

      So for those companies and individuals who generate a substantial portion of the income by invading the privacy of others, diversify or die ;).

      --
      Chaos - everything, everywhere, everywhen
    9. Re:Privacy? by stiggle · · Score: 1

      So are they going to start hitting private investigators who are 'pretexting' with the same level of charges? What is the difference between pretending to be someone else to access their email, be it with cracked passwords, and pretending to be someone else to access their finance, phone and utility records. Could you also hit MediaSentry (or whatever the RIAA snoopers are called these days) with the same charges?

    10. Re:Privacy? by gurps_npc · · Score: 1

      The fact that it 'usually' not without your knowledge is irrelevant. If it is done once without your knowledge, than that should be what we are talking apart It's sort of like saying "usually the cops don't knock people off a bike and claim the bike guy rammed them"

      --
      excitingthingstodo.blogspot.com
    11. Re:Privacy? by rtechie · · Score: 1

      would you quit over it if they don't fire the cubicle mate that reads your email?

      I'm assuming you cubicle mate isn't an authorized mail administrator.

      In your scenario you wouldn't quit, you'd sue the company. It's negligence on the part of the company. I'd draw an analogy with sexual harassment, if the company is informed that an employee is sexually harassing other employees and they do nothing about it, they take on the liability of the employee's actions. In fact, there really isn't any requirement to inform because companies have tried to weasel out of liability by claiming they were never informed (lying). The standard is actually "they should have known". Or even "There was no way they could have known, but they are still liable because they were inadequately monitoring their employees to begin with".

      Basically, if they don't immediately fire the employee that looked at your email they're looking at liability.

    12. Re:Privacy? by perlchild · · Score: 1

      I meant "usually" in the sense that even if companies would systematically put it in the contract, not everyone reads, or understands such provisions...

  2. Larry Mendte's real crime by Anonymous Coward · · Score: 5, Informative

    He is alleged not only to have accessed her account 100's of times, but he is also accused of leaking emailed conversations she had with her lawyer.

    You could say that it is stupid to have such conversations over email, but this was hardly "just looking over your shoulder."

    It is making for some drama in Philly.

    1. Re:Larry Mendte's real crime by causality · · Score: 3, Insightful

      You could say that it is stupid to have such conversations over email, but this was hardly "just looking over your shoulder."

      Sometimes shit just happens. Really. But most of the time that I see anything bad happen to anyone, they were doing something stupid. Something stupid that either directly caused the situation, or made it much worse than it had to be. That includes me, by the way -- if I have an advantage over others it's that I can admit this and see these things as lessons to learn from instead of treating everything as though it's random chance, as though my choices have no impact on what happens to me. Poor decision-making remains the number one cause of most peoples' problems, which is a good thing in a way because it's preventable.

      Try explaining this to most people, though, and see how far you get. Instead of saying "the power to change things for the better is in my hands" they say "so you're trying to blame this all on me?!" and they completely miss the point. Even if you don't directly cause things that happen to you, there is such a thing as making yourself available and allowing room for things to happen. It's disheartening because the way most people respond to anyone who says this leads me to believe that most of them want to be victims. When that's the case, they tend to get what they want.

      --
      It is a miracle that curiosity survives formal education. - Einstein
    2. Re:Larry Mendte's real crime by rohan972 · · Score: 1

      Try explaining this to most people, though, and see how far you get. Instead of saying "the power to change things for the better is in my hands" they say "so you're trying to blame this all on me?!" and they completely miss the point.

      I've found this too. It only really seems to work if you have a very solid relationship with that person so they are confident of your goodwill. Possibly talking about it in relation to events that are long gone would evoke a less emotional response, or in relation to something that happened to someone else, so they can understand the principle without getting upset before applying it to their own situation.

      It's disheartening because the way most people respond to anyone who says this leads me to believe that most of them want to be victims.

      I think it's to do with people's focus, past or future. For someone focussed on the past, since it can't be changed the only thing left is to apportion blame. Their self respect demands that they are not to blame. For someone focussed on the future, they want to influence that future for their benefit so they seek responsibility (the ability to respond). Their self respect demands that they do all they can. How to change this focus in someone else? I don't know.

    3. Re:Larry Mendte's real crime by causality · · Score: 1

      Thank you for such a well thought-out, real answer. I suppose our only difference is that, within the very narrow scope of "is this the truth?" (not nearly the same question as "do I want to date this person"!) I am not concerned with being confident of anyone's goodwill. I simply don't believe what people say unless I can independently verify it or it's consistent with what I already know to be true, so for me, worrying about their intentions is an unproductive trap I try pretty hard to never fall into. I say that knowing that you probably weren't describing yourself but rather the folks who react badly to anyone who tells them they are not really victims, so I am really explaining why I think they need not concern themselves with that. Anyway, I call it a trap because it takes you out of a potential "discernment" mode and places you into a "do I like this person" mode which tends to make everything a popularity contest. There are plenty of people who may not like you, may in fact hate your guts or may be completely indifferent to you from whom you can still learn something if only you can get past your personal feelings long enough to listen. We limit ourselves in so many arbitrary ways that just don't have to be the case. Having likes and dislikes is fine but letting them rule your life and filter your knowledge for you is neither desirable nor necessary.

      I also feel that adults should not call themselves mature (although many will falsely do so, because it sounds good) until they can deal with something without allowing their judgment to become clouded by an emotional response. That is, have your emotions but don't be a slave to them. Beyond that, I understand rather well the thought processes behind trying to protect that precious little ego and worrying about self-respect and apportioning blame, I just don't consider them to be valid. To me they are aberrations and most people have the misfortune of believing that only relatively rare phenomena can possibly be aberrant, that if most human beings participate in something then it can't possibly be a disease (dis-ease) state.

      So, I say what I believe to be true. If it upsets someone, no one forced them to react that way to something they could have chosen not to listen to. If a contrary opinion is really such an irritant, consider that with over 6.5 billion people in the world, that's a lot of convincing to do before the easily offended can finally relax. So let them get offended; perhaps someone else will hear their tantrums and indulge them even if I personally don't wish to do them such a disservice. In spite of all of this, yes I still think it's unfortunate that the victim mentality is in no danger of extinction. I still think that we, collectively, waste a lot of energy on things which are beneath us. I also think that no effort is ever wasted despite all appearances, and that there is an increasing number of people like you who generally seem to understand these things.

      Now, I believe that the above are largely matters of opinion or personal style. You have to decide for yourself how you want to feel about it; this is not where I can use a mathematical proof to decisively declare that one of us is right and the other is wrong. Not at all. So, please don't think that anything I am saying here is intended to argue with you. In this instance, that is not my place. The purpose was more to explain how I feel about it, since you were kind enough to do the same (and it didn't start out being this long-winded, I swear!). I am not being sarcastic or facetious in the slightest when I tell you that I am thankful for your response. I wish there were more like it.

      --
      It is a miracle that curiosity survives formal education. - Einstein
  3. "Over 500 times" by Anonymous Coward · · Score: 0

    Assuming someone set it up as a POP account to download every minute, that would be about a work day's worth of POP account checking. Remember, laws are written to give prosecutors as many crimes as possible to work with, so if the evidence falls through they have others, and so they have something to bargain with in a plea deal.

    1. Re:"Over 500 times" by clang_jangle · · Score: 1

      Assuming someone set it up as a POP account to download every minute

      That seems like a silly argument. The default is usually every 10 minutes or more, isn't it? I would expect most mail servers to block an IP scheduling a check every minute. I know mine would.

      --
      Caveat Utilitor
    2. Re:"Over 500 times" by Anonymous Coward · · Score: 4, Informative

      Oh, Mendte wasn't checking automatically, it was a webmail account. The logs were made public, and revealed that Mendte was quite obsessive about checking Lane's mail.

      Mendte apparently put a physical keylogger on one of the computers Lane used in the newsroom, and got her account details. The only reason he got caught was because he got sloppy-- in (IIRC) March, he left a computer in the newsroom logged into Lane's webmail. Someone else working at the station saw it, thought it odd since Lane had been fired in January, and reported it.

      This has been ridiculously huge news in Philadelphia and even managed to push the "hot chick and her boyfriend who stole people's identities" stuff off the front page for a while.

  4. The line is fine by clang_jangle · · Score: 2, Interesting
    From TFA:

    "I don't think people are of the understanding that this type of conduct is a crime," said Scott Christie, a former federal prosecutor who headed up the computer hacking and intellectual property section at the U.S. Attorney's Office in New Jersey.

    The other FA goes on to state that the reporter being charged accessed his coworker's email over 500 times ! So IMO it is really not possible to "go too far" punishing someone with that level of utter disregard for the rights of others. According to wiki.answers:
    "The deliberate withholding and/or opening of US mail that is addressed to another party is a violation of federal law. The penalty for tampering with US mail is a maximum of 5 years in a federal facility and/or a $250,000 fine."
    Sounds reasonable to me. The thing I find incredible is that people aren't making that correlation between email snooping and tampering with the mail? Oh well, ignorance of the law has never been an excuse for violating it. Maybe after a few people get big sentences and fines for their asshattery everyone will know it is illegal.

    --
    Caveat Utilitor
    1. Re:The line is fine by socsoc · · Score: 3, Insightful

      Except that e-mail is not US mail. You're confusing law about the US Postal Service (so snail mail) with e-mail.

    2. Re:The line is fine by Anonymous Coward · · Score: 0

      One difference is that snail mail is commonly used to deliver bills, invoices, payments, and other business documents. If this flow can be arbitrarily disrupted it could have an effect on business between individuals and companies, between two companies, business with governments, and the credit ratings of individuals and companies. There is a presumption that snail mail is reliable, albeit sometimes tardy,.

      I suppose that something similar could happen if someone arbitrarily *deleted* email messages, instead of just viewing them, depending on what those messages were. But emails can be deleted by the ISP or by the corporate mail server because of spam filtering, or document retention policies. Important documents are still routinely delivered by either snail mail, air express, courier, or fax, to ensure that the recipient will have a hardcopy.

    3. Re:The line is fine by clang_jangle · · Score: 3, Informative

      No, that's an incorrect assumption. What I'm doing is pointing out the equivalence of purpose, i.e., personal, private communication. It just didn't occur to me I had to specify it, as it struck me as rather obvious.

      --
      Caveat Utilitor
    4. Re:The line is fine by clang_jangle · · Score: 3, Informative

      It is just as illegal to intercept US mail in order to open it, read or photocopy it, reseal it, and send it on to its destination. So that difference doesn't exist, and deletion/theft is not the line. Privacy is the line.

      --
      Caveat Utilitor
    5. Re:The line is fine by Klaus_1250 · · Score: 4, Informative

      Not sure how the law in the US is, but there are countries (in Europe at least) where email falls under the the same laws as for snail mail. Which makes sense to me, except that you cannot drop bulk-mail silently (even though there is some logic to that too).

      What people need to understand is that your standard email has roughly the same privacy as sending a postcard with text on the back. There is no envelope, no seal, no nothing. The only thing that "protects" you privacy is that you need an password to log-in to your POP/IMAP/Exchange account, which is roughly the same as having a lock on your Postbox. But it is still not private, as the mailman can still read your mails as well as anyone else in the chain.

      If people really want privacy for their email, they need to use a SSL-connection to their POP/IMAP/SMTP/Exchange accounts and encrypt all their email through PGP/GnuPG.

      --
      It only takes one man to change the Wisdom of the Crowd to Tyranny of the Masses.
    6. Re:The line is fine by Anonymous Coward · · Score: 0

      Well, another important difference is that the US Postal Service is run under the auspices of the US government. They don't guarantee that mail will be delivered, but they do take the reliability and confidentiality aspects seriously, and the law mandating harsh punishment of interlopers is one part of that. Snail mail is stodgy but reliable, a good choice for transmitting contract bids and the like which are important to be kept confidential.

      Email is administered by private corporations, and several companies are typically involved in each transmission/reception. And it's just one of many ways of transmitting electronic documents; new ones spring up on a regular basis. Congress is wise to tread lightly here on legislating security or privacy here.

    7. Re:The line is fine by Anonymous Coward · · Score: 0

      Well, another important difference is that the US Postal Service is run under the auspices of the US government.

      The USPS has been a private corporation administered by the executive branch of the US government for some time now. It is not, strictly speaking, a government agency. Think AmTrack, not DHS. So the difference is not so important for the purpose of this discussion.

    8. Re:The line is fine by socsoc · · Score: 1

      It may be obvious to you, but that isn't covered under the law that you are quoting. Also, one of the allegedly accessed accounts was a corporate account and although it shouldn't be accessed by a co-worker, it belongs to the company and so does any associated messages.

      Going back to your wiki.answers source, there can't be any ignorance of a law when the said law is not applicable.

    9. Re:The line is fine by Anonymous Coward · · Score: 2, Informative

      Way to miss the point. OP was saying in essences, "email should get the same protection snail mail gets". A common sense solution, IOW. Sadly (as your post illustrates), common sense just isn't all that common. :(
        In any event, the perp had to commit fraud in order to read his coworker's email, and there are certainly laws against that.

    10. Re:The line is fine by Teun · · Score: 1
      Indeed, here in The Netherlands the comparisson with a postcard is usual.

      At the same time companies are required to have their own privacy policies and instruckt their employees about it. A company might write in their rules that privacy is not guaranteed as you are using company equipment, they are still not permitted to snoop unless it is agreed upon with the in-house works council and there is proper cause.

      --
      "The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
    11. Re:The line is fine by SkyDude · · Score: 2, Informative

      Way to miss the point. OP was saying in essences, "email should get the same protection snail mail gets". A common sense solution, IOW. Sadly (as your post illustrates), common sense just isn't all that common. :( In any event, the perp had to commit fraud in order to read his coworker's email, and there are certainly laws against that.

      US Courts have already held that a business can view an employee's email account, and that the employee has no right to privacy. That doesn't mean anyone in the business can read another employee's email, but trying to give employer-owned email the same kind of protection afforded US Mail isn't going to happen anytime in the foreseeable future.

      --
      == First cross river, then insult alligator.
    12. Re:The line is fine by Anonymous Coward · · Score: 0

      And there is none. I am the proverbial geek living in his mothers basement. A walkout which I built for her, even before my careers as astrophysicist, chemical engineer, nu-cu-lar engineer, and biophysicist. I was at fault in a car accident 4 years ago, and I have not received a piece of mail since then with a firm seal. Don't be fooled: they will abuse any access they can, until we fire them, all of them.

    13. Re:The line is fine by rohan972 · · Score: 1

      The difference is in who owns the mail. Send a personal letter, your company can't open it. Send a letter on company letterhead and they can. I think you'd find a different response in court to the company accessing your personal email account than when they access your company email account.

      When I log on to the company network, there's a pop-up which states [paraphrased] "We watch everything you do and can read every file and email, this is for work, not personal use." There is some tolerance for personal use in practise, but if you use it for something you'd be upset about them seeing it would have to be your own fault in my opinion.

    14. Re:The line is fine by SkyDude · · Score: 1

      The difference is in who owns the mail. Send a personal letter, your company can't open it. Send a letter on company letterhead and they can.

      Ownership is not the test. Let's say you bring a utility bill to work with the intention of purchasing a stamp for the letter. Your boss sees the envelope and demands to see it. Until it has a stamp on it, the boss could insist on opening and examining the envelope to insure it doesn't contain any trade secrets. Once a stamp is on it, it gains Federal protection, in most cases. Certain high security places would prohibit personal mail of any kind and could demand to open the envelope, if you agreed to such during the hiring process. It doesn't have to pass through the USPS first, the stamp is the protection.

      In reality, few of us are ever going to be in such a situation. I've learned over the last few years that the days when doing personal business at work are quickly disappearing. While the employer probably would be in the wrong to crack your personal web email account, the simplest way to avoid an issue is to not read your personal email at work. If one can afford it, receive personal stuff on your cell phone. But, as we know, there are places where cell phones are banned too, mostly due to the cameras in phones.

      Best bet is to leave the personal stuff at home or find a more open-minded employer.

      --
      == First cross river, then insult alligator.
    15. Re:The line is fine by rohan972 · · Score: 1

      Ownership is not the test. Let's say you bring a utility bill to work with the intention of purchasing a stamp for the letter. Your boss sees the envelope and demands to see it. Until it has a stamp on it, the boss could insist on opening and examining the envelope to insure it doesn't contain any trade secrets. Once a stamp is on it, it gains Federal protection, in most cases.

      And yet if that envelope is a company branded envelope, the boss can still open it, being company mail. Ownership is still a test, perhaps not the test, as you say. Probably until it has a stamp it doesn't qualify as mail and therefore comes under different laws, I don't know, it hasn't been a problem for me.

      Best bet is to leave the personal stuff at home or find a more open-minded employer.

      Spot on.

    16. Re:The line is fine by Anonymous Coward · · Score: 0

      Not sure how the law in the US is, but there are countries (in Europe at least) where email falls under the the same laws as for snail mail. Which makes sense to me, except that you cannot drop bulk-mail silently (even though there is some logic to that too).

      Indeed! In Spain, e-mail (and in fact anything you send or receive over an internet connection) is protected in the same way as snail mail and phone calls, which are protected by the Spanish constitution. So e-mail snooping is an criminal felony punishable with three to six years in jail and some heavy fines, IIRC, but IANAL.

    17. Re:The line is fine by thegermanpolice · · Score: 1

      I think that there is a more interesting point.

      Who paid for the stamp?

      If the company did, then the letter is from the company to the recipient, therefore, the company would be entitled to look inside the letter.

    18. Re:The line is fine by rohan972 · · Score: 1

      Probably not, as the stamp doesn't identify the sender as the company, the letterhead etc does. It would just mean it was a stolen stamp.

    19. Re:The line is fine by Anonymous Coward · · Score: 0

      Except this didn't involve employer owned email; it was webmail.

  5. Dong by Anonymous Coward · · Score: 0

    'What you're dong when you're accessing e-mail is affirmatively exceeding your access to electronic documents and systems.'

    Spell check might not have caught this one but proof reading surely could have. Although it is an amusing mistake.

    1. Re:Dong by clang_jangle · · Score: 1

      you're dong

      It's your dong, silly git!

      --
      Caveat Utilitor
  6. Is not it a federal crime to interfer or open .... by 3seas · · Score: 1, Insightful

    .... anothers snailmail?

    then of course email should be treated the same, as it is private communication between sender and receiver.

  7. Stupid analogy by phorm · · Score: 2, Insightful

    You look over someone's shoulder and read a personal letter and that's not a crime, so how can it be a crime to access someone's e-mail

    Talk about apples to oranges.

    If you read somebody's letter over their shoulder, not a crime. If you read somebody email over their shoulder, same thing.

    If you break into their postbox and open their mail, that would be more comparable to actually entering somebody's account without permission to read email...

    1. Re:Stupid analogy by Anonymous Coward · · Score: 0

      You look over someone's shoulder and read a personal letter and that's not a crime, so how can it be a crime to access someone's e-mail? It's not the same thing, of course

      Someone mod parent down please, quote-mining is just plain wrong.

  8. Same as physical mail why not? by apathy+maybe · · Score: 3, Insightful

    Just make the deterrent/punishment the same as accessing someone's paper mail without permission.

    Sure, in some cases you have to pretend "to be that person to break into their account", in which case you might throw a bit of "fraud" at them as well, but in most cases, accessing snail mail and accessing physical mail are similar enough.

    If you are reading something over someone's shoulder, they can tell you to piss off, cover it up or whatever. The difference is actually going to the mail box (whether it be physical or electronic) and accessing what is in it.

    Oh yeah, I guess it might be slightly harder to prove that someone has accessed the electronic box (because they don't have to open any envelopes), but considering you should be treating email as you would post cards anyway... (That is, anyone between you and the destination can read it, unless you take measures to encrypt it or something.)

    -----
    Disclaimer, I don't believe the state should exist. However, my opinions expressed above are given on the condition that my belief is suspended for the time being.

    --
    I wank in the shower.
  9. What about family? by Anonymous Coward · · Score: 1, Interesting

    Email snooping doesn't exclusively occur in the workplace- what if this furtive reading of emails occurs within the home? i.e. in the midst of a divorce, one party accesses the others email in an attempt to get material to use against them in court? Is that means for punishment as well?

  10. PGP by drsmall17 · · Score: 0

    There is no privacy, unless you encrypt with PGP.

    --
    Oday ouyay antway otay ayplay away amegay?
  11. Email == Postcards by Anonymous Coward · · Score: 1, Interesting

    After beating my head against the wall trying to get my company to enforce strong passwords, I instead started advising my employer to not put anything in an email he doesn't want someone else to read. Use the phone and FAX instead.

    What this guy did was obviously against the law (the impersonating part, not the email reading part), but if he gets a good lawyer he'll get off with a small fine and some community service time counseling kids not to put anything in email they don't want others to see.

  12. Simple by schnikies79 · · Score: 4, Interesting

    It should be the same as physically opening up someone else's mail from the snail-mail box. Being electronic changes nothing.

    Sec. 1702. - Obstruction of correspondence

    Whoever takes any letter, postal card, or package out of any post office or any authorized depository for mail matter, or from any letter or mail carrier, or which has been in any post office or authorized depository, or in the custody of any letter or mail carrier, before it has been delivered to the person to whom it was directed, with design to obstruct the correspondence, or to pry into the business or secrets of another, or opens, secretes, embezzles, or destroys the same, shall be fined under this title or imprisoned not more than five years, or both.

    --
    Gone!
    1. Re:Simple by Anonymous Coward · · Score: 0

      I agree it shouldn't change anything, but I'm not so sure that's the case.

      I think reading other people's mail is a federal crime in part because the Post Office is run by the government. I'm not sure that law covers FedEx or UPS, much less e-mail.

    2. Re:Simple by Zadaz · · Score: 1

      So what you're saying is that we should be allowed to snoop all we want as long as it's email that is marked as "read".

      Hmm.

    3. Re:Simple by Anonymous Coward · · Score: 0

      So what you're saying is that we should be allowed to snoop all we want as long as it's email that is marked as "read".

      Hmm.

      Good point. The fact is the snoop pried into business or secrets of another. This is a key to it being a crime.

    4. Re:Simple by Jack9 · · Score: 1

      Email is more complicated than the us postal system. Email is not regulated, controlled, operated by the public. In fact, it's often unclear who controls the email servers since anyone can set them up and use them. Imagine a postal system that any person OR ENTITY (including foreign interests) can set up and operate. That's what we're talking about. You cannot apply the same rules.

      --

      Often wrong but never in doubt.
      I am Jack9.
      Everyone knows me.
  13. Crappy journalism - par for the course by DNS-and-BIND · · Score: 4, Insightful
    "While it might seem like a practical joke or a harmless, furtive glance, e-mail snooping could land you in more hot water than you'd ever expect you could be charged with a federal crime."

    Sigh. They are NOT repeat NOT talking about looking over someone's shoulder, or a furtive glance. They're talking about logging into another's email account and making the (damaging) contents public. But hey, this sort of confusion is what I expect from journalists - doesn't matter if they work for the New York Times or the Daily Shopper, they're all pretty much the same.

    --
    Shutting down free speech with violence isn't fighting fascism. It IS fascism!
    1. Re:Crappy journalism - par for the course by PJ1216 · · Score: 1

      It wasn't the journalist who made the analogy, it was a quote from a former federal prosecutor who headed up the computer hacking section of the US Attorney's office. Before attacking something, read it more carefully first to ensure your attack is actually justified.

    2. Re:Crappy journalism - par for the course by DNS-and-BIND · · Score: 1

      Right - because journalists are paragons of accuracy. If it's misleading, it shouldn't be in the story whatsoever. Of course, I'm not a journalist, so what do I know about writing a story.

      --
      Shutting down free speech with violence isn't fighting fascism. It IS fascism!
  14. Flawed analogy by cheebie · · Score: 4, Interesting

    The "looking over the shoulder" vs. "read someone's email" analogy is flawed. This would need to be two separate analogies. Looking over their shoulder to read a letter vs. looking over their shoulder to read an email on the screen, and accessing someone's email account vs. breaking onto their house and reading the letters they keep in a drawer in their bedroom.

    The former is rude, but not generally prosecuted. The latter is a crime.

  15. Will people learn ? by itsthebin · · Score: 0

    once it's on teh intarwebs

    too fcuking late

    --
    ...I obey the laws of physics....
  16. How did he get the credentials? by jackvalko · · Score: 0

    Since the two parties here were co-workers at one time, I wonder how the breaker got the breakee's login? Did she give it to him? Did he guess it?

    In either situation his defense should be (a) she gave me her credentials or (b) her password was so weak that ergo, the expectation of privacy and security was waived.

    1. Re:How did he get the credentials? by socsoc · · Score: 1

      An earlier AC posted some info that definitely isn't in TFA... Maybe an inside source? http://yro.slashdot.org/comments.pl?sid=634517&cid=24457275

    2. Re:How did he get the credentials? by Anonymous Coward · · Score: 1, Insightful

      A weak password does not waive the expectation of privacy and security at all. The fact that it is a password (read security access device) should clue you in to that. Bad argument.

    3. Re:How did he get the credentials? by PJ1216 · · Score: 1

      Your defenses are still weak in general. If I give someone a key to my house, it doesn't mean I give them the right to come in whenever they want. If I have a key lock on my door that is easily cracked, it also doesn't mean my expectation of people not coming in is waived.

    4. Re:How did he get the credentials? by socsoc · · Score: 1

      I disagree, giving someone a key to your house DOES give them the right to enter. Maybe not ethically without knocking, but they do legally have a right to enter your home.

    5. Re:How did he get the credentials? by Anonymous Coward · · Score: 1, Insightful

      You know, my mailbox doesn't even have a lock on it, all anyone has to do is open it to read all the letters inside. It's still a federal offense to do so. 'Expectation of privacy' applies to mail no matter how weakly it's protected.

    6. Re:How did he get the credentials? by Idarubicin · · Score: 2, Informative

      I disagree, giving someone a key to your house DOES give them the right to enter. Maybe not ethically without knocking, but they do legally have a right to enter your home.

      The details will depend on jurisdiction, but no--the right to enter your home at any time does not necessarily come with the voluntarily-given key. If I gave the maid a key so she could clean once a week, she would be committing trespass if she used the key to enter my house at four in the morning. If I fired the maid but forgot to take my key back, she would be trespassing if she used the key again--even if she showed up on Tuesday morning and cleaned my kitchen. More generally, when a key is given it is often accompanied (explicitly or implicitly) by conditions determining the situations wherein its use would be appropriate. Mere possession of a key is not necessarily sufficient to grant the would-be trespasser the rights and privileges of an invitee.

      --
      ~Idarubicin
  17. P.S. How this probably came to light by Anonymous Coward · · Score: 2, Informative

    Alica Lane was busted in NYC after getting into a fight with a woman who turned out to be an undercover cop.

    I suspect that this is the only reason why the monitoring even came to light. And if the conversations with the lawyer hadn't been leaked, this propably wouldn't have become such a big deal.

  18. When does it become a crime? by Bieeanda · · Score: 1
    How about 'Immediately'. This is no different than any other act of hacking or social engineering, it is gaining access to personal data under false pretenses. People seem to be under the misapprehension that since it affects non-tangible documents, it is non-harmful.

    Make it prosecutable on the first offense, and pursue those cases vigorously. That is the only way that people will learn to not fuck with someone else's e-mail.

    1. Re:When does it become a crime? by b4upoo · · Score: 1

      How large do you want prisons to get? These days, because of high gas prices, people are riding scooters and bicycles quite a bit. We need to put people who steal bikes and scooters away for a long time. But can we? We can't even keep major criminals locked up due to the high cost of prisons.House arrest is a joke. Who pays for the house, food. etc.. Society doesn't like chain gangs anymore. But in the south we ran prisons on the cheap with chain gang labor. They even raised their own food etc..

  19. Is there even a story here? by GroeFaZ · · Score: 3, Interesting

    You read someone's snail mail without permission - it is an action punishable by law. You read someone's electronic mail without permission - it should very much be punishable by law, because the punishable action of reading snail mail is not that you read a letter written on paper, but that you read information addressed to someone else than you.

    And privacy is only as dead as anyone wants it to be. If you say, go ahead, here are my login and password, read my mail, fine. But you know what? Some politicians in Germany have argued in favour of the infamous law for mass data retention. They have done so on this exact argument, that "on the Internet, everybody gives away all private information anyway."

    Bullshit!

    --
    The grass is always greener on the other side of the light cone.
  20. Re:Is not it a federal crime to interfer or open . by janeuner · · Score: 5, Insightful

    US Mail and E-Mail are fundamentally different. With snailmail, the government guarantees the timely and confidential delivery of your message, and it is a federal crime for a third party to interfere with that contract. Contrast that against E-Mail, where confidentiality is never guaranteed - consider every virus scanner and Junk Mail filter along the transmission path. However, when a third party breaks into an email account, a different crime is being committed - identity theft.
    Laws that specifically protect US Mail should not apply to crimes involving electronic mail. The act of impersonating the victim should be sufficient for prosecuting the offender.

  21. Re:Anger. by causality · · Score: 3, Funny

    Don't think that people are not furious at the big dumb companies and government officials who have violated them. Your cube mate is just less able to defend himself from your anger and is an easy scape goat for hypocritical government that wants to look like it is doing something right.

    I can't believe you actually made one post without once mentioning Windows or Microsoft. So, who the hell are you and what have you done with the real Twitter?

    --
    It is a miracle that curiosity survives formal education. - Einstein
  22. Re:Is not it a federal crime to interfer or open . by PJ1216 · · Score: 1

    So, if something isn't guaranteed (privacy), then it should be perfectly legal to do so? Confidentiality is guaranteed at times. Third-party services such as virus scanners and junk mail filters usually have privacy policies that guarantee you a certain level of privacy. US snail mail doesn't guarantee 100% privacy. Mail can and does get opened up on occasion if certain conditions are met (jail, military, etc.). So, even US snail mail has conditions on the privacy, as does email. Why are they fundamentally different? It's a breach of privacy and should be treated as such.

  23. I read your e-mail tshirt by Anonymous Coward · · Score: 0

    Oh no, better burn that "I read your email" tshirt from ThinkGeek.

    http://www.thinkgeek.com/tshirts/frustrations/31fb/

  24. From a sysadmin Point of View by Anonymous Coward · · Score: 0

    It depends on the intent and on the context.

    To read someones email in order to actually *snoop* on them is extremely wrong. If the intent is to snoop on a particular persons received email, in his email account, to read it - then of course it should be punishable in the same way as if you access his snail-mail.

    On the other hand, if you're a system administrator trying to fix the fscking account for a person, knowing that it's a corrupt mbox-file that the pop/imap server no longer understands, and you open up the file in 'vi' to find the invalid part in order to rip it out / fix stuff so that it works again .. then personally I feel the situation is a tad different (as you can understand, I've did exactly the above in the past, when I think it was qpopper refused to understand stuff due to the file being pretty messed up. Had to hand-seperate a bunch of messages by hand :P

    I've also resorted to reading the email-bodies to find strings to grep for to figure out what message-id's belonged to a specific bot that sent out 100 messages at a time before disconnecting to change email address. Damn infuriating when you don't have access to block out a particular user from logging on to the network - but do have access to the outgoing mailserver for that ip-range. Find a spam-message, read the body, put a longish string into a blacklist.

    Having worked for the postal service in the country I live, I do know that they also stop 419s when discovered and there is a common denominator - in addition to opening mail if the recipient address do not exist and there is no return address, in hope that there is information inside about who the recipient is.

  25. Re:Anger. by tepples · · Score: 1

    I can't believe you actually made one post without once mentioning Windows or Microsoft. So, who the hell are you and what have you done with the real Twitter?

    Twitter hasn't been real ever since he started posting more than 140 characters.

  26. Re:Anger. by Anonymous Coward · · Score: 4, Informative

    The real twitter has been found dead, it appears he has been bludgeoned to death with a chair. His /. account is now a microsoft sockpuppet.

  27. What about you're dong? by Anonymous Coward · · Score: 0
    'What you're dong when you're accessing e-mail is affirmatively exceeding your access to electronic documents and systems'

    You said dong, haha.

  28. Is going to have him in civil and criminal trouble by toxic666 · · Score: 5, Informative

    Lawyers live by e-mail, so it wasn't stupid of her to use a supposedly secure personal web mail account in her situation.

    Larry Mendte installed a hardware keystroke logger on her work computer to steal her username and password. Then, he started leaking embarrassing information to a reporter for the Daily News (one step above a tabloid in Philly).

    When Alicia Lane (the victim) got into a scuffle in New York, the arresting officer exaggerated the charges; Lane entered a deal that would see the charges dropped after several months of good behavior. But with all the negative personal publicity from Mendte's leaks, the station fired her.

    As part of her lawsuit against the station, her attorney contacted the FBI with a suspicion that someone was accessing her account and leaking information and the focus quickly turned to Mendte, who obsessively viewed her as a rival. The FBI decided to pursue it as a criminal case because it resulted in substantial damage (loss of an $800,000 per year job and serious damage to her reputation).

    It isn't like she was using the company e-mail system to work with her lawyer. She was using a private web mail account. Her legal problems (and Mendte's leaks) threatened her job.

  29. Please don't read other people's email, by British · · Score: 1

    the NSA doesn't like competition.

  30. A crime, you say? by Jager+Dave · · Score: 1

    So it is illegal for you to read someone else's email, or for them to read yours. Unless you work for the government or a telco. Then you don't need a warrant, permission, or even a reason, and you can do so without fear of repercussion. Thank you, Mr. Bush, for a lovely eight years....

  31. same as by celle · · Score: 1

    Why haven't they just extended the laws for snail mail to cover email as it serves the same purpose. It's not like there isn't a major set of federal laws already on the books protecting the privacy of mail. Whether snail mail or email, it's still mail! Do it to a lot of things instead of creating new laws to do the same thing. Problem fixed, no new abusive laws need to be passed, of course then congress would have nothing to do and rail at or use to screw us out of our rights. For the paranoid, the laws are defined pretty well so there would be little likelyhood of extension into other areas leading to a potential totalitarian state. They kindof make it up as they go along anyway, whether lawmakers, judges, or prosecutors so whats the difference. Just look at the last few scotus decisions, or get inappropriately arrested for just standing on a corner and refusing to give id.(papers please) -- hogans heroes

  32. Privacy Needs A Rethink! by b4upoo · · Score: 2, Insightful

    Privacy is highly over rated. Much can be done for the greater good when the very concept of privacy vanishes. The really important idea is that all entities should be free to study and accumulate all information. That puts government, the citizen and business on equal footing.
            From the past I wonder just how much privacy an American Indian who spent his entire life with a tiny tribe experienced. Chances are everyone knew every little thing about every other member of the tribe. Did harm flow from that? I sort of doubt it.

    1. Re: Privacy Needs A Rethink! by WamBam · · Score: 3, Insightful

      I'm glad you feel that way. And since you feel that way, can I have your email address, SSN, bank account# and any or all passwords you might have? Thanks dude! Oh, and I'll, um, share my info with you later...

    2. Re: Privacy Needs A Rethink! by Anonymous Coward · · Score: 0

      yeah that system worked out real well for them. maybe the mindset that made them not care so much about privacy is the same mindset that helped them get annihilated when the white man showed up.

      captcha: brutally

    3. Re: Privacy Needs A Rethink! by dbcad7 · · Score: 1

      I all for open source.. but I don't think I want an open source life.

      --
      waiting for ad.doubleclick.net
  33. What? by slimjim8094 · · Score: 1

    There's something weird about the summary... there's an undercurrent of 'well people don't think it's wrong, but it is'

    Hell yes it's wrong. Where do you draw the line? Why do you draw the line?

    Especially because in this case it contained conversations with her lawyer. Why would anybody be going 'oh, well, we need to be careful to not overpunish here'...? I'd be worried about underpunishing.

    It's like reading someone else's snail mail without their permission (a felony IIRC) except worse because you (almost) can't trace it and you can do it for every email

    I hope he gets butthurt for this, and I still don't see why this is a question.

    --
    I have developed a truly marvelous proof of this comment, which this signature is too narrow to contain.
  34. Read your Email by fireheadca · · Score: 1

    I have a T-shirt that reads "I read your email".

    Everyone who knows me has seen me wear that shirt at one time
    or another.

    I consider it fair warning.

    1. Re:Read your Email by Anonymous Coward · · Score: 0

      I wonder what the prosecution would consider it? ;-)

    2. Re:Read your Email by Anonymous Coward · · Score: 0

      In defense of the T-shirt wearer:

      Your Honor, the words 'I read your email' did not turn red when she looked at the shirt. It wasn't specifically meant for her...

      BTW, one neat trick. Rig up a frame and stretch red cellophane over the frame. When someone who emailed you comes by, put it on for a second for effect ;-)

  35. Cognitive dissonance by overshoot · · Score: 2, Interesting

    Isn't this the same government that reads our e-mails as a matter of course and tells the courts that intercepting electronic communications isn't as serious as reading someone's mail?

    --
    Lacking <sarcasm> tags, /. substitutes moderation as "Troll."
  36. Stupid question. by drolli · · Score: 1

    if you look over the shoulder of your co-worker, it does not matter if hes watching a screen or a paper. If you break into his locked desk or hacking a password, this alone is a crime. If you open his unopened snail mail letter, in Germany this is also a crime, i think something similae may apply in US - i would appreciate if the lawa for e-mail could match this. If you use information from this act, well you could be facing all kinds of funny things, most likely civil charges (e.g. you forwarded his e-mails, which he sent privately to your boss, without beeing properly instructed to do so, snd the guy gets fired and you promoted imagine there may be something in that for him). And inside then company, there is only one way to handle it - if somebody spys on his coworkers withoput that beeing part of his job (by the rules and the laws), fire him. No second chance, There are a lot of things where you could be lenient. Surfing privatly etc.. But for reading the colleagues e-mail, the person has to go. If he was an admin, make sure he does not find another job easily.

  37. punishing email snooping? by Anonymous Coward · · Score: 0

    Last I heard governments, employers, ISPs, and mafiAA types all thought it was perfectly reasonable to spy on users' data. I guess the gentleman in this story didn't give terrorism/kiddy porn/corporate profits as a justification and therefore it's not OK?

  38. Re:Is going to have him in civil and criminal trou by Kent+Recal · · Score: 1

    $800.000 per year?

    Cry me a river.
    If I was her I'd just take the money from the previous years and call it a life.

    Regardless of the e-mail snooping (which should be punished regardless) I think you deserve what you get when you make 800 grand a year on your looks and manners, yet throw it all away by calling a Cop (of all people) "a f---ing dyke".

    These kind of articles make me think that (owning lots of) money must seriously melt your brain. I mean just look at that chick's face in the photo. Blown up to 800 grand meets Darwin I say. Yes, pun intended.

  39. Never Read Others Mail Without Their Consent by aaaaaaargh! · · Score: 1

    Well, at least were I come from, you're taught as a child that it's completely immoral to read someone else's mail without that person's consent. And I can't see why there should be any difference between snail mail and email. Reading someone's mail is on a par with breaking (seriously made) promises and oaths or being disloyal to friends when it has severe consequences for them. Decent people just don't do it, be it legal or not.

  40. Re:Is not it a federal crime to interfer or open . by fishbowl · · Score: 2, Insightful

    >So, if something isn't guaranteed (privacy), then it should be perfectly legal to do so?

    Yes, as long as you have a legal right to be where you are, what you witness is perfectly acceptable.

    I know there are gray areas like looking into windows from the road, and so on. But if you have a legal right to be where you are, what you witness from there is acceptable, and can be used as evidence.

    If you do your "email snooping" while burglarizing an office, that's a crime.

    --
    -fb Everything not expressly forbidden is now mandatory.
  41. What about Google, Yahoo by lingoman · · Score: 2, Insightful

    OK, I know that when you sign up the fine print gives them to right to study your emails. And I know that it's not a human being, but an automaton reading the email, and directing spam toward your screen. The Telcos are drifting in that direction. Ha, the NSA has plenty of company. And what happens when their (Google, Verizon, and the NSA) software gets good enough to be called intelligent?

    Even if prosecutors aren't interested if you sign your right to privacy away, but this a good place to discuss the bigger picture.

  42. At what point... by nick_davison · · Score: 2, Interesting

    At what point does a privacy breach demand punishment?

    The problem's in the question.

    If you look for a single point, you create a system where it reinforces bad behavior...

    Minor breach: "You pesky perisher, you!" "Hmm, guess I can do it again, no consequences."

    Medium breach: "Tut, tut, very naughty!" "Hmm, guess I can do it again, no consequences."

    Major breach: "That was very naught!" "Hmm, still no consequences, this shit really is risk free."

    Marginally less major breach that someone makes an issue of, "YOU ARE EVIL, YOU MUST DIE!" "WHOA! That's kind of unfair. No one had an issue before!"

    Instead of reinforcing that a behavior is consequence free, how about an escalating scale that allows for minor infractions to be punished suitably, ensuring most people learn before major punishments become necessary and those that do get the major punishments truly deserve them.

    Make every case of a snooping ex punishable by a $500, easy to obtain, civil judgment in small claims - with more serious ones slowly gaining criminal records, probation, jail time, etc. Let them know that there are consequences there and then you likely won't have them learning it's OK and your giving a sudden and apparently inconsistent sentence when they do it hundreds of times, accessing more sensitive information.

  43. Re:Is going to have him in civil and criminal trou by Tuoqui · · Score: 1

    Any access through an insecure email service (Hotmail, Gmail both do not use https for anything other than for login credentials as far as I can tell) is just asking for this to happen to you. The fact he used a keylogger is irrelevant. He could have just as easily been 2 routers upstream sniffing traffic with wireshark and done the same thing.

    --
    09F911029D74E35BD84156C5635688C0
    +2 Troll is Slashdot's way of saying groupthink is confused
  44. It's also a matter of ownership by Sycraft-fu · · Score: 3, Interesting

    The company owns the computers and network, that gives them a right to monitor it and decide who gets access to what. It is the same at your house, in many (most?) states. I can, if I wish, bug my house. I can have cameras record everything, I can tap my own phones, etc. It's my house, so I can do what I please. However I can't bug YOUR house, at least not without your permission. To do so is a fairly serious crime.

    Basically, I have an expectation of privacy in my house, but you don't. Likewise you have an expectation of privacy in your house, but I don't. If it is your stuff, you get to determine how it is used, how it is watched and so on. You don't get to make that determination for someone else though. Thus a company can monitor what you do at work, but not at home. If they want to install monitoring software on your work computer, that's their right. If they try to install it on your home computer without your permission, that's breaking the law.

    1. Re:It's also a matter of ownership by coolsnowmen · · Score: 1

      Thus a company can monitor what you do at work, but not at home. If they want to install monitoring software on your work computer, that's their right. If they try to install it on your home computer without your permission, that's breaking the law.

      How does drug testing fit into all that then?
      Even the GAP drug tests, and you basically have to be high to want that job.

    2. Re:It's also a matter of ownership by Repossessed · · Score: 1

      IANAL

      In Utah at least, you would be in violation of the law to make audio recordings of me in your own home. (Utah law requires explicit consent of at least one party to the conversation, and that if a party to the conversation is doing the recording, that other parties be informed).

      More interesting, federal law dictates that the more stringent law always applies for interstate communication. So if you bug you own phone, and a guest calls me in Utah, you again become liable, our laws cover email as well, which makes my companies snooping practices in violation. The really stupid thing is, if they just changed the line 'monitor your activity' to 'monitor and record your activity' in their AUP they'd be airtight. At least until I find a state where both parties have to be informed or somesuch.

      I could be wrong about the legal definition of 'monitor' though.

      --
      Liberte, Egalite, Fraternite (TM)
  45. Shoulder surfing by Paracelcus · · Score: 4, Informative

    The protocol at IBM used to be swiveling around when a user was entering their password(s), towards the end (of my career) I noticed that the young crowd no longer did this but seemed to watch intently everything you typed. I wrote up (disciplined) several trainee techs for this. While your tinfoil hat may or may not be necessary, those privacy screen gizmo's are a good idea and if anybody is standing where they can see your keyboard move to block their view when typing passwords, etc.

    --
    I killed da wabbit -Elmer Fudd
  46. Re:Is going to have him in civil and criminal trou by Kalriath · · Score: 1

    Gmail will use SSL for the actual email IF (and only if) you get to it by typing https://www.gmail.com/ rather than http://www.gmail.com/ (this gives you a certificate error though, you really need to use https://mail.google.com/ - it will stay on whatever protocol you initially access it with.

    --
    For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
  47. SSL on the connection solves a narrow problem by igb · · Score: 1
    If your opponent is your email provider, someone who has a means to obtain your account password, or someone who has the means to obtain a warrant, SSL on the connection to your mailbox is worthless. In all of those scenarios, your opponent will obtain the data direct from your mailbox, no snooping of the connection required. Yes, it will protect against an active snooping attack, but those are less likely scenarios. In very, very general terms, you should ensure you have protected data at rest before you worry about data in motion.

    And handily, if you PGP your mail (or S/MIME, if you must) that protects the data at rest _and_ the data in motion. The only benefit of using SSL then it to protect your password, and if you're not using either APOP or one of the MD5 IMAP authentication styles then indeed it's worth doing. But the PGP is numbers one, two and three on your list.

    ian

    1. Re:SSL on the connection solves a narrow problem by Klaus_1250 · · Score: 1

      PGP should come on the list first, I agree, but it is also the most difficult method for people (non-geeks) to employ. In fact, I don't know anyone who uses PGP. But PGP does not protect everything, such as the email-headers. Even with PGP, you still leak potentially private data.

      With only SSL, your ISP, authorities and such can still read all your data, but it does protect mail in transit from third parties. For many people (non-geeks) this is the thing to worry about. I know plenty of people who will read their non-SSL'd mail over open WiFi-accesspoints or other public networks.

      Of course, there is much more to email-security than just PGP and SSL. Many email-providers/ISP's do not use SSL-connections for SMTP between each other either. DNS isn't fool-proof, ip-addresses can get hijacked. All your mail sits in the mailbox of the ISP relatively unprotected, e.g. not all email-providers use disk-encryption (doesn't happen often, but servers do get stolen once in a while), etc.

      --
      It only takes one man to change the Wisdom of the Crowd to Tyranny of the Masses.
  48. Wrong by Anonymous Coward · · Score: 0

    Consult a local lawyer, etc., but I'm studying for my CISSP and it touches on much of this.

    Your employer can look at your email since you agreed to it. They almost certainly have the right to do so anyway, but local laws might throw a wrench in that so it's standard practice to have you sign a consent form as part of your employment package.

    Your ISP definitely can't look at your email without your consent or legitimate court order. [Hear that, DHS?]. Their computers and network, but they have no right to look at the content beyond what you agreed to. Of course you agreed to some access when you got the account, but it should have only covered things like the right to back up the mail server. (There's also some very... reality-impaired... distinctions between 'mail in motion' (which is highly protected) and 'mail at rest', even if the latter is just sitting in your mail folder for a few minutes until your home system snarfs it up.)

    On the phone, it definitely comes down to local law. I think everywhere requires that at least one party know that the phone call is being recorded, and in many jurisdictions both parties have to know. It doesn't matter that it's your house, you gotta tell him that his call may be recorded.

    On the general expectation of privacy, it again comes down to local law. Most places will give you a "reasonable expectation of privacy" in, e.g., a bathroom. Even in somebody else's home.

    That's not all. You also trip federal wiretapping laws if you record sound in public places even when they're privately owned. That's why security cameras are silent -- one restaurant chain was nailed hard because their security system recorded sound. (Dennys? Perkins?).

    Did I mention you should check with a local lawyer?

  49. Re:Is going to have him in civil and criminal trou by Anonymous Coward · · Score: 0

    This is only partially true. There is an option in Gmail's settings that asks whether you want to use http or https.

  50. If it's a crime, it's a crime. by jcr · · Score: 1

    If it's enforced against civilians though, I want it enforced against government employees and contractors who do the same thing without warrants.

    -jcr

    --
    The only title of honor that a tyrant can grant is "Enemy of the State."
  51. Re:Is not it a federal crime to interfer or open . by Anonymous Coward · · Score: 0

    With snailmail, the government guarantees the timely and confidential delivery of your message,

    You gotta be kidding me. Are you talking about the POST OFFICE? The post office guarantees nothing.

    More than once I've received mail addressed to neighbors. I even once received someone else's passport by certified mail. I was nice enough to report it.

  52. Not 100 Percent Correct by fast+turtle · · Score: 1

    A couple of area's they get upset with your for Vid-Cam usage is the bathroom and any bedroom. Otherwise you're fine to bug/video monitor any public area of your own home.

    --
    Mod me up/Mod me down: I wont frown as I've no crown
  53. Re:Anger. by philspear · · Score: 1

    They also typically contribute less to political campaigns.

  54. Over five hundred times? by Ophion · · Score: 1

    Even once is too much. Break into someone else's account, even if doing so is easy, and go to jail. It really must be that simple, as this is unconscionable behavior.

  55. True in Switzerland by Anonymous Coward · · Score: 1, Interesting

    Disclaimer: Posting as AC so that current employer will not recognise me.

    here in switzerland, there is no legal distinction between email and snail mail. Both of them are covered by a law known as breifgeheimnis, and opening or viewing either belonging to another person will get you into serious legal trouble.

    I was accused in a previous job of accessing the boss' email (I was a sysadmin, and he had actually asked me to look why his email wasn't functioning correctly). It was pretext to fire me and I had of course looked at his email having been asked to do so, and he denied having asked me to do so.

    In the end I couldn't defend myself and he couldn't prosecute (after my lawyer contacted his lawyer) but I had to go in any case.

    Moral: Be VERY careful when accessing other people's email. Make sure, that if you do because you are asked to, that there are witnesses.

  56. just a few laws broken by stanjam · · Score: 1

    Got to be careful. There are a number of laws that you can get busted on in this one. If you really can't resist snooping into email, then get into Information Security or systems administration. Then you can do it legally, if your policies are set up properly.

    --
    Open Source: Eroding the Digital Divide
  57. Re:Anger. by genericpoweruser · · Score: 1

    Twitter never mentions Windows or Microsoft--he only mentions Windoze and Micro$haft.

    --
    A fool and his lamb are worth two in the bush.
  58. Re:Anger. by Anonymous Coward · · Score: 0

    That was the best thing I have read on /. in years. However, I am obliged to hate you for ruining my screen.

  59. EFF and ACLU mistakes,. by freedom_india · · Score: 1

    The lawyers for EFF and ACLU made an initial mistake when suing about privacy.
    They should have equated reading email as similar to postal mail except it is speedy.
    This is similar to how railroads established acquiring legal rights of corporations as a person.
    If ACLU and EFF had set a couple of precedents for email as faster postal mail (ya, it is dumb, but then judges need a precedence), then it would be easier to sue governments for opening up mail.
    Instead these two organisations tried to make it as a new front, thus enabling the government and corporates to use their muscle to remove email from postal mail snooping laws.
    Otherwise, Amex and VISa would long have been criminally convicted for mail snooping.

    --
    "Doing what i can, with what i have." ~ Burt Gummer
  60. Re:Anger. by trimmer · · Score: 0

    Something happened to him. Just look at his latest post history. Interesting, Insightful, Informative... you can hardly find a Troll post anymore. Maybe he got tired of trolling?

  61. Re:Is not it a federal crime to interfer or open . by Anonymous Coward · · Score: 0

    One day I had to overnight a letter (it was to a P.O. box, so I couuld not use FedEx). The guy at the counter spent about 5 minutes telling me why the letter might not get there overnight, despite it being "overnight" service.

  62. I thought that by Cro+Magnon · · Score: 1

    if we couldn't snoop on our cow-orkers email, the Terrorists (tm) would win!

    --
    Slow down, cowboy! It has been 4 hours since you last posted. You must wait another few hours.