Where To Draw the Line When Punishing Email Snooping?

CWmike writes "While it might seem like a practical joke or a harmless, furtive glance, e-mail snooping could land you in more hot water than you'd ever expect — you could be charged with a federal crime. The recent case of a Philadelphia TV news anchor charged with breaking into his co-anchor's e-mail accounts shines a light on the seriousness of such snooping. Scott Christie, a former federal prosecutor who headed up the computer hacking section at the U.S. Attorney's Office, said, 'You look over someone's shoulder and read a personal letter and that's not a crime, so how can it be a crime to access someone's e-mail? It's not the same thing, of course... What you're doing when you're accessing e-mail is affirmatively exceeding your access to electronic documents and systems.' He adds: 'Usually, you're doing that by pretending to be that person to break into their account.'" It's worth noting that the Philadelphia man accessed his co-worker's email over 500 times, and his use of the information he found was hardly harmless. However, the rules and conventions for email privacy are much less familiar to most people than the laws regarding snail mail. At what point does a privacy breach demand punishment?

Comments

Privacy?

[BSAtHome]

At what point does a privacy breach demand punishment?

Wasn't privacy declared dead some time ago? So, no punishment, I guess...

Re:Privacy?

[KingSkippus]

Good point.

When companies systematically reads our e-mail, we've gotten desensitized to the point where we just don't care any more. When your cubicle neighbor does, though, they (literally) make a federal case of it.

Privacy? What privacy? It's just one more person knowing all the stupid little nitpicky details about my life. The best idea is to simply hole up somewhere and live the life of a hermit.

Re:Privacy?

[causality]

At what point does a privacy breach demand punishment?

Wasn't privacy declared dead some time ago? So, no punishment, I guess...

It certainly is dead if we don't stand up and demand it and if we choose not to punish those who violate it. We do have a choice in the matter, you know. We don't have to just sit back and do nothing and watch it slowly erode.

Of course the other angle is that there is plenty you can do to make your communications and your systems much more difficult to compromise. You can use encryption, you can refuse to use free services like Hotmail and Gmail for sensitive data, you can follow good security practices for how you administer your computer. You can also assume that someone somewhere really might target you, which that co-worker mentioned in the summary almost certainly did not do until it became evident that this was the case. Privacy is very much like freedom; the price is vigilance.

Re:Privacy?

[perlchild]

When a company does it, it's "usually" not without your knowledge. (As in, you've agreed to it) You can also quit over it, but would you quit over it if they don't fire the cubicle mate that reads your email?

Re:Privacy?

[TFGeditor]

I wonder what this portends for mail server admins? I am admin for my small company's server, and therefore have access to everyone's mail. I do not snoop, but I could. Is "I was just doing my job" a credible defense?

Re:Privacy?

[dgatwood]

And even if it is without your knowledge, the federal government won't lift a finger because that's a civil issue between you and them. Translation: we'll only help you protect yourselves against invasion of your privacy by individuals because they aren't as generous with their lobbying dollars. The government these days is pretty thoroughly in the back pockets of the corporate world. Expecting them to do anything to defend you against their buddies is like expecting the corporations not to sell your personal info if it will make them a quick buck.

Re:Privacy?

[Leading Stoker]

The government these days is pretty thoroughly in the back pockets of the corporate world. Expecting them to do anything to defend you against their buddies is like expecting the corporations not to sell your personal info if it will make them a quick buck.

That's why we're all in the situation in the first place. Corporate and Government need each other, and feed off each other, which each vying for more power. Every day some right that was so fought before to keep, is relinquished to be part of the herd (e.g., "everyone else is doing or doing it so often, who cares?"). It's no wonder workplaces resemble pastures, complete with mud pies. :/

Re:Privacy?

[Provocateur]

The best idea is to simply hole up somewhere and live the life of a hermit.

You left out '...and come back when the wisdom and mad skillz of the Jedi are needed once more.'

Makes it more attractive to this demographic in particular. Well, I *did* have a brush with Marketing.

Re:Privacy?

[rtb61]

I think you will find it reflects a run around in privacy. Politicians and the rich are realising that the privacy invasive tactics they use to exploit others can also be readily used against them, hence, there is a major change in attitude developing towards privacy. While this change in attitude has been some what schizophrenic due to the RIAA and the MPAA, as well as, lobbyist paid for by privacy invasive companies, oddly enough while those self same lobbyist are desperately trying to keep their own activities hidden and private, just as those companies invading other peoples privacy want to keep their activities secret.

So private email is not a postcard and those googlites who believe so could find them selves at variance to future far stricter privacy laws and social sites will find them selves increasingly under scrutiny and when it comes to invading the privacy of minors who can not make legally binding contractual agreements.

With this is of course is the distinction between work email and private email, email received and sent on company equipment during company time is the property of the company and not the individual sending or receiving it, especially as the individual has been paid to create, send and receive said email.

So for those companies and individuals who generate a substantial portion of the income by invading the privacy of others, diversify or die ;).

Re:Privacy?

[stiggle]

So are they going to start hitting private investigators who are 'pretexting' with the same level of charges? What is the difference between pretending to be someone else to access their email, be it with cracked passwords, and pretending to be someone else to access their finance, phone and utility records. Could you also hit MediaSentry (or whatever the RIAA snoopers are called these days) with the same charges?

Re:Privacy?

[gurps_npc]

The fact that it 'usually' not without your knowledge is irrelevant. If it is done once without your knowledge, than that should be what we are talking apart It's sort of like saying "usually the cops don't knock people off a bike and claim the bike guy rammed them"

Re:Privacy?

[rtechie]

would you quit over it if they don't fire the cubicle mate that reads your email?

I'm assuming you cubicle mate isn't an authorized mail administrator.

In your scenario you wouldn't quit, you'd sue the company. It's negligence on the part of the company. I'd draw an analogy with sexual harassment, if the company is informed that an employee is sexually harassing other employees and they do nothing about it, they take on the liability of the employee's actions. In fact, there really isn't any requirement to inform because companies have tried to weasel out of liability by claiming they were never informed (lying). The standard is actually "they should have known". Or even "There was no way they could have known, but they are still liable because they were inadequately monitoring their employees to begin with".

Basically, if they don't immediately fire the employee that looked at your email they're looking at liability.

Re:Privacy?

[perlchild]

I meant "usually" in the sense that even if companies would systematically put it in the contract, not everyone reads, or understands such provisions...

Larry Mendte's real crime

[Anonymous Coward]

He is alleged not only to have accessed her account 100's of times, but he is also accused of leaking emailed conversations she had with her lawyer.

You could say that it is stupid to have such conversations over email, but this was hardly "just looking over your shoulder."

It is making for some drama in Philly.

Re:Larry Mendte's real crime

[causality]

You could say that it is stupid to have such conversations over email, but this was hardly "just looking over your shoulder."

Sometimes shit just happens. Really. But most of the time that I see anything bad happen to anyone, they were doing something stupid. Something stupid that either directly caused the situation, or made it much worse than it had to be. That includes me, by the way -- if I have an advantage over others it's that I can admit this and see these things as lessons to learn from instead of treating everything as though it's random chance, as though my choices have no impact on what happens to me. Poor decision-making remains the number one cause of most peoples' problems, which is a good thing in a way because it's preventable.

Try explaining this to most people, though, and see how far you get. Instead of saying "the power to change things for the better is in my hands" they say "so you're trying to blame this all on me?!" and they completely miss the point. Even if you don't directly cause things that happen to you, there is such a thing as making yourself available and allowing room for things to happen. It's disheartening because the way most people respond to anyone who says this leads me to believe that most of them want to be victims. When that's the case, they tend to get what they want.

Re:Larry Mendte's real crime

[rohan972]

Try explaining this to most people, though, and see how far you get. Instead of saying "the power to change things for the better is in my hands" they say "so you're trying to blame this all on me?!" and they completely miss the point.

I've found this too. It only really seems to work if you have a very solid relationship with that person so they are confident of your goodwill. Possibly talking about it in relation to events that are long gone would evoke a less emotional response, or in relation to something that happened to someone else, so they can understand the principle without getting upset before applying it to their own situation.

It's disheartening because the way most people respond to anyone who says this leads me to believe that most of them want to be victims.

I think it's to do with people's focus, past or future. For someone focussed on the past, since it can't be changed the only thing left is to apportion blame. Their self respect demands that they are not to blame. For someone focussed on the future, they want to influence that future for their benefit so they seek responsibility (the ability to respond). Their self respect demands that they do all they can. How to change this focus in someone else? I don't know.

Re:Larry Mendte's real crime

[causality]

Thank you for such a well thought-out, real answer. I suppose our only difference is that, within the very narrow scope of "is this the truth?" (not nearly the same question as "do I want to date this person"!) I am not concerned with being confident of anyone's goodwill. I simply don't believe what people say unless I can independently verify it or it's consistent with what I already know to be true, so for me, worrying about their intentions is an unproductive trap I try pretty hard to never fall into. I say that knowing that you probably weren't describing yourself but rather the folks who react badly to anyone who tells them they are not really victims, so I am really explaining why I think they need not concern themselves with that. Anyway, I call it a trap because it takes you out of a potential "discernment" mode and places you into a "do I like this person" mode which tends to make everything a popularity contest. There are plenty of people who may not like you, may in fact hate your guts or may be completely indifferent to you from whom you can still learn something if only you can get past your personal feelings long enough to listen. We limit ourselves in so many arbitrary ways that just don't have to be the case. Having likes and dislikes is fine but letting them rule your life and filter your knowledge for you is neither desirable nor necessary.

I also feel that adults should not call themselves mature (although many will falsely do so, because it sounds good) until they can deal with something without allowing their judgment to become clouded by an emotional response. That is, have your emotions but don't be a slave to them. Beyond that, I understand rather well the thought processes behind trying to protect that precious little ego and worrying about self-respect and apportioning blame, I just don't consider them to be valid. To me they are aberrations and most people have the misfortune of believing that only relatively rare phenomena can possibly be aberrant, that if most human beings participate in something then it can't possibly be a disease (dis-ease) state.

So, I say what I believe to be true. If it upsets someone, no one forced them to react that way to something they could have chosen not to listen to. If a contrary opinion is really such an irritant, consider that with over 6.5 billion people in the world, that's a lot of convincing to do before the easily offended can finally relax. So let them get offended; perhaps someone else will hear their tantrums and indulge them even if I personally don't wish to do them such a disservice. In spite of all of this, yes I still think it's unfortunate that the victim mentality is in no danger of extinction. I still think that we, collectively, waste a lot of energy on things which are beneath us. I also think that no effort is ever wasted despite all appearances, and that there is an increasing number of people like you who generally seem to understand these things.

Now, I believe that the above are largely matters of opinion or personal style. You have to decide for yourself how you want to feel about it; this is not where I can use a mathematical proof to decisively declare that one of us is right and the other is wrong. Not at all. So, please don't think that anything I am saying here is intended to argue with you. In this instance, that is not my place. The purpose was more to explain how I feel about it, since you were kind enough to do the same (and it didn't start out being this long-winded, I swear!). I am not being sarcastic or facetious in the slightest when I tell you that I am thankful for your response. I wish there were more like it.

The line is fine

[clang_jangle]

From TFA:

"I don't think people are of the understanding that this type of conduct is a crime," said Scott Christie, a former federal prosecutor who headed up the computer hacking and intellectual property section at the U.S. Attorney's Office in New Jersey.

The other FA goes on to state that the reporter being charged accessed his coworker's email over 500 times ! So IMO it is really not possible to "go too far" punishing someone with that level of utter disregard for the rights of others. According to wiki.answers:
"The deliberate withholding and/or opening of US mail that is addressed to another party is a violation of federal law. The penalty for tampering with US mail is a maximum of 5 years in a federal facility and/or a $250,000 fine."
Sounds reasonable to me. The thing I find incredible is that people aren't making that correlation between email snooping and tampering with the mail? Oh well, ignorance of the law has never been an excuse for violating it. Maybe after a few people get big sentences and fines for their asshattery everyone will know it is illegal.

Re:The line is fine

[socsoc]

Except that e-mail is not US mail. You're confusing law about the US Postal Service (so snail mail) with e-mail.

Re:The line is fine

[clang_jangle]

No, that's an incorrect assumption. What I'm doing is pointing out the equivalence of purpose, i.e., personal, private communication. It just didn't occur to me I had to specify it, as it struck me as rather obvious.

Re:The line is fine

[clang_jangle]

It is just as illegal to intercept US mail in order to open it, read or photocopy it, reseal it, and send it on to its destination. So that difference doesn't exist, and deletion/theft is not the line. Privacy is the line.

Re:The line is fine

[Klaus_1250]

Not sure how the law in the US is, but there are countries (in Europe at least) where email falls under the the same laws as for snail mail. Which makes sense to me, except that you cannot drop bulk-mail silently (even though there is some logic to that too).

What people need to understand is that your standard email has roughly the same privacy as sending a postcard with text on the back. There is no envelope, no seal, no nothing. The only thing that "protects" you privacy is that you need an password to log-in to your POP/IMAP/Exchange account, which is roughly the same as having a lock on your Postbox. But it is still not private, as the mailman can still read your mails as well as anyone else in the chain.

If people really want privacy for their email, they need to use a SSL-connection to their POP/IMAP/SMTP/Exchange accounts and encrypt all their email through PGP/GnuPG.

Re:The line is fine

[socsoc]

It may be obvious to you, but that isn't covered under the law that you are quoting. Also, one of the allegedly accessed accounts was a corporate account and although it shouldn't be accessed by a co-worker, it belongs to the company and so does any associated messages.

Going back to your wiki.answers source, there can't be any ignorance of a law when the said law is not applicable.

Re:The line is fine

[Anonymous Coward]

Way to miss the point. OP was saying in essences, "email should get the same protection snail mail gets". A common sense solution, IOW. Sadly (as your post illustrates), common sense just isn't all that common. :(
  In any event, the perp had to commit fraud in order to read his coworker's email, and there are certainly laws against that.

Re:The line is fine

[Teun]

Indeed, here in The Netherlands the comparisson with a postcard is usual.

At the same time companies are required to have their own privacy policies and instruckt their employees about it. A company might write in their rules that privacy is not guaranteed as you are using company equipment, they are still not permitted to snoop unless it is agreed upon with the in-house works council and there is proper cause.

Re:The line is fine

[SkyDude]

Way to miss the point. OP was saying in essences, "email should get the same protection snail mail gets". A common sense solution, IOW. Sadly (as your post illustrates), common sense just isn't all that common. :( In any event, the perp had to commit fraud in order to read his coworker's email, and there are certainly laws against that.

US Courts have already held that a business can view an employee's email account, and that the employee has no right to privacy. That doesn't mean anyone in the business can read another employee's email, but trying to give employer-owned email the same kind of protection afforded US Mail isn't going to happen anytime in the foreseeable future.

Re:The line is fine

[rohan972]

The difference is in who owns the mail. Send a personal letter, your company can't open it. Send a letter on company letterhead and they can. I think you'd find a different response in court to the company accessing your personal email account than when they access your company email account.

When I log on to the company network, there's a pop-up which states [paraphrased] "We watch everything you do and can read every file and email, this is for work, not personal use." There is some tolerance for personal use in practise, but if you use it for something you'd be upset about them seeing it would have to be your own fault in my opinion.

Re:The line is fine

[SkyDude]

The difference is in who owns the mail. Send a personal letter, your company can't open it. Send a letter on company letterhead and they can.

Ownership is not the test. Let's say you bring a utility bill to work with the intention of purchasing a stamp for the letter. Your boss sees the envelope and demands to see it. Until it has a stamp on it, the boss could insist on opening and examining the envelope to insure it doesn't contain any trade secrets. Once a stamp is on it, it gains Federal protection, in most cases. Certain high security places would prohibit personal mail of any kind and could demand to open the envelope, if you agreed to such during the hiring process. It doesn't have to pass through the USPS first, the stamp is the protection.

In reality, few of us are ever going to be in such a situation. I've learned over the last few years that the days when doing personal business at work are quickly disappearing. While the employer probably would be in the wrong to crack your personal web email account, the simplest way to avoid an issue is to not read your personal email at work. If one can afford it, receive personal stuff on your cell phone. But, as we know, there are places where cell phones are banned too, mostly due to the cameras in phones.

Best bet is to leave the personal stuff at home or find a more open-minded employer.

Re:The line is fine

[rohan972]

Ownership is not the test. Let's say you bring a utility bill to work with the intention of purchasing a stamp for the letter. Your boss sees the envelope and demands to see it. Until it has a stamp on it, the boss could insist on opening and examining the envelope to insure it doesn't contain any trade secrets. Once a stamp is on it, it gains Federal protection, in most cases.

And yet if that envelope is a company branded envelope, the boss can still open it, being company mail. Ownership is still a test, perhaps not the test, as you say. Probably until it has a stamp it doesn't qualify as mail and therefore comes under different laws, I don't know, it hasn't been a problem for me.

Best bet is to leave the personal stuff at home or find a more open-minded employer.

Spot on.

Re:The line is fine

[thegermanpolice]

I think that there is a more interesting point.

Who paid for the stamp?

If the company did, then the letter is from the company to the recipient, therefore, the company would be entitled to look inside the letter.

Re:The line is fine

[rohan972]

Probably not, as the stamp doesn't identify the sender as the company, the letterhead etc does. It would just mean it was a stolen stamp.

Is not it a federal crime to interfer or open ....

[3seas]

.... anothers snailmail?

then of course email should be treated the same, as it is private communication between sender and receiver.

Stupid analogy

[phorm]

You look over someone's shoulder and read a personal letter and that's not a crime, so how can it be a crime to access someone's e-mail

Talk about apples to oranges.

If you read somebody's letter over their shoulder, not a crime. If you read somebody email over their shoulder, same thing.

If you break into their postbox and open their mail, that would be more comparable to actually entering somebody's account without permission to read email...

Same as physical mail why not?

[apathy maybe]

Just make the deterrent/punishment the same as accessing someone's paper mail without permission.

Sure, in some cases you have to pretend "to be that person to break into their account", in which case you might throw a bit of "fraud" at them as well, but in most cases, accessing snail mail and accessing physical mail are similar enough.

If you are reading something over someone's shoulder, they can tell you to piss off, cover it up or whatever. The difference is actually going to the mail box (whether it be physical or electronic) and accessing what is in it.

Oh yeah, I guess it might be slightly harder to prove that someone has accessed the electronic box (because they don't have to open any envelopes), but considering you should be treating email as you would post cards anyway... (That is, anyone between you and the destination can read it, unless you take measures to encrypt it or something.)

-----
Disclaimer, I don't believe the state should exist. However, my opinions expressed above are given on the condition that my belief is suspended for the time being.

Re:"Over 500 times"

[clang_jangle]

Assuming someone set it up as a POP account to download every minute

That seems like a silly argument. The default is usually every 10 minutes or more, isn't it? I would expect most mail servers to block an IP scheduling a check every minute. I know mine would.

What about family?

[Anonymous Coward]

Email snooping doesn't exclusively occur in the workplace- what if this furtive reading of emails occurs within the home? i.e. in the midst of a divorce, one party accesses the others email in an attempt to get material to use against them in court? Is that means for punishment as well?

Re:Dong

[clang_jangle]

you're dong

It's your dong, silly git!

Email == Postcards

[Anonymous Coward]

After beating my head against the wall trying to get my company to enforce strong passwords, I instead started advising my employer to not put anything in an email he doesn't want someone else to read. Use the phone and FAX instead.

What this guy did was obviously against the law (the impersonating part, not the email reading part), but if he gets a good lawyer he'll get off with a small fine and some community service time counseling kids not to put anything in email they don't want others to see.

Re:"Over 500 times"

[Anonymous Coward]

Oh, Mendte wasn't checking automatically, it was a webmail account. The logs were made public, and revealed that Mendte was quite obsessive about checking Lane's mail.

Mendte apparently put a physical keylogger on one of the computers Lane used in the newsroom, and got her account details. The only reason he got caught was because he got sloppy-- in (IIRC) March, he left a computer in the newsroom logged into Lane's webmail. Someone else working at the station saw it, thought it odd since Lane had been fired in January, and reported it.

This has been ridiculously huge news in Philadelphia and even managed to push the "hot chick and her boyfriend who stole people's identities" stuff off the front page for a while.

Simple

[schnikies79]

It should be the same as physically opening up someone else's mail from the snail-mail box. Being electronic changes nothing.

Sec. 1702. - Obstruction of correspondence

Whoever takes any letter, postal card, or package out of any post office or any authorized depository for mail matter, or from any letter or mail carrier, or which has been in any post office or authorized depository, or in the custody of any letter or mail carrier, before it has been delivered to the person to whom it was directed, with design to obstruct the correspondence, or to pry into the business or secrets of another, or opens, secretes, embezzles, or destroys the same, shall be fined under this title or imprisoned not more than five years, or both.

Re:Simple

[Zadaz]

So what you're saying is that we should be allowed to snoop all we want as long as it's email that is marked as "read".

Hmm.

Re:Simple

[Jack9]

Email is more complicated than the us postal system. Email is not regulated, controlled, operated by the public. In fact, it's often unclear who controls the email servers since anyone can set them up and use them. Imagine a postal system that any person OR ENTITY (including foreign interests) can set up and operate. That's what we're talking about. You cannot apply the same rules.

Crappy journalism - par for the course

[DNS-and-BIND]

"While it might seem like a practical joke or a harmless, furtive glance, e-mail snooping could land you in more hot water than you'd ever expect you could be charged with a federal crime."

Sigh. They are NOT repeat NOT talking about looking over someone's shoulder, or a furtive glance. They're talking about logging into another's email account and making the (damaging) contents public. But hey, this sort of confusion is what I expect from journalists - doesn't matter if they work for the New York Times or the Daily Shopper, they're all pretty much the same.

Re:Crappy journalism - par for the course

[PJ1216]

It wasn't the journalist who made the analogy, it was a quote from a former federal prosecutor who headed up the computer hacking section of the US Attorney's office. Before attacking something, read it more carefully first to ensure your attack is actually justified.

Re:Crappy journalism - par for the course

[DNS-and-BIND]

Right - because journalists are paragons of accuracy. If it's misleading, it shouldn't be in the story whatsoever. Of course, I'm not a journalist, so what do I know about writing a story.

Flawed analogy

[cheebie]

The "looking over the shoulder" vs. "read someone's email" analogy is flawed. This would need to be two separate analogies. Looking over their shoulder to read a letter vs. looking over their shoulder to read an email on the screen, and accessing someone's email account vs. breaking onto their house and reading the letters they keep in a drawer in their bedroom.

The former is rude, but not generally prosecuted. The latter is a crime.

P.S. How this probably came to light

[Anonymous Coward]

Alica Lane was busted in NYC after getting into a fight with a woman who turned out to be an undercover cop.

I suspect that this is the only reason why the monitoring even came to light. And if the conversations with the lawyer hadn't been leaked, this propably wouldn't have become such a big deal.

When does it become a crime?

[Bieeanda]

How about 'Immediately'. This is no different than any other act of hacking or social engineering, it is gaining access to personal data under false pretenses. People seem to be under the misapprehension that since it affects non-tangible documents, it is non-harmful.

Make it prosecutable on the first offense, and pursue those cases vigorously. That is the only way that people will learn to not fuck with someone else's e-mail.

Re:When does it become a crime?

[b4upoo]

How large do you want prisons to get? These days, because of high gas prices, people are riding scooters and bicycles quite a bit. We need to put people who steal bikes and scooters away for a long time. But can we? We can't even keep major criminals locked up due to the high cost of prisons.House arrest is a joke. Who pays for the house, food. etc.. Society doesn't like chain gangs anymore. But in the south we ran prisons on the cheap with chain gang labor. They even raised their own food etc..

Re:How did he get the credentials?

[socsoc]

An earlier AC posted some info that definitely isn't in TFA... Maybe an inside source? http://yro.slashdot.org/comments.pl?sid=634517&cid=24457275

Is there even a story here?

[GroeFaZ]

You read someone's snail mail without permission - it is an action punishable by law. You read someone's electronic mail without permission - it should very much be punishable by law, because the punishable action of reading snail mail is not that you read a letter written on paper, but that you read information addressed to someone else than you.

And privacy is only as dead as anyone wants it to be. If you say, go ahead, here are my login and password, read my mail, fine. But you know what? Some politicians in Germany have argued in favour of the infamous law for mass data retention. They have done so on this exact argument, that "on the Internet, everybody gives away all private information anyway."

Bullshit!

Re:Is not it a federal crime to interfer or open .

[janeuner]

US Mail and E-Mail are fundamentally different. With snailmail, the government guarantees the timely and confidential delivery of your message, and it is a federal crime for a third party to interfere with that contract. Contrast that against E-Mail, where confidentiality is never guaranteed - consider every virus scanner and Junk Mail filter along the transmission path. However, when a third party breaks into an email account, a different crime is being committed - identity theft.
Laws that specifically protect US Mail should not apply to crimes involving electronic mail. The act of impersonating the victim should be sufficient for prosecuting the offender.

Re:Anger.

[causality]

Don't think that people are not furious at the big dumb companies and government officials who have violated them. Your cube mate is just less able to defend himself from your anger and is an easy scape goat for hypocritical government that wants to look like it is doing something right.

I can't believe you actually made one post without once mentioning Windows or Microsoft. So, who the hell are you and what have you done with the real Twitter?

Re:Is not it a federal crime to interfer or open .

[PJ1216]

So, if something isn't guaranteed (privacy), then it should be perfectly legal to do so? Confidentiality is guaranteed at times. Third-party services such as virus scanners and junk mail filters usually have privacy policies that guarantee you a certain level of privacy. US snail mail doesn't guarantee 100% privacy. Mail can and does get opened up on occasion if certain conditions are met (jail, military, etc.). So, even US snail mail has conditions on the privacy, as does email. Why are they fundamentally different? It's a breach of privacy and should be treated as such.

Re:How did he get the credentials?

[Anonymous Coward]

A weak password does not waive the expectation of privacy and security at all. The fact that it is a password (read security access device) should clue you in to that. Bad argument.

Re:How did he get the credentials?

[PJ1216]

Your defenses are still weak in general. If I give someone a key to my house, it doesn't mean I give them the right to come in whenever they want. If I have a key lock on my door that is easily cracked, it also doesn't mean my expectation of people not coming in is waived.

Re:Anger.

[tepples]

I can't believe you actually made one post without once mentioning Windows or Microsoft. So, who the hell are you and what have you done with the real Twitter?

Twitter hasn't been real ever since he started posting more than 140 characters.

Re:Anger.

[Anonymous Coward]

The real twitter has been found dead, it appears he has been bludgeoned to death with a chair. His /. account is now a microsoft sockpuppet.

Is going to have him in civil and criminal trouble

[toxic666]

Lawyers live by e-mail, so it wasn't stupid of her to use a supposedly secure personal web mail account in her situation.

Larry Mendte installed a hardware keystroke logger on her work computer to steal her username and password. Then, he started leaking embarrassing information to a reporter for the Daily News (one step above a tabloid in Philly).

When Alicia Lane (the victim) got into a scuffle in New York, the arresting officer exaggerated the charges; Lane entered a deal that would see the charges dropped after several months of good behavior. But with all the negative personal publicity from Mendte's leaks, the station fired her.

As part of her lawsuit against the station, her attorney contacted the FBI with a suspicion that someone was accessing her account and leaking information and the focus quickly turned to Mendte, who obsessively viewed her as a rival. The FBI decided to pursue it as a criminal case because it resulted in substantial damage (loss of an $800,000 per year job and serious damage to her reputation).

It isn't like she was using the company e-mail system to work with her lawyer. She was using a private web mail account. Her legal problems (and Mendte's leaks) threatened her job.

Please don't read other people's email,

[British]

the NSA doesn't like competition.

A crime, you say?

[Jager Dave]

So it is illegal for you to read someone else's email, or for them to read yours. Unless you work for the government or a telco. Then you don't need a warrant, permission, or even a reason, and you can do so without fear of repercussion. Thank you, Mr. Bush, for a lovely eight years....

same as

[celle]

Why haven't they just extended the laws for snail mail to cover email as it serves the same purpose. It's not like there isn't a major set of federal laws already on the books protecting the privacy of mail. Whether snail mail or email, it's still mail! Do it to a lot of things instead of creating new laws to do the same thing. Problem fixed, no new abusive laws need to be passed, of course then congress would have nothing to do and rail at or use to screw us out of our rights. For the paranoid, the laws are defined pretty well so there would be little likelyhood of extension into other areas leading to a potential totalitarian state. They kindof make it up as they go along anyway, whether lawmakers, judges, or prosecutors so whats the difference. Just look at the last few scotus decisions, or get inappropriately arrested for just standing on a corner and refusing to give id.(papers please) -- hogans heroes

Privacy Needs A Rethink!

[b4upoo]

Privacy is highly over rated. Much can be done for the greater good when the very concept of privacy vanishes. The really important idea is that all entities should be free to study and accumulate all information. That puts government, the citizen and business on equal footing.
        From the past I wonder just how much privacy an American Indian who spent his entire life with a tiny tribe experienced. Chances are everyone knew every little thing about every other member of the tribe. Did harm flow from that? I sort of doubt it.

Re: Privacy Needs A Rethink!

[WamBam]

I'm glad you feel that way. And since you feel that way, can I have your email address, SSN, bank account# and any or all passwords you might have? Thanks dude! Oh, and I'll, um, share my info with you later...

Re: Privacy Needs A Rethink!

[dbcad7]

I all for open source.. but I don't think I want an open source life.

What?

[slimjim8094]

There's something weird about the summary... there's an undercurrent of 'well people don't think it's wrong, but it is'

Hell yes it's wrong. Where do you draw the line? Why do you draw the line?

Especially because in this case it contained conversations with her lawyer. Why would anybody be going 'oh, well, we need to be careful to not overpunish here'...? I'd be worried about underpunishing.

It's like reading someone else's snail mail without their permission (a felony IIRC) except worse because you (almost) can't trace it and you can do it for every email

I hope he gets butthurt for this, and I still don't see why this is a question.

Re:How did he get the credentials?

[socsoc]

I disagree, giving someone a key to your house DOES give them the right to enter. Maybe not ethically without knocking, but they do legally have a right to enter your home.

Read your Email

[fireheadca]

I have a T-shirt that reads "I read your email".

Everyone who knows me has seen me wear that shirt at one time
or another.

I consider it fair warning.

Re:How did he get the credentials?

[Anonymous Coward]

You know, my mailbox doesn't even have a lock on it, all anyone has to do is open it to read all the letters inside. It's still a federal offense to do so. 'Expectation of privacy' applies to mail no matter how weakly it's protected.

Cognitive dissonance

[overshoot]

Isn't this the same government that reads our e-mails as a matter of course and tells the courts that intercepting electronic communications isn't as serious as reading someone's mail?

Stupid question.

[drolli]

if you look over the shoulder of your co-worker, it does not matter if hes watching a screen or a paper. If you break into his locked desk or hacking a password, this alone is a crime. If you open his unopened snail mail letter, in Germany this is also a crime, i think something similae may apply in US - i would appreciate if the lawa for e-mail could match this. If you use information from this act, well you could be facing all kinds of funny things, most likely civil charges (e.g. you forwarded his e-mails, which he sent privately to your boss, without beeing properly instructed to do so, snd the guy gets fired and you promoted imagine there may be something in that for him). And inside then company, there is only one way to handle it - if somebody spys on his coworkers withoput that beeing part of his job (by the rules and the laws), fire him. No second chance, There are a lot of things where you could be lenient. Surfing privatly etc.. But for reading the colleagues e-mail, the person has to go. If he was an admin, make sure he does not find another job easily.

Re:Is going to have him in civil and criminal trou

[Kent Recal]

$800.000 per year?

Cry me a river.
If I was her I'd just take the money from the previous years and call it a life.

Regardless of the e-mail snooping (which should be punished regardless) I think you deserve what you get when you make 800 grand a year on your looks and manners, yet throw it all away by calling a Cop (of all people) "a f---ing dyke".

These kind of articles make me think that (owning lots of) money must seriously melt your brain. I mean just look at that chick's face in the photo. Blown up to 800 grand meets Darwin I say. Yes, pun intended.

Re:How did he get the credentials?

[Idarubicin]

I disagree, giving someone a key to your house DOES give them the right to enter. Maybe not ethically without knocking, but they do legally have a right to enter your home.

The details will depend on jurisdiction, but no--the right to enter your home at any time does not necessarily come with the voluntarily-given key. If I gave the maid a key so she could clean once a week, she would be committing trespass if she used the key to enter my house at four in the morning. If I fired the maid but forgot to take my key back, she would be trespassing if she used the key again--even if she showed up on Tuesday morning and cleaned my kitchen. More generally, when a key is given it is often accompanied (explicitly or implicitly) by conditions determining the situations wherein its use would be appropriate. Mere possession of a key is not necessarily sufficient to grant the would-be trespasser the rights and privileges of an invitee.

Never Read Others Mail Without Their Consent

[aaaaaaargh!]

Well, at least were I come from, you're taught as a child that it's completely immoral to read someone else's mail without that person's consent. And I can't see why there should be any difference between snail mail and email. Reading someone's mail is on a par with breaking (seriously made) promises and oaths or being disloyal to friends when it has severe consequences for them. Decent people just don't do it, be it legal or not.

Re:Is not it a federal crime to interfer or open .

[fishbowl]

>So, if something isn't guaranteed (privacy), then it should be perfectly legal to do so?

Yes, as long as you have a legal right to be where you are, what you witness is perfectly acceptable.

I know there are gray areas like looking into windows from the road, and so on. But if you have a legal right to be where you are, what you witness from there is acceptable, and can be used as evidence.

If you do your "email snooping" while burglarizing an office, that's a crime.

What about Google, Yahoo

[lingoman]

OK, I know that when you sign up the fine print gives them to right to study your emails. And I know that it's not a human being, but an automaton reading the email, and directing spam toward your screen. The Telcos are drifting in that direction. Ha, the NSA has plenty of company. And what happens when their (Google, Verizon, and the NSA) software gets good enough to be called intelligent?

Even if prosecutors aren't interested if you sign your right to privacy away, but this a good place to discuss the bigger picture.

At what point...

[nick_davison]

At what point does a privacy breach demand punishment?

The problem's in the question.

If you look for a single point, you create a system where it reinforces bad behavior...

Minor breach: "You pesky perisher, you!" "Hmm, guess I can do it again, no consequences."

Medium breach: "Tut, tut, very naughty!" "Hmm, guess I can do it again, no consequences."

Major breach: "That was very naught!" "Hmm, still no consequences, this shit really is risk free."

Marginally less major breach that someone makes an issue of, "YOU ARE EVIL, YOU MUST DIE!" "WHOA! That's kind of unfair. No one had an issue before!"

Instead of reinforcing that a behavior is consequence free, how about an escalating scale that allows for minor infractions to be punished suitably, ensuring most people learn before major punishments become necessary and those that do get the major punishments truly deserve them.

Make every case of a snooping ex punishable by a $500, easy to obtain, civil judgment in small claims - with more serious ones slowly gaining criminal records, probation, jail time, etc. Let them know that there are consequences there and then you likely won't have them learning it's OK and your giving a sudden and apparently inconsistent sentence when they do it hundreds of times, accessing more sensitive information.

Re:Is going to have him in civil and criminal trou

[Tuoqui]

Any access through an insecure email service (Hotmail, Gmail both do not use https for anything other than for login credentials as far as I can tell) is just asking for this to happen to you. The fact he used a keylogger is irrelevant. He could have just as easily been 2 routers upstream sniffing traffic with wireshark and done the same thing.

It's also a matter of ownership

[Sycraft-fu]

The company owns the computers and network, that gives them a right to monitor it and decide who gets access to what. It is the same at your house, in many (most?) states. I can, if I wish, bug my house. I can have cameras record everything, I can tap my own phones, etc. It's my house, so I can do what I please. However I can't bug YOUR house, at least not without your permission. To do so is a fairly serious crime.

Basically, I have an expectation of privacy in my house, but you don't. Likewise you have an expectation of privacy in your house, but I don't. If it is your stuff, you get to determine how it is used, how it is watched and so on. You don't get to make that determination for someone else though. Thus a company can monitor what you do at work, but not at home. If they want to install monitoring software on your work computer, that's their right. If they try to install it on your home computer without your permission, that's breaking the law.

Re:It's also a matter of ownership

[coolsnowmen]

Thus a company can monitor what you do at work, but not at home. If they want to install monitoring software on your work computer, that's their right. If they try to install it on your home computer without your permission, that's breaking the law.

How does drug testing fit into all that then?
Even the GAP drug tests, and you basically have to be high to want that job.

Re:It's also a matter of ownership

[Repossessed]

IANAL

In Utah at least, you would be in violation of the law to make audio recordings of me in your own home. (Utah law requires explicit consent of at least one party to the conversation, and that if a party to the conversation is doing the recording, that other parties be informed).

More interesting, federal law dictates that the more stringent law always applies for interstate communication. So if you bug you own phone, and a guest calls me in Utah, you again become liable, our laws cover email as well, which makes my companies snooping practices in violation. The really stupid thing is, if they just changed the line 'monitor your activity' to 'monitor and record your activity' in their AUP they'd be airtight. At least until I find a state where both parties have to be informed or somesuch.

I could be wrong about the legal definition of 'monitor' though.

Shoulder surfing

[Paracelcus]

The protocol at IBM used to be swiveling around when a user was entering their password(s), towards the end (of my career) I noticed that the young crowd no longer did this but seemed to watch intently everything you typed. I wrote up (disciplined) several trainee techs for this. While your tinfoil hat may or may not be necessary, those privacy screen gizmo's are a good idea and if anybody is standing where they can see your keyboard move to block their view when typing passwords, etc.

Re:Is going to have him in civil and criminal trou

[Kalriath]

Gmail will use SSL for the actual email IF (and only if) you get to it by typing https://www.gmail.com/ rather than http://www.gmail.com/ (this gives you a certificate error though, you really need to use https://mail.google.com/ - it will stay on whatever protocol you initially access it with.

SSL on the connection solves a narrow problem

[igb]

If your opponent is your email provider, someone who has a means to obtain your account password, or someone who has the means to obtain a warrant, SSL on the connection to your mailbox is worthless. In all of those scenarios, your opponent will obtain the data direct from your mailbox, no snooping of the connection required. Yes, it will protect against an active snooping attack, but those are less likely scenarios. In very, very general terms, you should ensure you have protected data at rest before you worry about data in motion.

And handily, if you PGP your mail (or S/MIME, if you must) that protects the data at rest _and_ the data in motion. The only benefit of using SSL then it to protect your password, and if you're not using either APOP or one of the MD5 IMAP authentication styles then indeed it's worth doing. But the PGP is numbers one, two and three on your list.

ian

Re:SSL on the connection solves a narrow problem

[Klaus_1250]

PGP should come on the list first, I agree, but it is also the most difficult method for people (non-geeks) to employ. In fact, I don't know anyone who uses PGP. But PGP does not protect everything, such as the email-headers. Even with PGP, you still leak potentially private data.

With only SSL, your ISP, authorities and such can still read all your data, but it does protect mail in transit from third parties. For many people (non-geeks) this is the thing to worry about. I know plenty of people who will read their non-SSL'd mail over open WiFi-accesspoints or other public networks.

Of course, there is much more to email-security than just PGP and SSL. Many email-providers/ISP's do not use SSL-connections for SMTP between each other either. DNS isn't fool-proof, ip-addresses can get hijacked. All your mail sits in the mailbox of the ISP relatively unprotected, e.g. not all email-providers use disk-encryption (doesn't happen often, but servers do get stolen once in a while), etc.

If it's a crime, it's a crime.

[jcr]

If it's enforced against civilians though, I want it enforced against government employees and contractors who do the same thing without warrants.

-jcr

Not 100 Percent Correct

[fast turtle]

A couple of area's they get upset with your for Vid-Cam usage is the bathroom and any bedroom. Otherwise you're fine to bug/video monitor any public area of your own home.

Re:Anger.

[philspear]

They also typically contribute less to political campaigns.

Over five hundred times?

[Ophion]

Even once is too much. Break into someone else's account, even if doing so is easy, and go to jail. It really must be that simple, as this is unconscionable behavior.

True in Switzerland

[Anonymous Coward]

Disclaimer: Posting as AC so that current employer will not recognise me.

here in switzerland, there is no legal distinction between email and snail mail. Both of them are covered by a law known as breifgeheimnis, and opening or viewing either belonging to another person will get you into serious legal trouble.

I was accused in a previous job of accessing the boss' email (I was a sysadmin, and he had actually asked me to look why his email wasn't functioning correctly). It was pretext to fire me and I had of course looked at his email having been asked to do so, and he denied having asked me to do so.

In the end I couldn't defend myself and he couldn't prosecute (after my lawyer contacted his lawyer) but I had to go in any case.

Moral: Be VERY careful when accessing other people's email. Make sure, that if you do because you are asked to, that there are witnesses.

just a few laws broken

[stanjam]

Got to be careful. There are a number of laws that you can get busted on in this one. If you really can't resist snooping into email, then get into Information Security or systems administration. Then you can do it legally, if your policies are set up properly.

Re:Anger.

[genericpoweruser]

Twitter never mentions Windows or Microsoft--he only mentions Windoze and Micro$haft.

EFF and ACLU mistakes,.

[freedom_india]

The lawyers for EFF and ACLU made an initial mistake when suing about privacy.
They should have equated reading email as similar to postal mail except it is speedy.
This is similar to how railroads established acquiring legal rights of corporations as a person.
If ACLU and EFF had set a couple of precedents for email as faster postal mail (ya, it is dumb, but then judges need a precedence), then it would be easier to sue governments for opening up mail.
Instead these two organisations tried to make it as a new front, thus enabling the government and corporates to use their muscle to remove email from postal mail snooping laws.
Otherwise, Amex and VISa would long have been criminally convicted for mail snooping.

I thought that

[Cro Magnon]

if we couldn't snoop on our cow-orkers email, the Terrorists (tm) would win!