Slashdot Mirror
Ask Slashdot: Low-Cost Tools To Track Employees' Web Use?
First time accepted submitter red-nz writes "I come from New Zealand where new anti-piracy laws have come into effect that prosecute the owner of the internet connection for copyright violations. This is now a major issue for businesses, as they of course don't want to be liable for employee infringements. We have some good firewalls that are capable of doing basic filtering by 'category,' e.g. P2P sites, etc., but ideally would love to find a low-cost or even better Open Source alternative to expensive reporting tools (such as WebMarshal or Websense) that is capable of reporting on individual employees' usage with friendly reports (i.e. dont just show the URLs of the 3000 items their browser requested that day). It may be too much to ask but if the software could also show how long they spent on each site, it would be fantastic. Anyone got any winners out there they can share?"
A simple encrypted proxy or VPN over port 80 to home.
Do not look at laser with remaining good eye.
Anyone who requires internet access gets a wireless broadband card in their name that they can expense. Now they are the owner of the connection and you are off the hook.
IANAL especially not in New Zealand
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
Check out the zScaler proxy. Lots of good benefits, including what you need. I use it for all my employees and love it, especially the reporting and fine-grained control.
A year spent in artificial intelligence is enough to make one believe in God.
ntop (http://www.ntop.org) should be able to do more or less what you want, but you might have to tweak a few things. However, it would also help you get a better handle on all your network usage in general, so I'd look into it anyway if I were in your situation.
You should be asking about low cost politicians.
Seven puppies were harmed during the making of this post.
>>Block everything. Allow what needs to be allowed.
And then you'll have to hire 10 more IT guys just to deal with all the legitimate requests for unblocking that will come pouring in.
I used to work at a place like that. It eventually was just easier for them to give me the password to unblock sites myself, rather than pester them about it.
I am glad that you are a practicing lawyer in New Zealand and have educated us on this wonderful workaround. Could you please give us the contact information for your legal practice just in case someone in law enforcement questions the validity of your fine resolution to this problem? Because clearly your method trumps the employer-employee agency laws.
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
Back many years ago when I had concerns like this, I used the ACID network monitor that allows for complete tracking of all activity. It doesn't do any blocking but it does make report generation of all network activity very simple. However, it sounds like the solution to go for is something like Squid doing transparent proxying with content filtering. Also, block any ports in AND out that arent used for HTTP (80 and 443) to completely nix the chance of P2P working in any reasonable way. But alas, if the submitter were after a good filter why should they care what the users are doing; they surely aren't doing it on any illicit sites (assuming the filtering rules are effective?)
Seems like this should be two questions: one is what free/open ruleset can be trusted (as there are many good free tools at hand to enforce the rules) and two what additional inspection should take place to all content that might not be blocked, to find employees that spend too much time doing stuff on the "edge" of permissibility?
Is to get the law repealed.
If business owners are on the hook for the behavior of their employees, they should get together and get this law repealed. If enough do, it sounds like a slam-dunk to me. The reason why it hasn't already been done is that probably too many business owners don't know that they're on the hook.
--
BMO
"I'm required to stop copyright violations, so how can I best spy on my employees' surfing habits and see how much time they spend on each website?"
First: You are not required to monitor what you employees download at all. Under NZ law it is not illegal to watch copyrighted material via direct download (youtube etc.) You only need to worry about p2p applications. These are easy to spot as they *upload* to lots of different ip addresses at the same time. If someone has 500 open ports and a Gigabit/second outgoing bandwidth, go talk to him!
Second: People tend to leave their browsers on all day with 10 different tabs open, so even if you could view the time spent on different sites, that info would be meaningless.
Third: Spying on your employees surfing habits can piss them off, and is likely not worth it, for the same reasons why people don't work better if you mount "security" cameras behind their backs.
I'm a Software Engineer. A peripheral part of my job involves dealing with Oracle. If I run in to a problem, I google the error message (or google what I am trying to do). I typically find the answer on some random blog or forum (no, the answer isn't always on ask tom). Are you going to claim those sites aren't "required" and therefore I don't need access to them? Otherwise, your whitelist is going to be pretty long...
The right to protest the State is more sacred than the State.
Seems to me that asking this question here is like going on a vegetarian's blog and asking whats the best cheap knife to butcher a cow with...
What would cost more, censorware acceptable to the government, or a small server hosted in the Philippines?
>>Block everything. Allow what needs to be allowed.
>And then you'll have to hire 10 more IT guys just to deal with all the legitimate requests
You could have a click through that puts a persons name to the unblocking - so instead of hiring anyone you have the user self-certify that the page is work related and doesn't compromise any work usage policies. Internally publish the list of domains and who certified them.
The 3-strikes law covers P2P traffic only. Adding web traffic reporting isn't going to do anything to help you.
Now if you are being asked to do web traffic reporting then sit down with management and work out what they want, why and who is going to be responsible for reviewing traffic (hint - this should be HR not IT). Doing this should give you enough information to justify some expenditure, even if it is just a new server/VM for Squid.
http://sourceforge.net/projects/ttracker/
Basically, it does nothing but track the titlebars of every window that's open, and which one is in focus at any given time. And since every browser lists the URL in the title bar, it works like magic.
And it writes everything to a simple CSV file, so you can analyze it any way you choose. But it also has some nifty reporting screens, if you really care.
If you're only interested in web access, there's something else that you can do. Look into ".pac" files on windows. Basically, think a javascript file that gets run every time any URL is accessed by anything in all of windows. As in "return null" will make everything die, and "return slashdot.org" will make every URL return the slashdot homepage. You can easily write a five-line jscript file to log everything to a file through the FSO.