Instant Message, Instant Transcript 336
shams42 writes: "Although the internet has been far from private for some time now, it seems that public awareness and concern over this issue is mounting. This article at CNN discusses the issue of companies monitoring instant messages for cyberslacking or leaking company secrets. There is also the possibility of them being included as evidence in court cases."
Comment removed (Score:4, Insightful)
Re:Jabber + SSL (Score:4, Informative)
may not matter much if you are using SSL/SSH with your instant
messaging. There is software for monitoring the users' desktops
and keystrokes which is one of many tools that employers can use,
not only packet/traffic monitoring on company networks. Just to
add another formula to things, monitoring can be completely seperate
from the computer, they (employers) can also use well placed CCTV
systems.
Re:Jabber + SSL (Score:3, Interesting)
-Tim
www.newtechhigh.org
Re:Jabber + SSL (Score:2)
SealBeater
Re:Jabber + SSL (Score:2, Insightful)
That may get you in trouble with IT - they usually take a dim view of users reinstalling their workstations.
Jabber + SSL is almost worthless. (Score:2, Informative)
But you would be wrong.
The problem is that none of the Jabber clients implement the SSL protocol fully, and are vulnerable to 'man in the middle' attacks. They do not take the most basic precautions that you would find in any web browser (except Lynx, Lynx has this problem too).
I explained the vulnerability in a presentation at JabberCon 2001, and the client developers have still not taken the basic step of including some mechanism for validating the server certificate, much less added support for client certificates.
Jabber is interesting, and perhaps an improvement over other IM protocols, but the security is only halfway there.
Re:Jabber + SSL is almost worthless. (Score:3, Interesting)
You run into the script-kiddie fallacy here. Nobody is going to go to all the effort to find out what services I'm running on my machine, then look up all the possible exploits on the internet and patiently try each one. Of course not, they're going to download a script kiddie tool that scans entire netblocks and systematically tries all known exploits.
Similarly, companies are going to install 'snoop plugin for NT-firewall/proxy', and automatically snoop. I doubt they wrote the firewall modules they're currently using to snoop IM's, and installing a 'SSL proxy' doesn't take any more effort, just one unscrupulous software developer to produce and sell the plugin.
Of course nobody will bother unless there's enough people using the protocol you're using to sell that plugin - so find an unknown protocol and you'll be (relatively) safe.
First email, then URLs, then IMs... (Score:2, Interesting)
Then they started to watch where people surfed. After all, employees were not executives, they could not be trusted.
In 2002 they started to monitor Instant Messages and to log them all.
In 2004 software to trnascribe telephone calls became common, and these too were logged.
By the end of 2010 and the unbiquity of the thought transponder, the slavery of the employee was complete, and all human spirit was destroyed in the never-ending quests for profit and longer golf sessions.
All employees dressed identically, lived in identical houses with identical husbands, and wore identical corporate socks.
Is this the future we want?
How do we tell the corporate world that life is about people, not profit? The joy of sharing, of living in a community, of being alive, that is what matters. Take off those corporate socks and be free!
(is your postal mail is being monitored too? did you have rights, once?)
It's easy to say, this seems reasonable. It's hard to take a stand for what seems right. Do it anyway.
--
Re:First email, then URLs, then IMs... (Score:2, Insightful)
Traffic analysis (Score:5, Informative)
I happen to be the dude in between management and the users on my site. I refuse to eavesdrop on my users. Not all of my users realize it, but we've got a pretty liberal policy (don't break the law, don't be offensive to others, don't use excessive bandwidth during business hours; that basically sums it up).
Some of my users know me for cracking down on porn or MP3 downloads, and think I'm reading their every keystroke. Because if I wasn't, then how would I know that they were doing stuff that they weren't supposed to do?
The reality is, when I get complaints about Internet performance, I run some quick scripts on the logs to find out who is hogging the system. If, after eliminating the obvious business use connections, I'm left with a top ten and number two is downloading a gazillion of
Usually, the user will accept the lecture that his contractual obligation to stick to the corporate guidelines is not optional. I sometimes learn through the grapevine that such a user thinks I'm a fascist. So be it. If other people can't work because of egregious abuse, I have to intervene.
Do I even look at the stuff they're downloading? Not if I can avoid it. The only times I look at what they're downloading is when they start yanking my chain, giving me the go around that there is no law against downloading Warez or porn. Maybe there isn't, I've got no clue. I do know what's in their contracts though.
Most of these issues are dealt with amically. People sometimes don't realize how big their impact on the corporate network is, and even if they do I usually let them get away with it if the abuse stops. They're usually pretty happy when I tell them I've got no clue what they were downloading, but could find out when forced to.
Over the last year, IM became a bit of an issue because of the way their stupid tools communicated (if only they used persistent connections they'd fly right under the radar). At some stage, 30% of our proxies capacity was used to serve a few dozen IM sessions and it really started to hurt web performance.
It's always funny when they let it escalate to management level, and I can at that stage let them rant about the invasion of their presumed privacy, and then drop the bombshell that I didn't even look at what they were downloading, and that it was trivial traffic analysis that gave them away, and that the reason they were in that meeting was because they incriminated themselves.
Alternate (Score:4, Funny)
Why not use on-the-fly encryption? (Score:2)
I really don't have to worry about this, since I'm the 'IT' guy at my company. hehehe
Re:Why not use on-the-fly encryption? (Score:2, Informative)
It also does on the fly language translation using a babelfish-quality replacement engine, so you can chat with people whose language you don't speak. It's very cool.
Re:Why not use on-the-fly encryption? (Score:2)
Why? (Score:2)
Re:Why? (Score:2, Informative)
Re:Why? (Score:3, Interesting)
The company I work for, for instance, uses an internal ICQ server and the corporate ICQ client for interoffice IM, and doesn't allow any other IM clients. This lets people communicate internally without a problem, but keeps them from wasting time on idle chats with outside friends.
DennyK
Re:Why? (Score:2)
Obviously, I don't work for eight hours straight. That's what breaks and lunches are for. Work a couple of hours, take a break, work a couple more hours, go eat lunch. On my break, I'll read a book, check Slashdot, whatever relaxes me. But I still don't do anything that I would get in trouble for if my employer found out, so they can keep logs of my web "surfing" during breaks if they want. I'm usually visiting sites that have a relevance to my field, anyway. I don't spend my break time posting company secrets to F*ckedCompany.com or griping about work over AIM, first because I have no desire to do so (I happen to like my job and the company I work for...
DennyK
Re:Why? (Score:4, Interesting)
Being a multi-national company, without this we would be spending a lot of money on international phone calls (although I believe we are looking at VOIP for this too)
It also allows you to share your desktop so you can collaborate on a document. Sometimes we use a combination of the instant messenger and the phone for this.
You can also see if the person you are trying to reach is at their desk before you try to reach them.
It is less intrusive than a phone call and more immediate than email.
Re:Why? (Score:2)
At least with email there is the expectation that a response will come back in a a few hours, or by the end of the day. With IM, I'd be expected to respond within a few minutes. What a chore.
Re:Why? (Score:3, Informative)
Depending on your level of responsibility, it really doesn't work out to "every few minutes". I, too, use Sametime at work and it, like MSN and Jabber (I never tried any others) allows you to set your online status. So each employee has their contact list up with a little status indicator right next to the name. Green means available, Red means Away (which can be set to not auto-return), and there's a little "international NO symbol" which means "Do Not Disturb".
I most recently used it to "feed lines" to my project manager while he was presenting to some big wigs in a meeting. He doesn't have time to know all the minutiae, so he would tread water on questions while I fed him better details. Luckily, I looked ahead into a presentation and saw some numbers were way off. I was able to warn him before he got to the page.
Being a mobile employee means I have to go to many different customer sites (or work at home) all the time. For coworkers with whom I'd occasionally have conversations of a personal nature, I always "take it outside", and off Samtime onto MSN or AIM. The chances of ALL of the customer sites recording IM sessions will always be less than the 100% guarantee that my IM's will be recorded if I use the company Sametime server.
Why would a company NOT ban IM? (Score:3, Interesting)
Generally slackers will abuse IM just like they will abuse 'free' phone calls -- to stay in touch with friends and family, make plans to go out after work, or just idle chat.
It can be difficult to implement a technical ban on instant messaging, webmail, etc. There are two many different services using different protocols and different servers to easily create firewall or filter rules to block them all.
AOL Instant Messenger is an interesting example. The AIM client is very persistent in trying to establish connectivity with their servers. First it tries the 'official' OSCAR protocol on port 5190, but if that fails, it tries a high port, and also FTP, SSL, and other protocols that many firewalls permit unrestricted outbound client access.
Re:Why would a company NOT ban IM? (Score:2, Insightful)
Re:Why? (Score:2)
I can name 12 people off the top of my head (of the 81 on my list) that use IM everyday while at work. Two of those people are parents that talk to their kids at school (one is my father).
How much time at work do you really spend doing work? Unfortunatly for me I have a job where I am working no less than 95% of the time I am there. For other people I know this percentage is well under 66%
It isn't that they had nothing better to be doing, it is just easy. Why not do it?
Re:Why? (Score:2)
1. The father should do the work he's being paid for.
2. The kid should pay attention to what the teacher is saying.
Re:Why? (Score:2)
We have a winner. If an employee is doing his assigned work well, why should anyone care if he spends half an hour a day chatting on IM? In the Peter Principle there is a section that describes how good managers evaluate output while incompetent managers evaluate input; the latter seems to be the case for companies that obsess over every keystroke of their employees.
Re:Why? (Score:3, Informative)
Unlike the phone or in-cube appearances, the recipient may respond when it is convenient for them (no interruption necessary if you have your message windows set to auto-minimize), but unlike e-mail, it's more interactive and conversational.
It's also incredibly convenient to be able to cut and paste example code, command-lines, URLs, etc. to co-workers on the fly.
Re:Why? (Score:2)
Perhaps I don't understand the protocol well enough, but it seems to me that you're sending eachother messages from inside your network to Yahoo and back, all in the clear. I'm always creeped out by this with idle chatter, but with internal company information?
Screw firing people for wasting time. If my employees were jeopardizing company data like this I'd have 'em out on their ear.
Re:Why? (Score:3, Insightful)
Then everyone gets laid off. Welcome to the workplace.
Re:Why? (Score:2, Informative)
- - instant 'are you online' status
The main enhancements I can see corporates needing for this to become as mainstream as email are security, supportability, scalability, the ability to lockdown who can connect (ie internal only, external approved list etc) and centralised logging. It's certainly lessened the load on my email inbox and made me more productive. I work with a large team across the globe. I regularly use IM to answer real quick questions from colleagues in the Americas, Europe, South Africa and Asia.- ideal for quick questions and answers
- removes load from email systems (bandwidth, storage, backup)
- it is instant. Ideal when taking part in a global con call and you want to check something offline
- IM cuts down on the number of intl (or even national!) calls you need to make
Easy to monitor (Score:2, Informative)
You can use 'tethereal' for realtime AIM decodes (Score:2)
The text-interface equivalent is 'tethereal', which provides realtime decoding of AIM messaging traffic, and supports logging raw packets to a file.
One of the most common ways for AIM to work through a firewall is by pretending to be a SSL connection to the AOL 'oscar' server, and tunnel through a HTTP/SSL proxy. But in reality, that session is still cleartext, easily intercepted.
I am not sure if any similar software currently exists for MSN, Yahoo or ICQ. IRC is trivial, and Jabber's XML doesn't take much to extract to human readable dumps.
Even Jabber's SSL support only offers minimal protection, as (despite repeated requests to have the feature added) none of the Jabber client software implementations include any checking of the server certificate, so all Jabber clients are vulnerable to 'man in the middle' attacks.
simple solution (Score:4, Informative)
I've not heard of an employer that monitors Port 22, and even if they did, it's encrypted so they can't pick up what you said.
Best program for this is PuTTY (assuming you use NT at work)
The whole thing assumes you are using *n?x at home and can run an SSH daemon on it.
OF course best of all is to not shout from the rooftops what should be said in private.
Re:simple solution (Score:5, Insightful)
(Says the guy posting to slashdot in the middle of the night)
Re:simple solution (Score:3, Insightful)
Also, I don't know how the we're-too-cool-for-IM crowd is doing things but in MY software team our internal IM client is very essential for development collaboration. Unless you live in your own little world never speaking to anyone it's a very major tool for tracking people down to ask questions/fix bugs/etc.
Re:simple solution (Score:2)
-- PhoneBoy
Re:simple solution (Score:3, Informative)
Yes we block IM
Yes we block AIM
Yes you get fired if you break the rules
When you start work with us you sign an agreement which clearly states what is and isn't allowed - the shock comes about for most people when we enforce that agreement - and we do.
The employer pays you to work, there are NO work reasons (cut the crap about tech support IRC and suchlike - i've heard it and seen what these guys talk about - there's no tech support going on at all - its chatting) for IM clients that i can see other than wasting time.
Re:simple solution (Score:4, Insightful)
That's a slippery slope...
You might expect employees to clock in in the morning, think and do nothing but work, have no stray thoughts, don't get up to eat, drink, or talk, and then clock out at night, without any second wasted... It's called a robot. Look in to hiring one instead of a human being.
I don't think I've ever met a collegue that could perform up to that standard.
You need distractions every once in a while to maintain your creativity.
Re:simple solution (Score:2)
The rules in the AUP were written by the company and my bosses, the 4 regional CIO's and the Global CIO - i did'nt write them but it's my job to see they are followed.
That being said anyone who equates blocking IM with encouraging slavery has other problems - its software for god sake not thought. We allow access to the web with very little monitoring, we allow unlimited email providing the content doesn't get out of hand (we filter it)
We tell jokes, have fun, party togethere and my guys are always able to speak up to me - i encourage them to challenge me as a manager every day.
Rules are rules - if you agree to them when you get a paycheck then thats that, companies set the rules and if you want to work for company A you abide by their rules - thats the workforce.
Re:simple solution (Score:2)
Re:simple solution (Score:2)
When you start work with us you sign an agreement which clearly states what is and isn't allowed - the shock comes about for most people when we enforce that agreement - and we do.
I respect that. I'd much rather have my company spell out what is and isn't allowed rather than just disallow everything and then enforce at their leisure.
That said, I probably wouldn't work for your company. I'm paid to do a job, not to sit a desk for X hours. If you're going to force me to do that job for a certain amount of time, in a certain place, in a certain way, I'm not an exempt employee, and you are required by law to pay me hourly, and pay 150% for every hour over 40 a week.
Re:simple solution (Score:2)
I dont set the rules for the 500th time - the company does and the do it for good reasons.
We ran internal IM servers for over 2 years - when we looked at the traffic earlier this year we found about 1% work related stuff - thats after 2 sexual harrasment suits in which IM harrasment was named.
We stopped it as people clearly cannot be trusted to use common sense - this in a company where the average wages is $50'000 k and 80% of staff have a university degree.
See you work for an IT company - likely a company in the business of software development - i don't we are a services based business. IT companies has a reasonable expectation that their staff are intelligent enough to know their limits - we don't have that luxury and after lawsuits we don't have the patience.
The company culture is one of proffesionalism - it's a suit and tie workplace where the customer is our most important assett, the company doesn't monitor dress code (you don't follow it subtle peer pressure will pull you into line), they don't spy on employees (we just don't allow IM and we strip
The company has a reputation as being the most porffesional and succefull in our business feild world wide - and they made a decision at global level (we have some 15'000 employees) to formulate policies and apply them - us as IT Managers enforce these - thats the job you take on when you are a manager - something i doubt you have ever been
Thanks for your comment - but please next time - use a username and i will listen to what you say without dismissing it out of hane -anonymous opinion is worth the same as free advice.
Re:simple solution (Score:2)
And anyway in my mind if you are the sort of person who needs IM or they don't work then i would be paying you a lot less than double - thats asking an employer to pay you more for actually doing the job they hired you for
Block 22? Use 443 (Score:3, Informative)
That said - It's not spelled Foxtrot Uniform November, it's Whiskey Oscar Romeo Kilo - if you want to download porn or waste lots of time IM'ing, then do it at home. A quick scan of
Re:simple solution (Score:2)
The reason that blocking port 22 is so important is that SSH enables trivial tunneling. This will allow anyone in the corporation who runs outbound ssh to determine what the corporations inbound security policy is. Or translated from business-speak to techno-speak: those who run ssh are allowed to let any TCP port back into the corporation.
Breaking the firewall policy is not something that large corporations, especially banks, are fond of.
Of course, the fact that you can tunnel tthrough firewalls on port 80 [nocrew.org] and port 443 [maniac.nl] does not sit easily with these type of corporations.
Companies have AUPs for a reason (Score:4, Insightful)
Nearly every company today has an Internet Acceptable Use Policy. Said policy covers allowed surfing habits (work related only, etc), as well as appropriate email useage (no sexist jokes, spamming of jokes). Once companies realise that IM traffic is essentially the same as email, they will need to incorporate policy on usage into their existing AUP.
Naturally there's privacy concerns here. People don't like their every word and action at work scruitinized. However, as Pamela Housley (director of compliance at Thomas Weisel Partners investment banking firm) said in the CNN article,'It's just easier to archive it all. I don't have the manpower to have somebody look at this all day long.' This will hold true in most cases.
Most companies already archive all email sent/received by work accounts as a matter of course. However, that's not to say people actually read all those emails. They're there with the sole intent of keeping a record to cover the company's ass if something goes wrong - such as a client accusing an employee of doing something they were not asked to do. If said employee can turn around and say 'I was asked to do it via email, and HERE IT IS!', the company is fine.
Face it - IM traffic sent/received at work will end up being logged as a matter of course. It has to if companies want to keep themselves out of a legal quagmire. However, just because your communication via IM is logged, doesn't mean someone is going to actually violate your privacy by reading it. In fact, most AUPs specifically prohibit the reading of another's work communications without the proper authorisation.
Keep in mind that you're using work assets. Keep in mind that you can, and will, be held responsible for abuse of said assets. Stick to the AUP, and everything will be rosy.
Companies destroy e-documents (Score:2)
They destroy e-mail archives because they don't want it to be used against them later. The roasting Microsoft got over internal e-mail has put the fear into them (if they didn't have it already).
The same will likely hold for IM traffic, but it is still safe to assume that it will be logged and retained for some period of time.
;-) is all you need. (Score:4, Funny)
For real though, I really don't care if people see my IMs. 99% of it is just jibber-jabber anyway, so who cares.
If your are dumb enough to write messages like "My boss is an asshole" over IM, then that is your own fault if your get busted.
IM Use at Work (Score:2, Insightful)
Re:IM Use at Work (Score:2)
This is pretty standard. Most large corporations monitor email, search people randomly (and sometimes always) on arrival and leaving. All monitor phonecalls if they feel like it, but rarely record every conversation simply because of the effort involved.
You've never worked for an employer that searched you upon arrival and leaving?
Jabber Intranet (Score:2)
encrypting won't stop you from getting in trouble. (Score:3, Interesting)
I seriously suggest that anyone who IMs at work should stop. If you know your company monitors email, etc, I could only imagine that you encrypting your sessions would raise their suspicions even higher.
If you are that worried that you feel you should have to encrypt, you probably shouldn't be doing it at all.
Just my worthless
Tunnelling (Score:2, Interesting)
I would think that tunnelling via SSH would solve most of the problems.
I currently SSH tunnel for IRC, but for IM related software, I can't seem to SSH tunnel and get the relevant ports forwarded.
Anyone have a good idea for doing this?
But I'd think that my IRC connections are rather well encrypted.
Re: Tunneling (Score:3, Informative)
Assuming you have a recent version of OpenSSH, follow these instructions:
1. Run ssh -D 1080 hostname. This causes ssh provide a SOCKS v4 proxy services when connecting to localhost on port 1080.
2. Set your IM client to use your SOCKS v4 proxy server and point it to localhost on port 1080. Most IM clients support the SOCKS proxy protocol.
3. Chat.
I consider the instant transcript a "feature" (Score:4, Informative)
In any case, why I consider the instant transcript a "feature" is because my co-workers and I do tech support. We talk to each other frequently about customer issues. These transcripts often contain useful troubleshooting information. It seems awfully silly to type something more than once, so once a conversation is done, it's copied straight from Jabber into a case note. We usually do not make those kinds of notes viewable to customers, but they are good for internal documentation.
For those of you who have issues with your employer "snooping" on what you're doing, I would not expect any sort of privacy with respect to your computer usage at work. However, your employer needs to tell you your computer usage is subject to monitoring. Employers who fail to notify employees of monitoring are subject to serious trouble if they decide to take advantage of any information they find out as a result.
-- PhoneBoy
I still don't get this.... (Score:5, Insightful)
You are in a building that you don't own..
You are sitting in a chair that you don't own
You are using a computer that you don't own
You are using a network that you don't own
You are using bandwidth that you don't own
Why do you have any expectation of privacy?
It's simply a given.... If I am talking on my cell phone in the middle of the IT department I have no expectation of privacy...
If I am 'yelling' my conversations over the network why do I have expectation of privacy...
If I want to chat personally or sell company secrets I will do it at my home where I DO have privacy... But, not at work
Re:I still don't get this.... (Score:5, Insightful)
Because you're a human being with human rights. One of those rights is freedom of speech, and part of that freedom is the ability to control when, where and to whom to speak. The speech is what should be protected, not the company's stupid network.
If they don't want to hire people, fine. Let them buy an M$ wizzzzzzzard to set up their databases and sit in meetings. But if they want hard-working, knowledgeable, imaginative people, then they are going to have to accept the fact that they are HUMAN BEINGS, not machines.
Just because you're in a "building you don't own" doesn't mean you have to hand over control of your entire life to some middle-manager.
People are people FIRST, then "employees." This "the company rules the universe" routine is getting REALLY fatiguing.
Re:I still don't get this.... (Score:2)
It really has nothing to do with your employee/employer relationship.
Re:I still don't get this.... (Score:2)
Why is the employee/employer relationship entitled to so many exemptions from the basics of every other element of society? What if a non-employer corporation sought to restrict the speech of people? The screams would shake the Earth.
Why is it acceptable then for an employer to do the exact same thing?
Re:You still don't get this (Score:2)
An amusing red herring, but beside the point. The original statement stands as written. Freedom of speech is meaningless if society chooses to countenance its restriction by any agency, government or not. The same goes for privacy, due process, and the rest of the Constitution.
It applies to everyone, or it is meaningless.
Tell me how, say, Walmart (for whom I do not work) could possibly restrict my speech
1) You can't use the term "$Company Name" because it is trademarked.
2) You can't criticize $Company in public because it hurts their business.
Either of these can be enforced by fiat because the average citizen will choose not to litigate for the right to make an offhand remark. Nevertheless, these are both unjust restrictions on speech.
Re:I still don't get this.... (Score:2)
Because you're a human being with human rights. One of those rights is freedom of speech, and part of that freedom is the ability to control when, where and to whom to speak.
Another is the right to enter into contracts where you agree to limit your speech. If that contract is excessive (never talk again), or illegal (don't tell them about the ammonia we put in cigarettes), you might get out of it. But if that contract is simply "don't use our network for personal conversations", then it's a whole different story.
If you want to speak freely, don't sign contracts agreeing not to. If you want job security, make sure you sign a contract giving it to you. If you want privacy, make sure that a) your company signs an agreement to give it to you, and b) you have the sole administrator password to your machine.
If you want a job, ignore all the things I said above. Or be prepared to not have many choices.
Re:I still don't get this.... (Score:3, Insightful)
To expect to isolate someone from all "personal" conversations during the work day is an unjust exercise of control, basically for the sake of control. It really has next to nothing to do with the company or the work.
It certainly doesn't give the employer the right to the contents of that conversation.
For most of the people in this country, a job is a necessity. To withhold necessities from people in exchange for their abdication of their inalienable (an important word) rights is to offend those rights to the point of denying them altogether.
No person, employer or otherwise, should be empowered, either by necessity or choice, to deny the basic rights of another person.
Re:I still don't get this.... (Score:2)
But these "contracts" are almost never written. They are decrees delivered from the raised dais of management, usually in the form of a memo.
True, but most people don't have real employment contracts at all. Usually employers can fire employees for any non-discriminatory reason, and at most all they get is two weeks severance pay. If you want to be able to speak freely and still keep your job, you need to get that put into your employment contract.
To expect to isolate someone from all "personal" conversations during the work day is an unjust exercise of control, basically for the sake of control. It really has next to nothing to do with the company or the work.
Possibly, although there are certainly some circumstances where allowing any unaudited outside communication is dangerous. But the point is that you chose that job. No one is forcing you to work there.
It certainly doesn't give the employer the right to the contents of that conversation.
Unless your employment contract that you signed says that the company reserves to right to record any communication you send over their network (or some lawyerly version of that).
For most of the people in this country, a job is a necessity.
Sure, but a job in a particular industry, let alone a particular company, is not a necessity. If you and your coworkers aren't good at negotiating employment contracts, maybe you should think about hiring someone else to negotiate your employment contracts for you.
No person, employer or otherwise, should be empowered, either by necessity or choice, to deny the basic rights of another person.
What are these basic rights exactly? It seems to me like you've made just about every contract illegal.
If you want to have rights in this society, you have to stand up for them. There are still good places to work here in the United States. They may not pay as well as selling your soul to the company (who are waiting there to sell plasticware [everything2.com]), but for some people it's well worth the cut in pay to gain the increase in personal freedom.
Re:I still don't get this.... (Score:2)
Of course the bathroom is the easy one. Things start going down hill from there. The courts have general held that people have a reasonable expectation of privacy on the telephone, and employers are usually barred from recording calls to/from an external source. Hypothetical example: An employee waiting to hear the results of a VD test from their doctor will probably want the doctor to call them as soon as the results are in, but won't want it to be management's hot gossip of the week. The employee has a reasonable expectation of privacy when their doctor calls them on the phone whether it is at work or home.
When you get to email, the courts don't generally find personal issues which need prompt notification are transmitted via email. So the conditions under which you would need an expectation of privacy are far fewer, so monitoring internet crap is usually acceptable.
Re:I still don't get this.... (Score:2)
The employee has a reasonable expectation of privacy when their doctor calls them on the phone whether it is at work or home.
Legally perhaps, but in practical terms employees should assume their employers are listening and act accordingly. Individual employees are virtually powerless when dealing with their employers unless they are in a union and their actions are protected by the contract.
Well, they own the bathroom too ... (Score:2, Interesting)
... and the stalls, and the seats, but I sure hope you don't think they can/should install webcams there, for the sole purpose of monitoring excessive bathroom breaks, of course.
Re:I still don't get this.... (Score:2)
I think people expect privacy just because of the handful of laws that protect workers otherwise (minimum wage, discrimination, etc). While the privacy rights may not exist, there's always a chance they someday might.
Logging is mandatory (Score:3, Informative)
There is a very good reason for this. Apart from the usual virus problems, it is often *mandatory* by law for investment banks to log all communications between employees and clients, just like the article says. It is well known that all telephone calls are recorded for this reason. All proxy requests are naturally recorded and scanned for port and external mail use (also against company policy). Allowing IM would equally thus be in violation of company policy and legal requirements. Unless of course... if a system was introduced where all messages could be reliably logged and traced.
If you still aren't convinced about these policy issues, consider this. In a IB, if your phones are tapped, all web access is logged and you know it, then perhaps consider that logging IM isn't such a big extra step.
My company and the last place I worked (Score:2, Informative)
I discovered that the 'promised-management-positions' crowd was keeping close tabs on their fellow employees as well. Monitoring exactly how long each of us worked, took breaks for, (and of course) never mentioning the major overtime we put in.
It's funny, because between them monitoring us and talking all day with numerous online boyfriends - the management hardly did any work. We on the other hand managed to keep 100 clients happy, fix the "Interactive Unix" network so that it didn't die each and every day, *and* format all of their MSN chat logs for easy reading off a floppy disk when the inevitable day came that we would quit.
and man, those chat logs were good!
Once we left, we started our own Software Company [solidblue.biz] and are almost ready to release software exactly for companies like that. Network Security & Productivity monitoring software [solidblue.biz]. I wish we had a package like this when we were there, but don't get me wrong - NGREP worked pretty well too.
NGREP src 192.168.10.3 or dst 192.168.10.3 -ql "MSN-IM-Format" >log.log
Ah yes (Score:5, Interesting)
For people so concerned with freedom, it is astonishing that the entirety of a person's basic rights are handed over like a movie ticket once the workday begins.
And to top it all off, everyone DEFENDS this by saying, "well, they sign your paycheck."
Newsflash: signing a paycheck != control someone's life.
Here are people who tell you what to do 40, 50, 60 hours a week. What time to sleep. How long to spend eating. What kind of house you can buy. Where you must live. What to say. How to dress. How many phone calls to make. What web sites to visit. And so on. It's worse than grade school. If you don't like it, you're "downsized."
Personal life is not to interfere in the workday. No personal activities of any kind are to be conducted at work, unless you're a manager and you have kids. Then you can "take the afternoon off" or leave early on Friday any time you feel like it. All time off is given begrudgingly, even if it is pre-approved.
Now they'll just help themselves to every word typed or spoken during the workday. Excuse me, but why is the workplace exempt from a person's inalienable rights? Why are companies allowed to treat people this way? Why is a paycheck carte blanche to control someone's life?
If it isn't company business, PAYCHECK OR NOT, it isn't company business. Period. People should be given the freedom to be people before corporate drones.
Re:Ah yes (Score:5, Insightful)
Who are you, Bodhi from Point Blank?
No one forces you to take a job. When you do, you engage in a contract with your employer. It says I will provide X amount of hours of labor for X amount of wages. If you are fucking off chatting with your warez buddies on AIM, than you are not fulfilling your end of the bargain. You are ripping off your employer. Period.
If I pay someone to dig holes for me for 1 hour, then I am entitled stand beside him and make sure he digs for that hour. Even moreso if he's using my shovel. Why do you think that because you work with computer equipment that you are special? It's the same thing.
Excuse me, but why is the workplace exempt from a person's inalienable rights?
I don't think you understand. You do not have an inalienable right to use other people's equipment to chat on the Internet. If you want to do that - do it at home, where you pay for it.
Re:Ah yes (Score:2)
For comparision, here's my take on the issue. First, I'm a bigtime privacy wonk [jerf.org]. Second, despite that, I still believe that a corporation can pretty much do whatever it can get away with to its employees legally, and that legal action should NOT be taken to 'correct' this.
The fact of the matter is we have a perfectly fine set of union laws, which provide protection. This is a union issue. If you don't want to be monitored like cows, make your union make an issue out of it. It's stress inducing, it's probably a waste of company resources (after a certain point), it's probably not a net business gain (after a certain point) anyhow, rigid rules rarely match reality, it's not hard to come with counterarguments.
But until people care, and not just a bare minority, nothing will happen. In this case, I am actually against laws... they'd only make things worse. (Not that you were proposing them, I'm just giving my position for comparision to yours.)
here is an easy, but less-reliable, transfer... (Score:2)
http://www.guerrilla.net/reference/biological/rfc
Try logging that! Then again, the company could shoot the birds down or fire you for having birds in the office. Or to make matters worse, the bird getting hurt along the way (like flying into a window while trying to send the packet).
Your "likeness" and natural copyright (Score:5, Interesting)
Sure, it would get all the merit of some of the recent patent lawsuits, but it's perfectly legal. At work, you have no expectation of privacy and often you even explicitly waive these rights by AUPs, as others have mentioned, so you have no legal high ground.
However of all the AUPs I have seen, none mention the property transfer of your communications, which are effectively your thoughts and are unique to you. This is called your "likeness". You are expressing it in your messages and chat transcripts, and by your employer snooping on you and storing records, they are effectively "copying" your copyrighted material, which you can claim copyright to.
Unless you're in a contract situation, the only works your company owns are those, which it has commissioned. Despite popular belief, it doesn't own everything you do at work -- only the work from your assigned tasks/projects/whatever.
I am no legal expert by any means, but at lunch with a lawyer friend I brought this issue up, and he said if he had a client in this situation he would have whatever logs found non-admissible due to copyright infringement. He then told me about likeness and how it can be used against an employer and possibly even to be on the plaintiff side of a suit. I found it interesting he would challenge this privacy issue from this interesting angle.
I guess you're best actually doing work while at work. If you must have security, use the various methods of encryption. Don't be stupid.
Re:Your "likeness" and natural copyright (Score:2)
Re:Your "likeness" and natural copyright (Score:2)
Re:Not interesting and not true (OT) (Score:2)
Now they can own everything you do when you are under a contract that specifically states this (although it's rare and hardly inforceable, similar to contracts that force you to waive rights in sexual harrasment areas in favour of company appointed arbitration).
It helps if you think of companies as people, which is kind of what they are legally. If I hire you to paint my house, and you instead work on a product that ends up selling millions, I would have no claim to that product. I WOULD have a claim to any damages I lost as the result of your working on this other task and for whatever I paid you if I can prove you didn't do your job.
Re:Not interesting and not true (OT) (Score:3, Interesting)
Companys pay employees to work and provide a certain function, they *DO NOT* own them. This was discussed on Slashdot a few weeks back.
The discussion a few weeks back was about work created outside the office. If it's related to your job, or it's done on company time, chances are it's owned by your company.
If I hire you to paint my house, and you instead work on a product that ends up selling millions, I would have no claim to that product.
That's not an employer-employee relationship, thus it's subject to different rules.
Contractors by default have their works owned by them. Employees by default have their works owned by their employer.
Re:Not interesting and not true (OT) (Score:2)
What constitutes permission? (Score:2)
Re:What constitutes permission? (Score:2)
Seriously though, how much privacy should we be able to insist upon.
Certainly plenty when our naked bodies are concerned.
codetalking ... (Score:3, Interesting)
Not only did they transmit messages in code, but they added a nice little touch, all transmissions were forwarded in their native dialects. Both my father and I would chortle at the prostpect of some enemy intercept trying to figure out Cherokee.
It makes me wonder, especially when you consider the costs of snooping everone's transmissions
Sure, I'm sure the employer and their lawyers could still crack it
Re:codetalking ... (Score:2)
The best way to encrypt communications would be to write a one-time pad and hand it to your buddy everyday. [maybe you e-mail from home it in the morning using PGP?].
But we are getting off the subject. One aspect is the fact that your IM's become court record. The other aspect is the fact that your employer doesn't want you to do something on their computers.
Rubbish (Score:2)
What's next? X10 cameras in the workplace? :-)
Say, all the productivity benefits of 'computerization' couldn't have been due to the freedom people using them found to work at their own pace, could it? It's unthinkable that a guy is *more* productive for next two hours after a 2 minute IM conversation with his girlfriend, I guess. Nah, let's watch over every damn move they make. Make 'em think before they pick their own nose. That'll improve productivity, all right!
Props to all BOFHs. You have a long and prosperous future ahead of you.
GAIM + PGP (Score:2)
Companies might be required to do this (Score:2)
another article on IM privacy (Score:3, Informative)
What's with this stupid double standard? (Score:2)
Do they do the same thing with the telephone?
No?
That, ladies and gentlemen, is a double standard. Also known as hypocrisy.
Oh, they do monitor your phone conversations? Fine: do they "downsize" you if you use the phone for personal use? No? Then lather, rinse, and repeat.
Oh, they "downsize" you if you use the phone for personal use? Who do they think they are, the NSA? What do they think you are, a slave?
If they're going to treat you as a slave at work, then they can fuck off when you're not physically at work: you should refuse to give them the benefit of any thoughts, ideas, or efforts that don't originate at work. And if they press it, then you should be able to bring them up on criminal charges (slavery is against the 13th Amendment of the Constitution, and it doesn't matter whether or not you're being paid: slaves were "paid" in the form of food, too).
employees have no right to screw off (Score:2)
First off, employees don't have the 'right' to dick around on the web or IM when they should be working. I pay them to work and I define what 'work' is; and that isn't it. Second, if they truly can't function without wasting *my* money goofing off for part of the day, then they need to get a job someplace else. I can and will replace them with someone who isn't hampered in terms of 'creativity' when they actually have to put in eight solid hours of work a day. Especially in this economy, it's damned easy to fire the whining kid and hire someone with an actual worth ethic.
I don't see what the problem is with a company monitoring things like IM. You're at my business, using my equipment - I'll monitor whatever I please in any fashion I desire. If you want to hold private conversations with friends or surf the web, do it at home on your own time.
Max
Re: (Score:2, Insightful)
Employees (Score:2)
Re:Employees (Score:2)
Can you imagine that?
*sarcasm off*
Employers can't yet buy robots to do this stuff. They can't manage things well enough to keep a person even 70% busy most of the time. They refuse to allow telecommuting most of the time, so a person can't mix personal and work time very well, if at all. They have a choice, of letting that employee go crazy, and stare at a wall, for 3 hours out of every 8, and have high turnover, or they can provide minimal entertainment and/or look the other way when employees invent their own. Internet access costs them the same, whether or not they check espn.com every 20 minutes. If the employer is that RETARDED that they believe some measurable work would have been performed if internet access hadn't been available to the employee, then I don't even know what to say.
Re:Employees (Score:2)
I've seen people making $60/hour idle for four months before. If people are not busy, it is ONE HUNDRED PERCENT the fault of management.
This kind of boss gets his own punishment (Score:3, Insightful)
Hopefully within a couple of years we'll get the cheerful news that these monitoring companies have gone belly-up.
later,
Jess
Re:This kind of boss gets his own punishment (Score:2, Insightful)
This system is a crutch, plain and simple. Effective managers "accept" an amazing number of things, so long as the job gets done.
later,
Jess
Re:This kind of boss gets his own punishment (Score:2)
I have 13 staff and a turnover rate of 0 in 2 years, 3 of my staff have worked for me in 2 jobs now. They know their internet and email are monitored and they accept it as the company has a AUP that all staff sign - I won't bend the rules for anyone - we all have to comply.
Knowing this weeks tasks are being done is fine - understanding the costs of bandwidth usage and the other stuff plus the users who see it and whine that they don't have it.
As for this "Any employee who is worth access to a computer and all the costs that entails is capable of managing his time at least to the hour, or if not will quickly be found out without such a system. " Oh my god - do you know how much porn and games we pull out of email systems every day - all of our staff in the company (some 1500) have a computer and email and without such a system they can easily cover it up.
Re:This kind of boss gets his own punishment (Score:2)
:-)
Re:There are more implications to this... (Score:3, Interesting)
they can as they legally own anything you do, write or say on company equipment in company time (it's been proven - do a websearch on the subject)
"Personal data can be stored and later used for blackmail"
What ARE you doing at work and who do you work for - what company would actually do this.
Re:Why encryption is difficult (Score:2, Informative)
A more pressing concern is how to keey your private key private from your employer if you're using their computers.
One line sums it up (Score:2)
:)