Forgot your password?
typodupeerror
Privacy Security Businesses Government The Courts News

Keystroke Logging Declared Illegal in Alberta 310

Posted by Zonk
from the naughty-canucks dept.
Meshach writes "The Globe and Mail has a story about how keystroke logging has been declared illegal in Alberta Canada. The ruling applies to companies using logging as a means to track employees." From the article: " The employee, who was not named, worked as a computer technician for six months in 2004. Ms. Silver said it was a job where productivity was hard to measure. 'We thought that using an objective check through the computer would be the most fair and objective way to do that,' she said Wednesday."
This discussion has been archived. No new comments can be posted.

Keystroke Logging Declared Illegal in Alberta

Comments Filter:
  • There are times when keystroke logging could be appropriate, like if you are in data entry- and they need to see how many wpms you are at.
    I for one expect no privacy at work, because I am being paid and am using their equipment. Then again, the toilet belongs to my company, and I don't want them watching me pinch a loaf....
    • Re:Could be ok (Score:5, Insightful)

      by Asgard (60200) * <jhmartin-s-5f7bbb@toger.us> on Thursday July 07, 2005 @03:49PM (#13006966) Homepage
      Logging > counting, if you want wpm just count the # of clicks, not record the content.
      • by ShaniaTwain (197446) on Thursday July 07, 2005 @03:56PM (#13007067) Homepage
        clearly the 'productivity' excuse is just a smoke screen, and their real goal is finding good free porn.

        I want the job where they have no measure of your days work other than the number of times a key was pressed:

        1.turn on key repeat
        2.leave heavy book laying on keyboard
        3.take rest of the week off and PROFIT!
      • by mikael (484)
        Yeah, when I stopped using the copy, cut and paste macro keys on my keyboard, and started retyping everything instead, my wpm sht up and I become the most productive employee in the office.
        • Re:Could be ok (Score:3, Interesting)

          by BlueCup (753410)
          This is modded funny, but this really happened to me. I wrote macros that were able to automate the work, and go 8 times the second fastest... my employer however would say I wasn't working hard enough (ignoring the actual output) I tried explaining how the macros increased my productivity... but she didn't get it, and eventually told me I had to start typing everything again... so I quit. And now I wait tables.
    • US centric thinking? (Score:5, Interesting)

      by www.sorehands.com (142825) on Thursday July 07, 2005 @03:53PM (#13007023) Homepage
      In the USA this type of activity is permitted in most situations. Canada has privacy protections for individuals which seem to limit this type of monitoring.

      [sarcasm]Why not let the employer and police monitor everything you do? You only have something to hide if you are a criminal.[/sarcasm]

      • [sarcasm]Why not let the employer and police monitor everything you do? You only have something to hide if you are a criminal.[/sarcasm]

        [sarcasm]And why not simply let the government control the conduct of every business and every economic relationship?

        They know what's best for all of us, afterall.[/sarcasm]

        • by sp0rk173 (609022) on Thursday July 07, 2005 @04:12PM (#13007230)
          Well, when deciding between a business and the government, i'll trust the government long before i trust a business. And I never trust the government.
    • by Strange_Attractor (160407) on Thursday July 07, 2005 @03:56PM (#13007060) Homepage
      the toilet belongs to my company, and I don't want them watching me pinch a loaf

      So, you ARE against monitoring vis a vis logging!
    • If they're doing data entry why would they need a key logger to see how productive they are? Just check to see how much data they entered. Any data that gets entered should be tagged for who entered it and when so it it should (unless the company is stupid) be easy to track how much a given employee has added without keyloggers.
    • Re:Could be ok (Score:5, Insightful)

      by l2718 (514756) on Thursday July 07, 2005 @04:06PM (#13007152)
      There are times when keystroke logging could be appropriate, like if you are in data entry- and they need to see how many wpms you are at.

      Keystroke logging means recording your keystrokes, not simply counting them. I would say that if company policy was "your computer use may be monitored", they should be able to do so -- if you won't like this clause, you don't have to work there. Persumably this will lead to a compromise, especially if workers negotiate their contracts jointly.

      As a brother post says, this is more-or-less the situation in the US, but not in Canada. There, privacy is a constitutional right which even private businesses have to respect. However, note that the ruling doesn't say that all logging is wrong -- just that in this case, there were less intrusive ways to evaluate the performance of that employee. Government regulation is another way to balance the competing concerns of the company and the individual.

    • by Anonymous Coward
      Then again, the toilet belongs to my company, and I don't want them watching me pinch a loaf....

      i wouldn't want to work for a company that kept logs from the bathroom either!
  • by AEton (654737) on Thursday July 07, 2005 @03:46PM (#13006913)
    "We thought that using an objective check through the computer would be the most fair and objective way to do that,' she said Wednesday."

    That's all very well, but did she say it objectively? I have to know.
    • >Mr. Work said he didn't have the jurisdiction to
      >rule on whether or not the employee was
      >dismissed as a result of his complaint.
      >Ms. Silver confirmed the employee no longer
      >works at the library but said his departure had
      >nothing to do with the privacy complaint.

      Riiiiight... he just found out he was being keylogged, filed a complaint, and then randomly 'stopped working' there.
  • Fox news... (Score:2, Insightful)

    by chill (34294)
    The first thing that popped into my head when I read this line "...the most fair and objective way..." was Fox News and their "fair and balanced" reporting.

    What crackhead honestly thinks keystroke logging is "fair and objective"?

  • monitoring (Score:5, Interesting)

    by Quasar1999 (520073) on Thursday July 07, 2005 @03:47PM (#13006932) Journal
    I don't much mind if an employer of mine monitors what I'm doing at work while being paid. In my specific line of work, sometimes I'm asked to stay late to finish a project or meet a deadline. In exchange for doing this, I expect (and receive) a reasonable tolerance of doing personal things (like surfing to slashdot) during normal working hours. But if I started doing no work, and the employer didn't have to wait until my project got screwed, and the deadline missed by months before realising that I'm not working, then I say it's well worth it. Even more so if they get one of my coworkers, since that saves me work in the long term... Privacy be damned, as long as it's not abused, I welcome it.
    • by Chris_Stankowitz (612232) on Thursday July 07, 2005 @03:52PM (#13007012)
      Privacy be damned, as long as it's not abused, I welcome it.

      It *will* be abused and there is no ifs, ands or buts about it. CS-

    • Re:monitoring (Score:3, Insightful)

      by Digital_Quartz (75366)
      Monitoring your employees productivity is one thing. Keystroke logging is quite another. My employer does not need to know every key I press in order to decide whether or not I am productive.

      If I write an email to my wife that says "I love you snugglywugglykins!", my employer definately doesn't need to see that. You can say "It's the employer's equipment, they have a right to do what they want," but that isn't true. Your employer, for example, can't tap your phone without your knowledge. They CAN reco
      • Re:monitoring (Score:3, Insightful)

        by maxpublic (450413)
        If I write an email to my wife that says "I love you snugglywugglykins!", my employer definately doesn't need to see that.

        If you're wasting company time and company resources writing personal emails, you deserve to be shit-canned. You don't have a 'right' to do anything with company property other than what the company decides you can do with it.

        Max
    • You should mind (Score:5, Insightful)

      by Anonymous Coward on Thursday July 07, 2005 @04:04PM (#13007139)
      The problem with keystroke logging is how completely pervasive it is.

      It's one thing to say "We'll read all your e-mail, and any files you save." That's reasonably "what you're doing on the company network."

      On the other hand, suppose you get a phone call on your cell with fairly personal information. Your doctor's phoned you up to tell you the name of the clinic to get your AIDS treated at, for example.

      It's not reasonable to say "employees shouldn't take calls like that during work," because doctor's offices run the same work hours as everyone else. So you take the call, you have to write down the name of the clinic. Ok, so you pop open notepad.exe to do it. You're going to write it down after, but the doc's talking fast enough, you don't have the writing skill to do it on paper.

      You *know* it would be stupid to save this file on the company network, or e-mail it to yourself. But with a keystroke logger, even though you haven't saved it, it's recorded.

      There are a hundred things like this. Who hasn't gotten a phone call from his or her boss, some extraordinarily irritating interference, and typed into his or her code "I would strangle this man if he weren't in charge of my paycheck..." then deleted it?

      Finally, and most importantly, keystroke loggers intercept passwords. While it may be fine to check up on what your employees are doing at work, it is abhorrent to destroy their security on every single site they might visit.

      Moreover, that information is not magically placed in the hands of "The Company." The Company is not a person. The administrator is a person, and while you as an employer may trust that administrator with corporate records, your employees have a right to have their bank account passwords kept out of that administrator's hands.

      Computers are, at this point, far too much an extension of our minds to log every single keystroke. It's just too detailed, too internal. There are far too many easy ways to check employee productivity without resorting to this intimate spying.

      In almost all cases, you can check employee productivity by watching out for sol.exe, checking the weblogs for things like slashdot or porn, and seeing whether the employee's work actually gets done.

      The ends don't justify the means in this case. Keystroke logging is insane.
      • Re:You should mind (Score:4, Insightful)

        by Casca (4032) on Thursday July 07, 2005 @04:29PM (#13007411) Journal
        A lot of good points. It should also be noted that a keystroke logger will destroy completely the ability to have a valid audit trail. The guy reading the keystroke logger can become anyone because they capture passwords. That should terrify pretty much anyone, especially managers.
    • >>In exchange for doing this, I expect (and receive) a reasonable tolerance of doing personal things (like surfing to slashdot)

      >>Privacy be damned, as long as it's not abused, I welcome it.

      Keep in mind that they will be collecting your passwords, credit card information, etc ...

      The two points that you have brought up seem to conflict.
    • Re:monitoring (Score:4, Interesting)

      by zulux (112259) on Thursday July 07, 2005 @07:07PM (#13009081) Homepage Journal

      My company is works the other way:

      My employees work for 6 hours per day - they're paid for 8.
      In exchange for having 2 hours of time to spend with family, avoid rush hour, and walk in the park, I expect no screwing around. Period.

      It works! They're productive and happy at the same time. I think I'm actually getting a bargain, because they work *hard* during those six hours. They get to go home and have a life.

  • Odd. (Score:2, Insightful)

    by Anonymous Coward
    So what else can you not do in Alberta with computers you, you know, technically own?

    Can you track what programs your employees run? Can you track what websites they visit?

    And does this apply to anyone who owns a computer, or just businesses with employees? Like what if you own a web kiosk in a public place, or you lend your personal computer to a friend? Can you log keystrokes from that?
  • by Anonymous Coward
    In this productivity assement, fatties would have an advantage, what with all the mashing of the hands against the keyboard.
  • by Enigma_Man (756516) on Thursday July 07, 2005 @03:47PM (#13006946) Homepage
    taking screen captures every 5 seconds on any employee computer under surveilance.

    -Jesse
    • by DigiShaman (671371) on Thursday July 07, 2005 @04:29PM (#13007406) Homepage
      It's not funny when all the PCs in your department have NiceSoft installed. I call it KGB software. http://www.nice-soft.com/product/nicespy/index.htm [nice-soft.com]

      Note: Our network will be upgraded to gigabit due to the bandwidth saturation that this program causes. Also, the central capture server will be upgraded too.

    • Sounds insane, doesn't it?

      There's at least one vendor out there who sells software that contains essentially this functionality. It tracks what websites you visit, and how long you surf on them, by seeing whether or not IE is in the foreground, whether the mouse/keyboard are in use when it it in the foreground, etc. I imagine it would be pretty easy to monitor damn near any application this way.

      The argument in its favour, so I was given, was that the proxy server couldn't tell with enough precision how LO
  • Six Years Ago (Score:5, Insightful)

    by DanielMarkham (765899) * on Thursday July 07, 2005 @03:48PM (#13006958) Homepage
    Six years ago, I was contacted by a stock brokerage company in New York. They were looking for ways to track the computer use (of their developers, I believe. I think they were concerned about Internet Surfing) Like a dummy, I rambled off some ideas that could help them track usage without the employees noticing it. At the time, I thought it was a very strange call! Why would anybody secretly want to know what their employees were doing? Didn't they trust them? I never heard back from the people, and I always thought that I had "given away too much" by specifiying the programming during the interview.
    Now that weird scenario has become all too commonplace, and it's just as secret as I feared. FTA, "When the employee discovered that he had been monitored, he lodged a complaint with Alberta's information and privacy commissioner."
    The guy didn't even know the software was there. Now it's one thing to tell people "We're watching you. This will go on your evaluation" It's another thing entirely to do it secretly.
    In the present day, clients are modeling their business practices more and more, and would like a way to track metrics. I'm all for it: if I were a businessperson or employee, I wouldn't have a problem with my boss measuring how long it took to do my work. Where I surfed during my lunch hour? Forget it. But my productivity? Sure.


    Welcome To My World [whattofix.com]
    • But can it always be measured like this? If we put aside busphrases such as "Work smarter, not harder", there's still a point there that your WPM may not show just how much work you've put into something. I often sit back and think and take some notes on paper when about to write an algorithm.

      I may have misunderstood this whole issue, but I really don't see productivity being measured simply be registering keystrokes.
    • ... any chance of it staying secret will be gone.

  • by 0110011001110101 (881374) on Thursday July 07, 2005 @03:49PM (#13006967) Journal
    And I thought clearcutting and logging of our national forests was bad....

    Take up arms! Our nations keyboards are in jeopardy due to these evil logging tactics, soon our keystroke supply will exist only in preserved forests and small wildlife areas.


    • Amen brother! I, for one, will start keyboard sitting to protect this ancient keyboard from the loggers!

      alsjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj jjjjjjjjjjjjjjjjjjj
  • by hesiod (111176) on Thursday July 07, 2005 @03:49PM (#13006968)
    If keylogging is declared illegal, how much of a stretch would it be to declare that scanning EMails or even net traffic for inappropriate material is illegal?
    • by mellon (7048) * on Thursday July 07, 2005 @03:56PM (#13007066) Homepage
      Remember, kids, if keylogging is declared illegal, soon only criminals will have keyloggers....
    • you're confusing scanning vs logging, as well as data entry vs communication. For the first, there is usually no permanent store of incoming/outgoing messages, they are scanned in passing rather than stored and redirected. For the second, no one needs to know that I took six tries to spell 'nuclear payload', while at the same time they have reasonable cause to wonder why I am discussing such things with the outside world using company resources.
    • by Intron (870560) on Thursday July 07, 2005 @04:49PM (#13007617)
      Nowhere in the article does it say that keystroke logging was "declared illegal". That's just the usual /. hyperbole. The case was about logging on one employee without telling him which raised privacy issues. That's why in the US, they always have announcements like "your call may be monitored" on hotlines. They make it clear not only to you, but also to their own employees that someone may be listening in. Also, most companies tell their employees that email and web surfing may be monitored.
  • Gotta rethink things (Score:3, Interesting)

    by dtfinch (661405) * on Thursday July 07, 2005 @03:51PM (#13006990) Journal
    There goes my idea of logging all keystrokes, mouse movement, and monochrome screenshots every minute from every system on the network thru VNC. I calculated that I could get it all down to only 200mb per day for 25 systems. A 250gb hard drive could hold many years of this data.
  • by ArsonSmith (13997) on Thursday July 07, 2005 @03:52PM (#13007001) Journal
    http://slashdot.org/ [slashdot.org]
    (refresh clicked)
    (refresh clicked)
    (refresh clicked)
    (refresh clicked)
    (refresh clicked)
    (refresh clicked) ...
    (refresh clicked)
    (refresh clicked)

  • by Anonymous Coward
    ...which is bullshit.

    If you try to determine productivity by simply counting keystrokes, someone who's chatting with a bunch of friends all day on AIM looks significantly more productive than someone, say, doing work-related data entry. You almost HAVE to look at the keystrokes to see what's going on, or failing that, monitor some other aspect of the computer use in conjunction with keystrokes to best determine what apps are being used and how frequently.
  • by wfberg (24378) on Thursday July 07, 2005 @03:53PM (#13007018)
    "We thought that using an objective check through the computer would be the most fair and objective way to do that,' she said Wednesday."


    Sounds reasonable. Except for one thing. Why did they hire some one for this job? What problem needed to be solved? Did that problem get solved?


    Presumably the problem was that not enough people were typing. So they hired some one to type, and measured the typing, right?


    They should've hired some guys off of IRC. They type a lot.

  • by back@slash (176564) on Thursday July 07, 2005 @03:53PM (#13007019)
    This doesn't affect me one bit. I know that there is no keystroke logging where I work. The sys admins here are complete idiots and have their heads so far up their ass they wouldn't know how to implement key logg&*%$^

    !NO CARRIER
  • by buckthorn (40295)
    "How did people ever look busy before computers?"

    But to make this acutally substantive, I have a hard time imagining a job where keystroke logging, even just for counting purposes, is the ONLY way to track productivity. Productivity implies you are producing something, making progress somewhere. That has to be trackable somehow. If nothing else, make the guy account for his time in certain increments. I know that's not a great thing to do and not foolproof either, but what I'm saying is there have to b
    • "How did people ever look busy before computers?"

      1. Carry a clipboard.

      2. Walk fast. Everywhere you go.

      You could be daydreaming about boning that cute blonde from accounting as you go to queue up a few more movies in your BT client but as long as you keep those legs moving all your boss thinks is "Wow there's Smith busting ass again, I wish more of my employees showed that kind of hustle!".

  • Right... (Score:3, Interesting)

    by xstonedogx (814876) <xstonedogx@gmail.com> on Thursday July 07, 2005 @03:54PM (#13007036)
    'We thought that using an objective check through the computer would be the most fair and objective way to do that,' she said Wednesday."

    Because the amount of typing is a sure indicator of productivity. /sarcasm

    Sorry, but about the only thing it will tell you is whether someone is spending time using email, message boards, and instant messages for personal use.

    And it's poor at that, because unless they're doing A LOT of non-work related typing, you don't really know how much time they're spending doing non-work related stuff. We all type at different speeds. Maybe it's all on their lunch hour.

    Besides, you can check all that stuff in other, less intrusive ways.

    Objective? Please. Except in obvious cases (like data entry as another poster mentioned) this requires subjective review by its very nature.
  • managers never looked at any of the computer files that were logged.

    So if they were keylogging, but weren't looking at the logs what were they looking at? Number of keystrokes? Counting keystokes isn't a great way to measure performance, because it penalizes people who are more proficient at the keyboard.

    We don't know the details of the case, but it seems like the employeers said that they were using a keylogger to measure performance. This is doubtful, because there are many better ways to measure perf
  • by SenFo (761716) on Thursday July 07, 2005 @03:57PM (#13007077) Homepage
    In addition to writing software for the company I work for, I am also the system administrator. And I have been working in the IT world for about 6 years now. In that time, I have never read another persons email. I have never gone through their personal files. This is, of course, unless asked to do so by the owner of said objects. And to this day, I still find it completely ridiculous that anybody would find it necessary to spy on their users/employees by means of logging all keystrokes.

    I believe that if a person cannot be trusted to perform the operations (s)he was assigned to, that they have no business working in the same company as me, in the first place. Maybe I'm too trusting. I don't know. But what I do know is that I am respected by my coworkers for being fair and not letting my power go to my head.

    Having said that, I wish key logging were illegal in all states. IMHO, certain people need to lighten up.
    • I think that people should be able to trust their employees also. Despite another post I've made on this topic, I'm not a fan of keystoke logging. On the other hand, in large companies, it can be difficult for a small group of managers or admins to oversee the productivity of a great number of workers. The name of the game in competetive american business is still 'productivity'. If you're not pulling more weight than your cubicle partner, then your partner will have more desk space next month. This is not
  • This is an interesting issue because, as far as America is concerned, keystroke logging could be warped and molested into an argument about privacy in the workplace in most courts. But where I don't really think it should be illegal is the fact that almost every company I've ever seen details the fact that company computers are to be used only for company work. Conducting personal business is to reprimanded in most cases.

    But with cubicle farms being so prevalent in even small offices, you really have no ot
  • The Issue is Trust (Score:5, Insightful)

    by agent dero (680753) on Thursday July 07, 2005 @04:01PM (#13007113) Homepage
    The idea of needing to secretly log keystokes on an employee is ludicrous.

    If you, as an employer, manager, etc, cannot trust the people below you to do the work you put before them, then why are they your employees?

    When it comes to computers at work, I might need to fetch files from home, they'd log my personal passwords, and all other data; that's not only unnecessary, but unfair. I trust them to not snoop my personal data that may be transmitted through a work computer, and they trust me to get my work done.
  • So it would make it illegal to have video surveillance too? If you can SEE the keyboard and the keys being pressed...Other than key logging being cheaper and the obvious format differences, what's the difference?
  • An employer should have the right to expect reasonable performace from their employees. No one puts a gun to an employer's head saying "employ that person", and no one is putting a gun to the employee saying "work for this person".

    The employer should have the right to approach their employees and tell them up front, their work is being monitored. As long as it's done in the open, the employee can't complain about invasion of privacy. If they feel their privacy is threatened, perhaps they are not doing thei
  • I didn't look this up, but I'm pretty sure the Alberta Privacy Commissioner only has authority over government employees/employers.

    I think the submitter is wrong: I don't think this ruling has any effect on a private employer. So it's not really "illegal."
  • One thing I have not noticed mentioned yet is that no one is questioning the "productivity" angle. Are not most jobs quantifiable in some way? I mean, this worker was not conjuring spirits or some such? When you hire someone, you usually tell them you need to do such and such, in such amount of time, or something like that. Did they hire this person to perfect the fung shei of the library?

    Once again managers, bosses, supervisors not giving a whole lot of thought into what their people are supposed to d
  • By no means should anyone think that keylogging is an "objective" way of measuring performance. Because employee A takes care of all her work and has some free time so she gets online and chats on IRC and employee B spends all day working on the same issues (and still doesn't get them fixed), employee B is not more productive then employee A.

    We need to understand that a productive worker is one who makes sure the job is done, and it doesn't matter what he or she does in their downtime. Want to measure the productivity of the tech at the library? Are the computers he is responsible for functioning properly? If yes, he is a productive worker. If it seems like he has too much free time, give him more resposibility. If he struggles with it, can him or lighten his workload.

    • I would agree, and this is one of the biggest fallacies in management today. I am appalled at the library's response - "How on Earth do you measure productivity?" as if technology was some bewildering alchemy akin to warlocks and potions. I mean, give me a break, the library must have had a reason as to why they hired a technician prior to hiring him. Are we to believe that they simply hired one without any justification, then wondered why they were paying him?

      There are much more effective methods of monit
  • All the porn and warez my employees have been so diligently finding for me?
  • This Is Bulls**t. (Score:2, Interesting)

    by ubuntu (876029)
    How can it be the company's responsibility to police employee use in order to prevent kiddie porn, piracy, death threats, etc. on company computers if your hands are tied behind your back? Companies have been often charged for crimes their employees have committed...

    At a place I used to work, half the people were salesmen, who, because they went out on the road all the time, had laptops. They would change their Windows XP passwords and not tell management. They would change MANY passwords (to supplier e-co
    • The problem isn't that the company could see the data. The problem is that the company didn't tell the employee what data would be accessed. That would allow the employee to make an enformed choice about what he wanted to reveal
  • by Locke2005 (849178) on Thursday July 07, 2005 @04:55PM (#13007666)
    Set heavy object down on space bar and go to lunch; let auto-repeat do the rest! Seriously, anybody that is counting key-clicks to measure productivity is just asking employees to spend 8 hours hitting random keys, and not encouraging them to do useful work. They are rewarding the typists that make lots of mistakes, then need to go back and correct them, rather than the typists that enter everything correctly the first time!
  • The Actual Report (Score:2, Informative)

    Since no-one has appeared to gone off to find this yet, here [oipc.ab.ca] is the report of the privacy commissioner.
  • IIRC, in the US courts have used the "reasonable expectation of privacy" as a litmus test to see if a monitoring activity is intrusive.

    Under this paradigm, NOTHING you do in the workplace other than going to the bathroom carries a reasonable expectation of privacy, unless someone with certain powers (such as the CEO) tells you (usually in writing) that a particular communication is private.

    Most courts have taken a pretty open view about what an empoloyer may do to monitor employee behavior while on the jo

IF I HAD A MINE SHAFT, I don't think I would just abandon it. There's got to be a better way. -- Jack Handley, The New Mexican, 1988.

Working...