E-mail And Phone Snooping In The UK

bscanl writes: "According to this Irish Times story, British companies are to be allowed intercept their employees' e-mail and telephone calls. Nasty stuff."

Both Illegal and Legal here in the States

[scotpurl]

The strange thing is that someone really needs to sue their employer (any takers out there?) and get this resolved here in the States. There are situations where it's OK for the employer to snoop on phone calls, and others where it's not. One of the exceptions I remember (me not Lawyer) is Montana and Delaware, both having state constitutions highly protective of individual rights, say that it's not OK for employers to snoop. Other states are like, "Sure, if it increases your profits, do whatever you like...."

Anyway, at some point, they'll label email and telephone as similar communications, and thus bound by similar rules. Which means they'll either give telephone conversations the same weak protections email has, or they'll do what Thomas Jefferson would do, and extend the same protections to email that telephone users enjoy.

And maybe grandfather us DSL and cable modem users in, too. :-)

Um...

[Jetifi]

Two days ago there was a fuss about the European Convention on Human Rights (or something) becoming law. This was billed as "The greatest change to English law for 300 years", and one of the things it stops is employee surveillance.

So preseumably this law is out of date already.

As if they weren't doing it before???

[human bean]

The number one feature management asks for on any private telephone system (PBX/key, etc.) is "boss listen" or equivalent. It is on probably seventy percent of private telephone systems in the US, and I don't know how many in the UK. Some PBX makers no longer list it as an option, but have it as part of the default operating set.

Email is the same way. Lots of companies simply record everything in and out of the server "just in case".

The key is in whether the management really monitors these things. Easy enough to find out, though. Use disinformation, and see where the screams come from...

Already quite legal.

[_LORAX_]

In the US or most anywhere, it is perfectly legal to snoop on your employees. They are using company propery, and on company time, why not. The biggest problem that I see with the current system, is that is does not go nearly far enough to warn employees exactly what and when they will be monitored.

I would like to see companies bound by a policy that they have to state, and have employees sign every 6 months. This policy would describe what channels are monitored, when, and who to appeal to. Snooping should also only cover outbound calls, or inbound only under suspision, as employees have less control over who calls them.

Personally I don't believe monitoring in most situations is good buisness practice, as it shows that your managers can't do there job of keeping tabs on productive / non-productive employees without employing technology seems a little strange to me, but anyways.

They don't have to ban it..

[_LORAX_]

In the UK they can demand passwords to encryped data. Failure to submit and you can be jailed for 1 year.

Re:Um...

[luckykaa]

I'm not sure that it was actually a law saying that they CAN snoop, rather the failure of a law to say that they can't. (I might be wrong here)

Did they have a cloaking device?

[billybob2001]

So how many employers worry about the legality of snooping?

Some unofficial access to email happens in most companies.

Someone, somewhere can look at your stuff anyway, whether it's on your LAN, at your ISP, or anywhere else in the universe.

I always treat my mail as though it might be read, one day, by someone else it wasn't intended for.

If you've got nothing to hide, you can stop nervously looking over your shoulder, and remember that all comms methods are inherently insecure, but we don't generally worry until it gets on a computer.

That may say more about us and our kind than about snoopers.

Re:Already quite legal.

[radja]

in europe there is such a thing as 'reasonable expectation of privacy', and all breaches of privacy (like snooping email) have to be known in advance. Just because the infrastructure belongs to the company doesn't give them full rights to snoop everything. And it shouldn't.. or do you think companies should also be allowed to hang cameras in their toilets? After all.. it's their property... it is reasonable to expect that you won't be taped in a compromising position on the toilet.

//rdj

//rdj

Re:Both Illegal and Legal here in the States

[blameless]

someone really needs to sue their employer (any takers out there?) and get this resolved

That's really sad, isn't it? It would be nice if the legislators would do their jobs & protect the rights of individual Americans, wouldn't it?

Last night, during the debate, Bush said he believes "that the judges ought not to take the place of the legislative branch of government."

I feel they ought not to have to take the place of the legislators. Unfortunately, it appears that we, the people, have no choice but to take matters into our own hands & litigate.

As it stands, the legislative branch of our country operates under a system of open bribery.

The law is mostly irrelevant in USA...

[marcus]

...when exchanges, commerce, contracts, etc between two private parties are concerned.

The US Constitution was afterall a set of laws that were intended to describe the purpose and structure of and restrict the behavior and the authority of the federal government, and not much anything else.

So, if you were offered a job and the HR gnome informed you that the company's communications gear is to be used for job oriented communications only, and that the corp reserves the authority to monitor the activities of its employees, as in timesheets, schedules, ID badges, etc. you've really got no place to complain. Ask for more money to compensate for inconvenience, or go somewhere else rather than sign the contract.

It would be nice if the legislators would do their jobs & protect the rights of individual Americans, wouldn't it?

In order to succeed in protecting the rights of individuals, the legislative bodies basically have to do nothing at all because those rights exist a priori. Which is of course, the problem. They have been doing stuff that they should not have done and thus the individual's rights have been reduced.

Unfortunately, it appears that we, the people, have no choice but to take matters into our own hands & litigate

Here is the core of the problem. It is not at all unfortunate that we the people have to take matters into our own hands. It is by design! You are supposed to take care of yourself, friends, family and neighbors. Those responsibilities do not reside on any gov in the USA according to the Constitution. OTOH, litigation is not the only alternative, why not just get a better job?

Good judgement comes from experience, and experience comes from bad judgement.

What about encrypted data?

[blameless]

Does this legislation allow companies to ban the use of encryption on company emails?

For many businesses, encryption is necessary to protect sensitive information, so instituting such a restriction would be, to say the least, counterproductive. Even so, I wouldn't be the least bit surprised to hear of such a development, particularly in corporate bureaucracies.

Re:Conditionally quite legal.

[Teun]

I would like to see companies bound by a policy that they have to state, and have employees sign every 6 months. This policy would describe what channels are monitored, when, and who to appeal to. Snooping should also only cover outbound calls, or inbound only under suspicion, as employees have less control over who calls them.
I can largely agree with this quoted description For example in The Netherlands this type of snooping can only be done after a (general) warning and the consultation+OK of the elected personnel representation.
When for some reason (in a criminal investigation)this warning might spoil the efforts only a court order can allow such secret snooping in a very precisely described way.
The main difference between the US and European privacy laws is that in Europe we have them.....
Another difference is that in Europe we don't so much have freedom of speech but instead freedom of information and that is a two-way street.

Letter from Patricia Hewitt to Financial Times

[PhilHibbs]

Found this ;he re [ucl.ac.uk]:
LETTERS TO THE EDITOR: Interception and the rights of individuals
Financial Times, Aug 8, 2000, 174 words

>From Patricia Hewitt MP.

Sir, Your article "Companies snooping on staff face curbs" (August 3)
suggests that the draft lawful business practice regulations, currently the
subject of a public consultation, will entail a "legal clampdown" on
companies' monitoring of electronic communications by "bringing private
business under the scope of interception laws for the first time".

This is not accurate. The regulations will actually reduce the burden on
business by making exceptions to the general rules on interception set out
in the regulation of investigatory powers act. They will permit businesses
to intercept communications on their own systems without consent for certain
purposes such as providing evidence of a commercial transaction, preventing
crime, or protecting a network against viruses or hackers. The regulations
will therefore help legitimate business practices regarding interception
while at the same time providing a high degree of protection to individuals'
civil rights.

The regulations have been drafted in the light of informal discussions with
business and other interests. We have already taken on board some of their
suggestions and I will take careful account of any further ones.

Patricia Hewitt, Minister for e-commerce, Dept of Trade and Industry, 1
Victoria Street, London SW1H 0ET

Re:What about encrypted data?

[Miragejp]

And just how the heck are they gonna ban encryption without it becoming a burden on themselves? For me, it was as simple as getting admin access to my box (we're stuck w/ crappy NT boxes at work and they only give us Power(L)User access to our own boxes) and installing PGP (or any other encryption software and encrypting to your heart's content.) They can ban attachments, but they can't ban all email without it affecting other users.

Just my 2/100 of $1