Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
×
Privacy

UK Employers May Read Employees' Mail 233

Martin Spamer writes: "The BBC reports that today the UK introduces Controversial new regulations (RIP) giving employers sweeping powers to monitor their workers' e-mails and Internet activity. Campaigners say the rules, under the new Regulation of Investigatory Powers Act, are an assault on personal privacy." I guess I just don't see it. If I was gonna bad mouth my boss, I'd use my domain as the e-mail address, and PGP crypt the message. It's not so simple when you're using, say, a corporate laptop on your couch at home on a Saturday night tho.This bill was passed a while ago - but this is the day it takes effect.
This discussion has been archived. No new comments can be posted.

UK Employers May Read Employees Mail

Comments Filter:
  • ...and make decrypting it a violation of the DMCA.
  • I'm working for an UK ISP, so the odds of my emails etc being checked without me knowing are incredibly low. However, this might turn out to be a real pain if we get told to start checking our customers emails...!
  • The BBC reports that today the UK introduces Controversial new regulations (RIP)

    Actually, it came into force yesterday.

  • Have you thought about patenting that idea?

    sounds like a good one ;)
  • "Campaigners say the rules, under the new Regulation of Investigatory Powers Act, are an assault on personal privacy"

    How is this an assault on PERSONAL PRIVACY? You are sending mail and surfing while on company time and you whine because your employer wants to see how you are using it's resources. If this were the government monitoring it's citizens I could understand, but not a company monitoring it's employees.
  • OK, a lf of folks here might shout and scream about privacy, etc., but the fact is that email or web browsing on corporate time should only be for corporate purposes. There were quite a few articles a few years back about email wasting employee time and such.

    So I think it's okay to say whatever on your own time, but it seems like an *okay* step to take in work matters, as long as such a law is never evvvvvvver passed for normal home use/personal use.

  • Can't they force you to hand over your key if they suspect something is amiss? So you can either give them access to your encryted mail or walk out the door...
  • Being at work or using corporate equipment to do - whatever... is like being a guest behind enemy lines. Regardless of the company tells you, you're always under suspect and someone will always be watching you. As the poster mentioned, the only way to really be safe is to encrypt anything you have to say that the company might not like. Then again, can they ask you to decrypt whatever it is you send when they find the message?
  • by NetJunkie ( 56134 ) <`jason.nash' `at' `gmail.com'> on Tuesday October 24, 2000 @05:20AM (#680051)
    I'm always amazed that people are surprised that an employer is reading their mail. Users need to realize that the computer they use at work belongs to their employer, as does the network, the internet connection, and the service to keep it running.

    Given that, I've never been anywhere that just checked everyone's email. The person they check on has been doing other things that make the employer suspect something is up.

    But be warned, there are plenty of applications out now that scan email for keywords whether it be naughty words or things that may be confidential to the company.
  • I believe e-mail and internet usage can be monitored by US employers, but only if they notify the employees that montoring is taking place.

    However, I seem to remember the outcome of the Steve Jackson Games case was that the govt. treats e-mail just like postal mail (i.e. court order required), but since the machine that sends/stores e-mail is owned by the company, they have the right to do with the contents as they please. This allows companies to monitor e-mail.
  • First off, not every employee is going to know how to encrypt their messages so Malda's suggestion is hardly universal. But dealing with the issue, I am not necessarily opposed. While laws that regard penalties for anonymous posters (eh-hem) to be responsible for their posts are ridiculous, using your company's infrastructure to degrade it should not be permissable and oughtta come at some sort of risk.

    1. My Vote's On This Doofus [mikegallay.com]
  • my break is my time, not my employer's. and my employer better not snoop on that...

    //rdj
  • by Lxy ( 80823 )
    the company I work for already does this (or so they claim). In the employee policy manual, it specifically states that my employer can read my e-mail, listen to my voicemail, and monitor my internet activity. What's the solution? Use PGP e-mail. Most PHB's don't know what encryption is and are too naive to think their's someone in the company smarter than them. Use anonymizer to surf the web for any non work related stuff. It's that simple.

    "You'll die up there son, just like I did!" - Abe Simpson
  • What on earth could you be sending to other employees while at work, that it would matter what you're sending? Anyone, who at this point, is not aware that email is not in the least bit secure, should get what they have coming to them. Personally, I hate it when other employees send crap they download from AOL, thinking they are witty or clever, and that I'd be interested in this droll humour. Chances are, I've probably already seen it anyway.

    Has anyone ever noticed it's the technopeasants who send you this stuff (as if they discovered some untapped corner of the internet).
  • by radja ( 58949 ) on Tuesday October 24, 2000 @05:22AM (#680057) Homepage
    >Users need to realize that the computer they use at work belongs to their employer, as does the network, the internet connection, and the service to keep it running.

    so is the toilet.. how'd you like a camera there?

    //rdj
  • I honestly don't understand why this is even an issue. If you're on company time and using company equipment, then yes, your boss has a right to monitor what you're doing. Go back 20 years ago. If you're typing something and your boss walks over and starts looking over your shoulder, did you tell him to quit invading your privacy?
    Just wait until you get home to send those personal emails or download mp3's or look at pr0n or whatever else it is you want to do. That way you'll keep your privacy AND your job.
  • by 11223 ( 201561 ) on Tuesday October 24, 2000 @05:25AM (#680059)
    Yes, but (on your break) do you use company equipment to send email? Is it not their perogative to monitor any usage of equipment they own? Go take a walk to the local library and then send your email, okay?
  • by 11223 ( 201561 ) on Tuesday October 24, 2000 @05:26AM (#680060)
    ...employees of backbone service providers? If you send an email badmouthing your boss (you work at, say Sprint or MCI) and it travels through a Sprint or MCI portion of the backbone, even if you sent it from another provider, can they then still read your email, because you work for Sprint or MCI?
  • I do it over the phone, or from home using my personal email account. I'm so amazed at examples of the following:

    People who trash their employers via company email.

    People who trash fellow employees via company email.

    Executives who say damning things about their company behaviour around a live mic or in email.

    How often this sort of thing finds its way public

    I'm not surprised at how many dumb people there are int he world, just disappointed.


    --

  • As I commented on in the Linux in the workplace [slashdot.org] article, the email servers and network connection are there because the companied is paying for the equipment and upkeep of that, therefore they make the rules. Not all companies are draconian on email/internet activity restrictions, so if you don't like that company's rules, get a job elsewhere.

    I personally avoid using work email for anything beyond work correspondence, and while certainly not draconian, I feel that it's a responsibility to my place of employment to minimize the use of email for personal business.

    Now, if the rules extended to any email/activity from any account even outside of the company's control, then it becomes a free speech issue. (i.e. use hotmail or other web-based emails if you really want personal email at work).

  • ...to include forms submitted to webpages and FTP transfers? E-mail might just be the beginning of this Hobbesian renaissance.

    (Hobbesian = compliant with the social philosophy of Thomas Hobbes [i.e.: paranoia regarding the "inherent wickedness" of people and their tendency to do bad things when out of the scrutiny of authority])

  • It shouldn't cover your customer's e-mails, only employee's e-mails.
  • Everyone who's screaming about personal privacy being violated, please repeat after me. "The machines my company gives me do not belong to me. I have no rights to privacy on company machines. I cannot do whatever I want to company machines. I cannot install Linux on company machines if they don't tell me I can. I can be looked at any time to see what I am doing on a machine that the company is loaning me to do work for them. If I want privacy and the ability to do things to machines, I can do them to machines that I actualy own. Otherwise, I will not whine."

    Now keep saying that until you grok it.
  • There are the obvious solutions, e.g. using an ssh tunnel to an external web proxy and doing all your non-business-related emails through that or at the external shell account at the far end of the ssh tunnel. All you need is a shell account on an external box and a copy of Junkbuster to act as a (non-caching) web proxy to tunnel to. Of course it helps to have sshd running on the remote box too...

    now if only I could find a free ssh program that supported port forwarding/tunneling for Windows...

  • ...in case a law like this is passed in the US.
  • Coincidentally the UK has signed up to the European Human Rights act, and also recently the Data Protection Act has been ammended. I am unsure how much of the HR act will cover this but...
    I do that the DP act states that employers should not subject employees to continual monitoring of their private affairs.... this includes emails, telephone calls etc - whether made using employer resources or their own.

    Having said that I don't see the problem, I use my works email for *personal* use during the day, but personal use does not include bitching about my boss, distributing porn etc. If you can't be sensible then you probably will lose your job anyway.

  • > If I was gonna bad mouth my boss, I'd use my
    > domain as the email address, and PGP crypt the
    > message.

    Not enough! The RIP requires you to hand over your private keys if asked to by the Home Secretary (or some designated by him, so realistically any policeman) or face imprisonment.

    Frankly it amazes me that Jack Straw can't see the contradiction between passing legislation like the Human Rights Act on one hand, and the RIP act on the other.
  • its always been on military computers. As I look at my monitor right now, I see a big fat sticker that says 'consent to monitoring, use of this computer constitutes consent to monitoring at all times ' etc etc etc. I dont see what the big deal is. Its the same principal in the corporate world as in the military.... you have access to potentially damaging material (if it gets in the hands of the wrong person). If your doing anything to put your org at risk, well then you lose your rights to 'privacy'. also, its _their_ equipment. Thats why I never send personal email from my work box. as far as Web surfing, etc, dont go to any sites that may not shine in yoru favor. use common sense.... ...

    "sex on tv is bad, you might fall off..."
  • Dear Jane

    After having started on my new job today, I'm afraid I have some bad news to tell you. The work I am doing here is very challenging which might cause me to do some real overworking. The fact that the boss is a really nice guy obviously has something to do with this. I seriously suspect him to have been a sergeant-major at least in Her Majesty's service, as the charisma and leadership of this man is unrivaled by any previous employer I have worked for. It seems as though this is the place where I belong. The job I have been looking for all this time. I must stop now, as I feel it is inappropriate to take more than 10 minutes of breaktime a day.

    Sincerely yours,
    me
  • I guess if it's that critical that you send email at work get a laptop and one of those really expensive wireless links and just bulk send all you written email at once.
  • The bottom line is that HMG doesn't get I.T. At all. It's sickening really; we have Smilin' Tony telling us we want to be at the forefront of the e-revolution, and then a sickening bunch of has-beans toadying along behind coming up with crap like the R.I.P. bill and this load of old tosh.

    The extent of the problem was highlighted on the BBC Breakfast news when the self-styled e-minister Patricia Hewitt said that although yes, the Government was allowing employer snooping, it was only for "reasonable" uses. To paraphrase the good lady "Employers shouldn't pry. We trust them not to go looking at messages that are private". e-minister *blech*. Bet she wouldn't know a website from a kick in the teeth, let alone exactly what barrel of worms she's just opened. "reasonable use only".... nice. Let's see someone get a legal definition of that one; it'd be like nailing jelly to the wall.

    What's worse is that Her Majesty's Opposition is just as technically inept, if not more so. I don't mind so much the boneheadedness (hey; I'd make a crap politician so why should they make good geeks?), but I am fed up to the back teeth with smiling baby-kissers telling me all about how great the technology is and how they know *just* how it needs regulating.... Oh, and then hold 1 week unannounced "review" periods for public consultation, then trumpet their spawns-of-satan legislation as "widely approved of by industry and public".

    The thought of actually going out and *asking* people what legislation they need (other than the police, of course, who have predictable knee-jerk reactions hence RIP), and *listening* to them instead of patronisingly telling them what they want could never occur to this bunch of rabid style-over-substance image-is-everything inept sheep. I mean... not towing the party line? showing evidence of independent thought? not being "On-message"? Heaven forbid.

    TOh dear did I really type that load of tripe? Ah well, it's off my chest now. Just scroll down a bit will you? There is nothing to see here. I'm going to go and lie down with a cold towel and maybe lay off the coffee for a bit.

  • Sorry to be posting such a blatant ad, but I've begun to use hushmail.com for just this reason. Its web based, but done in a java applet, so that every byte that travel over my employer's LAN is strongly encrypted. Nervous folks in the UK may find it useful. Hushmail [hushmail.com]
  • by lga ( 172042 )
    Under the RIP act several things have changed. First of all the authorities (any authorities, it's badly worded.) can demand access to your email and the rest of your computer. MI5 has a building dedicated to monitoring links from ISP's. Secondly they can demand a decryption key for anything they cannot read. Failure to come up with a key carries an automatic two year prison sentence. Telling anyone that you have been ordered to give access to your email also carries the two year sentence.

    Steve
  • by Anonymous Coward
    do you use the company toilets ? i assume you have no objections to us distributing CCTV snaps of your pee.
  • In the U.S. an employer is fully within its rights to monitor e-mail, phone calls and what have you so long as employees are informed that it may happen (not required on a per-call basis). There are some requirements to stop listening/reading once it is clear that you are dealing with purely personal material, but the cat is often out of the bag by then.

    While annoying, it doesn't seem completely unreasonable. One should hope that nobody could stay in business investing the kind of resources to meaningfully monitor everybody's every move.

    At the same time, one would like to think that employees who threaten others, conspire to steal, etc. could be monitored and apprehended.
  • In the United States we have basically established that email is the property of them employer. It is basically to be regarded in the same way as any other tool you would use. At work you are part of the company machine and all that matters is company privacy. In the home you are an individual and have more rights to personal privacy as well as family privacy. This shouldn't be seen as employers snooping into private matters. To every thing there is a season and work is not the time for personal privacy and concerns. :)
  • > ..and make decrypting it a violation of the DMCA

    Content-Type: exttay/yptocray; arsetchay="us-ascii"

    Hi Sue. How's work today. Mine's a real itchbay, so I'm idinghay down at Jim's office, and just kind of uckigfay off instead of trying to fight the ullshitbay that it takes to get anything done around here. My new boss is a a real oronmay, and I'm "this close" to telling him to isskay my ass. I'm going to brush up on my resume tonight, and get the hell out of this itholeshay.

    How 'bout an afternoon quickie? I was going to eaksnay out early today anyway.
  • by JurriAlt137n ( 236883 ) on Tuesday October 24, 2000 @05:36AM (#680082)
    doing a good job. My employer will neither check my e-mail nor whine about what I'm doing on the Web as long as I get the job done. Period.
  • .and make decrypting it a violation of the DMCA.

    Irrellevant. It's UK. The RIP bill actually specifies that taking measures to intervene with decryption for monitoring purposes is a crime. If you are asked for your keys you must hand them off.

  • If you are porviding business mail hosting as some UK ISPs do you must brace yourselves to be ready to order such service. In both technical and moral terms. The employer is entitled to read the business mail of its employees. This is valid only for hosted business email though. Not for personal.
  • I guess I just don't see it. If I was gonna bad mouth my boss, I'd use my domain as the e-mail address, and PGP crypt the message.

    Except if they were monitoring corporate traffic. Then it wouldn't matter whose domain you were using.

    Encryption? Just use traffic analysis ("Hmm... it appears Rob is sending email through his own domain, instead of the company's domain. Why?")

  • > Content-Type: exttay/yptocray; arsetchay="us-ascii"

    > How 'bout an afternoon quickie? I was going to eaksnay out early today anyway.

    Well, my usbandhay, whom you refer to as your oronicmay ossbay, is taking the afternoon off, so we can't oitday here this time. How 'bout if I just come to the office, and we'll give the old oomclosetbray a try?
  • Minor correction.

    You do not walk out of the door. If you do, they can sue you for misconduct and than you should give the key to the police which will lawfully request it as a part of the investigation. If you refuse to do so it is 2 years in jail.

    That is what RIP is all about.

    Clockwork Orange and 1984 all the way.

  • Why aren't these people being judged on their productivity? You pay them X dollars (or pounds, in this case). They produce results worth Y. If Y is greater than X, they are an asset. If Y is less than X they should be fired. (Alternatively, you could say "Your Y is less than X, we will have to fire you if this doesn't change in 3 month" and let the employee decide whether to bump up the ol' productivity).

    (Don't bother bringing up "porn == sexual harassment" because that is orthogonal to tracking and mail-opening)

    Now, I realize that tracking an employee's worth in actual dollar figures can be difficult, but any manager worth a damn knows if she is getting bang for the buck out of her employees. Telling an employee that he should spend his 15 minute coffee breaks in the break room reading a book as opposed to emailing his wife to complain about his cow-orkers is just micro-management.
    --
    An abstained vote is a vote for Bush and Gore.
  • My bosses won't be monitoring my mail - they wouldn't know how. They are all too stup...

    £^(*&%%$£&*^^ - Carrier lost...
  • Many have said that the companies are supposed to be allowed to monitor what they want. That employees should have no expectation of privacy when using company equipment. To some extent I agree. But then again, how far is reasonable?

    If I receive a personal phone call from my girlfriend, is it fair they listen? Is it fair they inform my wife, if she works in the same company? Or if not? When I take a break and use the corporation toilet, is it fair they videotape everything? Run chemical tests on the urine I pass there to monitor my stress levels? To monitor drug abuse? To screen for markers of inherited diseases or tendencies? If one day they get this mind-reading machine, is it fair to read my mind to detect if I am about to leave? about to be unhappy with the company? think private thoughts on "company time"?

  • actually a lot of company toilets do have CCTV

    Heh, so if I use too much TP does that count as pilfering office supplies?

    oh please oh please oh please let that one go to court....

  • Unless the company is registered with the Data Protection Registrar

    AND the employee specifically authorises the company to store their personal data on the monitoring computers

    AND the employee specifically authorises the use of that data for monitoring purposes

    AND the employee has full rights to know WHAT is stored, at ANY time

    AND the employee has full rights to ammend or correct data that is stored, at ANY time

    they would be breaking the law to monitor their employees e-mail. I'm not exactly keen on the idea that employers have the right to snoop on employees - whistle-blowers need protection more than corporate executives - but provided the DPA is given sharper teeth to tackle abuse, I think that this might not be such a terrible thing.

    (It's only an invasion of privacy if the DPA is essentially rendered worthless for this. You always need checks and balances, and the DPA is the only check your average Joe Bloggs has, right now, to handle computer misuse by corporations.)

  • One for business- open to your bosses;
    One for personal.

    What then if you read your personal account
    on a work computer?
  • Does it use their resources? Certainly, if someone was having significant amounts of personal mail (as people tend to, with e-mail) arriving at work, then I would expect employers to quietly ask the employee just what was happening.

    I'm sure infact, that if employees were getting 5-10 personal letters arriving at work (I'm guessing based off my own e-mail quantities), a similar bill would probably follow shortly afterwards, for personal mail.

    If you want to keep it private, don't involve work in it!

  • <I believe e-mail and internet usage can be monitored by US employers, but only if they notify the employees that montoring is taking place.>

    No. Numerous court cases have said the employer has a defacto right to intercept all communications- letters, email, telephone- that use company resources- address, time, facilities.
    However, in this tight labor market it is stupid for an employer not ot be upfront about it,
    because people do quit when they find out.

  • American's confuse me in this respect: why is it that you are so paranoid of goverment intervention in your lives, yet you don't think twice of CORPORATE influences?
    I mean, your country and your values are being sold down the crapper to big business and you don't even seem to care. Snooping is wrong NO MATTER WHO DOES IT. If I call my Sister on the phone at work it doesn't give my employer the right to record the conversation. There are laws against recording conversations here (Canada) where the recording party is not present in the converstation. The same should apply to email. If I don't write my boss he shouldn't be able read my mail. HOWEVER, he _should_ be able to read the headers to know _where_ I am sending my mail because indeed it is a work resource and he should know if I am wasting my time. I just have a big problem when people assume that because your company owns the equipment and resources you are suddenly in 1984 where you have no rights to privacy. This is wrong.

    -Shieldwolf
  • by ichimunki ( 194887 ) on Tuesday October 24, 2000 @05:59AM (#680128)
    This law doesn't need to be passed in the US. US employers pretty much already have this right. In fact, the law in the United States seems to support business in depriving you of what would otherwise be your civil rights. Some employers already engage in search and seizure of actual persons and personal belongings. Many employers require that you submit body fluids for testing. Video surveillance of employees is rampant (and is often done covertly, just as much as video surveillance of customers is done-- in fact, monitoring one often makes it trivial to monitor the other). Employees seem to be able to deprive you of your ability to sue the company by requiring "mediation" for all disputes. They frequently deprive employees and contractors of their ability to build a career through dead-ending tactics like non-compete clasuses.

    I fully recognize that civil rights are about government and not business, in fact that's what I'm complaining about (such a myopic view of rights in modern society), so please, no flames about the semantics!
  • I have one on both sides of my Windows2000/Linux box. If anyone needs help setting up their own... :)
  • I see your point, but I don't agree.

    If someone is in an office, and receives an email from their doctor, giving them information about an appointment, that information should be private, as it is none of the company's business (at least in most cases).

    The fact that the company owns and controls the vector that is being used to communicate the appointment is, in my opinion, irrelevant in any reasonable moral context. They may own the laptop, but they have no right to the proprietary information flowing between me and a third party. Because email leaves a trail, it is inherently less secure than paper mail - if I use a company pen to write a letter, they can't snoop on it, even if it's written on their paper, but because with email they can, they do...

    A related point is that The RIP bill, as far as I understand it, means that they can do this without informing you of their intention to do it prior to the fact, so someone a little less clued up than your average Slashdot reader may be writing in the belief that it is private.

    And what makes you think the library isn't snooping? Or the Cybercafe? Or your ISP? Or your telephone company?

    Whichever way I look at this, I don't like it.

  • I am married and I communicate through email with my wife.
    We happen to exchange, say, 3 or 4 mails during the day. which is not that much.
    We consider it private and would be quite pissed off if anybody decided to monitor our conversations, even though they remain "soft" because I am here at work and not prepairing tonight festivities.

    I admit English accept this rule, because they're so.
    But I take this story as a warning not to accept my next job in England because if I am considered as brilliant by my colleagues, I also admit I use the corporate network to coimmunicate a bit while working. It is necessary for me to swap between tasks.
    I then should be considered as somebody who's working habits are shocking ?
    what about my work, what I am here for ???

    If this law was about to pass in a Latin country (France, Italy... even here, in Switzerland) most people would refuse it because I am far from alone in this case.
    --
  • And they won't.. as long as you aren't using THEIR equipment and THEIR bandwidth to do stuff.
  • by hawk ( 1151 ) <hawk@eyry.org> on Tuesday October 24, 2000 @06:09AM (#680139) Journal

    Why, how can you possibly not understand this. The computer is theree, therefore I'm entitled to privacy. In fact, I'm entitled to have my employer provide a computer to use for my personal matters during working hours. Not having one just isn't *fair*.

    Furthermore, my employer has absolutely no right to question what I do with its property that it provides me. It's not like it has any right to control the use, nor that it amy get sued for my use of company property.

    Why do they think I'm here? to do stuff for *them*???

    Furthermore, I demand full privacy screens to protect me from them
    monitoring me . . .

    *********

    Given that the employer has absolutely no obligation to allow personal use, there's no privacy issue. Personal use is only permitted on these terms. Don't like them?--demand your money back.

    hawk, esq.
  • by TomV ( 138637 ) on Tuesday October 24, 2000 @06:13AM (#680144)
    How is this an assault on PERSONAL PRIVACY? You are sending mail and surfing while on company time and you whine because your employer wants to see how you are using it's resources

    Because RIP is not the only new legislation bearing on this matter.

    It's going to take a fair bit of fighting in the courts to establish what takes precedence - this aspect of RIP, or either of...

    • The latest cut of the Data Protection Act, under which it's a criminal offense for the employer to monitor personal communications without the consent of both parties, so long as there's sufficient evidence that the communication is personal (e.g. "[personal]" in the subject), and..
    • The Human Rights Act, which (at last!) gives us, amongst others, the right to Privacy, and to private personal communications in the workplace.
    As was in fact mentioned in the (broadcast) BBC reports on this story this morning on Radio 5. Just before their loopy debate on whether email actually serves any useful purpose whatsoever.

    TomV

  • by hawk ( 1151 ) <hawk@eyry.org> on Tuesday October 24, 2000 @06:13AM (#680146) Journal
    >If someone is in an office, and receives an email from their doctor,
    >giving them information about an appointment, that information should
    >be private, as it is none of the company's business (at least in most cases).

    1) then don't get it at work.
    2) if it's just the time to come, and you go during office hours, it *is*
    the company's business.

    >The fact that the company owns and controls the vector that is being
    >used to communicate the appointment is, in my opinion, irrelevant in
    >any reasonable moral context. They may own the laptop, but they have no
    >right to the proprietary information flowing between me and a third party.

    ??? And you get to decide what goes between the "do not look" veil? This
    makes industrial espionage just too easy.

    And again, you have no "right" to use the company's machines in this
    manner anyway.

    hawk, esq.
  • After reading some of the posts.. here's a thought.

    Someone brought up the point about personal snail-mail at work. Your employer does not have the right to open your mail, so why should they open your email? Well.. here's why, although a bit abstract.

    There is, due to long-standing law, as well as the fact that something is in a sealed envelope, a reasonable expectation of privacy when you send mail in the post office. (Recall, if you sendt a post card, with no envelope, there is NO expectation of privacy; anyone can legally read it.)

    The internet at-large is basically a *public* network. Yes, it's 'public' in a different sense than we usually use, but the fact that you have no real contorl of where your data goes after it leaves whatever you DO control.... that makes it public. THat, coupled by the fact that you don't know the policies of every network your message will pass through. Sending unencrypted mail ils as good as sending a bloody postcard! Yes, you can be reasonably sure the whole world cant' read it, but anyone who happens upon it legally CAN (the postman, your boss, the guy in the mailroom). This equates to things like: The IT staff, your boss, etc...).

    Think about it.
    If your boss wanted, he could say 'I want to see ALL snailmail coming into the building. Now.. he *CAN*, I believe, do this. He cannot make you open your mail, but he can see the volume/where the stuff came from. After all, the mail was addressed TO HIS BUSINESS.

    Use encryption. Seriously. Otherwise, it's like complaining about people using scanners on your cellphone calls (well, the US *DID* legislate against that, funny enough> Canada didn't.). Canada said 'well.. it's going with standard modulation over public airwaves... what did you expect? No expectation of privacy'. Of course, if it was *encrypted*, there is an expectation of privacy, and a scanner that could decrypt it may be illegal.
  • I used to be a sysop of a WWIV board and I would read user's mail all the time. My system, my phone line, mine mine mine. Same situation applies here.

    //MAILR is good clean fun. :)
  • Not all companies are draconian on email/internet activity restrictions, so if you don't like that company's rules, get a job elsewhere.

    I get the impression that many slashdot posters have never lived through a severe recession or depression, where jobs are scarce and getting a job elsewhere is not a practical option. They are going to be in for a shock when their employer unilaterally cuts their pay, and imposes new duties and rules. You don't like it? Quit. There are 100 people waiting in the HR office who would be happy to have your job.

  • As you say, it's rare but it happens. Even if there was no law passed, I believe that each of those could be dealth with, as a simple matter or corporate turpitude. If a company got wind of a coup against the company, it could always argue that since the computers and everything on it are property of the company, that all correspondences are as well. There'd be a pretty good chance the court would side with the company, since after all, the participants of the email were up to no good. There's always the plea of corporate self defense .

    I think more often, the companies would use the newly enacted law to fire people who are passing off-colour jokes or sending those annoying joke exe files - espcecially if the exe files have a virus attached to them. At the very minimum, they could use it as leverage to save some money at evalution time (i.e. no raise for you).
  • It will be intersing to see just what effects the Human Rights Act is going to have on UK law. It seems to me that much of British Legislation is built on the assumption that the government is fundamentally composed of good people (stout fellows). This is the tradition that the RIP act comes from - 'okay, it does infringe on peoples rights, but we're British, Dammit! We don't abuse peoples rights by nature' - this seems to be the general attitude.

    However, the Human Rights Act comes from an entirely different tradition, that of continental Europe, where they don't trust the government, and with good reason, given their history. This means that the Human Rights act will probably clash will all sorts of surprising parts of British Law, and I don't think this will be a good thing

    An example might be in Scotland, where traffic speed cameras may have to be removed thanks to the Human Rights Act.(the idea is that they can identify the speeding car, but not the driver, so it's stupid to prosecute the driver of a car caught speeding)

    I'm not saying that I agree with the RIP bill, because it seems to abuse the most fundamental of British Traditions, that of innocence until proven guilty, but I am wary of the different directions that British Law is being pulled at the moment, on the one hand by Jack Straw and his blatantly idiotic laws (bye bye trial by jury), and on the other by the alien edicts and ethics of European law.

    I think it's about time we ignored all these foreign infringments, and realised that British Law should be dealt with within it's own traditions as it always has.

  • by sulli ( 195030 ) on Tuesday October 24, 2000 @06:24AM (#680159) Journal
    Well, of course the employer owns the computer, so the employer has certain rights. But that doesn't make it good practice to do so. I know that if I had reason to believe that my employer routinely monitored my email for anything other than patently criminal activity, e.g. stock manipulation or corporate espionage, I would quit.

    Good employers know how to treat their workers. It's up to the employee to choose a company that treats him/her right - particularly in this tight job market.

  • Is there anyone else who really doesn't give a hoot about email monitoring? If your company respects you, they're not going to be a snit about personal use of email and web surfing, unless of course, you're obnoxious about it. If your company acts like the Gestapo, well, find yourself a new employer. It is the company's resources, after all. And if you're divulging secrets or bad-mouthing other employees, well duh! you moron, of course you're going to get smacked.

    I myself keep job inquiries in my inbox, just as a warning to any snoopers: mess with me, and I can walk in a heartbeat.

    What too many people seem to forget though is the imbalance of power in this situation. Your email is suspectible to snooping by upper managment, but how many of you have the oppurtinity to snoop on their personal doings at work? And before all your submissive lap-dogs whine about "it's not your job to know what they're doing", remember that a great many wokers in the tech sector are stockholders in the companies for which they work. I have just as much desire to see the company succeed as the suit with the inflated salary, and I have a right to know that he isn't wasting my money.

    But alas, that's the corporate republic for you. It's feudalism, not democracy.
    --
  • Agreed, sort of. It's long been traditional since I grew up reading unix sysadmin books by O'Reilly that employers should be able to track stuff, certainly in the case of abuses of the system.

    Where all the modern fad of calling it a breach of privacy has come from, I dunno.

    How much mileage is there in the view that "freedom of speech is fine, but abuse it and lose it"?
    ~Tim
    --
    .|` Clouds cross the black moonlight,
  • by Bug2000 ( 235500 ) on Tuesday October 24, 2000 @06:26AM (#680163)
    In the case of emails, why not marking personal emails as 'Personal'. Those emails would not be legally accessible by the employer. And if an employer sees that there are 50 personal emails a day for an employee then he is fully entitled to say he has a problem with it. Privacy is preserved and company working time is monitored. In the case of internet access, I believe that employers should be allowed to say that it can only be used for work purposes and therefore have full right to monitor their employees' navigation. Sort of meeting behalves...
  • They are using our bandwidth to send personal mail--so we should be allowed to read it!
    They are using our phone system to make personal calls--so we should be allowed to listen in!
    They are using our parking lot to park their cars--so we should be allowed to search them!
    They are using our plumbing to take personal dumps--so we should be allowed to watch!
    They are using our lighting to illuminate personal activities--so we should be allowed to monitor!
    They are using our air molecules to vibrate with personal spoken messages--so we should be allowed to eavesdrop!

    All of these things are "environmental". Presumably there is value to the company to provide them to all employees. If an individual employee is being unproductive, fire him. There's no need to read his mail, search his car or test him for drugs. If the mail system (or parking lot) as a whole is costing more than it provides, de-install it. There's no need to read everyone's mail or search everyone's cars.

    Remember during the Olympics and how everyone squawked about how the FBI was reading the email from the kiosks? But the kiosks belong to some company or government--can't they do what they want? I'm using my ISP's bandwidth, does that mean they can cc all my mail to the FBI? No, dammit!
    --
    An abstained vote is a vote for Bush and Gore.
  • In the USA, land of the free, home of the brave, the constitution, etc...employers have the right to scan all the transmissions on the wire, read your emails, whatever.

    Just thought you'd like to know.

    The last place I worked didn't delete ex-employees mail accounts, preferring to harvest and read what people sent them months/years after the employee left.

  • A couple of points.

    In the UK the employer does have an obligation to provide a phone, free from monitoring, for personal use. This is in recognition that people do need to take care of personal business in working hours.(For Americans who see any employee rights as an affront to the sacred cow of free enterprise, I have never seen a complaint from a business that this is unreasonable)

    Email is becoming widespread, but many people do not have access at home, therefore use it at work. In moderation this will have minimal impact on effectiveness, but personal email may contain information that you would wish your employer not to know - that job offer, or that test for a serious disease.

    Yes, you should use other methods, regardless of the legal status, but this enshrines the employers right to snoop.

  • by nigelb0 ( 234670 ) on Tuesday October 24, 2000 @06:39AM (#680182) Homepage
    So what sort of bosses like to see what their underlings are up to. Do they themselves believe they should be monitored also?

    A while ago our head salesman logged on to check his shares, only to find a porno site had taken its place (temporarily). Those photos were in his cache whether he liked it or not, and our proxy logged the accesses. As it happened we were working in a small office and we all had a good laugh about it.

    How would things be in a larger organisation where the monitor may be unable to see (or appreciate) the context? Would it matter if our head salesman was a junior instead?
  • by Anonymous Coward
    There are things I do not understand.

    If I want to say that my boss is a stupid idiot, can't I do that?

    If I say that he'll kill me or that I'll kill him for the extra work he is giving me, I'm NOT saying that I or he will died. This is just a way of expressing my frustration.
    Such comments are not intended to hurt the feeling of my boss. They are not even directed against my boss. They are expression (=release) of something that I had into me.

    Anyway, this is a private conversation between me and someone else and should not be taken out of context.

    I beleive I am the right to say what I want if I do not offend publicly someone, if I do not offend the person receiving the email.

    Lawyers may say that this is not how things work, but I do not care what lawyers can say.
    They should think a bit and realize that there are many more ways to hurt and insult people in a civilized and educated way! People that really want to hurt someone else would use this subtle lawyer-proof way and not a more direct one.
  • At one workplace, where I was a union representative, there was an issue where someone was being victimised by their immediate supervisor. The HR department were quite enlightened, and were pleased to have evidecne that said boss was responsible for the alarming rate of resignations. It was a large site with open-plan offices. Private phone calls to HR were impractical. Note, all parties concerned were workers at the same organisation.

    In general, a private channel is often very helpful in intra-organisational disputes.

    Stephen
  • Very true. We in the USA have much lower protections than exist even after this law goes into effect in the UK.

    We sold our privacy rights to corporate interests and they gave us promises of shiny baubles. And now our government tries to arm-twist nations that have higher privacy rights than we do into "opening the market" and reducing their consumer and employee privacy protections.

  • ??? And you get to decide what goes between the "do not look" veil? This makes industrial espionage just too easy.

    No - there's no decision to make - they never look, they have no right to (well, until yesterday I guess).

    Industrial espionage 101 :
    1. Get confidential documents
    2. Photocopy confidential documents
    3. Put photocopies in envelope
    4. Send letter to competitor
    5. Return originals to cupboard

    This has been possible for decades. Email didn't rewrite the rules, it just happens to be a vector that *can* be controlled, therefore they pass laws taking away rights that have been taken for granted for generations.

    Industrial espionage has always been easy, email didn't rewrite that rulebook.

    And again, you have no "right" to use the company's machines in this manner anyway.

    Even if that were true (which it isn't unless that happens to be explicit in the terms of your contract or the general terms of employment), once you have sent the message using their equipment, regardless of whether you had the right to or not, they still should not have the right to intercept and read it - they should only be allowed to discipline you for using the company equipment in an unauthorised way. Now, whether the use of the computer was permitted or not, they can still snoop - you have lost privacy in the workplace, which I think is very serious indeed.

  • "In the UK the employer does have an obligation to provide a phone, free from monitoring, for personal use"

    Umm, no they don't. Kindly point to the relevant piece of legislation - what's that? You can't? I wonder why...

  • Ok, so I can't use the toilet during the break because that would be abusing the company's property.
    I guess I can't shit on my chair also.
    Is this [pibmug.org] the solution, then?

    ____________________
  • No.. not the same thing at all.

    Recorded music/media/whatever, the issue is all about copyright, NOT about privacy at all. They may have a sense of ownership, but that's a completely different beast.

    Traditionally, laws regarding mail (and other communications, such as cellular phones) were based around whether or not the parties involved had a reasonable expectation of privacy.

    ie: Conversations and eavesdropping. If I'm in the middle of a field whispering to my friend, and you use some sort of listening device to amplify my conversation so you can hear it, you would be doing an illegal act.

    If I am in the middle of a field yelling at my friend, loud enough that you can hear it with your plain ears, and you use some sort of device to amplify it a bit and record it.. you are NOT breaking the law. I had no reasonable expectation of privacy if I was yelling.

    Same used to be (and still is in Canada) with cellular phones. It's not whether you had an expectation of privacy, but whether you had a *reasonable* expectation of privacy. Yelling loudly and saying 'I thought nobody was around' is not reasonable. Taking steps to make yourself not heard IS reasonable'. As with cellphones.. transmitting over public airwaves in the clear (the airwaves are *all* public), even though you may be ignorant to the physics of it, does not give you a reasonable expectation of privacy (under canadian courts, anyway). You are broadcasting something that can be picked up by any capable radio receiver.

    Copyright has nothing to do with privacy. The DMCA (not that I'm defending it) is about copyright. Making it illegal to break a copy protection mechanism is NOT equal to the act of violating a privacy protection mechanism, though both MAY use encryption.

  • My comment is made considering the IT market today -- if jobs are so scarce, why do we need more H1 Visas?. I know that 5 years, we just might be in a recession, and the market might soak up. Or in my case, the market for chem eng is sufficiently tight that job jumping isn't as feasible in IT at my particular education level. But for most that read slashdot, the employee's market is still very very strong.

  • Lose 2 marks for bad reporting again, somewhere along the line.

    This bill does not specifically give UK employers more access in terms of monitoring their staffs email.

    This bill gives the UK government + police services, access to monitor *ANYBODYS* email, for any reason, even if you are not under suspicion of having committed a crime. It's not even email either - they can demand the ISP feed traffic in general their way.

    If it was just work mails I wouldn't really care - it's their bandwidth, but the fact is that the RIP bill is in fact there purely to give the authorities unprecedented power to intercept the communications of the general populace, to demand their decryption keys (or face prison), and other such lovely fluffy things. It's big brother, approved by a government with no clue whatsoever.

    If anyone offers me a job in the US, I'll move..
  • >I guess I just don't see it. If I was gonna bad
    >mouth my boss, I'd use my domain as the e-mail
    >address, and PGP crypt the message.

    PGP encrypting it would do you no good, RIP gives the government powers to demand that you hand over your encryption key(s). And if you don't comply, or you've lost the key, or something? 2 years in the slammer.

    There's an interesting article about RIP and what people can do to avoid it at http://www.fipr.org/rip/RIPcountermeasures.htm
  • Some of the spy programs operate at tail end of transmission- that is, dump your screen perdiodically, say every 30 seconds. Private accounts and encryption would fail here. This spying is popular inside the home, but may be unwieldy in a company.
  • They always have been.
    Send some plain test mail with certain kinds of threats in them and you'll be hearing from somebody. This trivial to do in the current internet.

  • How is this an assault on PERSONAL PRIVACY? You are sending mail and surfing while on company time and you whine because your employer wants to see how you are using it's resources. If this were the government monitoring it's citizens I could understand, but not a company monitoring it's employees.
    Personally? I start work at 8:30 am, finish well after 7pm, five days a week (weekends optional). No-one (with the possible exclusion of you, it seems) honestly believes you can cut that big a chunk out of your life, totally excluding any personal business, especially if you are married with children. Excessive personal time during working hours is usually frowned upon, but arranging doctor's appointments, being contacted by your offspring's school and/or arranging your weekend's entertainments is usually accepted as a small overhead for being in business. Employers may well expect such things to take second place to working practices, and in particular outgoing calls should be in breaks rather than while on duty, but it *should* be deeply suspect if an employer decided to pass over an employee for promotion, based on the twice she has phoned her doctor to arrange a pregnancy test.....
    --
  • It's ironic, in Holland the government just passed a law that makes it illegal for a person to read e-mail not sent to that particular person. It falls under the same law as written letters (the constitution is going to be changed to cover electronic commucication). If they read your mail, you can sue them... (of course you'd have a hard time proving it.) I think it's a great law and it shows that 'our' government has at least some sense when it comes to new communication technology.

  • How would you feel if laws were passed allowing you boss to plant hidden microphoens and cameras in your office? Its really not very different.
  • Well, if reading your employee's mail is OK I guess this means that all Brittish Citizens, who together employ every Member of Parliment, have the right to read the email of their employees. Not sure the best way to read the email of any given MP, sniffers? Carnivore? Any ideas?
  • That's why it pays to be in the higher eschelon of your company's IT pyramid.

    LK
  • ...but your email can and will. Your post is hardly a refutation. The point being made is that misusing company resources is wrong; not that you have no right to privacy at work. What you say is completely irrelevent.
  • Who says you have to run ssh/sshd on port 22? On the external machine, run 'sshd -p 80'. While it is possible to set up a firewall that examines traffic at the presentation/application layer to be able to distinguish between a http and ssh, rather than doing simple blocking at the session/transport layer, in practise this would not be feasible except in the most security consious enviornments.

    In most circumstances, your privacy will be safe due to the ineptitude of your cow-orkers. Even if your network administrator is an uber-geek, just find out what he uses to secure his email.

  • Then you shouldn't be creating that (personal) data at work, should you?
  • I don't think anyone thinks that. The issue is with people who whine about doing something they (in *most* cases) technically shouldn't, and being harangued about it.
  • >How would you feel if laws were passed allowing
    >you[r] boss to plant hidden microphoens [sic.]
    >and cameras in your office?

    Actually, a law would need to be passed forbidding this. It is legal today. Consider
    the convenience store with the hidden microphone
    and camera? How is that workplace different from
    "your office?" How would you, as a lawmaker, word
    the bill to make a hidden camera legal in one
    workplace but not another?

  • You don't seem to understand the point : even though I know this *is* possible, I don't want it to be considered as *legal*.
    I want to have the right to contest such practices.
    --
  • I live in the UK. I had a boss who did this (and more) 2 years ago.

    Every account on the LAN had a blank password, which we were not allowed to change. The purpose of this was to allow the boss access to any email account when he pleased. Security on the network just didn't exist.

    What was really annoying was that this was an isolated office network. Email access to the outside world was via a separate PC, situated next to the boss. If we needed to access a web-sire or news for support work purposes we had to do it from home.

    Whilst I worked there one collegue had some personal mail delivered c/o the office, as he didn't have a permament address in the area. The boss opened this private mail and read it. I should have walked out then - I was already pissed off by the fact that I'd been standing outside in the rain for 45 minutes, waiting for the boss to turn up to open the place.

    I only worked there for 2 days (I'd have not come back from lunch on the second day if I hadn't left some possessions in my desk). It was the work place I'd ever worked at.

  • simple? I suppse this is.

    There's no entitlement to use the company computer. THe simple solution for the company is "absolutely no personal use," at whcih point there is absolutely no objection available to the company reading anything on there.

    The next step from here is the company offering limited yuse with conditions. If you don't like those conditions, don't take that limited use.

    *nothing* in here suggested that companies could read email on personal accounts, or tap personal phones.

    This is really about the company being able to control its assets.
  • No. Because YOU pay for that service. Your company pays for the service at work. Big difference.
  • > I think this fad comes from the entitlement
    > thinking that people can do whatever they want
    > whenever they want and misusing company
    > equipment or embezzling time are not
    > considerations. :)

    Agreed. I think "freedom of speech" needs to be justified rather than pulled out of the hat every time something goes slightly wrong.

    People will want entertainment. Entertainment is not hacking. Entertainment is a zero-quality plain waste of time, IMNSHO.
    ~Tim
    --
    .|` Clouds cross the black moonlight,

This is now. Later is later.

Working...