legendNYC
Premium
join:2003-06-04
Jamaica, NY
 ·Verizon Online DSL
1 edit |  Who Reads Your E-Mail
I am trying to locate a recent article about e-mail security where one guy reported that his Admin asked about "the barbecue last weekend". The Admin read his e-mail without permission or authorization.
I know this is a vague reference, but I believe I read it either here or at SANS. |
|
jefe
Premium
join:2001-05-19
Northport, NY
 ·Verizon FIOS
| I don't know the specific article you're referring to, but I think it's generally accepted, court upheld practice that any email on a company's server belongs to the company. The company has every right to read that email.
I know at least in my company you sign an acknowledgment to that fact. I don't think anyone at my employer bothers to read my email, but they can and have the right to. I don't forget that and anything that I don't think I'd want them to read, I don't send via a company email. |
|
legendNYC
Premium
join:2003-06-04
Jamaica, NY
·Verizon Online DSL
1 edit | By now I think most computer-literate folks know that e-mail has the privacy of a postcard.
At my wife's job there has been a problem with switchboard operators listening to calls after they are connected. I used the "barbecue" example to illustrate that most networks were designed with security as an afterthought. The important thing was for it to work. Security costs extra.
I agree that the company owns the system and has the right to view e-mail, but the Admin does not have sufficient authority to view e-mail without restriction. |
|
mattmag
Premium,ExMod 2000-03
join:2000-04-09
NW Illinois
clubs:
 ·Mediacom
| said by legendNYC  :I agree that the company owns the system and has the right to view e-mail, but the Admin does not have sufficient authority to view e-mail without restriction. If a company owns the system, and has the right to view the mail, that authority can pass to the person they assign to be responsible for the mail and the mail system.
What they *should* have, however, is a strict policy regarding what that Admin can DO with the information viewed. Quite obviously, it is improper and most likely unlawful to disseminate any information from those messages to anyone outside of the management of the company, and that would include the intended recipient of the mail. |
|
Blue2
Premium
join:2004-04-14
France
1 edit | reply to legendNYC
said by legendNYC :but the Admin does not have sufficient authority to view e-mail without restriction. Of course they do.
I believe the courts have upheld that you have no right to expect privacy using the company's computer, their server, their internet connection, while in their office. Not only can they view your emails and surfing habits without restriction, but they can use these as the basis for proving that (by viewing private email, surfing porn, etc.) you are not doing what you are being paid to do, and use this as the basis for firing you.
It isn't "yours", so what would make you think it's private? It's more like making a call from a public phone booth in a train station, and complaining that you have no privacy.
Of course, employers can be forced to give up their emails records by a court, so this occasionally works in the other direction as well. But the rule of thumb is quite simple: if you don't want anyone else to know about it, don't ever send it by email. Period. Case closed. |
|
legendNYC
Premium
join:2003-06-04
Jamaica, NY
·Verizon Online DSL
| said by Blue2 :said by legendNYC :but the Admin does not have sufficient authority to view e-mail without restriction. Of course they do. I do not agree.
The Admin's primary responsibility is to ensure the delivery of e-mail. It is not his job to indiscriminately review messages for content. Just because this individual has the ability view messages it does not follow that he has license to be a voyeur. Reading other people's e-mail is not an acceptable form of entertainment. |
|
jefe
Premium
join:2001-05-19
Northport, NY
·Verizon FIOS
| said by legendNYC :said by Blue2 :said by legendNYC :but the Admin does not have sufficient authority to view e-mail without restriction. Of course they do. I do not agree. The Admin's primary responsibility is to ensure the delivery of e-mail. It is not his job to indiscriminately review messages for content. Just because this individual has the ability view messages it does not follow that he has license to be a voyeur. Reading other people's e-mail is not an acceptable form of entertainment. You do not agree, but what your stating is wishful thinking on your part, not the situation in the real world.
Read this, for example: »www.privacyrights.org/fs/fs7-work.htm
In court case after court case a company's right to read any and all email sent through it's system has been upheld. If that's being a voyeur, the company has the legal right to being a voyeur.
As has been stated already, don't write anything in a company email that you don't want the company to read. Assume they are reading your mail, even if they're not, and you'll stay out of trouble. |
|
Blue2
Premium
join:2004-04-14
France
| reply to legendNYC
said by legendNYC : I do not agree. The Admin's primary responsibility is to ensure the delivery of e-mail. It is not his job to indiscriminately review messages for content. Sorry, you don't seem to get it. It doesn't whether you agree or not. What matters is what the law says.
You work for an employer and they pay you. They don't promise to provide you conditions of privacy. You use their tools and their materials. They can look in your garbage pail, check your emails, tap your phones, watch your surfing habits, even look through your (their) desk I believe, and you can do little about it except be better informed. About the only thing they can't do is put cameras in the bathroom, because you do have a right to expect privacy there.
Still don't believe us? Look at the link that Jefe provided at privacyrights.org. You have few rights.
Still don't agree? Take them to court and report back on the result. Good luck. |
|
legendNYC
Premium
join:2003-06-04
Jamaica, NY
·Verizon Online DSL
| Thanks for your responses. I guess I did not make myself clear.
I do not dispute the company's ownership of e-mail, nor their right to audit and view messages. I simply think that the individual Admin did not exercise good judgment when he read other people's e-mail. From the example it does not seem like he read the messages in the normal course of his duties, but instead as an attempt to engage in social intercourse with his co-worker. |
|
Nightfall
My Goal Is To Deny Yours
Premium,MVM
join:2001-08-03
Grand Rapids, MI
 ·Site5.com
·AT&T Midwest
·Comcast
| reply to legendNYC
I know most companies are covering themselves by telling employees and making them sign a waiver that nothing they do on the company network is private. In short, if they are browsing the web and checking their bank statements, there is no privacy that is implied. Same goes for email and such as well. The admins have the legal right to keep tabs on all access and what is accessed. Everything is logged these days as well.
I know that we would all like some kind of privacy at work, but it just doesn't work that way anymore.
--
My Domain
Nightfall's Hockey and Life Journal |
|
Nightfall
My Goal Is To Deny Yours
Premium,MVM
join:2001-08-03
Grand Rapids, MI
·Site5.com
·AT&T Midwest
·Comcast
1 edit | reply to legendNYC
said by legendNYC :Thanks for your responses. I guess I did not make myself clear. I do not dispute the company's ownership of e-mail, nor their right to audit and view messages. I simply think that the individual Admin did not exercise good judgment when he read other people's e-mail. From the example it does not seem like he read the messages in the normal course of his duties, but instead as an attempt to engage in social intercourse with his co-worker. It depends on what his duties are. I have been a network admin/systems admin for years, and I don't spend time looking at other people's emails. I have better things to do. If a manager asks me to get into someone's email, I do so with them looking over my shoulder while I do it. In short, I have all the keys, but I want to make sure the employees know that I don't turn those keys unless I am told to by a manager.
Maybe he was told that his job is to check other coworkers email. He could be a police officer of sorts when it comes to things like that. While that may not be something we like, its legal thats for sure.
Absolute power corrupts absolutely. Maybe that is the case here. He just feels the need to check other people's email and see what people are saying. That gives network admins a bad name in my opinion.
--
My Domain
Nightfall's Hockey and Life Journal |
|
Blue2
Premium
join:2004-04-14
France
| reply to legendNYC
It pays to be clear.
If your Admin. read emails solely for his own amusement, and not in the course of the duties outlined in his job description, then I would think that a few people complaining would result in him being reprimanded and/or fired for unprofessional conduct. If he is male and did this to a female co-worker, your company would probably be concerned and take action so that this could not be construed as the company condoning harassment.
However, that aside, it may be that your company's management specifically instructed him to monitor emails or even to keep tabs on certain individuals. If one person brings up this issue, they'd better be squeaky clean, as this would probably lead your company's management to be even more suspicious and conclude that they should start monitoring all your activities. |
|
youveshutmedown
@sbcglobal.net
| I have been asked to "monitor" other employees email and surfing habits many times in the past by management. I have been asked to scour harddrives for stuff, poke pry and prod through everything by management.
I don't even share this with the employee.
Going up to a fellow coworker and asking "How was the BBQ this weekend?" can be construed as harrassment in many states, and is a nasty grey area I personally would like to stay out of. |
|
Woody79_00
join:2004-07-08
united state
| reply to legendNYC
Why not end all the debate
get your self an email encryption program you can take to work on a flash disk
make sure the people you want to read your email also has a copy
and simply encrypt it and send it
then when the admin/company tries to open it and read it they can't
if they question you about it, simply say "i don't know what your talking about"
if they push the issue, refuse to give them the encryption key...if they try to fire you, they have no "real" proof to have reasonable grounds to fire you. just say you "lost" the encryption due to a flash drive failure..not your fault
i know someone who did this, the company fired him, he went to court and sued, the judge agreed that it wasn't his fault that the drive failed and the employee had no "reasonable" way to recover the selected data
he got his job back, worked like a charm
if you don't want your emails read, encrypt them |
|
Nightfall
My Goal Is To Deny Yours
Premium,MVM
join:2001-08-03
Grand Rapids, MI
·Site5.com
·AT&T Midwest
·Comcast
| In most well run organizations, employees have to have the rights to install that kind of software. Making sure you can install it could be a challenge, but if you want your internal mail encrypted as well, getting others to install it may be more of a pain.
Why not just end the debate and not send questionable emails from your corporate email account? 
--
My Domain
Nightfall's Hockey and Life Journal |
|
Blue2
Premium
join:2004-04-14
France
| said by Nightfall :Why not just end the debate and not send questionable emails from your corporate email account? Exactly!
Suggesting that someone encrypt their drive to obscure their activities while at work is like telling someone to wear a mask if they want to commit crimes at work. The point is that you have no legal right to do it, and this isn't a forum on how to cheat, hack, or commit criminal acts.
You work for a company and they pay you. If you don't like the arrangement, you are free to sit at home in your PJ's writing all the emails you want, surfing porn all day, beer in hand. You can also show up at the unemployment office that way too, but I doubt you'll get your check. |
|
miketavares
join:2000-12-10
North Dighton, MA
| reply to Woody79_00
said by Woody79_00 :Why not end all the debate get your self an email encryption program you can take to work on a flash disk Easy in most companies I have worked in this is in clear violation of the acceptable use of the company system(s) which generally say only COMPANY approved software can be installed and is grounds in and of itself for termination.
--
I need to put something unique here.... HMM can't think of anything.... |
|
