Discussion on:

Workplace privacy versus computer abuse prevention, which prevails

Are there formal privacy policies at your workplace? What are your expectations for workplace privacy? Do those expectations match actual company practice?

there isn't. When I first started for this company they had only one document that could some what be considereed company policy for IT, that delt with email use and even then it didn't cover very much. I am at present having to write all company policies when it comes to IT.

My current employee is a helpdesk/call centre. Like most "hell centres" nobody has "their" pc, and all are imaged and used with generic logins.

We signed an acceptable use policy that in fact said we would be able to surf webmail between calls. 3 days later all Browser access was denied externally and the only Internet use I have now is internal.

sigh.

Like many threads that have started on this site, users of PC's in a business environment should have no expectation of privacy when using a work resourse. Does a ditch digger have to use his own shovel, and does he take it home with him at the end of the day ??

When you are at work you do work, and when at home you do "at home" stuff. end of story.

I work in an environment in which you have to have signed permission to get Internet access. In addition, merely accepting the JOB includes consent to monitoring. My company can and does monitor e-mail at the packet level, and has sniffers that key on foul language and other e-mail abuses. They also monitor Internet use and lock out many of the abuse hot spots, ie sports, games, shopping etc. At times, this is an annoyance. But the truth is, many of the potential security issues stem from visiting popular sites. The policy is supported both by law and by "policy guidance" documents.

The work place should be a "safe place" to be. Management is responsible for creating the safe environment using available standard solutions. The policy should be enforced by filtering and regular monitoring. The monitoring should be done discreetly to protect individual dignity, but be visible enough to remind employees it is being done. Employee expectations should be set by the presence of and regular enforcement of the policy management chooses. An environment where lazy management only writes policies on paper and then expects the "normal humans" of our times to "behave themselves accordingly" is not safe. Management can no longer claim ignorance to the effects of unbridled Internet access. Making examples of the abusers where there is no strong policy enforced with filtering and monitoring only makes management look like Scrooge (the guy who almost sent Tiny Tim to an early grave). We have the ghosts of Internet Past, Present and Future to show us what will continue to happen. Individual employees are responsible for their own actions.

Kevin - You are so right in that the setting of expectations is management responsibility - however - the expectations MUST be universal throughout the organization/company. I just left an environment where I was the CIO & Security Officer where I had rewritten and developed effective policies, including a very comprehensive and extensive Information Security Policy, and had them approved by executive management and the Board of Directors. The problem came in when certain managers wanted exceptions to the policies so they could surf the net to websites that were being blocked due to content (fantasy football and hacker "information" websites for example). When I refused to grant that exception, the CEO at the Holding Company "directed" me to allow them access. In fact, he "directed" me to allow one particular manager "unimpeded and unfiltered" access through the firewall. This same manager then got permission to have a cable modem installed directly to his office so he could bypass ALL security devices in place. The reason this particular individual was granted this special exception? He is the "IT Auditor" and is a "security specialist" (he has been working with IT security for 2 years and is therefore an "expert in security"). There had not been a single security incident in the previous 2 years and then ?suddenly? and "I don't know how that got there" his workstation had a "FTP server" program installed on it as well as ?something? that was running on his workstation that was attempting to modify security settings on our servers and access other employees workstations.

A policy is nothing more than words on paper ....IF management doesn't enforce it universally. I'm sorry to bust some people's bubbles - but I believe a comprehensive research of policy violations and systems that have been compromised (virus, trojan, spyware, etc) would very likely reveal that management (senior managers in particular?) would have more incidents than the staff personnel (just my humble opinion after 34 years in IT).

For those in positions within their own company that can make a difference - develop fair, enforcable policies when it comes to computer and network use for security purposes. Ensure everyone understands the policy - don't just write it, have everyone supposedly read it, and sign off on it. Many people don't actually read a policy and others just don't understand them when it comes to IT "stuff". Hold a training session and explain the policy - then enforce it at all levels.

Yes, there are always exceptions, but an FTP server!?

Did you hear about the company in Europe? They were contacted by the police due to child porn traffic being detected going into the company. At least one person went to jail on felony child porn charges. Many more people were put on probation for inappropriate Internet usage. This in a company struggling for survival due to economic issues.

Yes - a FTP server that the "security expert" didn't know how it had gotten there. In fact, he was the one that found it when he was conducting an internal audit, and ironically, his workstation was the only one that anything illegal and suspicious on it!?! Hmmmm, I wonder if maybe it was due to the "exception" my staff and I were forced to give him for access to the internet without filtering through the firewall????

Just to clarify - when I said it's a "management responsibility", I meant - IT management. IT leads the charge on technology to help set and enforce policy. If you're fortunate enough to have other management support in your organization - lucky you. But let's be LEADERS in IT and not wait for someone else to do it. I mean, really - let's face it - IT runs the company anyway, right? : )

With School District's, we have an Acceptable Use Policy that applies to both staff and students. We carefully monitor computer use, because we are liable for anything that the students view.

We take the approach that every piece of equipment here is "district property", so anything that occurs on them is within our rights to monitor. Sort of the same concept as locker sweeps in schools.

Anybody that oversteps that Acceptable use Policy is subject to disciplinary action...ranging from a "write up" to expulsion...or in the case of staff, termination.

Of course in schools, we've got a little broader scope of inappropriate material than a corporate environment might have, because we're dealing primarily with minors...so really anything from pornography and drug materials to gang activity and even violent game and film imagery is banned and in most cases, blocked by our sonicwall device.

The problem we have now is that trying to enforce the policy has of course issued a seemingly unspoken challenge to the kids. For every site we block and every port we lock down, they find two ways to get around it.

On a website kids can get the following, "get a computer load apache, load mod perl load nph-proxy and put in a robots.txt file so you do not get indexed. Then KEEP YOUR MOUTH SHUT ABOUT IT, or someone will talk. Dont tell your best friend, dont tell your priest; if you want it to work for any length of time at all this is the most important thing! This will work for almost every site out there, except the ones that are streaming media like youtube. There are plenty of tutorials out there to tell you how to do all of this. Just copy down your IP address before you go to school, and put it in your browser with a /cgi-bin/nph-proxy.cgi at the end."


This allows them(students) to by-pass your proxy


by the wAY HERE IS THE LINK TO MORE INFO:

http://www.darknet.org.uk/2006/02/browse-anonymously-at-work-or-school-bypass-firewall-proxy/#comment-1853


HOPE THIS HELPS

I'm pretty sure that was the saying anyhow.
: )

I'm sure that I don't have the problem to nearly the same extent, but on my network of 50 ADULTS the same thing happens. The employees actually use the internet for work related purposes so I can't just outright block their access. The use policy, that they all signed, tells them all that they are not to use the computer for personal reasons. They have all sorts of leeway in that, though. It only needs to be remotely related to work to be acceptable, so that their creativity is not stifled. The end result is that they can't be chatting with family members online, checking their ebay auctions, looking at inappropriate material(read porn), shopping for personal stuff, or downloading movies or music. They are even expressly allowed to do their banking on the company machine when they are at lunch. The problem is that even with all of this liberty I still get traffic to and from ebay, myspace, fox sports, youtube and all sorts of garbage. The entire action that I am allowed is to let them know of the potential security risk and liability associated with this kind of traffic, cc their manager, block the site through group policy and the DNS server, and tell them not to do it again. The manager is expected to talk to them about the activity. The problem is that there is no border patrol here and no intention from the powers that be to pay for one. The DNS server is assigned to the user by active directory so I have some control. Group policy only seems to replicate to the user most of the time. For work related reasons some managers have less restrictions on their machines and don't seem to care who uses their account. They actually let their department members use their browser because a site was blocked from that user's account. These are adults! They all know that there are logs of what they are doing and when it comes down to it they only care for about 2 days after they are told about it. These are users who don't know what the right mouse button does. One person actually had to find out from their son how to change the DNS Server to match their home ISP's so that he can get to sites that were blocked. I'd tell his boss but he's the owner!
At least when you chase these problems you can always say that you are responding to new breeches as they occur. They are kids and they will be mischievous. I have adults that are insisting that it's unrealistic to keep them from downloading that ring tone at work because it takes too long on their dial up at home. They will actually click through 12 pages of adds in order to give that website their credit card number. If I missed it on the DNS log, then I sure noticed when the anti-virus server sends me a text message.

It's like the twilight zone or a Philip K. Dick short story. These are normal people that are otherwise very smart, but give them a mouse and their brain oozes out of their ear.

Mine is a perfect example of a seemingly good plan for a usage policy that is completely meaningless because of the enforcement.

I used to (or at least make an effort to) have faith in users.

When I was in the Marine Corps, a high ranking officer received CLASSIFIED documents on his non-classified e-mail. I mean, we're talking troop movements and stuff that could quite literally get people hurt if it was compromised.

Instead of alerting the proper people to the issue, he forwarded it to his buddies (other high ranking officers) saying, "Can you believe this was sent on the SIPRNET (non-secret network)!!"

So instead of one problem, we had about a hundred (because of course other people forwarded it on). This isn't even the worst example of what kind of thing happened either.

As to the original question...

There should be no expectation of privacy. Period. There should also be no exceptions. If you have management granting exceptions, then your Acceptable Use Policies, etc. are worthless.

The way I explained it to our VP is this. If they aren't going to support or adhere to the policies, then it isn't worth paying me to author and implement the policies, then paying a lawyer to review them, then paying for a web-monitoring/filtering solution.

You have to get obscure to stop them. When I was teaching, I disabled DNS and used the hosts file to control web browsing from my lab. Storm Windows then locked down the desktop. Authorized sites had valid entries; all other sites pointed to localhost (127.0.0.1) or null (0.0.0.0). In three years, only one student figured out why students could not access their favorite proxy servers and web sites, and he worked evenings as a net admin at Wachovia.

Unfortunately, the school ordered a new interactive curriculum that required essentially unrestricted web access and I was forced to allow DNS in the lab.

Edit: grammar

Concepts by example. Please consider questions.

Last I looked, pay telephone (equipment) is owned by phone companies. Is it legal for them to monitor conversations?

I own my car. If you use it to rob a bank, am I responsible?

You work my fields using my tools. If you bash in your brother's head with my shovel, am I responsible?

I work in your office. My ex-wife sends me porn and also reports me as a child abuser. You monitor my office PC, find porn in my inbox, and fire me because our office will not tolerate "workplace sexual abuse". The LAW collars me. After all, I'm a reported child abuser with a history of workplace sexual abuse. Who wins at my trial?

--- Point is, the internet is just like the street, the depot and the park: public place where all kinds of mayhem and merde can take place. Snooping and sniping and also sleazing are ALL reprehensible. On the street, in the depot, or in the park, who hollers fire, calls the cops, reports the flasher? Answer: the passerby, the traveler, the player AND NOT a force of COPS who are assigned the role of snooping and sniping to prevent sleaze (and worse.)

IF NOT, George Orwell wins, and we'll learn well what is the 'number of the beast'.

If you leave a gun in your bedroom drawer on the second floor of your house, an area of the house where you would expect some privacy that any reasonable person would respect. However, if some guest found it, used it to commit suicide, you could find yourself charged under any number of laws. Or if someone were to find medications in your bathroom, take them and come to harm ? you can expect , at the least, to be admonished, investigated and possibly charged for neglect.

People have been sucessfully sued, found guilty, if/ when some clumsy idiot trips and falls on an un-even section of your sidewalk.

The recurrent theme of forcing all internet users to be subject to Child-friendly restrictions relieves parents of the necessity of monitoring their own offspring - at the expense of adult prerogatives.

the list is broad and endless of things over which you have little or no control, being found, under current legal thinking, to be things that fall under the "would'a, could'a, should'a" - umbrella.

You are correct on the numerous lawsuits people bring against others for their own harmful actions, however, in a business environment there are two sides to the equation. The employee should expect some level of privacy in their workspace, but they should NOT expect to have unlimited access to the internet (which is what I believe this thread is really addressing). Companies can be - and are being - held accountable for what their employees do via the internet and have on their workstations. Some examples where the company can be held accountable include porn, sexual harrassment (emails to other employees), and illegal software. If I, as the owner or executive management, am going to be held accountable for what a workstation is being used for, then the employee should expect me to monitor it. I would venture to say that most companies have employees sign a "Computer Use" statement of some sort that they understand their workstation is company property, is to used for company business only, and can be monitored by the company with mis-use being a cause for immediate dismissal. It again comes down to policy and enforcement on a global level. If a manager can get away with downloading files from the internet (porn, pictures, executables, etc) but a staff member is admonished, then the policy is not being enforced - period. One exception to a policy renders it ineffective and subject to being challenged in court. It's IT managements responsibility to establish the procedures for monitoring and reporting, but the IT Director/CIO may not have the authority (as given by executive management and/or the Board of Directors) to enforce the policy by admonishing or restricting an employee without first reporting it to executive management. A good executive management team will delegate that authority to the senior IT person (Director or CIO) and then expect incident reports to be provided. The company must protect itself from lawsuits and let's face it - employees more often than not are more concerned about their own "rights" than protecting the company. My personal feelings on this (yes, personal views) is that if an employee is surfing and doing personal "stuff" (email, ebay, etc) during business hours, then they are stealing from the company. Why stealing? They are being paid to do a job, but they are in effect being paid to "play" when they are surfing the net and buying personal items on ebay, etc.

I'm sure everyone can tell from my 2 posts so far that this is a sore spot with me. If you do your job while at work, then it shouldn't matter if the company is monitoring your computer activity. If you are doing things you really shouldn't be doing, then those are the folks that get the most upset by monitoring. Just do your job and earn your paycheck.

I work for the Department of Education at postsecondary level, I'm not against all this monitoring because I do my job. The problem that I have is the stupid filtering system that is used at all levels in our system, I cannot access anything because is supposed to protect children. This forum for example is marked as business, so no access, we have a nursing program that cannot search for information in anything related to sex. Candy canes are mark as weapons. Electronics and programming sometimes are marked as terrorism o spy related. Updates from Sony is business ands so on. So I don't use internet where I work.

I agree with the main theme of this thread - that a company has a right to protect itself against employee Internet conduct that could harm the company legally or professionally.

But any policy has to be kept within reason, and it has to acknowledge employee needs. I'm at a job where I was told at the beginning that they expect at least 50 hours a week from me. (Isn't that demand illegal?) They provide cheap or free food and beverages to entice employees to stay longer. OK. But when do I then have time to take care of personal business?

I do some of it at work. I feel that I don't have any choice given my work schedule. I don't abuse the privilege by surfing porn sites, or such. But I definitely use my employer's computer for some personal business. I don't know if I'm being monitored, but I really don't care. If my boss raises the issues, I'll tell her she has a choice of me continuing to stay late and accepting that I'll do some personal business here, or I can start going home earlier so I can use my own computer.

Just because an employee works long hours, they are not entitled to conduct personal business on company time.

In most cases, you're paid for the time that you're there or you wouldn't be there to begin with.

So laying out an ultimatum of let me conduct my personal business at work or I won't work overtime is ridiculous.

If the company has a policy in place that says "no personal use of company technology", the employee that spends 50 hours a week at work doesn't have anymore right to surf and conduct their personal business than the person who spends 40

Thanks, jfrank, for telling me how ridiculous my opinions are.

Guess I shouldn't have wasted my time with a reply since there's no room for opinions beyond your superior intellect.

It is not uncommon for companies to allow exceptions. If you use a company computer during lunch, or say take a short break I believe it is acceptable. Depending on company policy. I have been with companies that put computers in their lunch room for employee use to conduct personal business during breaks, I thought that was a great idea.

We all have our views on this. Those that oppose ***-for-tat in you giving your opinion on dedicating so much time to the company that it's difficult to take care of personal business has their head in the sand. This is a very common practice among employees as well as management.

It is the companies policy ultimately that governs the privilege, but I believe that most companies are sensitive to their employee's needs, and work around protecting their data.

If I surf e-bay durning work hours you consider that stealing but if I get paged at 2 AM for an issue why isn't the company "stealing" from me?

In the case of the phone, there are issues between the phone being a private telephone and a public conveyance. In general, it follows under wiretapping laws. If one party to a conversation wants to record the conversation, that is OK. There is no sign by the phone warning you that your private conversation may be monitored. In the case of the payphone, it is being provided for your own use. In the case of a computer network with a company provided PC, you are being told that these are to be used for company business only. You have no right to make personal "calls" on their equipment; you can only use it for business. Same your your telephone. The key here is that the equipment is private equipment and they don't have to let you use it for whatever you feel like. For that matter, they can fire you for using the photocopier to print up "for sale" signs and other such personal material.

For your car, if they can prove you gave the car to the bank robbers to commit the robery, you go to jail. Otherwise, you just lose your car in some states. Too bad; so sad. You might be able to get the car back but, not without a fight. Maybe if you had reported it "stolen", for example.

If you work in my office and your ex sends you porno, etc. Who wins at your your trial? Your ex -wife does because you're the man and the woman wins. First of all, why does your ex have your email address? Did you give it to her against company policy? When you received the pornography, did you immediately delete it? Did you report it immediately? If they say the email is for business use only your ex has no business sending you anything! Did you show the porno to your co-workers? Did you forward it?

The internet may be just like the street. However, the street is not supposed to be allowed into your office and you can't take your work out into the street if your bosses say you can't. At our work, the Internet is a privledge and not a right. They used to allow "personal" surfing on your own time, but not anymore. They can block where you go and monitor where you have been. After all, if you borrow my phone, I don't have to give you privacy unless I want to.

The thrust of this is EXPECTING privacy. Your boss is telling you that you have none, right upfront. It's his phone, his computer, his network. If you had your own PC, own modem, own phone line, own time, then you can do what you want and have a right to privacy unless George Bush doesn't want you to have it. Not at the office.

Dont use this IT forum for your own political bigotry.

1. I didn't see any political bigotry in the post to which you replied. If it's the George Bush crack, well, it's true, if W wants to spy on you, he has the power...

2. This topic is pure politics. There are not any technical issues here, it's the application of technology and the rights and responsibilities of all parties. How we get along with each other. Which is nothing but politics. That's all politics is, relationships between entities.

I don't think I was being "bigoted" as I don't even think I expressed any of my own views. I answered the points he was asking about. I've been working with computers for 40 years and the issue of what you can and can't do has taken a major turn towards excessive productivity. I was not stomping over his views and I'm sorry if you got that impression. I've always tried to argue that the employee should have some expectation of privacy at least in their business dealings. I just don't think management looks at things that way anymore.

In our nation, every citizen has the right to expect privacy, whether he is at work, in church, or standing in the public square or in his own living room. (IMHO) that expectation is part of the expectation that we have "rights to life, liberty and the pursuit of happiness."

(IMHO) If an employer experiences wanton employee absence, (it) should have the right to fire; but just because one employee is missing for an afternoon, unapproved, the employer shouldn't have the right to hire detectives to monitor every employee's whereabouts so as to be ready to find the occasional truant.

There's much that makes sense in other posts, but its this notion of "expectations" that really seems the key place for having legally enforceable expectations.

I see no reason why an employer should be allowed to coerce employee behavior just because employer is providing pay checks.

Some other examples:

** If that pc you are (mis-)using is the one company inventory terminal, or the principal means for you do do your job, whether programming or taking orders, I agree that the company has some rights to expect that you'll not use it to play (at least in such a way that detracts from you getting the required results of your job.) BUT, its the results notion that counts with me, not how you get to the results. So if you are a manager, or a clerk, and you talk to your wife or husband on your company phone, but you get your work done, I see no harm done AND I see no justification for the company to listen to all phone calls just to find the sitution where you are like the "clerk" at MacDonalds the other day who kept me waiting for five minutes while she talked to her boyfriend (apparently about matters that weren't life or death.) Sure that clerk was wasting company resources (her time and their phone), but (imho) the waste was the problem and not the "misuse of the phone." I extend this opinion to computer use by recalling when (40 years ago) I was managing a team of programmers. One gent could play blackboard chess with two or three people simultaneously, while he was also solving vector algebra problems in his head. He could waste other peoples time easily, but he also taught many people how to do their jobs. It was very hard to argue that he wasted the company's resource that was his blackboard or his time. He always got his job done, and often was the sole reason why a bunch of others even got enough of their jobs done so that we could assess their work and promote them out of the "maintenance pit" Same notion regards the programmer years ago who used to keep the football pool on a deck of punched cards: while I did (at times) check his desk drawers (in search of the long-delayed impossible "fix-it" task write-ups that he would reserve to himself because no one else could do), but I also felt that I was on very skaty grounds regards his privacy. Routinely monitoring keystrokes and searching logs to see what employees are doing may have a legal and practical value in a top secret communications center, but I see no right or value for such a thing to be considered as a normal practice of every company who wants to push employee productivity to some theoretical max.

** Any analogy with a legal aspect is almost impossible to reduce to meaning (imho), because the law isn't law unless its blindlingly fuzzy and demands the services of lawyers to understand it. So the question of monitoring every employee in search of one who is trading in porn, is hard for me to assess. But intuitively, it stays very hard for me to justify across the board key stroke monitoring unless there really is serious risk of the company being hugely penalized for the abberant employee involvement with it, ie: an exception technique, like a wiretap, ought to be used to approve such monitoring, and it should never be considered as a routine practice, like requiring timecards for use in checking in and out.

** To me, realizing the expectation that I can have life, liberty and the pursuit of happiness demands realizing the expectation that neither government nor employers will be monitoring my personal life to assure that I measure up to their expectations. They have a right to contracts, and laws, but not to monitoring individual activity solely to find instances of bad behavior the way you fish with a net, whose use will also kill more unwanted species than it catches needed ones. Sure, on a wiretap like basis, where there is validated need to poke into personal employee activity, the expectation of privacy is trumped by that validated need. For instance, to find a practicing pederast whose location is not clear, it seems reasonable to cast a wide net. But to make some feminazi happy that no fellow employees are trading sexy blonde jokes, is no reason to sift through all the keyboard streams, no matter if the feminazi represents 80% of the employees, and there are some crude male employees.

As I tried to explain to someone, I partially agree with you. Some people have said that the constitution does not give us the "right to privacy". If you look there you will not find it. However, the constitution does say that we "have the right to be secure" in our homes, which also gives us the reasons for requiring a warrant before the police can break in. That seems to imply a certain degree of privacy.

You did point out the areas where this becomes "fuzzy". But a few areas of interest are the mis-use of company property. For example, use of company computers to run a public website or conduct personal business for personal gain. There is also the matter that an employee was doing something with the computer that was against the law and traceable back to the company (even threatening clients via email). Did you ever call for service and have an automated message tell you that your call may be monitored?

It has already been determined by studies (nobody ever asked me) that internet surfing takes up a major amount of time that is a hit to productivity. In some cases, as you suggest, this is not relevant. As long as a fixed amount of work is getting done. There are limits to how much "productivity" can be enforced. My arguement that an employer should not tell an employee that they use the restroom on their own time still holds. However, this attitude isn't what we are seeing in companies today. We are, once again, coming to close to the "sweatshop" mentality even in professional jobs.

I think the only thing I can suggest to someone is to realize that the employer will tell you the "rules" that they use and you can either obey those rules or not work there.

While the idea of privacy may be a lofty one, there are just too many exceptions. At work, we are not only 100% monitored in our surfing habits, but categories are centrally blocked such as gambling, pornography, "hate" websites, and others. Departments have the right to add other categories such as shopping, blogging, news, racial, known spyware/virus sites, etc.

For the most part, employees are not watched over unless an issue comes up such as some of the exceptions you have mentioned. There is also a concern that users are going to sites that carry viruses and spyware. We already know that some employees are using company mail in lieu of private email resulting in large amounts of spam coming that that requires logging and blocking.

I think they do draw the line on keylogging. Some managers wanted to use keylogging as a way to determine productivity. I agree that it goes too far but they only way that can be stopped is by indicating that it is an unacceptable security risk that would expose users' passwords to those who should not have access to it. We did have a problem where managers demanded that employees give their passwords to their managers if asked and we tried to keep management informed that this is not to be allowed.

I guess what it boils down to that you have a life, liberty and the persuit of happiness, but many companies will tell you to have these things on your own time with your own equipment. Not necessarily, IMHO.

Laws, local customs and social standards differ greatly from one place to the next. When a company conducts its business in a country, it has to abide by the national and local laws of the countries in which it operates. In Europe, Privacy is regulated by national laws implementing the EU Directive 95/46. Privacy in the workplace has been the subject of an opinion of the "article 29 - Dta Protection Working Party" see http://www.datenschutz-berlin.de/doc/eu/gruppe29/wp48/wp48en.pdf

If you are going to make such a broad headline statement then either specify for US only (and cede that you are not a multinational but US only site) or give full and complete details for most countries. best do a series for that I s'pose

I agree fully. It is not only a different situation in different countries, but, even in the United States, there are differences among the many states.

It's not so much the privacy of the individual employee here in California, but the privacy of the data and what each employee can and connot do with that data (such as lose it on a laptop).

....let's be real here, users think it's they're personal computers to do with what they will, and management as well....but I'm sorry to say, it's our jobs to protect them from themselves AND the company/agency from lawsuits.....there can be NO EXPECTATION of privacy on a business network - it's provided so that they can do they're jobs, period! ....now, get off the blogs/horrible scopes/and chat sessions over http and get back to work! ....lol. Ok ok, on the serious note, as long as policies are in place regarding network "privledged" usage is in place, which also outlines the do's & don'ts, AND it has been signed by the user - there is no expectation of privacy.

As the tide swings to being an employer marketplace (an abundance of qualified employees to pick from), employers become more demanding - longer hours, more productivity expected, more weekend work, etc. There's got to be a middle ground that allows a person to fit in a "personal life" item here & there - privately - to maintain a reasonable level of sanity...
What am I thinking? The modern-era slave labor is the cube rats that must commit a minimum of 60 hours/week to try to complete the 90 hours/week of work that piles up under threats of their job being moved to India or China. NO EXPECTATION in this environment.

Since the employer owns the network, PC's etc., there is NO EXPECTATION OF PRIVACY -- you're using their "stuff." And, since you're expected to actually do something to earn that paycheck, they have the right to monitor their machines and network to ensure 1) they're getting something for their labor dollar, 2) you're not sending company secrets outside and 3) that you're not abusing Internet access for the time that you do make private use of it.

If you work in the public sector, there is even less expectation of privacy since that network you're on, as well as your paycheck comes from public funds.

Our written policy (acknowledged by your signature) is that there will be no non-work related Internet use... but there is actually a little leeway given by most supervisors -- but access is monitored, and certain things are forbidden such as use of any external IM facility (internal IM is the only one that can be used) and there will be no audio streaming or accessing of inappropriate web sites (we did have one employee arrested and terminated for access and storage of child porn).

The bottom line is that the PC's and infrastructure belong to the employer, not you, so there can be no expectation of privacy.

(Edited to correct typos)

The post on Vista reminded me that this technology is developing into a system capable of monitoring and controling all our buying, selling, etc.. It can see where we go, what we do, who we phone, who we chat with, what sites we visit. And the anonomous nature of it all is disappearing. I just read the article by Tom Olzak on this topic. In the article it mentions the Library staff who brought suite against the library for allowing a hostile environment because patrons were allowed to use the library to surf porn. The Library lost the case and had to pay out just under 1/2 million dollars! Cool!

There's three things here. First, there is the library management who set the rules. Next, there are the employees who are not the ones doing the surfing. Then there are the patrons who are surfing porn. The paying-out is going to the employees from the management. The result will be "NET NANNY" on computers in the library. So, if you don't have a computer at home and you can't personally surf the web at work, no matter where you turn there will be only restrictions. The patrons will be the losers here.

It is very unlikely that anyone will not receive "some" communications of a personal nature while at work. The reality is that where we shop, service professionals (mechanics, plumbers, appliance delivery, etc) all work the same hours as we do. Its a poor company that expects no personal information to be sent or received during business hours.

Therefore, I would not expect to hear any information, which obviously came through overly ambitious, lascivious or prurient personal gratification under color of ?the company?s best interest?. Such information should never be in general circulation around the cubical farm. Anyone that abuses company assets (including the monitoring staff) should be subject to censure, up to and including possible termination

Along with that these limited expectations - I would strongly caution anyone that expects to receive "delicate information" to find a way to separate their public life from their private affairs.

Maybe that?s why so many staff members are carrying personal cell phones, PDA's and other user-purchased devices - hoping to reclaim some degree of privacy?

This is all c**p! It is the employer's computer, the employer's network and the employer's information. You are paid to do work, NOT surf the Internet, look at porn, play on-line games or buy/sell junk on eBay.

This notion of an expectation of privacy at work is absolute drivel (ie, nonsense). If you want to do porn, games or eBay, do it at home on your computer.

This is no different that having your mail sent to work so you can do your banking and write checks and pay bills on your employer's time. If your employer wants to pay you for NOT working, please let me know as I would like to be employed by this guy myself. All my employers (all three) thought that I should be working for them when I was on the clock. And when I was not on the clock they expected me to go home (which my wife thought also BTW)!

NO. I am not an employer. Never have been. Probably never will be -- since I think all you morons and pansies surfing when you should be working should be fired; and boy is that ever politically incorrect, eh!

Every place I have worked (all three) have had formal policies that one signs when one is given access to computer facilities. The Internet didn't exist when I worked for the first folks but they explicitly forbid users from bringing in their own software, stealing software and creating documents that were not related to business; punishment ranged all the way up to dismissal. Of course, in New York, anyone can be fired at any time for any or no reason at all (except the Federally protected folks); a work-at-will state ... isn't that just wonderful. My last two employers included Internet access in the agreement and the punishment for miscreants was much the same except for porn ... that was grounds for immediate dismissal without recourse. So if you didn't like your cubie next door, all you had to do was surf over to whitehouse dot com on their lunch hour, then call the IT nazis and sit back. Wheweeee.

And that, sirs and ladies, is my 2 cents.

We have become stupid.

I read people who take the company's side and say that we need to monitor user cyber-slacking and put up technological barriers to the internet.

I read people who take the worker's side and say that the oppressors should not be spying on us.

First to the workers: it's not like you deserve to have a job, let alone the freedom and independence to do whatever you want in the workplace. You have a job because of your value to the employer and if they decide to stop giving you money for any reason, that's their perogative. If you don't like working in an oppressive environment, then quit.

Now, for the company: remember that you are paying your people for a job well done. You are not paying them to refrain from personal internet usage.

Some people need to have their nose held to the grindstone to produce, others can get as much or more done than others while engaging in all sorts of personal activities. The companies which are resorting to draconian, micro-managing-control-freak measures like using Active Directory permissions to prevent individual employees from accessing individual sites are displaying signs of bad management, unable to communicate directly with the offending employee and unable to motivate them to keep their mind on the job in the first place.

The most reasonable internet usage policy I have ever seen was to equate email and web access to the telephone (some of you older folks might remember the telephone, it is a voice communication device that you used to speak to other people in conversations, before you had a cell phone and needed to blab constantly just because you can, especially while ignoring the traffic around you). This employer realized that a normal human being needed to call home to check on the kids or call the dentist to make an appointment, or even to chat with friends about the party last Saturday night. However, when personal calling got out of hand, either by disturbing co-workers' concentration or interfering with work, the offending employee was spoken to. If the behavior persisted, then bye-bye. Nice and simple.

The modern version of this is to permit a reasonable amount of personal internet activity.

The big problem with this is that it requires attentive managers to be in tune with their employees' work habits and productivity. This type of leadership is getting as rare as product quality.

I have to agree with you about the common sense, what it been getting to me is a filter at work that really doesn't make sense if they expect some kind of reasonable work from their employees. I'm a teacher and I need information sometimes from business and forums and so on. This filter blocks everything. There is no form we can work because our leader (the director is really a dumb ass, follower of whatever his superiors tell him, it really doesn't have a brain. Lucky for me I can retired in one year and say goodbye to this merde!. Let me clarify that I am not against monitoring for porno and sites that are against our children, but they have to have someway to information to flow where is needed. Can I tell you the latest thing our employer is going to put? A biometric system to monitor attendance at our university. So, there is no way that I can answer to my student's before 8:00 am because I have to be there to get my middle finger scanned. I use to get to work at about 7:10 am and I'm no asking for extra pay. I like to have time to get prepared and be on time for my students (electronics and computer programming). These policies are making good workers start to be just mediocre workers, do your job and don't be excellent because is not worth it.

I have to agree with you about the common sense, what it been getting to me is a filter at work that really doesn't make sense if they expect some kind of reasonable work from their employees. I'm a teacher and I need information sometimes from business and forums and so on. This filter blocks everything. There is no form we can work because our leader (the director is really a dumb ass, follower of whatever his superiors tell him, it really doesn't have a brain. Lucky for me I can retired in one year and say goodbye to this merde!. Let me clarify that I am not against monitoring for porno and sites that are against our children, but they have to have someway to information to flow where is needed. Can I tell you the latest thing our employer is going to put? A biometric system to monitor attendance at our university. So, there is no way that I can answer to my student's before 8:00 am because I have to be there to get my middle finger scanned. I use to get to work at about 7:10 am and I'm no asking for extra pay. I like to have time to get prepared and be on time for my students (electronics and computer programming). These policies are making good workers start to be just mediocre workers, do your job and don't be excellent because is not worth it.

Anyone got any links to UK legislation on this subject?

You may find an excellent paper giving a lot of references @ http://visar.csustan.edu/aaba/Foutouchos.pdf

As an employer in the UK, am I able to ask employees to waive their privacy rights (with regard to any electronic communications) by inserting a clause in their employment contract? If so, then I can look at any e-mails, etc which they send or receive.

"Register within 30 days or the lights might go out on your career if you don't have a valid version ............ "

For a career limiting move make sure that you don't let staff install Vista in your office hacked and cracked. If you do then see how long you survive in the IT industry!"

see http://www.pcprofile.com/Hasta_La_Vista.pdf

The employer can act in ways that would (in theory at least) get U.S. government police and intelligence agencies prosecuted. Their powers to monitor telephone traffic, e-mail traffic, Internet browsing?is all but absolute. They can use keystroke-loggers and other spyware to determine ?productivity?.

They can and do place video and audio monitors in the workplaces and even in the toilets!

They also can and do employ undercover security agents?outside contractors or in-house security/spies!
?1984? is alive and well in the private sector.

DEMAND to see corporate policies and procedures that dictate how/when/where company spying on its employees is conducted. And DEMAND that all parts of these protocols that provide whatever privacy be ENFORCED TO THE LETTER with firings and civil and criminal penalties be enforced against those violating them. At least corporate entity has discovered that

THEY are NOT immune from criminal prosecution for such activities that transgress on the individual?s right to privacy.

We need MORE such prosecutions to get the message across to CEO?s, Boards of Directors, at others in the top echelons.
(Speaking of Echelon and Carnivore and so on and so forth?similar programs were already running on corporate Intranets and other communication lines long before they appeared in the public area!)

In short, the private sector can do what Himmler, Beria, Hoover?s FBI and the other government Gestapos and KGB?s did as a matter of course.

I feel that Bush Jr. and his cronies used the private sector?s spying when they designed the USA Patriot Acts I through Whatever. Beware?WHAT STARTS IN THE PRIVATE SECTOR INEVITABLY BECOMES PUBLIC SECTOR S.O.P.!

Beware?those who give up their liberties to purchase safety deserve neither!