Search Employee Computers

I have read many topics here and this is the first one I feel compelled to respond to. There are so many various opinions, with so many valid arguments.

I provide technical support for legislative customers and am a technical lead for 14+ Call Center Agents. I also am a HUGE multi-tasker to get everything done on a regular basis. Everything that has been discussed here has a catch 22.

I surf the web to find items to help support my customers and train other Call Center Agents. I have trivia games for my Agents to win prizes that require them to find the answers. I support customers who abuse the internet access and cause problems to their systems because they try to download items and install them. (We have Windows XP and have locked down their ability to install almost all products). I also have Call Center Agents who I find are surfing the web instead of working on projects they were given and when busted I get "Oh I am on break." Yet I also, if ever, have time to turn on my own computer at home to take care of business. During my lunch or after hours I have booked travel, banked online, bought concert tickets, etc. Where do we draw the line?

1. A policy must be in place to handle these new and ongoing issues.
2. The policy must be in writing so an employee can not argue privacy violations and other issues.

I don?t know how I would complete many of the things I do if I couldn?t surf and do some personal things during office hours. Then again I know that my computer belongs to the agency I work for and if I don?t keep my system clean I could loose the personal items I do have on my PC because of maintenance issues. See there is always a catch!

I've been in this business for more that 10 years, doing Network admin, DB admin (for ERPs), etc. I've came across confidential info a few times. It's unavoidable.
I believe that information belonging to the user is confidential and its retrieval cannot be made part of my attributions. It should be treated with the same confidentiality as any other part of the company data.
If someone must spy on them (users) then let the personnel dept do it. I won't, and I can't respect people that do. I'm not responsible for the user productivity... or else, they should change my title and paycheck ;) I worked my butt way too hard on technical issues to be dragged in this kind of trash.
It goes without saying that I don't condone such behavior, but there's no way I'll start spying on the private behavior of my users. Sure, when they bring in virii or spyware, I investigate - without involving personnel. I regard it as my failure rather than theirs. If I'm good, they can't do it. If they can, it's my fault.

Just my 2 cents.
Stefan.

What does the info leak have to do with the rest of the message? Do you normally stand by the FAX machine and ask to see every doc going out/in? Is that your ideea of IT security?

So what if you (as an employee) surf to Pron sites @wk during lunchbreak? Does this affect your productivity?
Also, since when is IT responsible on human productivity?

I guess the mistake (and I doubt anyone made it) would be to let you decide whom gets hired or not. You'd be more at ease in the personnel dept, if you ask me ;)

It's a nice dream, people that actually pay attention to what is going on around them. I for one will not be voting for those that keep several provisions of the Patriot Act alive... alas I'm but a drop in the ocean.

My comments were not directed at you personaly, just the notion that people want less government interference yet they know next to nothing about the system. Between "it's for the children" and "it's to aid in the war againt terrorism", watch as we hand over our freedoms for the mere perception of security.

As Benjamin Franklin (also cited to Thomas Jefferson) once said:

"people willing to trade their freedom for temporary security deserve neither and will lose both"

They have the right to know. They won't get access to your ID and password if you follow simple steps and use a secure browser.

Many won't care. Mine didn't within reason. Banking is ok, stock trading was not.

James

Cool screen name dude! And call yourself a manager.

Lately, I've seen lots of people confusing IT with other business areas. True, we solve many problems and we have to understand business processes, to help users do their jobs. But we're not in physical security. According to your (highly debatable) logic, it means that if IT configures the CardAx system, then IT's to blame if the security guard sleeps and uninvited persons enter the company's premises. Totally wrong. As is the rest of your statement. It is not IT's responsibility to monitor users. No IT is signing personnel info non-disclosure agreements; That's personnel's job. If someone needs to monitor, it's them. Contrary to your impression, IT is technical and has better things to do. Sure IT installs content screening/blocking systems, but...

With regards to the title of your message... I believe you're lacking elementary manners. I just hope the only person you're allowed to manage is yourself. I wouldn't be working for you. Ever!

What I have done is I block everything and then only allow what someone requests after I personally verify the integrity.

YES that takes alot of my time BUT when someone has to wonder if what they want access to would be considered objectionable we have seen less problems and more productivity.

This may or may not work for your environment but works in mine.

Most of the sites that have white listed have all been approvable under out Usage Policies.

Email is trikier but the same goes and I do filter though the SPAM folder for lost emails that someone is expecting and the 3rd party filtering removes most of the real SPAM that filters into the server.

Again this is what I have decided on and works in my situation.

Zu Befehl mein Fuhrer
You got it backwards, Companies are privileged to employ us. An attitude like that is for doormats and urinals.
Any employer who tried to string me a line like that would find out how little they had that I wanted or needed in a very short space of time.
I've been employed continuously since 1981, you don't have to eat it just because someone thinks they pay you to.
Got it, I doubt it.

As mentioned in other posts, if you use company assets, anything you create, view, etc. is the property of the company. This precedent was set in the courts some time ago.

If an employee views pornographic material and someone else sees it/finds it offensive, they can file a lawsuit against the company claiming a hostile work environment. The company has a right to protect itself from these suits by preventing the activity in the first place.

If an employee uses company resources to send out a virus or attack another network, the company is liable for that action and must respond, and then take action against the employee. Again, the company has the right to ensure that this does not happen in the first place.

There have also been studies done to show how much productivity is lost and how much it costs a company annually due to frivolous surfing, spyware, etc. It's expensive. Employees are there to to work. However, I do not believe that ocasional browsing on breaks, lunch, etc, in accordance to company policy, causes undue harm.

You do not have the right to do whatever you wish on a company's resources. You may do that at home. However, your ISP has the right to shut down your connection/deny you service if you violate their terms of service and acceptable use. Again, if you use their resources to attack another network, share files illegally, you will find that they do not take kindly to that. They have the right to protect themselves from expensive legal action.

As stated, the employees of tsert's company sign an Acceptable Use Policy, so they have been notified of what is acceptable and that they are subject to monitoring and review. So it would difficult to bring suit in this regard against that organization.

Above all, if you don't do anything wrong, you don't have anything to worry about.

So, you capture their passwords? Don't you have a policy about sharing their accounts with others? It's kind of difficult to maintain auditability and accountability if the accounts become shared, by virtue of keystrokes being captured. I sure hope there isn't a water shortage!

Craig Herberg

It makes more sense to do business with a company that doesn't care if it's employees are wasting time and resources, surfing websites and screwing around when they should be working on YOUR project/file/loan agreement/you-name-it.
As a customer, it makes more sense to have to wait that extra day or two to get your completed project because the "dude" who worked on the variable cost rates section of your project decided instead to spend time looking at possible vacation spots for his next holiday.
Right?
As a company, if it's not time adding value to the company's product or service... it's time wasted.
Since wasting time is acceptable to you, rest assured - I would never hire you.

I have found this to be an excellent tool to check on systems that have been questioned. I see there are many opposed to just checking. Our policy is always that the request must come from above. Once the director has made the request we spring into action. Snitch is the best that I have used. It can be found here http://www.hyperdynesoftware.com/. As for those on the network we utilized Web Inspector, http://www.cyberguard.com/products/webwasher/webwasher_products/Web_Inspector.html. This is very handy because users web history is kept in a database and reports of all kind can be run against the database.

Happy hunting.

Just because I have the privilege.
Just because I can.
Just because it makes me feel so good.

Leave ethics aside.
The Nazi said "I am doing my job" during WWII.
The CEO said "For Shareholder Value"
The IT department said "I can surf but you can't"
The police speeds, running RED LIGHTS turing the siren on only at the intersection whereas you get a ticket.

Rank has privileges
Wake Up
Face Life, we live in an IMPERFECT world.

Hope the oppression are not in the point that needs uprising.

DC_Guy:

Not only is this not an ethics issue, it's completely black and white. MY company's PCs/Laptops = MY rules. You do not have the right to do anything more than what the owners of the systems (who also happen to pay you, by the way) have said you can. Ethically/legally/morally you have zero expectation of privacy when using company-owned equipment, systems, or access networks. It's not a new concept, it's the law, deal with it.

Never said that anyone is a Nazi.

Doing my job is not an excuse. One has to understand why one is doing what one is doing.

I list a bunch of things, neither did I imply the IT guy is the CEO nor did I imply the IT guy is the police. Why just pick the Nazi?

One needs to be consistent and objective.

My comment is just to provoke thought, no accusations

If you are talking about what you can do on the system when the portable is plugged in at work. Aside from 'objectionable' emails an admin can get tools to cope with anything they know/care about.

If they are at home and have the facility to use a machine through their own connection, as opposed to the company's, then I think you are on dodgy ground unless there is a fair policy in place that basically says anything you do with this machine we can look at so don't do anything but company business on it.
Where I work those who have portables do all company business by 'dialing in', then they are monitored and controlled. The portables themselves are locked down to the same extent as the desktops.
Go through all this clat to protect your infrastructure is sensible considering the general level of education out there, but it won't protect the company from any liability from an 'offensive' file or email. 01.jpg or an english insult with no profanities will not be spotted, just confirmed.

He asked how to monitor it on laptops that are taken off site, and used on out side networks that may not have any security. Its a very legitimate question. The way in which he asked it makes me wonder if he is looking for an easier way of extracting the files to take home for his personal collection. Either way there are those that read these forums to get information that may be helpfull to them as well. So, if the question may have legitimate uses for others, but illegitimate reasoning, just answer the darn question.

I have the same problem and am looking into either putting a local app on each laptop to block, and or a monitoring tool.

Although it is legal to do this in the US, it certainly fosters an atmosphere of mistrust and hostility, when it's done routinely. And since keystrokes are recorded, passwords become shared and auditability is lost. So, when the company accountant is charged with embezzlement, his attorney can claim that somebody else used his password to login and steal money. Normally, people are held accountable for their passwords, but not when the employer secretly shares them with snoops. What a mess!

Craig Herberg

Actually, I was not referring to covering up one's own tracks -- I was referring to the IT staff automatically cleaning up internet clutter, rather than sniffing through it.

There is a real good reason why work computers and work network both have "work" in their names -- because they're for work! Some organizations do a better job than others articulating that fact. Consistancy is the most important thing.

Craig Herberg

This is probably the best anyone can hope for -- a policy that works the same for everybody, especially when it is communicated clearly.

I do take exception when organizations record keystrokes, though. When the employees' passwords are known by whoever monitors the keystrokes, I think that auditability and accountability are compromised.

Craig Herberg

Presuming you came across illegal material while acting in accordance with your privacy policy what would you do?

I don't know the law, USA locale, but my impression is that there is some duty to report suspected or observed illegal activity.

If this is the case I'd favor a privacy policy that includes statements to the effect that the confidentiality boudnary stops at law breaking.

No doubt you've noticed by now that many here fail to understand the fact that a company has the right to control the use of its property.

The only real issue at hand then becomes the ownership of the laptops in question.

Unless they are the private property of the employees, they are subject to company control.

to use company property for such personal purposes as you see fit.

You do not.

It's that simple. Get over it.

That's true; what is "ethical" in this situation all boils down to what is explicitly written down in the rules. If it is against clearly written company policies to engage in certain activities with company equipment, and all employees are made aware of it (at the point of hiring and, as is the case with our company, with regular yearly updates), then engaging in such activities is unethical and the company has a right to check for it. However, if there is no company policy against such activity, then it is the snooping around that would be unethical.

However, as with most things in our complicated life, there are gray areas. I don't know what the law has to say about it, or even if there are applicable laws in the first place, but if there are no clearly written policies, then things can get touchy. For instance, if company equipment is used for illegal activities, i.e., things which are against the law of the land, then such activity would be unethical, even if there is no clear company policy against it. But if there is no company policy on the matter, then snooping around could be unethical too -- there's such a thing as due process, and even law enforcers have to get warrants and such to do such investigations. Of course, it can be argued that it is company property, but, as I said, this is a very gray area and I'm not familiar with what our laws have to say about it.

This thread has brought up some interesting situations that I have not encountered. Of course a consultant should never break the law or cover up lawbreaking. I do think, however, that a consultant's responsibility is similar to that of a priest or lawyer, i.e., what is learned in confidence remains in confidence. I think I will check with some lawyer friends.

Craig Herberg

I dont know what the laws are in your state, but in Florida a business can make a policy that states there is no expectation of Privacy. That means if its on the work computer or work email - they CANNOT expect that it is PRIVATE.

I am a Network Analyst II for a huge hospital in Florida. I work closely with our Data Security department in monitoring Internet usage (ISA Server and GFI monitor)... if I see abnormal habits I search the hard drive for non-business software or inappropriate materials. If I catch someone going to Adult sites, Chat sites, Dating sites or surfing while they are suppose to be working I turn them into Data Security with the evidence. So far, 3 individuals in the last 90 days have been terminated because of it. Am I sorry? NOT ONE BIT! These people are surfing or doing NON-Business related activity while our patients could be neglected.

If I see someone surfing more than what I would consider appropriate I turn them in. They are employed by the hospital to do a job - in one way or another that job means PATIENT CARE. Am I a hard A**? Why YES I AM! I have a job to do and that is to protect the hospital and its patients. If one of those bonehead users downloads a virus they place ALL our systems in jeopardy. Dont think this doesnt include DOCTORS! I have turned in two doctors for inappropriate web surfing habits to Data Security. The Data Security Officer went to the Medical Chief of Staff, both of those doctors were given a very point blank warning about those habits.

Our CIO put it this way "These folks are treating the hospitals computers as "Extensions" of their HOME computers, this is unacceptable". Webshots, Gator and all that crap do nothing but put the systems in jeopardy. I will continue to do my job and if it means someone getting fired....please, let me hold the door :)

Jim S.
Florida

Bypassing all the ethics stuff, if you need to know what's on a computer try SeqoiaView. A neat graph of the partition. You can colour code for the file types you are concerned about. Clicking on the colour gets you the path to the file. It's also a great way to see what is hogging disk space.
http://www.win.tue.nl/sequoiaview/

Not only that you too read the original post, which many other posters have been guilty of not doing.
Though I don't think the spectre of terrorism has anything to do with it as such, simply the bang some get out of the power.

Keylogging is beyond the pale anyway, short of there all ready having been a massive security failure in a very open environment, it's next to useless and problematic in the ways you describe.

However if your company issues you with a portable. Is there an expectation of reasonable personal use.
The company gains from both the connectivity and from the control. After all it's much more problematic for employees to do business with their own equipment.
The big problem with a portable is that it's a portable. You take it home use it in a potentially unsanitized environment and then carry it and any dirty items inside the company firewall. But does that difficulty require browser cache and mailbox snooping ?
A fun thought if the portable got infected at work, and then you plugged it into your own personal systems and it infected them, would the company be liable ?
Turn about is fair play after all

It troubles me greatly to see how many of our brethren present, both here and in numerous other discussions, seem to believe that the property of others must perforce be subject to their personal use.

I wonder how many of such would be willing to allow the rest of us the same with respect to their personal property!

the possibility that my personal systems might be compromised by those of my clients.

I exercise due diligence with respect to my systems' security measures by treating clients' sites the same as any other.

I have yet to become infected by any virus; and, the only instance of any other malware was a relatively benign variant of coolwebsearch, which was quickly and easily dispatched with CWShredder.

Though I suppose one could be too many.
LOL
However as they so desire is a bit unfair. I thinks it's perfectly reasonable to email a friend, go on to TR, check my bank balance on the company portable provided me so they can reach me away from the office presumably where they've sent me on company business. I think given this situation, not only is there a reasonable expectation of personal use, there's also a reasonable expectation of privacy as well.
If this is n't the case, then the policy should be very clear.
I'm only talking off site/ out of hours here, where the portable has been provided for the benefit of the business. The only solution that's coming across at the moment is the employees should carry their own portable about for non-company business as well as the company one, which is a tad impractical.
I'll be the first to admit that in giving me some personal space on company property gives rise to a potential for abuse, but I fail to see a practical option to do anything other than trust me until I'm proven untrustworthy.

There are in many municipalities and states/provinces/countries, laws governing both providing washroom and ensuring that they are private. A washroom is an obligation that the employer must provide. The ability to use computers for non-company purposes is not an obligation in any way shape or form.

In most companies that watch the clock, they monitor whether or not someone takes a break, not what they do with it. If you choose to take a smoke break or use the washroom, the employer does not care.

James

If you don't want my staff to know what you are doing with a laptop while you are on the road, carry your own.

It's simple, it's the law, it's completely ethical. As long as you are using a company PC/network/email system you have no expectation of privacy whatsoever. I'm continue to be amazed at the number of bright, educated IT staffers/management in this thread who don't seem to grasp the basic concept at work here.

If best practice and legal doctrine aren't enough for you people, what is? Help me understand how any of you feel that your company does not have full and absolute rights to monitor and control what you can or can't do while using company-owned resources?

1) Yes, the laws DO require that an employer provide suitable facilities for the execution of necessary bodily functions. Accordingly, one uses this "property" by virtue of right, not privilege.

2) By providing additional amenities, such as mirrors, the owner of said facilities has implicitly granted users of such the right to engage in activities over and above those of mere neccesity. So long as such are lawful, cause no loss to the owner, and are not otherwise expressly forbidden, any and all reasonable activities are permitted.

3) One's civil right to privacy is NOT waived merely by virtue of being on the property of another.

Finally, I would note that your analogy is badly flawed.

The use of bathrooms deals with necessary activities which lack the potential to harm the property owner; the issue at hand involves discretionary activities, for personal gain, with much risk of harm to the owner of the property being used.

In the strict sense of the word, you are correct.

Since the company has no inate right to force you to work for them, but requires your consent for such, you are extending a privilege to them by accepting an offer of employment.

Your head's no bigger than mine.

Hi All,

Most of the maintenance activities can be automated. e.g Internet cache can be deleted while someone closes the browser. This can be configured on IE and there are many ways of doing it. You can do it thru group policies.

You can create standard desktop images (or follow a process for all installations) where in you customize all Temp variables to say D:\Temp. Then all users' temp data is in this folder and not embedded in their profiles, making it much easier to manage.

Also there are tools like network file locator for windows and 'whereis' for DOS. I'd used whereis very effectively on DOS envn as it support the action on the searched file. So I can search for say *.tmp (using batch files) and delete in the same command - No manual intervention

I guess one has to build little tools as per the specific need.

We the invisible blamed by the many for their screw ups
Come the revolution...............

Doesn't seem like an intrusion detection system would be very effective if it only monitored when someone 'thought there might be a problem'.

half or more of security breaches are done by employees.

Dennis is absolutely correct. Without a properly written policy, you don't have a leg to stand on.

Once you've got a policy in place, you can begin searching out what you're looking for. Given that, if you are working in a M$ shop, with a little coding in WMI you can interrogate systems for cache info, file types, etc... Additionally, with WMI you can copy, delete or remove the files to a server automatically when they log on to the lan without them ever knowing.

If you aren't up for coding, AuditWizard (www.auditwizard.com)is a nice, affordable software package that will interrogate the systems for the basics and can run searches on remote systems for different file types. Also, the reporting tools can help you out with obtaining your numbers for licensing and finding restricted apps that the user has installed.

The last part of your reply seems absolute. If this logic were to be applied to all company property, we would then say that when you were in the lavatory, you were using company owned equipment and were subject to loss of privacy. This is not true. The issues are complex and require policy, interaction training (as applicable) and reinforcement from time to time.

A zero tolerance approach has lead to the confiscation of fingernail clippers and toy soldiers at airport check points. This is neither productive nor contusive to an efficient and effective environment. The tone of some of these replies would lead me to think that a congratulatory e-mail or invitation is grounds for dismissal at some companies. That is positively Orwellian. Establish your policies and do what is required but lighten-up.

We have 2 policies in place:
1 is a logon banner that spells out acceptable use
2 when new employees start, when I explain policy 1, I tell them that if their momma can't watch over their shoulder when they surf, they better save it for home in the dark.
As for monitoring, between GFI and ISA logs/reports, we see it all......

The matter of sending Data Security is you job. that do not possess all informative content on behalf of the company , as you say take up company time as far as processing, company money as far as HDD storage, as quite rightly as you say clog up you message server which belong to the company.

I have even gone to the extent of NEVER permitting company owned resources to the application of MP3s, or games of any kind nor Hotmail or private emails. You are employed by the company to act as their administrator and it is your responsibility to ensure ALL company assets are used for company purposes.

In my country, NON US, virtually NO one has total freedom to surf web sights as this is a pure waste of company assets, time and infrastructure.

Put you case forward in plan simple terms to the CEO and give the CEO and actual Dollar figure what this what the cost is for HDD storage is costing his company.

As you are changed with the position of administering the company IT infrastructure its is your RIGHT to withdraw the offenders right to send ALL activity until you can place in simple dollar figures the cost to the CEO of what people are costing the company, not only n IT infrastructure but in lost staff productivity. Good luck this is what your job is all about.

You control access to the internet/LAN and am employed by the company to act in the companies best interests ? so go forth and fulfill your position authority empowered to you by the nature of your employment.

As for a software solution I think you should install Novell Small Business Edition 6.5, it gives you all this administrative authority, and will automate software installations as well as upload all the data in the My document folder from the client to the servers my document folder of the user, where the data should be, upon connection whether it be via VPN or cable or I hope not dialup.

Good luck and check it out. It?s less than half the cost of MS SBS 2003 and you wont need to change any hardware and you get far superior control over email, you can actuall see the history of an email, what time it was sent, what time it was read or deleted or forwarded and the user cannot stop history being recorded.

Good luck