Comment by vertex-four | Hacker News Reader

Comment by vertex-four | Hacker News Reader

Parent Full thread

The trick here, as my understanding of the law goes, is that (a) the company had a policy that work computers are to be used for work only, AND (b) that the account in question was being used for both personal and professional contacts.

In general, your workplace can (assuming that you have agreed to this in policy) ensure that you're using your computer for approved uses, and it can access all work-related information on the computer. You do have (limited) privacy over anything personal on the computer, but they're welcome to discipline or fire you just for its existence, and in some cases they may access it if they have reasonable belief that they have to.

This ruling clarifies that if your personal information is mixed in with professional information, the company may access it, as little as necessary (the word you'll come across lots is "proportionate"), as part of an internal investigation or similar. This has been spelled out by at least the British Government for a while now, nothing has changed.

EDIT: On a side note, anyone else notice how the article names the ex-employee and not the employer?

I think this is the judgement: http://www.clujust.ro/wp-content/uploads/2016/01/CASE-OF-BAR...

> EDIT: On a side note, anyone else notice how the article names the ex-employee and not the employer?

That's weird. This particular court case is him vs Romania, not him vs his employer. The earlier cases, in Romania, would have been him vs the employer.

There are many reports of this case, and most of them do the same thing:

http://www.bloomberg.com/news/articles/2016-01-12/companies-...

https://www.rt.com/news/328755-echr-employee-messages-snoopi...

http://sputniknews.com/europe/20160113/1033075519/eu-court-p...

> The case dates back to 2007 when Bărbulescu was informed by his employer that his Yahoo Messenger communications had been monitored from 5 to 13 July 2007 and that the records showed he had used the Internet for personal purposes.

> Barbulescu replied in writing that he had only used the service for professional purposes. He was presented with a transcript of his communication including transcripts of messages he had exchanged with his brother and his fiancee relating to personal matters such as his health and sex life.

http://www.express.co.uk/life-style/science-technology/63426...

>That's weird. This particular court case is him vs Romania, not him vs his employer. The earlier cases, in Romania, would have been him vs the employer.

The suit is in the European Court of Human Rights. He was claiming that Romania violated his right to confidential correspondence by having civil law that allowed his company to read private messages. He lost, therefore Romania's laws are fine, and thus the employer is still in the right.

> EDIT: On a side note, anyone else notice how the article names the ex-employee and not the employer?

Eh, yeah, that is weird, now that you mention it. It's like they were interested in protecting the reputation of the company, but they wanted to throw the ex-employee to the wolves.

Perhaps the name of the company was not revealed because it was not a party to the case, as strange as it appears. The lawsuit did not include the company, so it might not be in the public record (while the guy's name, being a party to the suit, is)

Better not to work for such companies.

Good luck finding one. The clauses that enable this kind of monitoring are boilerplate employee contract and company manual stuff.

Might be boilerplate in the US but it'll vary from country to country in the EU. Certainly Germany had very tight rules on this kind of stuff.

Also at a previous employer (multinational, 30+ countries) the CIO took an explicit decision not to employee any kind of technology that could "spy" within SSL traffic to avoid potential liabilities around company IT staff having visibility of personal banking details etc.

Also, just because something is in an employment contract or handbook doesn't mean it's enforceable.

I have researched the situation for Germany and the usual recommendation for the employer is to put something like the following in the contract:

1. Private use is forbidden.

2. Employer can't be held responsible for storing or processing private data if employee didn't follow 1.

Not exactly but quite similar to the ruling described in the original post.

Maybe big corporations, there are tons of small companies, which constitutes half the economy that don't do this.

The issue isn't whether they do it routinely, but whether they're entitled to do it. Most small companies hire people using boilerplate employment contracts and employee handbooks, too.

My point is that they don't have to intend to make monitoring possible for it to be possible; it's practically the default.

Also: pay close attention to what 'Spook23 is saying downthread about discovery. Your employer doesn't even have to want to monitor your stuff; all that needs to happen is they get sued, and if you've been mixing business and personal comms, it can all end up in scope.

It is not that hard. Just avoid being drone in big corporate. Which is a good job advice anyway.

> Better not to work for such companies.

Don't work for a company that monitors it's own IT equipment?

Monitoring the equipment is to ensure it's working properly, as well as to guard against employees misusing company equipment by installing toolbars and apps that have no business purpose (which ultimately leads to mis-performing equipment, and lost productivity).

I don't think I'd want to work for a company like that - the IT equipment would be in shambles, borderline unusable.

What a ridiculous strawman.

I should not need to explain that you can monitor installed applications without reading the contents of someone's gmail tab.

> you can monitor installed applications without reading the contents of someone's gmail tab

You should not be using gmail while being paid to do work on someone's equipment.

A parallel would be if your company used GMail for business purposes. You log into your personal Gmail account instead, and stay logged in. The company needs to gain access to an email from a customer, so they open Gmail on your computer - but discover you are logged into your personal account and can clearly see you have spent your afternoon sending personal emails... not working.

Another parallel would be if you were hired to drive a bus route, but decided to use the company owned bus to go shopping instead. You are misusing company equipment, and if they discover that via a typical investigation (such as checking your bus' GPS location), then they have done nothing wrong.

I don't see how any reasonable person could argue that this man's case was a clear violation of his privacy. This is a typical case of a person misusing equipment/breaking the rules, then getting upset that he was caught.

>This is a typical case of a person misusing equipment/breaking the rules...

... in a completely benign way that you might expect of a real human being, not a slave or serf.

> in a completely benign way that you might expect of a real human being, not a slave or serf.

No reasonable person can advocate in good faith that employees should actively ignore workplace policies and rules, because they're "real human beings"... and further, that there should be no consequences for these deliberate actions.

Sure they can... If those policies and rules are arbitrary, illogical, and backwards. Nobody follows all the rules all the time, and those that do are generally seen by the rest of society as stodgy and inflexible.

Also less effective. Example: Shadow IT exists for a reason, and that reason is not some variation of sticking it to the man.

> Sure they can... If those policies and rules are arbitrary, illogical, and backwards

Don't abuse company owned equipment, and don't use company owned equipment for personal reasons (especially during work hours) is certainly not an "arbitrary, illogical and backwards" policy.

> Also less effective

If you truly believe an IT department ensuring their systems are maintained properly and function as they should is "less effective" than just allowing chaos... I'm not sure what to say really.

> Shadow IT exists for a reason

Have you worked at a company which had different departments all using whatever they wanted? It's a nightmare, and not just from an IT perspective. Nothing is compatible with each other... transferring from one department to another results in a slew of new applications and practices to learn (and which are not necessarily better)... and when IT does need to step in and fix this new system a bunch of non-IT department staff cobbled together... it gets even worse. Soon these departments complain to the IT department when their "shadow IT" system breaks down and demand it be fixed promptly. It's not a net good for any company.

> Nobody follows all the rules all the time, and those that do are generally seen by the rest of society as stodgy and inflexible

Don't be ridiculous. It's not your property - you don't get to do whatever you want with it. It's really, really simple.

don't use company owned equipment for personal reasons

It's a bloody computer, not a backhoe. I know precisely nobody who has a computer at work that doesn't at least check their mail on it.

Why companies feel they have to treat their employees as serfs in this matter is beyond my comprehension. Nor do I understand the mindset that treats a mail check as "abuse".

Have you worked at a company which had different departments all using whatever they wanted?

Have you ever worked at a company which had an IT department that was so bureaucratic and slow moving that it prevented people getting actual work done? Your diatribe ignores the reason shadow IT springs up - because the "official" IT isn't doing their job and providing decent services.

I've been on both sides of this. The old quote "the harder you squeeze, the more slip through your fingers" applies. Shadow IT means that things are being provisioned without official approval, not that there's a policy allowing random things to be provisioned without approval.

You have an unnecessarily strict and unreasonable point of view that benefits no one, and I'm quite happy I don't work anywhere near you.

A company who blames the uses of a private gmail is dysfunctioning, and a country should rather get rid of such companies rather than the employees. Economic excellence, by keeping companies who know how to manage the motivation of employees.

OTOH there are problems with salespeople communicating with customers on their private emails, like, ugh, the director of the CIA who was recently caught by a teenager.

Why? Do you only work for companies that employ children?

Having worked in corporate IT for a long while, I can assure you that users will click "OK" on any popup, and install any program they think they need/want. This includes music player apps, torrent programs, toolbars, etc. None of which is allowed on a company computer (by most policies).

It's not your property, don't abuse it. It's really, really simple.

It's not your property, don't abuse it. It's really, really simple.

No, it is not. Where is the line between use and abuse?

If I install Notepad++ because it allows me to work faster, am I using or abusing the computer?

What if I install Firefox because some suppliers' site doesn't work in the company-provided IE8 anymore?

What if I install Dell's ActiveX control to download their drivers?

What if I disable the company-installed Flash Player because I feel safer without it?

What if I install NoScript or Flashblock using a company-provided Firefox install?

What if I look up my GP's phone number using a work computer because I need a consult for my back issues? Should I take sick leave just so I can call my GP?

I've worked in IT support, and the general rule among those companies was this: if employees have local administrator rights, they are expected to manage their system themselves. So all of the above would fall under "use" where I've worked. If your employees cannot be trusted to manage their machine, why do they have administrator rights in the first place?

> If I install Notepad++ because it allows me to work faster, am I using or abusing the computer?

This, and all of your examples, would be considered abuse if your corporate policy stated you were not allowed to install any software without IT's permission. It is that simple, really.

> if employees have local administrator rights, they are expected to manage their system themselves

This sort of thing really only occurs at small businesses with little-to-no internal IT support, or with very special cases (such as a developer, which would have special approvals by the company to do so).

> If your employees cannot be trusted to manage their machine, why do they have administrator rights in the first place

Well, they shouldn't, and they don't at most companies.

In the end, you signed a usage agreement. If you deliberately break that agreement, don't be surprised by the consequences.

This, and all of your examples, would be considered abuse if your corporate policy stated you were not allowed to install any software without IT's permission. It is that simple, really.

Except that two of my examples did not involve installing anything.

> This, and all of your examples, would be considered abuse if your corporate policy stated you were not allowed to install any software without IT's permission. It is that simple, really.

Well in that case any sane person would try to avoid working for a company with such draconian and controlling policies.

Do they even need a policy? If someone is on my computer and my network I assume I have the right to access any of the stuff on it.

The EU has said several times that any monitoring has to be proportionate and limited, and that you need to tell employees i) that you are monitoring, and ii) what you're monitoring.

Note that in this case he lost because his employer had the policy clearly in place. He might have won if they didn't have that.

The 'limited' aspect seems rather toothless if a clear policy of "we monitor everything" is valid.

The limited aspect is important so that the employee knows what's monitored. Employees are not forced to store private data on work devices or engage in private conversations.

All my employees are regularly reminded that work equipment is work equipment and that we have access to it and will in certain cases use that access. I'll try not to go through their private stuff, but if there's something I urgently need from their device (or account) and they're not able to provide it (1) I'll have to. If you send private conversation via a company account you know what you sign up for.

(1) for any reason, ranging from extended holidays away from the internet to "this person is no longer among us".

But "we monitor everything" is not valid. "We will monitor our work accounts on our equipment" is valid, and "we found some personal messages on this work account" becomes valid because it's not everything (which would violate his privacy) but because it's only the work account.

This doesn't sound proportionate though does it.

"We checked the work account on your work computer"? That sounds pretty proportionate.

The offence ie chatting to a some one - that's a verbal warning offence not gross misconduct aka instant dismissal.

Do you apply this to everything? If someone is using your bathroom do you believe you have a ethical and legal right to surreptitiously observe everything they do in there?

I believe what they meant was if someone were using your laptop on your network then you have the right to know what they're doing. Granted, if you're doing banking then I wouldn't expect that I'd have a right to know your bank account info but I'd expect to at least know if you're using my computer and my network to buy illegal drugs or something like that. This seems reasonable as far as "limited" means. I'd like to know what they found that made them terminate his employment though.

In the computer case, the reason surveillance is a good idea is so the owner can prevent misuse. Misuse is likely, as any computer with an internet browser may temp a user with a wide variety of possibilities for misuse.

In the restroom case, an owner often can safely assume that the user's activities will be restricted to a quite limited range of behaviors. However, if I had reason to believe that the user might be performing some illicit activity in the restroom (e.g. arson), I might feel surveillance is warranted.

The difference comes down to the disparate levels of suspicion.

The employer presumably didn't think he was using their computer for arson. Would you be more comfortable letting a stranger into to your premises to use your bathroom or letting them use your internet connection?

The bathroom.

I haven't put NEARLY enough effort into securing the accessible services on my LAN against unauthorized access. There's a practical upper limit on how much undetected damage someone could do in my bathroom (without a crowbar or a wrench) that is significantly exceeded by how much undetected damage they could do on my network.

Let's not conflate the ideas of a legal right and an ethical right. Especially where privacy is concerned, they are often in tension or even direct conflict.

You're likely right, but if I was hiring someone, I'd make sure to have a strong rule (ie - work devices/networks are for work purposes only) and a strong disclosure (ie - we reserve the right to monitor, read or otherwise use any and all information on work devices or networks).

Of course, I'm Canadian and our privacy law is fairly strict. Violations are also a tort, even without proof of damage, so my case may be unique.

But regardless, firm, written guidelines applied equally across the organization are always a good defense.

The person is your employee; you entered into a contract with that employee and the computer and your network is not just your property anymore, but tools provided to the employee to be used by said employee according to the contract. At this point, contract law, labor law, etc. can constrain what you can do pertaining to your employee's use of the computer and the network, especially when the constraints exist to safeguard fundamental rights.

The law might require it.

I don't know UK law but in several eu countries a employer can't monitor their own computers unless they have in writing informed the employees about it.

That's an extremely poor assumption. Any home user's computers would be on their ISP's network. Should they have the right to access any of the stuff on it?

No because I am on their network.

Reply on news.ycombinator.com