Hacker News Reader

Comment by jasonkostempski | Hacker News Reader

Do they even need a policy? If someone is on my computer and my network I assume I have the right to access any of the stuff on it.

View on HN

The EU has said several times that any monitoring has to be proportionate and limited, and that you need to tell employees i) that you are monitoring, and ii) what you're monitoring.

Note that in this case he lost because his employer had the policy clearly in place. He might have won if they didn't have that.

The 'limited' aspect seems rather toothless if a clear policy of "we monitor everything" is valid.

The limited aspect is important so that the employee knows what's monitored. Employees are not forced to store private data on work devices or engage in private conversations.

All my employees are regularly reminded that work equipment is work equipment and that we have access to it and will in certain cases use that access. I'll try not to go through their private stuff, but if there's something I urgently need from their device (or account) and they're not able to provide it (1) I'll have to. If you send private conversation via a company account you know what you sign up for.

(1) for any reason, ranging from extended holidays away from the internet to "this person is no longer among us".

But "we monitor everything" is not valid. "We will monitor our work accounts on our equipment" is valid, and "we found some personal messages on this work account" becomes valid because it's not everything (which would violate his privacy) but because it's only the work account.

This doesn't sound proportionate though does it.

"We checked the work account on your work computer"? That sounds pretty proportionate.

The offence ie chatting to a some one - that's a verbal warning offence not gross misconduct aka instant dismissal.

Do you apply this to everything? If someone is using your bathroom do you believe you have a ethical and legal right to surreptitiously observe everything they do in there?

I believe what they meant was if someone were using your laptop on your network then you have the right to know what they're doing. Granted, if you're doing banking then I wouldn't expect that I'd have a right to know your bank account info but I'd expect to at least know if you're using my computer and my network to buy illegal drugs or something like that. This seems reasonable as far as "limited" means. I'd like to know what they found that made them terminate his employment though.

In the computer case, the reason surveillance is a good idea is so the owner can prevent misuse. Misuse is likely, as any computer with an internet browser may temp a user with a wide variety of possibilities for misuse.

In the restroom case, an owner often can safely assume that the user's activities will be restricted to a quite limited range of behaviors. However, if I had reason to believe that the user might be performing some illicit activity in the restroom (e.g. arson), I might feel surveillance is warranted.

The difference comes down to the disparate levels of suspicion.

The employer presumably didn't think he was using their computer for arson. Would you be more comfortable letting a stranger into to your premises to use your bathroom or letting them use your internet connection?

The bathroom.

I haven't put NEARLY enough effort into securing the accessible services on my LAN against unauthorized access. There's a practical upper limit on how much undetected damage someone could do in my bathroom (without a crowbar or a wrench) that is significantly exceeded by how much undetected damage they could do on my network.

Let's not conflate the ideas of a legal right and an ethical right. Especially where privacy is concerned, they are often in tension or even direct conflict.

You're likely right, but if I was hiring someone, I'd make sure to have a strong rule (ie - work devices/networks are for work purposes only) and a strong disclosure (ie - we reserve the right to monitor, read or otherwise use any and all information on work devices or networks).

Of course, I'm Canadian and our privacy law is fairly strict. Violations are also a tort, even without proof of damage, so my case may be unique.

But regardless, firm, written guidelines applied equally across the organization are always a good defense.

The person is your employee; you entered into a contract with that employee and the computer and your network is not just your property anymore, but tools provided to the employee to be used by said employee according to the contract. At this point, contract law, labor law, etc. can constrain what you can do pertaining to your employee's use of the computer and the network, especially when the constraints exist to safeguard fundamental rights.

The law might require it.

I don't know UK law but in several eu countries a employer can't monitor their own computers unless they have in writing informed the employees about it.

That's an extremely poor assumption. Any home user's computers would be on their ISP's network. Should they have the right to access any of the stuff on it?

No because I am on their network.

Reply on news.ycombinator.com