Hacker News Reader

Comment by Kwantuum | Hacker News Reader

Also likely illegal in most of the world.

Also likely illegal in most of the world.

Where "likely" means "I'm not a lawyer so I'm just guessing here" and "most" means "I read on HN that Europe likes privacy."

In the Netherlands there was a court case which ruled that an employer cannot just read an employees work email, as even work-related emails are considered private information.

There are some exceptions of course: if you notify the employee and have a justified reason you can check some emails. So it's not outright forbidden. It matters a lot on the case and what you did, exactly.

I'm not aware of the situation in other countries.

(In Dutch: https://www.cnvvakmensen.nl/nextnow/blog/2016/march/mag-de-b... and https://www.sprengersadvocaten.nl/publicaties/wanneer-mag-ee...)

I like this personally. I can have a private conversation with a coworker in the break room, why not by email? If I wanted to include my boss I would have CC'd her.

This is not the current state of the law in the US however.

Can an employer set up a microphone in the break area without letting you know?

Depends on the state. I believe there are several in which the answer is "yes".

https://www.justia.com/50-state-surveys/recording-phone-call...

Also, depends on to what extent that room can be considered public. (IANAL TINLA)

Moreover, a lot of computer systems in the USA, for decades, have included a message telling employees that their access and use of the computer may be monitored, which seems similar to me to a sign in the break room letting you know if video/audio recording is in progress...

If your boss wanted to be included, she could have Bcc'ed herself.

When he she or it, is a gsuite admin ;)

This is a large part of the justification in Europe - that the conventional expectations of (some degree of) privacy should extend into new mediums, because work makes up such a substantial part of our lives that employees need to accept that parts of employees private lives will happen at work, and they need to act accordingly.

Use your personal email accounts. Problem solved.

Ask the former secretary of state how well that went for her.

It's not always an option, even if they can't read your email casually, your company may still have perfectly legitimate reasons to keep it under their control for reasons of auditing etc.

In some of the regulated organisations I’ve worked in, every single piece of email, web, or IM traffic has been scanned. At a minimum for DLP and malicious content reasons, and usually by profanity/obscenity filters too. How could that possibly work with such a regulation? Every communication is read, at a minimum by a computer, and if you trigger an alert, it will usually be read by a human being as well. If such a regulation allowed for that to take place, then it would be a very weak privacy regulation. If it didn’t allow for that, then it would interfere with the basic compliance requirements of a lot of industries.

So it turns out you're wrong and the GP is right. Of course it's technically possible, but not legally. Many European countries do have these protections, even in the fairly privacy lax UK it is illegal to read employees emails unless you have a reasonable reason to be doing so.

Even if you do have a good reason, perhaps they're ill, you're not allowed to open them if it's obviously not from a business contact or it's obviously a private email. So reading an email from an employee's spouse or girlfriend would be illegal.

Where "likely" means "I'm not a lawyer so I'm just guessing here" and "most" means "I read on HN that Europe likes privacy."

Please don't be a jerk in HN comments, no matter how ignorant someone else is or you feel they are.

https://news.ycombinator.com/newsguidelines.html

Though the delivery wasn't as polite as it could have been, I believe it was valid criticism.

HN commenters are responsible for delivering valid criticisms in ways that don't damage the container. A thoughtful explanation will be better received anyhow.

What does damage the container mean in this context?

You may be the first person who's ever asked that, even though I've been using that term for years [0]. By 'container' or 'commons' [0.5] I mean the capacity of this place to host thoughtful discussion and rich community interaction. An internet forum like HN is fragile [1]. It can easily succumb to flamewars and other destructive dynamics. When one user posts that way, it evokes more of the same from others. Actually it evokes worse from others, because they'll feel justified in striking back, and people always underestimate how hard they're hitting by 10x if not more.

If that happens enough, the best users—who don't want to read snark, aggression, petty spats, etc.—will leave, ceding the field to the commenters who do, eventually driving everyone else away and leaving a scorched-earth wasteland [2]. The classic death spiral of an internet forum.

HN started [3] with the idea of trying to avoid that outcome [4], or at least stave it off [5]. Think of it like a complex but fragile ecosystem that needs protecting. Since we all benefit from the ecosystem, we're all responsible for protecting it, much as you wouldn't leave a campfire burning in a dry forest, drive a 4x4 across a mountain meadow, litter in a city park, and so on.

The bonds that hold HN together are weak, because we only have access to tiny blobs of text that are open to misunderstanding. Users don't have relationships that can sustain disruption and still be repaired; the group is too large. Since the organism can't easily repair itself, it needs not to take too many hits in the first place.

Most of the damage is thoughtless rather than malicious. The solution is to become more conscious about the goal of the site and how to further it. This isn't really an ethical question. We're not telling people that they should be good (maybe they should, but who is an internet moderator to tell anyone that?) Rather, it's an optimization problem. We're trying to optimize the site for curiosity [6]. That requires overcoming the default tendencies of the internet, and for that we need to sustain a certain culture.

[0] https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

[0.5] https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

[1] https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

[2] https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

[3] https://news.ycombinator.com/hackernews.html

[4] https://news.ycombinator.com/newswelcome.html

[5] https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

[6] https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

In my industry it would be explicitly illegal not to log and monitor all employee emails when they are using a corporate email or a personal email if that personal email was used for business purposes. This is by design and not contradicted by any privacy laws.

Security guy working in fintech: this is true of many industries that need to adhere to regulation or compliance, including:

1. Finance

2. Medicine

3. Aeronautics

There are likely more I'm personally unaware of. In finance, which I'm most familiar with, lenders (sometimes banks, but can be things like credit unions, marketplace lenders, or investors) have a laundry list of regulations they need to meet in order to business in the US. Many of these regulations explicitly require that the lender produce any and all communications between the lender and borrower on-demand--and for good reason.

There's a long history of bad actors in finance lying or misrepresenting things in official communications (fraud, embezzlement, money laundering, etc). If you work for any finance company, you had better expect that everything you do on your corp accounts/devices will be logged, audited, and periodically reviewed.

That said, the only time I've heard of an employees' email being pulled out of an archive and read were due to concerns around IP theft or questionable behavior between said employee and business clients.

Many of these regulations explicitly require that the lender produce any and all communications between the lender and borrower on-demand--and for good reason.

This is why traders WFH during coronavirus lockdowns is so problematic; not only a lack of externally accessible recorded phone lines but the impossibility of policing OOB communications when the local compliance guy can’t physically see you talking on your mobile phone.

Then it should not surprise you to know that phishing attempts have spiked in recent months. The pandemic has sewn much chaos, and bad actors are taking advantage. :(

What really concerns me is that these phishing attempts are just the attacks we're observing. Many more will go unnoticed given how ad-hoc current work environments have become with so many organizations going full-time remote overnight without the IT/security systems and processes in place to safely support it.

Yeah, entire departments are just setting up their own Zoom, Slack etc with no oversight, it’s crazy. Mostly in a way that anyone can just join too.

Is that really a limitation of WFH? Even when someone is in the office, if the intent is to bypass monitoring someone can use their phone. I tether my laptop to my phone all the time on client sites (instead of fighting with yet another captive portal).

This is why personal phones are generally not allowed on trading floors.

No kidding! Ok, that makes more sense then.

I’ve been privy to how a few of these highly regulated organisations are handling WFH, and the main challenges they seem to face are compute/network capacity on their virtual desktop/VPN/conferencing/instant messaging infrastructure. Which usually tend to be hosted on site. Of course people could bypass the systems completely, by say getting a private slack for their team. But doing so would (usually) be a policy violation, and from a compliance perspective, policy is often a valid control. Not all regulations require technical controls, and if they do, there’s often room to make exceptions to implement alternative controls when circumstances require it.

if the intent is to bypass monitoring someone can use their phone

Not if phones are checked in at the security desk when you arrive, there is a phone jammer operating in the building, and compliance staff are patrolling to make sure no one has smuggled a phone in. These measures are normal on most trading floors.

In those industries, would you then also get a requirement not to delete emails? If not, those wouldn't appear in those investigations.

Because I work in aeronautics, and we've never had such requirement. Unless my company retains all deleted emails without telling us.

There's typically a retention period. I'm not clear on what that retention period would be for aeronautics, but 3 months to a year isn't unusual in fintech.

Access for auditing and security is not only legal but actually required in many regions.

Even editing is allowed (automatic disclaimers, file scanning, data loss prevention, etc).

I know that in some parts of the world using a work phone or work email for personal use is protected (I think it is a little silly, but not a big deal), but that's not quite what you sound like you're describing.

I'm not at all sure that I've heard of many places where your employer explicitly ISN'T allowed to access employer provided resources.

If that were the case generally I'm not sure how anyone would even provide security or etc.

Where I work, anyone in the world can read my emails. You just have to make a request, and we have 15 days to provide the email. There are some cut-outs like attorney/client communication or health related, but pretty much any email I’ve ever sent or received is subject to inspection by any member of the public. (Most government entities have a similar law and it generally more open than the Fed’s FOIA.

Under what laws would it be illegal? I think it is completely reasonable for a company to have access to all data on company-provided accounts, so long as the employees aren't mislead into thinking it is private.

This is a big difference between Europe and US. I think different European countries require different levels of strictness -- it may be employer isn't allowed to even track who are the correspondents, let alone reading the email contents.

It is regulated in Europe, not banned. In general, employers can read your email, they just have to do it a certain way.

Here's a guide for UK employers:

https://uk.practicallaw.thomsonreuters.com/2-107-4386?transi...

I don't know for the rest of the world, but in France you can indicate your mail being private by adding a prefix to the subject of your mail with "Privé". Then the "secrecy of correspondence"[1] apply. Some company restrict the usage of private messages using the company-provided mail, but it is not the default case.

The company cannot access those messages without your consent or without a suspicion of a crime (like a leak of data).

[1] https://en.wikipedia.org/wiki/Secrecy_of_correspondence

Source in French with some court's judgement : https://www.arobase.org/entreprise/email-personnel.htm

the reason for this power isn't just for abuse of power, it's literally to prevent fraud and reduce liability. You need to know if your dev is exfiltrating PII to his buddy who is a scammer, if your employees are participating in bullying or discriminatory behavior, etc. Work is work, it's not your personal life.

Some countries have limits on which emails can be monitored or how often it can happen. I haven't heard of any where it is forbidden.

I can't imagine how hard it would be to run a business in a jurisdiction where that would be the case. How would you handle audits, employee turnover, records retention, civil suits, etc?

For public companies in the US it is illegal not to.

Reply on news.ycombinator.com