7 ms·

Better not to work for such companies.

by x5n1 11y ago

Alupis 11y ago
> Better not to work for such companies. Don't work for a company that monitors it's own IT equipment? Monitoring the equipment is to ensure it's working properly, as well as to guard against employees misusing company equipment by installing toolbars and apps that have no business purpose (which ultimately leads to mis-performing equipment, and lost productivity). I don't think I'd want to work for a company like that - the IT equipment would be in shambles, borderline unusable.
- s73v3r 11y ago
  Why? Do you only work for companies that employ children?
  - Alupis 11y ago
    Having worked in corporate IT for a long while, I can assure you that users will click "OK" on any popup, and install any program they think they need/want. This includes music player apps, torrent programs, toolbars, etc. None of which is allowed on a company computer (by most policies). It's not your property, don't abuse it. It's really, really simple.
    - tremon 11y ago
      It's not your property, don't abuse it. It's really, really simple. No, it is not. Where is the line between use and abuse? If I install Notepad++ because it allows me to work faster, am I using or abusing the computer? What if I install Firefox because some suppliers' site doesn't work in the company-provided IE8 anymore? What if I install Dell's ActiveX control to download their drivers? What if I disable the company-installed Flash Player because I feel safer without it? What if I install NoScript or Flashblock using a company-provided Firefox install? What if I look up my GP's phone number using a work computer because I need a consult for my back issues? Should I take sick leave just so I can call my GP? I've worked in IT support, and the general rule among those companies was this: if employees have local administrator rights, they are expected to manage their system themselves. So all of the above would fall under "use" where I've worked. If your employees cannot be trusted to manage their machine, why do they have administrator rights in the first place?
      - Alupis 11y ago
        > If I install Notepad++ because it allows me to work faster, am I using or abusing the computer? This, and all of your examples, would be considered abuse if your corporate policy stated you were not allowed to install any software without IT's permission. It is that simple, really. > if employees have local administrator rights, they are expected to manage their system themselves This sort of thing really only occurs at small businesses with little-to-no internal IT support, or with very special cases (such as a developer, which would have special approvals by the company to do so). > If your employees cannot be trusted to manage their machine, why do they have administrator rights in the first place Well, they shouldn't, and they don't at most companies. In the end, you signed a usage agreement. If you deliberately break that agreement, don't be surprised by the consequences.
        tremon 11y ago
        This, and all of your examples, would be considered abuse if your corporate policy stated you were not allowed to install any software without IT's permission. It is that simple, really. Except that two of my examples did not involve installing anything.
        antihero 11y ago
        > This, and all of your examples, would be considered abuse if your corporate policy stated you were not allowed to install any software without IT's permission. It is that simple, really. Well in that case any sane person would try to avoid working for a company with such draconian and controlling policies.
- Dylan16807 11y ago
  What a ridiculous strawman. I should not need to explain that you can monitor installed applications without reading the contents of someone's gmail tab.
  - Alupis 11y ago
    > you can monitor installed applications without reading the contents of someone's gmail tab You should not be using gmail while being paid to do work on someone's equipment. A parallel would be if your company used GMail for business purposes. You log into your personal Gmail account instead, and stay logged in. The company needs to gain access to an email from a customer, so they open Gmail on your computer - but discover you are logged into your personal account and can clearly see you have spent your afternoon sending personal emails... not working. Another parallel would be if you were hired to drive a bus route, but decided to use the company owned bus to go shopping instead. You are misusing company equipment, and if they discover that via a typical investigation (such as checking your bus' GPS location), then they have done nothing wrong. I don't see how any reasonable person could argue that this man's case was a clear violation of his privacy. This is a typical case of a person misusing equipment/breaking the rules, then getting upset that he was caught.
    - lvs 11y ago
      >This is a typical case of a person misusing equipment/breaking the rules... ... in a completely benign way that you might expect of a real human being, not a slave or serf.
      - Alupis 11y ago
        > in a completely benign way that you might expect of a real human being, not a slave or serf. No reasonable person can advocate in good faith that employees should actively ignore workplace policies and rules, because they're "real human beings"... and further, that there should be no consequences for these deliberate actions.
        11y ago
tptacek 11y ago
Good luck finding one. The clauses that enable this kind of monitoring are boilerplate employee contract and company manual stuff.
- x5n1 11y ago
  Maybe big corporations, there are tons of small companies, which constitutes half the economy that don't do this.
  - tptacek 11y ago
    The issue isn't whether they do it routinely, but whether they're entitled to do it. Most small companies hire people using boilerplate employment contracts and employee handbooks, too. My point is that they don't have to intend to make monitoring possible for it to be possible; it's practically the default. Also: pay close attention to what 'Spook23 is saying downthread about discovery. Your employer doesn't even have to want to monitor your stuff; all that needs to happen is they get sued, and if you've been mixing business and personal comms, it can all end up in scope.
- arethuza 11y ago
  Might be boilerplate in the US but it'll vary from country to country in the EU. Certainly Germany had very tight rules on this kind of stuff. Also at a previous employer (multinational, 30+ countries) the CIO took an explicit decision not to employee any kind of technology that could "spy" within SSL traffic to avoid potential liabilities around company IT staff having visibility of personal banking details etc. Also, just because something is in an employment contract or handbook doesn't mean it's enforceable.
  - weinzierl 11y ago
    I have researched the situation for Germany and the usual recommendation for the employer is to put something like the following in the contract: 1. Private use is forbidden. 2. Employer can't be held responsible for storing or processing private data if employee didn't follow 1. Not exactly but quite similar to the ruling described in the original post.

Better not to work for such companies.

by x5n1 11y ago

Better not to work for such companies.

> Better not to work for such companies. Don't work for a company that monitors it's own IT equipment? Monitoring the equipment is to ensure it's working properly, as well as to guard against employees misusing company equipment by installing toolbars and apps that have no business purpose (which ultimately leads to mis-performing equipment, and lost productivity). I don't think I'd want to work for a company like that - the IT equipment would be in shambles, borderline unusable.

s73v3r 11y ago
Why? Do you only work for companies that employ children?
- Alupis 11y ago
  Having worked in corporate IT for a long while, I can assure you that users will click "OK" on any popup, and install any program they think they need/want. This includes music player apps, torrent programs, toolbars, etc. None of which is allowed on a company computer (by most policies). It's not your property, don't abuse it. It's really, really simple.
  - tremon 11y ago
    It's not your property, don't abuse it. It's really, really simple. No, it is not. Where is the line between use and abuse? If I install Notepad++ because it allows me to work faster, am I using or abusing the computer? What if I install Firefox because some suppliers' site doesn't work in the company-provided IE8 anymore? What if I install Dell's ActiveX control to download their drivers? What if I disable the company-installed Flash Player because I feel safer without it? What if I install NoScript or Flashblock using a company-provided Firefox install? What if I look up my GP's phone number using a work computer because I need a consult for my back issues? Should I take sick leave just so I can call my GP? I've worked in IT support, and the general rule among those companies was this: if employees have local administrator rights, they are expected to manage their system themselves. So all of the above would fall under "use" where I've worked. If your employees cannot be trusted to manage their machine, why do they have administrator rights in the first place?
    - Alupis 11y ago
      > If I install Notepad++ because it allows me to work faster, am I using or abusing the computer? This, and all of your examples, would be considered abuse if your corporate policy stated you were not allowed to install any software without IT's permission. It is that simple, really. > if employees have local administrator rights, they are expected to manage their system themselves This sort of thing really only occurs at small businesses with little-to-no internal IT support, or with very special cases (such as a developer, which would have special approvals by the company to do so). > If your employees cannot be trusted to manage their machine, why do they have administrator rights in the first place Well, they shouldn't, and they don't at most companies. In the end, you signed a usage agreement. If you deliberately break that agreement, don't be surprised by the consequences.
      - tremon 11y ago
        This, and all of your examples, would be considered abuse if your corporate policy stated you were not allowed to install any software without IT's permission. It is that simple, really. Except that two of my examples did not involve installing anything.
      - antihero 11y ago
        > This, and all of your examples, would be considered abuse if your corporate policy stated you were not allowed to install any software without IT's permission. It is that simple, really. Well in that case any sane person would try to avoid working for a company with such draconian and controlling policies.
Dylan16807 11y ago
What a ridiculous strawman. I should not need to explain that you can monitor installed applications without reading the contents of someone's gmail tab.
- Alupis 11y ago
  > you can monitor installed applications without reading the contents of someone's gmail tab You should not be using gmail while being paid to do work on someone's equipment. A parallel would be if your company used GMail for business purposes. You log into your personal Gmail account instead, and stay logged in. The company needs to gain access to an email from a customer, so they open Gmail on your computer - but discover you are logged into your personal account and can clearly see you have spent your afternoon sending personal emails... not working. Another parallel would be if you were hired to drive a bus route, but decided to use the company owned bus to go shopping instead. You are misusing company equipment, and if they discover that via a typical investigation (such as checking your bus' GPS location), then they have done nothing wrong. I don't see how any reasonable person could argue that this man's case was a clear violation of his privacy. This is a typical case of a person misusing equipment/breaking the rules, then getting upset that he was caught.
  - lvs 11y ago
    >This is a typical case of a person misusing equipment/breaking the rules... ... in a completely benign way that you might expect of a real human being, not a slave or serf.
    - Alupis 11y ago
      > in a completely benign way that you might expect of a real human being, not a slave or serf. No reasonable person can advocate in good faith that employees should actively ignore workplace policies and rules, because they're "real human beings"... and further, that there should be no consequences for these deliberate actions.
      - 11y ago

tptacek 11y ago

Good luck finding one. The clauses that enable this kind of monitoring are boilerplate employee contract and company manual stuff.

x5n1 11y ago
Maybe big corporations, there are tons of small companies, which constitutes half the economy that don't do this.
- tptacek 11y ago
  The issue isn't whether they do it routinely, but whether they're entitled to do it. Most small companies hire people using boilerplate employment contracts and employee handbooks, too. My point is that they don't have to intend to make monitoring possible for it to be possible; it's practically the default. Also: pay close attention to what 'Spook23 is saying downthread about discovery. Your employer doesn't even have to want to monitor your stuff; all that needs to happen is they get sued, and if you've been mixing business and personal comms, it can all end up in scope.
arethuza 11y ago
Might be boilerplate in the US but it'll vary from country to country in the EU. Certainly Germany had very tight rules on this kind of stuff. Also at a previous employer (multinational, 30+ countries) the CIO took an explicit decision not to employee any kind of technology that could "spy" within SSL traffic to avoid potential liabilities around company IT staff having visibility of personal banking details etc. Also, just because something is in an employment contract or handbook doesn't mean it's enforceable.
- weinzierl 11y ago
  I have researched the situation for Germany and the usual recommendation for the employer is to put something like the following in the contract: 1. Private use is forbidden. 2. Employer can't be held responsible for storing or processing private data if employee didn't follow 1. Not exactly but quite similar to the ruling described in the original post.