5 ms·

Just to add EU view on "legal". This is highly illegal and it is criminal offense in same manner as wiretapping. You (as employer, even if you own employee com

by stiray 7y ago

Just to add EU view on "legal". This is highly illegal and it is criminal offense in same manner as wiretapping. You (as employer, even if you own employee computer) can get jailtime for this although hefty fine is more plausable. Before employee leaves the company, its manager is responsible to get all the company data stored (by leaving employee) on another computer, then IT takes the computer and wipes all the drives, with at least two persons present.

meowface 7y ago
It is funny how cultures and legal systems differ. In US corporate culture, it's very ingrained that things done with company property belong solely to the company, and that the company has a right to look at company property and data at any time, for any reason. A big portion of one of my information security jobs involved looking at employees' browsing history and emails daily. Sometimes to investigate potential misconduct (something dumb like a manager wanting to see if someone's slacking off, or something serious like suspicion of stealing information), but usually to investigate potential security issues (like if we believed a computer visited a malware-associated web page, we wanted to see how the computer ended up there). In the US, pretty much no one bats an eye that this is considered necessary and normal. Employees who don't want to be snooped on are free to use their personal devices at work, like their phones, which of course we have no access to. But it's considered very normal that if an employer gives you a computer to use for work, that they can inspect that computer and data to and from it. No one has a feeling of their privacy being violated, because there's no expectation of privacy when using someone else's (the company's) property. For infosec operations people in European countries, how are these things handled? How do you investigate potential breaches which originate from endpoints? Do you have to ask the employee if you can look at their browsing history? What if it's a potential misconduct investigation, where tipping someone off may result in destruction of evidence?
- normalnorm 7y ago
  > No one has a feeling of their privacy being violated, because there's no expectation of privacy when using someone else's (the company's) property. Excellent. Now you only have to remove the expectation of privacy in any situation from the social norms, and another big problem will be solved. You will be able to live under total surveillance without anyone feeling that their privacy is being violated, because there was no expectation of privacy to begin with. An alternative hypothesis (crazy, I know...), is that the power imbalance in favor of the rich went very far in the US, which means that the poor have no safety net or ability to organize, so they are completely at the mercy of the whims of corporations for survival. And so, they will accept many indignities without bating an eye.
  - lotsofpulp 7y ago
    Expecting to have the same rights as if using your own devices when using someone else’s device that they are paying you to perform work on qualifies as an indignity to me. Do people in EU countries expect to use any other of their employer’s equipment for personal reasons?
    - normalnorm 7y ago
      > Expecting to have the same rights as if using your own devices when using someone else’s device that they are paying you to perform work on qualifies as an indignity to me. Every single second that you are working, you know that your employer might be looking over your shoulder. It's like living under a microscope. For me, this is an indignity. Having to work in such circumstances would probably drive me to deep depression. > Do people in EU countries expect to use any other of their employer’s equipment for personal reasons? Within reason, sure. I would say that the main value that underlies all EU countries (not that we realize it perfectly, or even get close to it, of course!) is that human beings are the most important thing. I find mainstream American values increasingly inhumane.
      - lotsofpulp 7y ago
        US law holds the employer responsible for what happens on their computers. No one cares to if you check your email every now and then or read the news. But how can an organization protect itself from the myriad ways someone can damage the computer or others on the network without monitoring it? In addition, everyone has a personal computer in their pocket they can use if they want privacy.
        normalnorm 7y ago
        Yes, yes. There is always some legal reason with you guys. Somehow we manage here in Europe. Go figure...
        meowface 7y ago
oarsinsync 7y ago
> Just to add EU view on "legal". This is highly illegal and it is criminal offense in same manner as wiretapping. You (as employer, even if you own employee computer) can get jailtime for this although hefty fine is more plausable. This is not an EU-wide regulation. The UK is currently a member of the EU, and this practice is legal in the UK. Employees do not have the expectation of privacy on employer owned equipment. (Please, lets not devolve into a conversation about Brexit, it's an unrelated tangent)

by stiray 7y ago

meowface 7y ago

It is funny how cultures and legal systems differ. In US corporate culture, it's very ingrained that things done with company property belong solely to the company, and that the company has a right to look at company property and data at any time, for any reason. A big portion of one of my information security jobs involved looking at employees' browsing history and emails daily. Sometimes to investigate potential misconduct (something dumb like a manager wanting to see if someone's slacking off, or something serious like suspicion of stealing information), but usually to investigate potential security issues (like if we believed a computer visited a malware-associated web page, we wanted to see how the computer ended up there). In the US, pretty much no one bats an eye that this is considered necessary and normal. Employees who don't want to be snooped on are free to use their personal devices at work, like their phones, which of course we have no access to. But it's considered very normal that if an employer gives you a computer to use for work, that they can inspect that computer and data to and from it. No one has a feeling of their privacy being violated, because there's no expectation of privacy when using someone else's (the company's) property. For infosec operations people in European countries, how are these things handled? How do you investigate potential breaches which originate from endpoints? Do you have to ask the employee if you can look at their browsing history? What if it's a potential misconduct investigation, where tipping someone off may result in destruction of evidence?

normalnorm 7y ago
> No one has a feeling of their privacy being violated, because there's no expectation of privacy when using someone else's (the company's) property. Excellent. Now you only have to remove the expectation of privacy in any situation from the social norms, and another big problem will be solved. You will be able to live under total surveillance without anyone feeling that their privacy is being violated, because there was no expectation of privacy to begin with. An alternative hypothesis (crazy, I know...), is that the power imbalance in favor of the rich went very far in the US, which means that the poor have no safety net or ability to organize, so they are completely at the mercy of the whims of corporations for survival. And so, they will accept many indignities without bating an eye.
- lotsofpulp 7y ago
  Expecting to have the same rights as if using your own devices when using someone else’s device that they are paying you to perform work on qualifies as an indignity to me. Do people in EU countries expect to use any other of their employer’s equipment for personal reasons?
  - normalnorm 7y ago
    > Expecting to have the same rights as if using your own devices when using someone else’s device that they are paying you to perform work on qualifies as an indignity to me. Every single second that you are working, you know that your employer might be looking over your shoulder. It's like living under a microscope. For me, this is an indignity. Having to work in such circumstances would probably drive me to deep depression. > Do people in EU countries expect to use any other of their employer’s equipment for personal reasons? Within reason, sure. I would say that the main value that underlies all EU countries (not that we realize it perfectly, or even get close to it, of course!) is that human beings are the most important thing. I find mainstream American values increasingly inhumane.
    - lotsofpulp 7y ago
      US law holds the employer responsible for what happens on their computers. No one cares to if you check your email every now and then or read the news. But how can an organization protect itself from the myriad ways someone can damage the computer or others on the network without monitoring it? In addition, everyone has a personal computer in their pocket they can use if they want privacy.
      - normalnorm 7y ago
        Yes, yes. There is always some legal reason with you guys. Somehow we manage here in Europe. Go figure...
        meowface 7y ago

oarsinsync 7y ago

> Just to add EU view on "legal". This is highly illegal and it is criminal offense in same manner as wiretapping. You (as employer, even if you own employee computer) can get jailtime for this although hefty fine is more plausable. This is not an EU-wide regulation. The UK is currently a member of the EU, and this practice is legal in the UK. Employees do not have the expectation of privacy on employer owned equipment. (Please, lets not devolve into a conversation about Brexit, it's an unrelated tangent)