7 ms·

Admin here. Of course you can. You should always assume you can. Even if I couldn't read the email (which I can, but fortunately have never actually had the ne

Admin here. Of course you can. You should always assume you can. Even if I couldn't read the email (which I can, but fortunately have never actually had the need to or done so), I can always reset a password and gain full and instant access. You should always assume your employer can see your enterprise correspondence. G Suite or not.

Skunkleton 6y ago
> You should always assume your employer can see your enterprise correspondence. Just to expand here. You should assume that your employer has access to _everything_ that you do with their assets. If you are trying to maintain privacy from your employer for whatever reason, do not use your work phone/laptop/email/etc.
- fxtentacle 6y ago
  You should also assume that your employer can take those things away instantly. For example, one day your laptop forcibly restarts and afterwards you're locked out. Then a day later, you get the call that you were canned. So always keep private communication separate and get private phone numbers / email addresses from coworkers that you get along well with. The company can delete your extension and email address, but with a bit of preparation that doesn't have to be the end of your personal relationships.
- SAI_Peregrinus 6y ago
  With a lot of employment contracts they not only have access to everything, but also own the copyright/patents of anything made with their equipment.
- everdrive 6y ago
  Exactly, and even if your employer doesn't have logging software, they can get physical access to your laptop and look for logs and data manually. Importantly, you can't predict when and if this could happen.
- crispyambulance 6y ago
  > assume that your employer has access to _everything_ I hear this a lot and it seems like sound advice, but always leaves me with questions. Sure, my employer can see what URL's I am hitting, what applications are installed, their usage, and if they want they could even decrypt https traffic, take screenshots without my knowledge, key-log, turn on microphone and camera too. I mean, I won't hesitate to open my personal gmail, read news, make comments on social media sometimes (like this), perform online "errands". At the back of mind, however, I wonder if someone is seeing what I am doing. It makes me wonder, what is typical? Under what kinds circumstances would the most draconian measures (like screenshots) be taken? How much latitude are IT folks given? Are there ways to detect when really ugly things like keyloggers/cameras/mics being controlled by whatever "enterprise IT" software suite? It seems IT folks don't talk about this much. The dominant advice is always don't use work computer for _anything_ but work. The reality is that almost everyone in every profession takes that advice with a grain of salt.
  - barkingcat 6y ago
    In this regards, I think IT isn't the driving force. The driving force is the lawyers/legal department and the HR department. You should redirect this question to each HR department: how much does HR want to protect a company from its (possibly) rogue employees?
  - unicornfinder 6y ago
    I think the truth is it really depends on your employer. I worked for one place that actively monitored and even recorded people's screens fairly frequently, and others where they honestly don't care in the slightest.
    - crispyambulance 6y ago
      I see, but what did they do with that information? Did they just randomly browse employee's screens? What triggered that level of monitoring? Are there ways to detect when a screenshot is captured? It seems like a lot of effort to monitor screens, it makes me think there has to be a compelling reason, and not just browsing around looking for "problems".
- acruns 6y ago
  You should also assume that the email you "deleted", is still there. Most email servers/services have a setting to keep deleted emails for a period of time. Most corporations also have a separate email server for execs that have different settings. This is above and beyond compliance settings that also email retention for different periods of time. Then there are also backups and archiving...you get the idea.
devy 6y ago
> I can always reset a password and gain full and instant access. AFAIK, resetting an individual GSuite account's password is the only way GSuite Admin can access individual account's emails. Is there any other way to get access?
- Tomdarkness 6y ago
  I'm pretty sure you can't do it via the UI but if you use the API you can delegate access to any account in your organisation without confirmation. Once you've delegated access to that account you can then login as that user via the standard user switcher that appears if you have multiple accounts.
  - rednet 6y ago
    My team has written an integration with Google's API[0] to explicitly pull back the full bodies of emails for all users across a whole organisation, to run some analysis on all emails. Once our service account has been granted access, we can assume the role of any user and access anything we have permission for. So, you should assume your IT administrator can also access all your emails, since they're likely to be the person that grants permission to the service account. [0]https://developers.google.com/gmail/api/v1/reference/users/messages https://developers.google.com/gmail/api/v1/reference/users/m...
- iokanuon 6y ago
  That's exactly what the article is about.
  - neonate 6y ago
    In this article you will see how being a G Suite Administrator you can get a copy of your users sent and received emails without knowing their passwords or putting forwarding in their mailboxes
    - devy 6y ago
      Got it now. Getting a copy of incoming + outgoing via BCC for an individual account's emails is not quite the same as accessing individual account's emails though. For GSuite basic subscriptions, there is a 30GB quota per inbox, having BCCs for every account's emails will like exceed the plan allowance. I doubt it would work if you exceed the account quota allowed for the subscription plan.
scrollaway 6y ago
AFAIK the legality of it is not consistent. I had an employer who insisted that after I leave, every email I receive to my corporate address be forwarded to him. I remember asking a lawyer how legal this is and not receiving a conclusive answer. (Still interested in an answer for CA+NY if someone knows)
- icedchai 6y ago
  It's the company's email address, they can forward it whereever they want. Forwarding an employee's email to their supervisor upon departure is standard practice is many companies.
- floatingatoll 6y ago
  How many hours are willing to be billed for in research, and are you willing to go to court to seek a conclusive answer if none is found in research?
- dekhn 6y ago
  Just so I understand what you're complaining about: 1) you worked for a company 2) the company provided you with an email address via their corporate email system 3) you left the company 4) the company wants to read email sent to your work email address in their corporate email system Yes, it is totally legal for them to do that, there is no question, and it wouldn't make sense for it to be any other way.
  - vidarh 6y ago
    This depends on jurisdiction, so just saying "yes" is wildly misleading. Expectations of privacy - even for corporate e-mail - is a thing some places. To what extent it applies tends to depend on a whole range of things.
  - e12e 6y ago
    Consider this: your former employer receive a closed envelope addressed to you, c/o workplace, from a medical clinic. Would you assume the employer could open and read this mail? I'm sure jurisdictions vary, but in Norway, excepting any written concent, your employer may not read mail addressed to you by name. Personally addressed work email likely (but not certainly) fall in a similar category.
dawnerd 6y ago
To expand, if the admin wants they can enable the vault and have access to emails, drive, etc.

Skunkleton 6y ago

> You should always assume your employer can see your enterprise correspondence. Just to expand here. You should assume that your employer has access to _everything_ that you do with their assets. If you are trying to maintain privacy from your employer for whatever reason, do not use your work phone/laptop/email/etc.

fxtentacle 6y ago
You should also assume that your employer can take those things away instantly. For example, one day your laptop forcibly restarts and afterwards you're locked out. Then a day later, you get the call that you were canned. So always keep private communication separate and get private phone numbers / email addresses from coworkers that you get along well with. The company can delete your extension and email address, but with a bit of preparation that doesn't have to be the end of your personal relationships.
SAI_Peregrinus 6y ago
With a lot of employment contracts they not only have access to everything, but also own the copyright/patents of anything made with their equipment.
everdrive 6y ago
Exactly, and even if your employer doesn't have logging software, they can get physical access to your laptop and look for logs and data manually. Importantly, you can't predict when and if this could happen.
crispyambulance 6y ago
> assume that your employer has access to _everything_ I hear this a lot and it seems like sound advice, but always leaves me with questions. Sure, my employer can see what URL's I am hitting, what applications are installed, their usage, and if they want they could even decrypt https traffic, take screenshots without my knowledge, key-log, turn on microphone and camera too. I mean, I won't hesitate to open my personal gmail, read news, make comments on social media sometimes (like this), perform online "errands". At the back of mind, however, I wonder if someone is seeing what I am doing. It makes me wonder, what is typical? Under what kinds circumstances would the most draconian measures (like screenshots) be taken? How much latitude are IT folks given? Are there ways to detect when really ugly things like keyloggers/cameras/mics being controlled by whatever "enterprise IT" software suite? It seems IT folks don't talk about this much. The dominant advice is always don't use work computer for _anything_ but work. The reality is that almost everyone in every profession takes that advice with a grain of salt.
- barkingcat 6y ago
  In this regards, I think IT isn't the driving force. The driving force is the lawyers/legal department and the HR department. You should redirect this question to each HR department: how much does HR want to protect a company from its (possibly) rogue employees?
- unicornfinder 6y ago
  I think the truth is it really depends on your employer. I worked for one place that actively monitored and even recorded people's screens fairly frequently, and others where they honestly don't care in the slightest.
  - crispyambulance 6y ago
    I see, but what did they do with that information? Did they just randomly browse employee's screens? What triggered that level of monitoring? Are there ways to detect when a screenshot is captured? It seems like a lot of effort to monitor screens, it makes me think there has to be a compelling reason, and not just browsing around looking for "problems".
acruns 6y ago
You should also assume that the email you "deleted", is still there. Most email servers/services have a setting to keep deleted emails for a period of time. Most corporations also have a separate email server for execs that have different settings. This is above and beyond compliance settings that also email retention for different periods of time. Then there are also backups and archiving...you get the idea.

devy 6y ago

> I can always reset a password and gain full and instant access. AFAIK, resetting an individual GSuite account's password is the only way GSuite Admin can access individual account's emails. Is there any other way to get access?

Tomdarkness 6y ago
I'm pretty sure you can't do it via the UI but if you use the API you can delegate access to any account in your organisation without confirmation. Once you've delegated access to that account you can then login as that user via the standard user switcher that appears if you have multiple accounts.
- rednet 6y ago
  My team has written an integration with Google's API[0] to explicitly pull back the full bodies of emails for all users across a whole organisation, to run some analysis on all emails. Once our service account has been granted access, we can assume the role of any user and access anything we have permission for. So, you should assume your IT administrator can also access all your emails, since they're likely to be the person that grants permission to the service account. [0]https://developers.google.com/gmail/api/v1/reference/users/messages https://developers.google.com/gmail/api/v1/reference/users/m...
iokanuon 6y ago
That's exactly what the article is about.
- neonate 6y ago
  In this article you will see how being a G Suite Administrator you can get a copy of your users sent and received emails without knowing their passwords or putting forwarding in their mailboxes
  - devy 6y ago
    Got it now. Getting a copy of incoming + outgoing via BCC for an individual account's emails is not quite the same as accessing individual account's emails though. For GSuite basic subscriptions, there is a 30GB quota per inbox, having BCCs for every account's emails will like exceed the plan allowance. I doubt it would work if you exceed the account quota allowed for the subscription plan.

scrollaway 6y ago

AFAIK the legality of it is not consistent. I had an employer who insisted that after I leave, every email I receive to my corporate address be forwarded to him. I remember asking a lawyer how legal this is and not receiving a conclusive answer. (Still interested in an answer for CA+NY if someone knows)

icedchai 6y ago
It's the company's email address, they can forward it whereever they want. Forwarding an employee's email to their supervisor upon departure is standard practice is many companies.
floatingatoll 6y ago
How many hours are willing to be billed for in research, and are you willing to go to court to seek a conclusive answer if none is found in research?
dekhn 6y ago
Just so I understand what you're complaining about: 1) you worked for a company 2) the company provided you with an email address via their corporate email system 3) you left the company 4) the company wants to read email sent to your work email address in their corporate email system Yes, it is totally legal for them to do that, there is no question, and it wouldn't make sense for it to be any other way.
- vidarh 6y ago
  This depends on jurisdiction, so just saying "yes" is wildly misleading. Expectations of privacy - even for corporate e-mail - is a thing some places. To what extent it applies tends to depend on a whole range of things.
- e12e 6y ago
  Consider this: your former employer receive a closed envelope addressed to you, c/o workplace, from a medical clinic. Would you assume the employer could open and read this mail? I'm sure jurisdictions vary, but in Norway, excepting any written concent, your employer may not read mail addressed to you by name. Personally addressed work email likely (but not certainly) fall in a similar category.

dawnerd 6y ago

To expand, if the admin wants they can enable the vault and have access to emails, drive, etc.