3 ms·

> That sexual harassment lawsuit that just came up? You are legally required to now do data hold on all these keylogs and screenshots you took. Oh and now you h

> That sexual harassment lawsuit that just came up? You are legally required to now do data hold on all these keylogs and screenshots you took. Oh and now you have to explain to a jury how you don't fall into the common charge of "could have or should have known" that abuse was occuring. I mean, you had all these logs and you still let this go on!? I can understand lawyers making that case, but do juries actually agree with that? Lots of organizations collect internal data en-mass but they're all siloed away and disconnected - so while the company-as-a-whole has all the data, no-one inside the company could combine them together (or more likely: no-one inside the company even considered that they could combine the data together). Hypothetically, if a company was doing everything - including logging every keystroke, instant-message chat and recording every audio and video call - but just archived it without doing any information-extraction - or they tried but the signal-to-noise ratio was too low, would that convince a judge to instruct a jury to disregard that? And isn't that why investigative agencies seemingly stopped asking ISPs and legislatures to record everyone's search-engine queries and DNS lookups - simply because the amount of actionable, useful data is impossible to find until some-bad-thing already happened?

kube-system 6y ago
If I could bet large sums of money on a jury not knowing anything about how companies handle internal data, I absolutely would.
- __MatrixMan__ 6y ago
  I wouldn't take that bet. Though, I think it would be up to a prosecuting attorney to subpoena and present the right evidence. One way to protect the average employee from the overreach of bossware might be to teach prosecuting attorneys to weaponize it against its users (i.e. the bosses). But that would ultimately involve shining light on data whose exposure might harm the very employees that we're trying to protect. What an ugly lose-lose situation.
avs733 6y ago
>but do juries actually agree with that? so you are tracking all of this data to ensure your employees are productive and on task, but keeping them productive and on task doesn't include stopping them from sexually harassing my client? oh you tried to prevent sexual harassment, but it was hard because you collected to much data on your employees actions?
refurb 6y ago
would that convince a judge to instruct a jury to disregard that? I doubt a judge would make that decision unless the data was somehow "poisoned" and can't be brought to trial. Most likely the prosecution would bring it up, the defense would counter and it would be up to the jury to decide how relevant it is. Saying "we strive for a harassment-free workplace, but didn't both to check the data we've been collecting for the past 5 years" wouldn't fly very well with a jury.
- novok 6y ago
  Many collect evidence for something after the fact. "We don't look at the data unless something has come up, because it would be a privacy violation otherwise". Which is pretty much how police is supposed to work in normal life either way.
  - AstralStorm 6y ago
    That is still violating privacy laws in EU, potentially. You cannot even give a blanket agreement for "work related" because that does not hold under scrutiny due to simple employee mistakes. You would be collecting more data than agreed upon.
ponker 6y ago
Logical arguments often do not survive first contact with the jury.
curryst 6y ago
It probably depends on whether the legal requirements are relative or absolute, and I don't know which they are. If the law explicitly stated measures you must take, they're probably fine. If the requirements use some kind of relative phrasing like that they must take "reasonable measures" to prevent sexual harassment, having all of that data already available might shift some jurors perspective of what "reasonable measures" are. I wouldn't expect a judge to instruct a jury to disregard it, even in the case of signal to noise. There's nothing that makes the evidence inadmissable afaik (not a lawyer, so I could very well be wrong). It would be up to the plaintiff to demonstrate that the company failed in their obligations, and up to the company to defend that what they did was adequate. > And isn't that why investigative agencies seemingly stopped asking ISPs and legislatures to record everyone's search-engine queries and DNS lookups - simply because the amount of actionable, useful data is impossible to find until some-bad-thing already happened? The use of that data is also very different. There are a small number of crimes where a DNS lookup or search query is a crime in and of itself. Probably none, without other evidence. At best, they're circumstantial evidence. In the case of digital communications, there are a lot of civil crimes that can be contained entirely within the communications. Sexual harassment, unlawful trade practices, etc. Likewise, the NSA is probably far more interested in everyone's email and chat than they are DNS lookups and search queries.

kube-system 6y ago

If I could bet large sums of money on a jury not knowing anything about how companies handle internal data, I absolutely would.

__MatrixMan__ 6y ago
I wouldn't take that bet. Though, I think it would be up to a prosecuting attorney to subpoena and present the right evidence. One way to protect the average employee from the overreach of bossware might be to teach prosecuting attorneys to weaponize it against its users (i.e. the bosses). But that would ultimately involve shining light on data whose exposure might harm the very employees that we're trying to protect. What an ugly lose-lose situation.

avs733 6y ago

>but do juries actually agree with that? so you are tracking all of this data to ensure your employees are productive and on task, but keeping them productive and on task doesn't include stopping them from sexually harassing my client? oh you tried to prevent sexual harassment, but it was hard because you collected to much data on your employees actions?

refurb 6y ago

would that convince a judge to instruct a jury to disregard that? I doubt a judge would make that decision unless the data was somehow "poisoned" and can't be brought to trial. Most likely the prosecution would bring it up, the defense would counter and it would be up to the jury to decide how relevant it is. Saying "we strive for a harassment-free workplace, but didn't both to check the data we've been collecting for the past 5 years" wouldn't fly very well with a jury.

novok 6y ago
Many collect evidence for something after the fact. "We don't look at the data unless something has come up, because it would be a privacy violation otherwise". Which is pretty much how police is supposed to work in normal life either way.
- AstralStorm 6y ago
  That is still violating privacy laws in EU, potentially. You cannot even give a blanket agreement for "work related" because that does not hold under scrutiny due to simple employee mistakes. You would be collecting more data than agreed upon.

ponker 6y ago

Logical arguments often do not survive first contact with the jury.

curryst 6y ago

It probably depends on whether the legal requirements are relative or absolute, and I don't know which they are. If the law explicitly stated measures you must take, they're probably fine. If the requirements use some kind of relative phrasing like that they must take "reasonable measures" to prevent sexual harassment, having all of that data already available might shift some jurors perspective of what "reasonable measures" are. I wouldn't expect a judge to instruct a jury to disregard it, even in the case of signal to noise. There's nothing that makes the evidence inadmissable afaik (not a lawyer, so I could very well be wrong). It would be up to the plaintiff to demonstrate that the company failed in their obligations, and up to the company to defend that what they did was adequate. > And isn't that why investigative agencies seemingly stopped asking ISPs and legislatures to record everyone's search-engine queries and DNS lookups - simply because the amount of actionable, useful data is impossible to find until some-bad-thing already happened? The use of that data is also very different. There are a small number of crimes where a DNS lookup or search query is a crime in and of itself. Probably none, without other evidence. At best, they're circumstantial evidence. In the case of digital communications, there are a lot of civil crimes that can be contained entirely within the communications. Sexual harassment, unlawful trade practices, etc. Likewise, the NSA is probably far more interested in everyone's email and chat than they are DNS lookups and search queries.