10 ms·

I remember when I first started working and was surprised to learn that email admins could and would read email. When I asked HR for their policy on this they s

I remember when I first started working and was surprised to learn that email admins could and would read email. When I asked HR for their policy on this they said they had none and the company can do anything they want with employee activity. This was the 90s and was true then as it is now. Same for the MITM ssl proxy stuff. This has always been legal and recorded, Microsoft just makes it easier. And I think maybe even better since at least the information is audited and not available to any random sysadmin. This just makes me choose my employers more carefully as while they certainly have this data to abuse, fortunately few do not. The risk of a micromanager misusing the information mentioned in this article isn’t one of privacy, but one of being a crappy manager. If someone ever remarked on the amount of screen sharing I did or did not use as if that metric mattered, it would just help me not work for them. If someone is forced to work for someone, it’s extremely easy to game this metric and maintain privacy. I learned decades ago to assume everything on company property is recorded and stored for ever. That’s why I have personal property that the company isn’t able to access so I can conduct personal activities with some level of privacy.

grecy 6y ago
> Same for the MITM ssl proxy stuff. If I logon to my personal banking website while at work, and my employer MITM's that connection to snoop, have they genuinely not broken any law?
- prepend 6y ago
  Sadly, not in the states I’ve worked. There’s a login banner on work machines letting them see everything. Fortunately, my org doesn’t actually mitm bank sites. I tried looking for cases where this was tried and haven’t found any. I would like to see this prosecuted as it seems wrong.
- fnord123 6y ago
  It depends on which country you're in.
- marcinzm 6y ago
  I'm sure somewhere in the many legal documents you signed to start the job (given to you after you've already resigned from your previous job, of course) you give them the right to do so.
  - mikro2nd 6y ago
    The law is the law: You cannot contract with another party to "allow" either one of you to break the law.
- SkyPuncher 6y ago
  If you're doing it on a company machine, haven't you implicitly given you permission to see that data? You don't have privacy on company equipment.
  - PeterisP 6y ago
    "You don't have privacy on company equipment." is true (AFAIK) in USA, but false in a number of other countries e.g. Germany; so this depends on where you live/work. In general, in Europe you can't contract away most of your privacy rights, so it's not even worth looking at your job contract because you signing "I allow the company to do X" does not necessarily mean that the company is allowed to do X.
- amlozano 6y ago
  I've often wondered the same thing, but about personal health information and educational information (HIPPA, FERPA). If you intercept that data and store it, transmit it or even just allow real time access to it are you suddenly on the hook for all that those laws require?
- adolph 6y ago
  I confirmed that at a company town hall once and I asked if that makes that system a hack target. The CISO didn’t seem to understand the vulnerability, as if it were inconceivable that their infrastructure would be targeted to take advantage of their position as mitm.
- 2rsf 6y ago
  Obviously it depends on what country you are in, but in a few examples I know of it is perfectly legal for them to do that. You don't want to be tracked ? use you own device and network.
leipert 6y ago
> That’s why I have personal property that the company isn’t able to access so I can conduct personal activities with some level of privacy. The problem right now is: due to Work from home, you basically have blurred the lines between the digital company and private assets. Either you have a company device; or even a personal device running this software in your private networks doing and telemetering you don’t know what. This especially bad for the folks who aren’t able to properly put those devices in a separate subnet and protect themselves.
- prepend 6y ago
  Or you have both. For example, I have work equipment and personal equipment on my same home desk. My home network blocks a lot of traffic, but I’d be really surprised if my personal device provided any telemetry to work.
- ThrowawayR2 6y ago
  > "due to Work from home, you basically have blurred the lines between the digital company and private assets" I have a separate work computer and home computer on my desk; the work computer is on a guest wi-fi network and cannot see local traffic. A decent wi-fi router with guest network capabilities is a trivial expense these days.
- p1necone 6y ago
  We just RDP into our in-office machines when we work from home.
  - skeeter2020 6y ago
    From your personal machine? Do you ever check your email via a web interface on your own box? write a quick textfile or document? Log into a web app? It's really easy to let your work bleed into your personal machine...
    - p1necone 6y ago
      Sure, but the threat level of occasionally writing some notes on a personal box is nowhere near what it would be if I was writing code or connecting to production environments from it.
weare138 6y ago
>it’s extremely easy to game this metric. This reminds me how companies used to rate the performance of programmers based on how many lines of code they produced and why so many companies eventually abandoned this model. All it did was incentivize programmers to quickly hammer out superfluous, inefficient, bug ridden code that would just bite them in the ass later rather than concentrating on writing quality code. I think that's all that would end up happening with MS Teams tracking. Once employees figure out the game, they're just going to spend as much time as they can chatting, posting messages and scheduling pointless meetings rather than doing actual work.
syspec 6y ago
> This just makes me choose my employers more carefully as while they certainly have this data to abuse, fortunately few do not. I think the issue with this approach, which is one that I completely agree with, applaud, and also adhere to is that many people are not as fortunate to be in such a position to turn down employment opportunities. Those are the people who need protection from "features" such as these, because those are the people who's employers WILL take advantage of them using features. Here's an example: "'I monitor my staff with software that takes screenshots'" https://www.bbc.com/news/business-54289152 https://www.bbc.com/news/business-54289152
- 2rsf 6y ago
  AFAIK legislators in most countries do not agree that this protection is needed. Employers are not allowed to track you in your private time, in the toilets or putting a camera under you chair, but it is perfectly fine to track your usage of the company's resources and adherence to regulations. We software engineers are a spoiled kind of employee, but in most traditional work places your time and actions are tracked
jacquesm 6y ago
Admins that read their users email without express instruction from management to dig up and review a particular email should be fired.

grecy 6y ago

> Same for the MITM ssl proxy stuff. If I logon to my personal banking website while at work, and my employer MITM's that connection to snoop, have they genuinely not broken any law?

prepend 6y ago
Sadly, not in the states I’ve worked. There’s a login banner on work machines letting them see everything. Fortunately, my org doesn’t actually mitm bank sites. I tried looking for cases where this was tried and haven’t found any. I would like to see this prosecuted as it seems wrong.
fnord123 6y ago
It depends on which country you're in.
marcinzm 6y ago
I'm sure somewhere in the many legal documents you signed to start the job (given to you after you've already resigned from your previous job, of course) you give them the right to do so.
- mikro2nd 6y ago
  The law is the law: You cannot contract with another party to "allow" either one of you to break the law.
SkyPuncher 6y ago
If you're doing it on a company machine, haven't you implicitly given you permission to see that data? You don't have privacy on company equipment.
- PeterisP 6y ago
  "You don't have privacy on company equipment." is true (AFAIK) in USA, but false in a number of other countries e.g. Germany; so this depends on where you live/work. In general, in Europe you can't contract away most of your privacy rights, so it's not even worth looking at your job contract because you signing "I allow the company to do X" does not necessarily mean that the company is allowed to do X.
amlozano 6y ago
I've often wondered the same thing, but about personal health information and educational information (HIPPA, FERPA). If you intercept that data and store it, transmit it or even just allow real time access to it are you suddenly on the hook for all that those laws require?
adolph 6y ago
I confirmed that at a company town hall once and I asked if that makes that system a hack target. The CISO didn’t seem to understand the vulnerability, as if it were inconceivable that their infrastructure would be targeted to take advantage of their position as mitm.
2rsf 6y ago
Obviously it depends on what country you are in, but in a few examples I know of it is perfectly legal for them to do that. You don't want to be tracked ? use you own device and network.

leipert 6y ago

> That’s why I have personal property that the company isn’t able to access so I can conduct personal activities with some level of privacy. The problem right now is: due to Work from home, you basically have blurred the lines between the digital company and private assets. Either you have a company device; or even a personal device running this software in your private networks doing and telemetering you don’t know what. This especially bad for the folks who aren’t able to properly put those devices in a separate subnet and protect themselves.

prepend 6y ago
Or you have both. For example, I have work equipment and personal equipment on my same home desk. My home network blocks a lot of traffic, but I’d be really surprised if my personal device provided any telemetry to work.
ThrowawayR2 6y ago
> "due to Work from home, you basically have blurred the lines between the digital company and private assets" I have a separate work computer and home computer on my desk; the work computer is on a guest wi-fi network and cannot see local traffic. A decent wi-fi router with guest network capabilities is a trivial expense these days.
p1necone 6y ago
We just RDP into our in-office machines when we work from home.
- skeeter2020 6y ago
  From your personal machine? Do you ever check your email via a web interface on your own box? write a quick textfile or document? Log into a web app? It's really easy to let your work bleed into your personal machine...
  - p1necone 6y ago
    Sure, but the threat level of occasionally writing some notes on a personal box is nowhere near what it would be if I was writing code or connecting to production environments from it.

weare138 6y ago

>it’s extremely easy to game this metric. This reminds me how companies used to rate the performance of programmers based on how many lines of code they produced and why so many companies eventually abandoned this model. All it did was incentivize programmers to quickly hammer out superfluous, inefficient, bug ridden code that would just bite them in the ass later rather than concentrating on writing quality code. I think that's all that would end up happening with MS Teams tracking. Once employees figure out the game, they're just going to spend as much time as they can chatting, posting messages and scheduling pointless meetings rather than doing actual work.

syspec 6y ago

> This just makes me choose my employers more carefully as while they certainly have this data to abuse, fortunately few do not. I think the issue with this approach, which is one that I completely agree with, applaud, and also adhere to is that many people are not as fortunate to be in such a position to turn down employment opportunities. Those are the people who need protection from "features" such as these, because those are the people who's employers WILL take advantage of them using features. Here's an example: "'I monitor my staff with software that takes screenshots'" https://www.bbc.com/news/business-54289152 https://www.bbc.com/news/business-54289152

2rsf 6y ago
AFAIK legislators in most countries do not agree that this protection is needed. Employers are not allowed to track you in your private time, in the toilets or putting a camera under you chair, but it is perfectly fine to track your usage of the company's resources and adherence to regulations. We software engineers are a spoiled kind of employee, but in most traditional work places your time and actions are tracked

jacquesm 6y ago

Admins that read their users email without express instruction from management to dig up and review a particular email should be fired.