5 ms·

> If it’s a company provided laptop then it’s a good idea to assume that every keystroke, DNS request, and network packet is fair game. In the USA and other co

by ls15 4y ago

> If it’s a company provided laptop then it’s a good idea to assume that every keystroke, DNS request, and network packet is fair game. In the USA and other countries with subpar privacy laws.

lazide 4y ago
Which countries don’t allow a company to monitor activity on company equipment and company networks during company time?
- MadsRC 4y ago
  IIRC Danish law states that work email may be used for private purposes and that anything clearly labeled as private is to be considered such. For example, by moving email to a folder called “private”. For the employer to open/read such communication would be highly illegal, akin to opening others private snail mail. I do believe that this also extends to corporate issued phones and computers. Especially since you’re automatically taxed for “private use” of such equipment when assigned.
  - lazide 4y ago
    That doesn’t apply at all here?
    - stareatgoats 4y ago
      > here I think you need to specify "here" to get an answer to that question.
      - lazide 4y ago
        The thread we are in about companies monitoring people accessing Glassdoor and penalizing them in various ways for using it to say things the company doesn’t consider flattering. That has nothing to do with putting private email in a private folder on the company mail server, near as I can tell, and nothing in that statement would address the statement about companies monitoring use of company equipment and network etc. Since they’d need to know even in the private email case what they folder names were, for instance, to know there even WAS private email.
  - chii 4y ago
    > Especially since you’re automatically taxed for “private use” of such equipment when assigned. so you get charged a tax when an employer gives you equipment required for work? What happens if you can't afford that tax then? This feels very wrong - taxing someone for a potential benefit when it is not proven that such benefit exists.
    - beagle3 4y ago
      In Israel, if you are assigned an employer car, you generally have to prove you don’t make personal use of it to avoid taxation - e.g. prove it isn’t in use almost every weekend (usually done by parking in a managed lot and showing the receipts or stuff like that). The vast majority of people prefer to also use the car privately, and pay the tax (which is reasonable, if taxation is reasonable). Cars that keep rotating between drivers are not subject to that (but exact record keeping of driver and trip required to avoid tax) Similarly, employer provided phone subscription is assumed to be partly private use (50% of monthly subscription cost considered a a taxable benefit iirc), not sure what hoops you need to jump through to prove it is not private use at all. (But phone plans are cheap - excellent domestic plans are $10 or so)
    - wickedsickeune 4y ago
      It's up to you if you want to use company provided equipment for personal/private use or not. If you declare that it's only used for work purposes, there is no tax. The tax makes sense, because it's effectively extra salary (eg if the company gave you a leased car).
    - geysersam 4y ago
      > so you get charged a tax when an employer gives you equipment required for work? Obviously this only happens when the equipment you get can plausibly be used for personal purposes. Such as a company car. > What happens if you can't afford that tax then? That's extremely unlikely.
- MauranKilom 4y ago
  In Germany, you need to document clear and reasonable suspicion of the employee doing something shady before you can monitor them (especially without their consent). It's not fundamentally illegal, but the rights of the employee also weigh in heavily and need to be outweighed before you can start e.g. recording their screen without their consent.
- ClumsyPilot 4y ago
  The idea that 'company time' and 'company equipment' gives the company absolute right to record and ownership of recording is almost feudal. Imagine I were to die in the office in some embarrasing way, on company time, in full view of company CCTV, do they have the right to upload the video to YouTube to make money from it? What if they record audio of me at home, can they publish it? Can they show it to anyone at the company? What if audio is recorded outside of compaby time by a company laptop thats had its lid closed? What if it's recording 24/7? Are they allowed to snoop on traffic of my home network? If I have a home camera thats not password protected, can they help themselves to that Video? If my network drive has no password, is it okay if they help themselves to those files?
  - lazide 4y ago
    You seem to be building a straw man here?
    - labawi 4y ago
      I assume he is trying to establish a dividing line between acceptable and not. For example, I'd consider all mentioned uses to be unacceptable and hopefully illegal, but I think others may be fine with it.
      - ClumsyPilot 4y ago
        I an not actually sure that they are illegal - are they? I can't think of which law stops a company sharing a video of your death - presymably they own the copyright
- wityak 4y ago
  Just about every EU-based company allows for network defense and visibility to include things like SSL inspection and egress monitoring. Some may consider this surveillance, but what needs to be stated from a governance standpoint is that this monitoring is reasonable from a risk mitigation standpoint and the expectation needs to be written within acceptable usage policy. Even more restrictive countries like Germany are fine with this.
- goodpoint 4y ago
  Most of developed countries except the US. People have legitimate expectations of privacy in the office and/or during working time. Employment means selling your skills and effort, not becoming a servant or a slave in a feudal society. Additionally, having delicate information in the hands of the company in general or sysadm/security engineers create a ton of liabilities. There has to be a balance between security needs, corporate surveillance, privacy and worker rights.
  - lazide 4y ago
    Practically, the company needs to administer and secure their equipment for a number of reasons, including a legal need to keep their customers data safe. That requires them to use tools which can easily let them know, for instance, what websites someone is visiting, and what executables are executing on the machine, what devices are being accessed and when, etc. It’s pretty fundamental. An individual looking to secure their machine would need to do the same thing. If a company abuses that to spy on every waking moment of an employee, that is obviously abusive (barring cases of investigating legitimate suspected abuse by the employee I guess?). But you’d need to somehow codify in law the line, and I haven’t see anyone having any success here so far. I have seen employees steal massive amounts of trade secrets, secretly steal customers from employers, run porn sites from company equipment, etc. I’ve also seen employees so creepy stuff like stalking customers, stalking other employees, harassing other employees using this tech too. Personally, I’ve always kept employer laptops and stuff closed and off when not used, and try to segregate personal and work equipment, but that’s been more to avoid something embarrassing coming up during a presentation or the like.
    - labawi 4y ago
      Just because it is easy and achieves a purpose doesn't make it necessary or right. People could be making backhanded deals on their phones or they could be having an urgent confidential conversation with their doctor or spouse. Should the company record and review phone calls? People could be stalking customers/coworkers or making deals in the bathroom. Or they could be using it for more personal purposes. Should the bathrooms have CCTV with audio? People could be selling company data in the company parking lot, in the mall or at home near/using the company laptop/phone that is permitted to be used for personal reasons, or just mandated to be near them, or they could do the same thing without presence or use of any company equipment. Where do you draw the line, and at what point is it even sufficient to prevent losing information etc.? Do you trust your employees? All trust can be abused, yet how can the company function if they don't trust their employees at all?
stareatgoats 4y ago
Correct me if I'm wrong but if the assumption here is that the EU prevents employers from reading private correspondence of employees then I find nothing to back that up. On the contrary, an employer in the EU explicitly seems to have such rights, given they jump through a few formal hoops first: https://www.grcworldforums.com/business/can-employers-legally-monitor-employees-emails-at-work/18.article https://www.grcworldforums.com/business/can-employers-legall...
- closewith 4y ago
  It depends on the country in question. In Ireland, for example, any workplace surveillance must be necessary, legitimate, and proportional. The employee also must be informed in advance of who, what, how, and when they may be surveilled. It is very hard to see the Workplace Relations Commission (WRC - the body which handles workplace disputes) accepting that identifying a user on Glassdoor would meet the test of being necessary, legitimate, or proportional. This is particularly true as the WRC has previously found that monitoring internet usage for example for pornography is not proportionate where the employer has the option instead to block such sites and make a policy against their access. Of course, an unscrupulous employer could also use surreptitious surveillance and find another reason to let the employee go, although firing an employee in Ireland is notoriously difficult short of gross negligence.
  - stareatgoats 4y ago
    OK thanks interesting, although I would like to add that I did not address trying to identify and punish reviewers on Glassdoor, which may or may not be illegal all over Europe depending on the nature of the review. That point I tried to make was that the GP was exaggerating when painting the US as an outlier regarding the rights of employees of not to be monitored. The US is more "employer-friendly" if you like, and much less complicated to fire employees (boo!) compared to Europe - yes. But generally not categorically different when it comes to the right of employers to snoop on their employees, which people here might want to be aware of.
    - 4y ago

by ls15 4y ago

> If it’s a company provided laptop then it’s a good idea to assume that every keystroke, DNS request, and network packet is fair game. In the USA and other countries with subpar privacy laws.

lazide 4y ago

Which countries don’t allow a company to monitor activity on company equipment and company networks during company time?

MadsRC 4y ago
IIRC Danish law states that work email may be used for private purposes and that anything clearly labeled as private is to be considered such. For example, by moving email to a folder called “private”. For the employer to open/read such communication would be highly illegal, akin to opening others private snail mail. I do believe that this also extends to corporate issued phones and computers. Especially since you’re automatically taxed for “private use” of such equipment when assigned.
- lazide 4y ago
  That doesn’t apply at all here?
  - stareatgoats 4y ago
    > here I think you need to specify "here" to get an answer to that question.
    - lazide 4y ago
      The thread we are in about companies monitoring people accessing Glassdoor and penalizing them in various ways for using it to say things the company doesn’t consider flattering. That has nothing to do with putting private email in a private folder on the company mail server, near as I can tell, and nothing in that statement would address the statement about companies monitoring use of company equipment and network etc. Since they’d need to know even in the private email case what they folder names were, for instance, to know there even WAS private email.
- chii 4y ago
  > Especially since you’re automatically taxed for “private use” of such equipment when assigned. so you get charged a tax when an employer gives you equipment required for work? What happens if you can't afford that tax then? This feels very wrong - taxing someone for a potential benefit when it is not proven that such benefit exists.
  - beagle3 4y ago
    In Israel, if you are assigned an employer car, you generally have to prove you don’t make personal use of it to avoid taxation - e.g. prove it isn’t in use almost every weekend (usually done by parking in a managed lot and showing the receipts or stuff like that). The vast majority of people prefer to also use the car privately, and pay the tax (which is reasonable, if taxation is reasonable). Cars that keep rotating between drivers are not subject to that (but exact record keeping of driver and trip required to avoid tax) Similarly, employer provided phone subscription is assumed to be partly private use (50% of monthly subscription cost considered a a taxable benefit iirc), not sure what hoops you need to jump through to prove it is not private use at all. (But phone plans are cheap - excellent domestic plans are $10 or so)
  - wickedsickeune 4y ago
    It's up to you if you want to use company provided equipment for personal/private use or not. If you declare that it's only used for work purposes, there is no tax. The tax makes sense, because it's effectively extra salary (eg if the company gave you a leased car).
  - geysersam 4y ago
    > so you get charged a tax when an employer gives you equipment required for work? Obviously this only happens when the equipment you get can plausibly be used for personal purposes. Such as a company car. > What happens if you can't afford that tax then? That's extremely unlikely.
MauranKilom 4y ago
In Germany, you need to document clear and reasonable suspicion of the employee doing something shady before you can monitor them (especially without their consent). It's not fundamentally illegal, but the rights of the employee also weigh in heavily and need to be outweighed before you can start e.g. recording their screen without their consent.
ClumsyPilot 4y ago
The idea that 'company time' and 'company equipment' gives the company absolute right to record and ownership of recording is almost feudal. Imagine I were to die in the office in some embarrasing way, on company time, in full view of company CCTV, do they have the right to upload the video to YouTube to make money from it? What if they record audio of me at home, can they publish it? Can they show it to anyone at the company? What if audio is recorded outside of compaby time by a company laptop thats had its lid closed? What if it's recording 24/7? Are they allowed to snoop on traffic of my home network? If I have a home camera thats not password protected, can they help themselves to that Video? If my network drive has no password, is it okay if they help themselves to those files?
- lazide 4y ago
  You seem to be building a straw man here?
  - labawi 4y ago
    I assume he is trying to establish a dividing line between acceptable and not. For example, I'd consider all mentioned uses to be unacceptable and hopefully illegal, but I think others may be fine with it.
    - ClumsyPilot 4y ago
      I an not actually sure that they are illegal - are they? I can't think of which law stops a company sharing a video of your death - presymably they own the copyright
wityak 4y ago
Just about every EU-based company allows for network defense and visibility to include things like SSL inspection and egress monitoring. Some may consider this surveillance, but what needs to be stated from a governance standpoint is that this monitoring is reasonable from a risk mitigation standpoint and the expectation needs to be written within acceptable usage policy. Even more restrictive countries like Germany are fine with this.
goodpoint 4y ago
Most of developed countries except the US. People have legitimate expectations of privacy in the office and/or during working time. Employment means selling your skills and effort, not becoming a servant or a slave in a feudal society. Additionally, having delicate information in the hands of the company in general or sysadm/security engineers create a ton of liabilities. There has to be a balance between security needs, corporate surveillance, privacy and worker rights.
- lazide 4y ago
  Practically, the company needs to administer and secure their equipment for a number of reasons, including a legal need to keep their customers data safe. That requires them to use tools which can easily let them know, for instance, what websites someone is visiting, and what executables are executing on the machine, what devices are being accessed and when, etc. It’s pretty fundamental. An individual looking to secure their machine would need to do the same thing. If a company abuses that to spy on every waking moment of an employee, that is obviously abusive (barring cases of investigating legitimate suspected abuse by the employee I guess?). But you’d need to somehow codify in law the line, and I haven’t see anyone having any success here so far. I have seen employees steal massive amounts of trade secrets, secretly steal customers from employers, run porn sites from company equipment, etc. I’ve also seen employees so creepy stuff like stalking customers, stalking other employees, harassing other employees using this tech too. Personally, I’ve always kept employer laptops and stuff closed and off when not used, and try to segregate personal and work equipment, but that’s been more to avoid something embarrassing coming up during a presentation or the like.
  - labawi 4y ago
    Just because it is easy and achieves a purpose doesn't make it necessary or right. People could be making backhanded deals on their phones or they could be having an urgent confidential conversation with their doctor or spouse. Should the company record and review phone calls? People could be stalking customers/coworkers or making deals in the bathroom. Or they could be using it for more personal purposes. Should the bathrooms have CCTV with audio? People could be selling company data in the company parking lot, in the mall or at home near/using the company laptop/phone that is permitted to be used for personal reasons, or just mandated to be near them, or they could do the same thing without presence or use of any company equipment. Where do you draw the line, and at what point is it even sufficient to prevent losing information etc.? Do you trust your employees? All trust can be abused, yet how can the company function if they don't trust their employees at all?

stareatgoats 4y ago

Correct me if I'm wrong but if the assumption here is that the EU prevents employers from reading private correspondence of employees then I find nothing to back that up. On the contrary, an employer in the EU explicitly seems to have such rights, given they jump through a few formal hoops first: https://www.grcworldforums.com/business/can-employers-legally-monitor-employees-emails-at-work/18.article https://www.grcworldforums.com/business/can-employers-legall...

closewith 4y ago
It depends on the country in question. In Ireland, for example, any workplace surveillance must be necessary, legitimate, and proportional. The employee also must be informed in advance of who, what, how, and when they may be surveilled. It is very hard to see the Workplace Relations Commission (WRC - the body which handles workplace disputes) accepting that identifying a user on Glassdoor would meet the test of being necessary, legitimate, or proportional. This is particularly true as the WRC has previously found that monitoring internet usage for example for pornography is not proportionate where the employer has the option instead to block such sites and make a policy against their access. Of course, an unscrupulous employer could also use surreptitious surveillance and find another reason to let the employee go, although firing an employee in Ireland is notoriously difficult short of gross negligence.
- stareatgoats 4y ago
  OK thanks interesting, although I would like to add that I did not address trying to identify and punish reviewers on Glassdoor, which may or may not be illegal all over Europe depending on the nature of the review. That point I tried to make was that the GP was exaggerating when painting the US as an outlier regarding the rights of employees of not to be monitored. The US is more "employer-friendly" if you like, and much less complicated to fire employees (boo!) compared to Europe - yes. But generally not categorically different when it comes to the right of employers to snoop on their employees, which people here might want to be aware of.
  - 4y ago