3 ms·

The rules on this vary across Europe, though broadly speaking accessing an employees mailbox is “something you only do after speaking to legal”. The patchwork

The rules on this vary across Europe, though broadly speaking accessing an employees mailbox is “something you only do after speaking to legal”. The patchwork of national laws and national interpretations of EU regulations is quite interesting, and rather confusing especially if you do offensive security work or DFIR. As an example, when doing consultancy we would do the usual phishing as part of an assessment. Usually this is followed by dumping the users mailboxes to look for further credentials/access to corporate resources (eg: are they emailing passwords around?) - but in some countries such as Germany that’s often explicitly ruled out due to fear of breaching privacy regulations.

donkeyd 3y ago
> The rules on this vary across Europe Not really, ECHR has already ruled on this. It's pretty much only allowed if there's an important reason for it. For example, to recover something invaluable (contract, code, report) that isn't available somewhere else and cannot be replaced. In that case that's also the only thing that them employer can look for. They can't open obviously unrelated e-mails. So before talking to legal, make sure you have a valid reason.
- lotsofpulp 3y ago
  What mechanism is there to prove who looked at what emails? And who would be there to enforce it, especially at a small business?
  - hef19898 3y ago
    Difficult, very difficult on deed. As with most corporate and whize collar crime, the investigation rate is extremely low. That being said, worker councils and unions. The former has to involved in these things, if the exist. The latter pushes for the former. That is valid for Germany.
  - donkeyd 3y ago
    There really is none. A smart company would work with the 4 eyes principle though (still no guarantee). However, if a company does find an unrelated e-mail they want to use against you (which is what most people fear), that makes them liable.

donkeyd 3y ago

> The rules on this vary across Europe Not really, ECHR has already ruled on this. It's pretty much only allowed if there's an important reason for it. For example, to recover something invaluable (contract, code, report) that isn't available somewhere else and cannot be replaced. In that case that's also the only thing that them employer can look for. They can't open obviously unrelated e-mails. So before talking to legal, make sure you have a valid reason.

lotsofpulp 3y ago
What mechanism is there to prove who looked at what emails? And who would be there to enforce it, especially at a small business?
- hef19898 3y ago
  Difficult, very difficult on deed. As with most corporate and whize collar crime, the investigation rate is extremely low. That being said, worker councils and unions. The former has to involved in these things, if the exist. The latter pushes for the former. That is valid for Germany.
- donkeyd 3y ago
  There really is none. A smart company would work with the 4 eyes principle though (still no guarantee). However, if a company does find an unrelated e-mail they want to use against you (which is what most people fear), that makes them liable.