4 ms·

In more sane countries, they expect to have privacy because there are reasonable worker protection laws. Something of this sort would be illegal in most wester

by wheels 17y ago

In more sane countries, they expect to have privacy because there are reasonable worker protection laws. Something of this sort would be illegal in most western countries. As an American that's been in Germany for the last 8 years, it often blows my mind what's actually taken for granted as being acceptable in the US. Searching through employees' mail is illegal here (as would be searching an employee's personal belongings, drug tests, the whole shebang).

tptacek 17y ago
How is it "sane" for companies not to be able to control and monitor their own Internet connections? People clearly do abuse those connections to violate IP, confidentiality, and insider trading agreements.
- wheels 17y ago
  People also use their home internet connections to violate IP, confidentiality and insider trading agreements. Using the purported Apple-logic from this post, Apple is (indirectly) paying for that too, so shouldn't they be able to monitor those connections as well? A utility argument here, I don't believe is the way to approach this. There are all sort of "useful" things that companies could do that most folks would agree cross the line into invasion of privacy, in the US or elsewhere. I think there are two important assumptions I'm working with: - People have a right to privacy in personal affairs - The work place being only for work is an idealization that in practice does not exist My argument won't make sense if you don't agree on those two. Employment is one of the fundamental elements of the social fabric, and the rights of employers and employees are participant to a more general social contract. There exists a line at which a company must sacrifice some utility to uphold its end of that contract (e.g. they can't make people work 12 hour shifts, 7 days a week, even if they think it'd boost output), and as employers have an imbalance of power in negotiating employment terms, the government, in the interest of the people, lays down some guidelines for what the minimum boundaries are. Every developed country has this. The only variant is the extent of those stipulations, not their existence. I believe the right to privacy is important enough that it's something that an employee should not be obliged to forfeit it in an employment contract. And since it's clear that personal and professional spheres overlap in the workplace, no, I don't think the company should have unrestricted access to an employee's data or actions in the workplace or through work-provided mediums. I don't think there should be microphones in every room; I don't believe that all thoughts discussed in the coffee corner are thusly entitled to the company. Even if they did buy the coffee and the chairs and are paying you at that time. And for me, and the legislators of many (most?) western countries, that clearly extends to internet access and company cell phones.
  - tptacek 17y ago
    Scott, employees generally are only able to use their home Internet connections to violate confidentiality because their work computers and connections are poorly policed. And, it is as a direct result of rampant abuse of company resources that companies are now deploying draconian security controls on worker machines, locking down USB connections and intercepting and parsing Word documents in the OS kernel. I've been involved in several deployments of these products (not a fan), and I can tell you that it's not an abstract concern that is driving their adoption. Bad stuff is routinely happening on company networks, and companies need to be able to protect themselves. People have a right to privacy in personal affairs, but people need to make arrangements for their privacy when they're at the workplace. The idea that a Dell desktop that a Fortune 500 company provides you with becomes a bastion of personal privacy just because you decide to use it to check your GMail is untenable. Companies need workers to be able to handle sensitive information, and they need workers to be able to use computers and networks to do their job, and they cannot be expected to grin and bear it as their confidential information walks out the door and onto Yahoo Finance message boards. Germany has powerful computer privacy laws. It is also not a great epicenter of tech entrepreneurship.
    - wheels 17y ago
      I'm not arguing that these things aren't useful or driven by real problem; I'm arguing that they're wrong. As are the actions of employees in harming the companies they work for. But the American stubbornness in me goes back to the same logic of the Fourth Amendment, that despite the no doubt usefulness from a policing perspective of being able to search people without jumping through a lot of hoops, it is still wrong. The issue of Germany and entrepreneurship is a whole different rant, and there are legal barriers here which I believe stifle entrepreneurship. (The essence of the real rant though is that it's a deeper cultural issue.) But Germany sans privacy laws wouldn't suddenly be an entrepreneurial hotbed. If we're talking easing incorporation, sure. Making it easier to hire and fire people? Once again, I'd be on board. But I don't think privacy is a significant component of the equation.
      - tptacek 17y ago
- jrockway 17y ago
  The people doing that just turn on encryption. The people that get in trouble for using encryption just encode the cyphertext as codewords in their email. Monitoring communication is mathematically impossible these days. The deep problem is that employees have a lot less to lose than employers. If you leak a picture of the next iPhone to your competitor, you lose, at most, everything you own. For most people, that's a few thousand dollars. The employer, on the other hand, can lose the entire market for their products.
  - tptacek 17y ago
    Technical countermeasures increase the cost of violating contracts. In the real world, DLP systems routinely catch violations, despite the fact that they are all (currently) trivially bypassable. Your logic says, "wiretaps are meaningless, because monitoring voice is mathematically impossible". Leaving aside the fact that many things that are mathematically possible (such as undetectably encoding high-entropy data as a greater volume of low-entropy data) are practically infeasible, what's your point? Wiretaps, for instance, are clearly incredibly valuable.
    - jrockway 17y ago
      For now. This sort of thing just encourages active development and deployment of countermeasures. "The more you tighten your grip, Tarkin, the more star systems will slip through your fingers."
      - tptacek 17y ago
        I think you think you understand my point, but you really don't. In a frictionless intellectual vacuum, it is true that you can create undetectable covert channels. Covert channels are a fundamental problem in systems security, and that's been well-known since Salzer-Schroeder. In the real world, the arms race of encoding and detecting extends to the horizon of our understanding of computer science and, most importantly, software engineering. Nobody knows all the mistakes that humans will make attempting to engineer systems to do perfect cover channels. For the forseeable future, both sides of this problem need to come to grips with the fact that they're armed imperfectly. However, in the data leak scenario, the incentives are lined up to favor the monitors and not the leakers. The monitors have budget, continuous practice, access to all company communications to derive norms, and roughly the same access to equipment as the leakers. Meanwhile, if the leakers are caught just once, they're liable for extreme civil and (in some cases) criminal penalties.
- JabavuAdams 17y ago
  I think you've over-simplified the situation to the point that it's a straw-man. Different societies have different social contracts. There's what is legal, and what is polite / socially acceptable. In many Western countries, this kind of behaviour at a non-military company would be in shocking bad taste. It kind of depends on whether your society thinks people > companies, or companies > people.
  - tptacek 17y ago
    Well, I don't believe companies are more important than people, and I do think companies should be able to monitor their own computers, and yet somehow I continue to exist.
houseabsolute 17y ago
A possible answer to the question: "Why wasn't Apple founded in Germany?"
- alex_c 17y ago
  How so?
  - houseabsolute 17y ago
    The rough idea is that countries that hobble companies' ability to compete will have more trouble generating competitive companies. Obviously this can be taken to extremes (allowing companies to buy children as slaves, for example), but if you err too much on the side of protecting the laborer then you can run into other kinds of consequences.
    - tayssir 17y ago
      There's many ways that governments protect their local industries. For instance, the US saved its semiconductor industry (Intel, etc) from doom at the hands of the Japanese, by aggressive tariffs and other trade policies. (Intel cofounder Andy Grove mentioned this in the context of worker's rights. [1]) And that's not mentioning all the subsidies that went into building the US high-tech industry [2], as well as US industry in general [3]. That said, I certainly don't think Apple developers are badly off compared to Apple janitors, or Bay Area fastfood workers. And it's not like countries like Japan and Germany are slouches. And it's possible that the article on Apple under discussion is false, as some commenters claim. [1] http://www.forbes.com/2003/10/10/1010grovepinnacor.html http://www.forbes.com/2003/10/10/1010grovepinnacor.html [2] http://books.google.com/books?id=Y75K660UfzsC&pg=PA293&lpg=PA293 http://books.google.com/books?id=Y75K660UfzsC&pg=PA293&#... [3] http://www.newamerica.net/events/2008/why_world_isnt_flat http://www.newamerica.net/events/2008/why_world_isnt_flat
    - wheels 17y ago
      The implicit suggestion that this is because of privacy laws is silliness. There are plenty of industries in which Germany is ascendent (automotive, biotech, chemicals) which have no more lax information security requirements than computing. I mean, wouldn't you call bullshit if I said, "Maybe if the US had stronger privacy laws Europe wouldn't be dominant in the chemicals industry..."

by wheels 17y ago

tptacek 17y ago

How is it "sane" for companies not to be able to control and monitor their own Internet connections? People clearly do abuse those connections to violate IP, confidentiality, and insider trading agreements.

wheels 17y ago
People also use their home internet connections to violate IP, confidentiality and insider trading agreements. Using the purported Apple-logic from this post, Apple is (indirectly) paying for that too, so shouldn't they be able to monitor those connections as well? A utility argument here, I don't believe is the way to approach this. There are all sort of "useful" things that companies could do that most folks would agree cross the line into invasion of privacy, in the US or elsewhere. I think there are two important assumptions I'm working with: - People have a right to privacy in personal affairs - The work place being only for work is an idealization that in practice does not exist My argument won't make sense if you don't agree on those two. Employment is one of the fundamental elements of the social fabric, and the rights of employers and employees are participant to a more general social contract. There exists a line at which a company must sacrifice some utility to uphold its end of that contract (e.g. they can't make people work 12 hour shifts, 7 days a week, even if they think it'd boost output), and as employers have an imbalance of power in negotiating employment terms, the government, in the interest of the people, lays down some guidelines for what the minimum boundaries are. Every developed country has this. The only variant is the extent of those stipulations, not their existence. I believe the right to privacy is important enough that it's something that an employee should not be obliged to forfeit it in an employment contract. And since it's clear that personal and professional spheres overlap in the workplace, no, I don't think the company should have unrestricted access to an employee's data or actions in the workplace or through work-provided mediums. I don't think there should be microphones in every room; I don't believe that all thoughts discussed in the coffee corner are thusly entitled to the company. Even if they did buy the coffee and the chairs and are paying you at that time. And for me, and the legislators of many (most?) western countries, that clearly extends to internet access and company cell phones.
- tptacek 17y ago
  Scott, employees generally are only able to use their home Internet connections to violate confidentiality because their work computers and connections are poorly policed. And, it is as a direct result of rampant abuse of company resources that companies are now deploying draconian security controls on worker machines, locking down USB connections and intercepting and parsing Word documents in the OS kernel. I've been involved in several deployments of these products (not a fan), and I can tell you that it's not an abstract concern that is driving their adoption. Bad stuff is routinely happening on company networks, and companies need to be able to protect themselves. People have a right to privacy in personal affairs, but people need to make arrangements for their privacy when they're at the workplace. The idea that a Dell desktop that a Fortune 500 company provides you with becomes a bastion of personal privacy just because you decide to use it to check your GMail is untenable. Companies need workers to be able to handle sensitive information, and they need workers to be able to use computers and networks to do their job, and they cannot be expected to grin and bear it as their confidential information walks out the door and onto Yahoo Finance message boards. Germany has powerful computer privacy laws. It is also not a great epicenter of tech entrepreneurship.
  - wheels 17y ago
    I'm not arguing that these things aren't useful or driven by real problem; I'm arguing that they're wrong. As are the actions of employees in harming the companies they work for. But the American stubbornness in me goes back to the same logic of the Fourth Amendment, that despite the no doubt usefulness from a policing perspective of being able to search people without jumping through a lot of hoops, it is still wrong. The issue of Germany and entrepreneurship is a whole different rant, and there are legal barriers here which I believe stifle entrepreneurship. (The essence of the real rant though is that it's a deeper cultural issue.) But Germany sans privacy laws wouldn't suddenly be an entrepreneurial hotbed. If we're talking easing incorporation, sure. Making it easier to hire and fire people? Once again, I'd be on board. But I don't think privacy is a significant component of the equation.
    - tptacek 17y ago
jrockway 17y ago
The people doing that just turn on encryption. The people that get in trouble for using encryption just encode the cyphertext as codewords in their email. Monitoring communication is mathematically impossible these days. The deep problem is that employees have a lot less to lose than employers. If you leak a picture of the next iPhone to your competitor, you lose, at most, everything you own. For most people, that's a few thousand dollars. The employer, on the other hand, can lose the entire market for their products.
- tptacek 17y ago
  Technical countermeasures increase the cost of violating contracts. In the real world, DLP systems routinely catch violations, despite the fact that they are all (currently) trivially bypassable. Your logic says, "wiretaps are meaningless, because monitoring voice is mathematically impossible". Leaving aside the fact that many things that are mathematically possible (such as undetectably encoding high-entropy data as a greater volume of low-entropy data) are practically infeasible, what's your point? Wiretaps, for instance, are clearly incredibly valuable.
  - jrockway 17y ago
    For now. This sort of thing just encourages active development and deployment of countermeasures. "The more you tighten your grip, Tarkin, the more star systems will slip through your fingers."
    - tptacek 17y ago
      I think you think you understand my point, but you really don't. In a frictionless intellectual vacuum, it is true that you can create undetectable covert channels. Covert channels are a fundamental problem in systems security, and that's been well-known since Salzer-Schroeder. In the real world, the arms race of encoding and detecting extends to the horizon of our understanding of computer science and, most importantly, software engineering. Nobody knows all the mistakes that humans will make attempting to engineer systems to do perfect cover channels. For the forseeable future, both sides of this problem need to come to grips with the fact that they're armed imperfectly. However, in the data leak scenario, the incentives are lined up to favor the monitors and not the leakers. The monitors have budget, continuous practice, access to all company communications to derive norms, and roughly the same access to equipment as the leakers. Meanwhile, if the leakers are caught just once, they're liable for extreme civil and (in some cases) criminal penalties.
JabavuAdams 17y ago
I think you've over-simplified the situation to the point that it's a straw-man. Different societies have different social contracts. There's what is legal, and what is polite / socially acceptable. In many Western countries, this kind of behaviour at a non-military company would be in shocking bad taste. It kind of depends on whether your society thinks people > companies, or companies > people.
- tptacek 17y ago
  Well, I don't believe companies are more important than people, and I do think companies should be able to monitor their own computers, and yet somehow I continue to exist.

houseabsolute 17y ago

A possible answer to the question: "Why wasn't Apple founded in Germany?"

alex_c 17y ago
How so?
- houseabsolute 17y ago
  The rough idea is that countries that hobble companies' ability to compete will have more trouble generating competitive companies. Obviously this can be taken to extremes (allowing companies to buy children as slaves, for example), but if you err too much on the side of protecting the laborer then you can run into other kinds of consequences.
  - tayssir 17y ago
    There's many ways that governments protect their local industries. For instance, the US saved its semiconductor industry (Intel, etc) from doom at the hands of the Japanese, by aggressive tariffs and other trade policies. (Intel cofounder Andy Grove mentioned this in the context of worker's rights. [1]) And that's not mentioning all the subsidies that went into building the US high-tech industry [2], as well as US industry in general [3]. That said, I certainly don't think Apple developers are badly off compared to Apple janitors, or Bay Area fastfood workers. And it's not like countries like Japan and Germany are slouches. And it's possible that the article on Apple under discussion is false, as some commenters claim. [1] http://www.forbes.com/2003/10/10/1010grovepinnacor.html http://www.forbes.com/2003/10/10/1010grovepinnacor.html [2] http://books.google.com/books?id=Y75K660UfzsC&pg=PA293&lpg=PA293 http://books.google.com/books?id=Y75K660UfzsC&pg=PA293&#... [3] http://www.newamerica.net/events/2008/why_world_isnt_flat http://www.newamerica.net/events/2008/why_world_isnt_flat
  - wheels 17y ago
    The implicit suggestion that this is because of privacy laws is silliness. There are plenty of industries in which Germany is ascendent (automotive, biotech, chemicals) which have no more lax information security requirements than computing. I mean, wouldn't you call bullshit if I said, "Maybe if the US had stronger privacy laws Europe wouldn't be dominant in the chemicals industry..."