Australia giving snoop powers to employers

@AC

There's nothing in *my* contract about my company monitoring my email, and if I ever found out that the were doing it, I'd be out the door, and on the way to appoint a lawyer, faster than I could explain why Paris!

took them that long

You mean that until now what you did at work was still private?? everyday I log on to my PC states that im being monitored. D'OH now ive gone and done it...will be posting from home now....

No comfort

The thought that Australia is moving to align its legislation with the UK and US is somehow not as comforting as one might expect.

@Steve Sutton

Doesn't have to be in your contract, will normally be in an "acceptable use policy" which you sign upto by coming into the office and using your computer.

I'd ask your Information Security team...

Tricky one

Hmm, whilst I'd be a bit unimpressed if I found out my employer was doing anything questionable with the information they found out, I've long been of the opinion that companies provide email, and come to think of it Internet access and telephony, as a tool for COMPANY business. If I'm doing anything with those facilities that I don't want them to know about, well y'know the simple answer is to wait until I get home, surf and send emails then, and use my home phone or moby!

Of course if they started bugging the offices I guess I rightly be outraged :-S

Paris, 'cos she knows the value of personal privacy :-D

There is an assumed right to privacy in the uk

Unless you've agreed to explicit monitoring of your email your employer has no right to read an email which appears to be personal.

They do have a right to collect statistics about how many and the size of your personal emails, but reading them would probably be a breach of the DPA and/or other legislation.

Booga-booga-booga!

if the equipment, software, and/or connection used for your "personal" communication, belong to a third party you do not control, like your employer, your government (yeah, don't kid yourself), or an internet cafe in Beijing, YOU SHOULD REALISTICALLY HAVE NO EXPECTATIONS OF PRIVACY WHATSOEVER.

many of these platforms are possibly infested with one or more of the following:

[1] monitoring/compliance software

[2] RDP or similar remote admin software

[3] trojan or other spyware/malware

any of which may also be open to someone else's exploits. the transiting communication will likely pass through other devices, which are also monitored (at&t, Verizon, etc.) and/or exploitable (Cisco, Microsoft, Apple, etc.). snooping IT people are the least of your problems, and i speak as a senior "IT person". the only times i've ever viewed someone else's emails or files, was when my boss or the HR director were staring over my shoulder, pointing to what they wanted to see. not that this isn't WIDE OPEN to abuse (it most definitely is), but there are SO many other reasons you should not trust the stuff provided by others, be it a mainframe, a UNIX laptop, or a mobile phone.

legal or not, moral or not, anyone who trusts connections under someone else's control, is a fool or worse; moreover, if one wants to keep something hidden, one should never commit it (unencrypted) to ANY medium, including print, audio recording, photography or film (though steganography and one-time cyphers are still adequately secure).

old Russian saying:

don't think.

if you think, don't speak.

if you speak, do not write it down.

if you write it down, do not sign your name.

if you sign your name, do not be surprised at what happens after.

Re: No Comfort

Agreed. That's one more potential bolt hole gone. But I suppose it should have been expected, as they always have been part of ECHELON.

Paranoia?

I just assume that anything I do on my work PC will be monitored. In practice I doubt if most of it is, but given that port 25 outbound is blocked and I wouldn't send personal mail via the company server, the most I do for mail is https to my home webmail.

It's not paranoia if they really are out to get you. Mine's the coat with the bug in the pocket.

Bottom line

1) It's not YOUR hardware;

2) It's not YOUR internet connection;

3) and since you're supposed to be at work, it's not YOUR time either.

And before anyone replies: I am Australian, I work in the IT industry (both private and public) and I consider any Internet time given to me by my employers a privilege not to be abused, not a right.

You want privacy, get your own ISP and pay your own way. Otherwise, lump it - you are using someone else's property.

Next, people will be bitching about how they can't take their computer home because they're so much better than the one they own. Sheesh.

Legal since the year 2000 in the UK: see...

...The Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000

Lawful interception of a communication

3. - (1) For the purpose of section 1(5)(a) of the Act, conduct is authorised, subject to paragraphs (2) and (3) below, if it consists of interception of a communication, in the course of its transmission by means of a telecommunication system, which is effected by or with the express or implied consent of the system controller for the purpose of -

(a) monitoring or keeping a record of communications -

(i) in order to -

(aa) establish the existence of facts, or

(bb) ascertain compliance with regulatory or self-regulatory practices or procedures which are -

applicable to the system controller in the carrying on of his business or

applicable to another person in the carrying on of his business where that person is supervised by the system controller in respect of those practices or procedures, or

(cc) ascertain or demonstrate the standards which are achieved or ought to be achieved by persons using the system in the course of their duties, or

(ii) in the interests of national security, or

(iii) for the purpose of preventing or detecting crime, or

(iv) for the purpose of investigating or detecting the unauthorised use of that or any other telecommunication system, or

(v) where that is undertaken -

(aa) in order to secure, or

(bb) as an inherent part of,

the effective operation of the system (including any monitoring or keeping of a record which would be authorised by section 3(3) of the Act if the conditions in paragraphs (a) and (b) thereof were satisfied); or

(b) monitoring communications for the purpose of determining whether they are communications relevant to the system controller's business which fall within regulation 2(b)(i) above; or

(c) monitoring communications made to a confidential voice-telephony counselling or support service which is free of charge (other than the cost, if any, of making a telephone call) and operated in such a way that users may remain anonymous if they so choose.

(2) Conduct is authorised by paragraph (1) of this regulation only if -

(a) the interception in question is effected solely for the purpose of monitoring or (where appropriate) keeping a record of communications relevant to the system controller's business;

(b) the telecommunication system in question is provided for use wholly or partly in connection with that business;

(c) the system controller has made all reasonable efforts to inform every person who may use the telecommunication system in question that communications transmitted by means thereof may be intercepted; and

(d) in a case falling within -

(i) paragraph (1)(a)(ii) above, the person by or on whose behalf the interception is effected is a person specified in section 6(2)(a) to (i) of the Act;

(ii) paragraph (1)(b) above, the communication is one which is intended to be received (whether or not it has been actually received) by a person using the telecommunication system in question.

(3) Conduct falling within paragraph (1)(a)(i) above is authorised only to the extent that Article 5 of Directive 97/66/EC of the European Parliament and of the Council of 15 December 1997 concerning the processing of personal data and the protection of privacy in the telecommunications sector[2] so permits.

Pfffttttt

I am wndering what possesses the Pollie's that they think the laws they try to introduce will actually do any good in stopping the "bad" people or bad things from happening.

Gun buy-back scheme anyone. What a friggin' waste of money that was. Did the government at the time actually think those criminals with the guns would gasp with horror and tremble with fear until they handed over their ill-gotten firearms

Do they actually think that anyone would be planning any terrorist act through their work email. Come on. Anyone that would be stupid enough to be caught through these expanded laws certainly doesn't have the intelligence to be able to plan it in the first place.

</Rant>

Cyber slacking

This won't change a thing.

Encryption

Anyone not routinely encrypting all their email might as well write it all on the back of a postcard and leave it on their desk.

Unfortunately, there are a lot of fools out there. I'm still trying to convince a damn medical research client of mine that sending client personal info by unencrypted email is not only not a good idea, but potentially a fucking crime in the country he's in. Will he listen? Hell no, because his regular Microsoft sales rep assures him that Outlook is secure. I'm sorely tempted to fire that particular client. I'd probably have better luck with Paris.

dabble

I dabble at home, I have my own ISP, my own equipment, does this mean I get to read all my emails?

@Aubry Thonon

You work in the IT industry, yet you seem to have forgotten that computers are used in quite a few more situations than just the IT industry these days, and thus there are quite a few more scenarios and businesses than just the one you work in.

I too live in Australia. I too work with IT. I don't work in the IT industry. I have in the past, both here, in Holland, and the UK though and I stress that you might want to look out the window one day...There's a whole world of activity in IT these days...

Boring your employees to death can be counter-productive...

Paris wins the icon, as she's having a Blonde moment.