Feeds

Email privacy in the workplace

Situation murky

Security for virtualized datacentres

Checking my magic 8-ball again, I get the same answer. Situation murky – ask again later. You see, interception of electronic communications is much more complicated than the listening in or recording of telephone calls.

The laws typically differentiate between intercepting a communication (and recording it) and accessing it when it is stored. To intercept or record a conversation requires all party consent in those all party consent states. To access it after it has been stored typically does not (although there are still legal protections for stored communications).

The problem here is both technical and legal. When exactly is an email "intercepted?" A few years back, in United States v Councilman, a federal appeals court in Boston wrestled with whether an operator of an online bookstore and email server violated the law by reading his customers' emails without their consent (only the ones to Amazon, of course).

At issue was whether the e-mails were intercepted "in transmission" or not. The majority of the court said that interception, "includes transient electronic storage that is intrinsic to the communication process for such communications." But they didn't decide what happens, "after a message has crossed the finish line of transmission[.]" The dissent said that, "the Wiretap Act's prohibition on intercepting electronic communications does not apply when they are contained in electronic storage, whether such storage occurs pre- or post-delivery, and even if the storage lasts only a few miliseconds."

In fact, emails are actually never intercepted. All email is "store and forward". While the packets "travel" across the internet, it's not like a physical pod is traveling down a tube. The "original" packet stays on the server, allowing its doppelganger to travel to the next point of departure. Indeed, it would be impossible to "read" an email "in transmission" – you have to stop it, and then reassemble it to get it to appear on the screen.

Thus, the principal legal loophole we rely on in allowing us to read emails with only one party consent is this legal fiction that the email is already "received" and stored - whether or not the recipient has ever seen it.

In one case, a California resident named Weibin Jiang was arrested for a sexual offense and used his employer's computer to communicate with counsel, retaining these files in a subdirectory called "Attorney."

Despite the fact that the computer belonged to the company, and that Mr Jiang signed an agreement expressly indicating that he had, "no expectation of privacy in any property situated on the company's premises and/or owned by the company", the court found that the government could not simply subpoena the attorney client privileged records from the employer. So even consent may not be fully effective. It all comes down to reasonableness.

Privacy in the workplace

What about an employer's right to read emails as they come in? As they hit the inbound server? Again, my magic 8-ball tells me that the situation is murky. If the email is not subject to the consent of all parties, and one of the parties (either the sender or recipient) lives in a jurisdiction that mandates all party consent, then this could be an unlawful interception under state law (Federal law requires only one party consent). Under the new California case, it may not matter that you are in a state that permits one party consent.

The truth is, we monitor these kinds of communications all the time, and everybody kind of expects this kind of monitoring. We are now at the point where most people would agree with the statement that, "I have no expectation of privacy in the email I use at work." This statement probably applies equally to the contents of work related email as well as to any personal (web-based) mail you send using your employer's computers or networks. NO PRIVACY.

Not so fast. You see, despite this fact, if you probe further you will find that people DO have expectations of privacy in both corporate and personal emails used at work – and, lo and behold, these expectations are reasonable. Is it okay for you to read your cubicle mate's email on the screen just because you are curious? Is is okay to forward that email? Can you (or more accurately, may you) read your bosses' email? If the opposite of "private" is indeed "public", does this mean all email is "public?"

Of course not. We expect that email may be read by anyone we send it to, and anyone they may forward it to. We expect that those higher than us on the corporate pecking order (including the system administrator who is God, and his or her denizens) may also read it for legitimate business purposes, and not for idle curiosity. Access may be granted for corporate compliance purposes, regulatory purposes, law enforcement purposes, or other legitimate purposes. But that does not mean there is NO privacy – just very limited privacy.

So, can an employer in an all party consent state read inbound or outbound electronic communications without the consent of all parties? We do it all the time, so it must be okay... but then again, where is that magic 8-ball?

This article originally appeared in Security Focus.

Copyright © 2006, SecurityFocus

SecurityFocus columnist Mark D Rasch, JD, is a former head of the Justice Department's computer crime unit, and now serves as senior vice president and chief security counsel at Solutionary Inc.

Beginner's guide to SSL certificates

More from The Register

next story
Bono apologises for iTunes album dump
Megalomania, generosity and FEAR of irrelevance drove group to Apple deal
HBO shocks US pay TV world: We're down with OTT. Netflix says, 'Gee'
This affects every broadcaster, every cable guy
Facebook, Apple: LADIES! Why not FREEZE your EGGS? It's on the company!
No biological clockwatching when you work in Silicon Valley
SCREW YOU, EU: BBC rolls out Right To Remember as Google deletes links
Not even Google can withstand the power of Auntie
Arab States make play for greater government control of the internet
Nerds told to get lost in last-minute power grab bid at UN meeting
Zippy one-liners, broken promises: Doctor Who on the Orient Express
Series finally hits stride, but Clara's U-turn is baffling
Don't bother telling people if you lose their data, say Euro bods
You read that right – with the proviso that it's encrypted
America's super-secret X-37B plane returns to Earth after nearly TWO YEARS aloft
674 days in space for US Air Force's mystery orbital vehicle
10 Top Tips For PRs Considering Whether To Phone The Register
You'll Read These And LOL Even Though They're Serious
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.