Feeds

Employee privacy versus employer policy

US court rulings cast doubt on privacy policy

High performance access to file storage

Whether you expect something to be private isn't an "all or nothing" thing. You may expect privacy for some purposes (police searches) and not for others (your boss). The lower court had concluded, "the banner relied upon by the military judge to find no privacy expectation may have limited [Long's] expectation of privacy with regard to non-law enforcement monitoring of the computer system, but that the seizure of the emails in this case was for law enforcement purposes".

That's why I am inherently suspicious of policies that state outright "you have no expectation of privacy". Of course you do. You have lots of expectations of privacy in what you do at work. For example, you don't expect that a coworker will read or examine the contents of your hard drive just cause they want to, or that you can read your bosses email. You don't leave the laptop lying around in the reception area because, after all, there is noting "private" there.

You have certain reasonable expectations with respect to your email and files on corporate or government networks. These are really not defined by policy, but rather by common sense and ordinary use. You expect that email will be read by people you send it to, and by others they send it to, by network administrators when necessary in the course of their work, and possibly by counsel or others when needed for business purposes. You also expect that it will not be read by hackers, thieves, and the merely curious. This is, after all a privacy related interest.

If nobody in the company has a privacy interest in electronic records, then how can the company resist a subpoena, search warrant, or even a warrantless search, since the courts only protect a reasonable interest in privacy? How can the company have a privacy interest and nobody in the company have one? Corporations, while a separate legal entity from its employees, can't have a privacy interest in the wake of a policy that disclaims it.

The court in Long also relied on the fact that Long had her own personal password which was not known to her supervisors, and which she was required to change to establish that she at least thought her emails were private. This is an example of bad lawyering and bad fact development by the government. The mere fact that the employee could set a password is like a 14-year-old having his or her own combination lock in the school gym with the sign next to the locker room stating that the school reserves the ability to cut off any locks. It creates some privacy rights, but not with respect to the provider of the network.

High performance access to file storage

More from The Register

next story
Dropbox defends fantastically badly timed Condoleezza Rice appointment
'Nothing is going to change with Dr. Rice's appointment,' file sharer promises
Audio fans, prepare yourself for the Second Coming ... of Blu-ray
High Fidelity Pure Audio – is this what your ears have been waiting for?
Did a date calculation bug just cost hard-up Co-op Bank £110m?
And just when Brit banking org needs £400m to stay afloat
MtGox chief Karpelès refuses to come to US for g-men's grilling
Bitcoin baron says he needs another lawyer for FinCEN chat
Zucker punched: Google gobbles Facebook-wooed Titan Aerospace
Up, up and away in my beautiful balloon flying broadband-bot
Apple DOMINATES the Valley, rakes in more profit than Google, HP, Intel, Cisco COMBINED
Cook & Co. also pay more taxes than those four worthies PLUS eBay and Oracle
It may be ILLEGAL to run Heartbleed health checks – IT lawyer
Do the right thing, earn up to 10 years in clink
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.