Original URL: http://www.theregister.co.uk/2006/11/03/workplace_digital_privacy/

Employee privacy versus employer policy

US court rulings cast doubt on privacy policy

By Mark Rasch

Posted in Business, 3rd November 2006 11:17 GMT

Your organisation has a computer and internet use policy. Fine. It's been reviewed by corporate counsel, approved by senior management, and implemented over the years. The policy is comprehensive - it includes policies on expectations of privacy, employee monitoring, and the ownership of corporate electronic assets.

Now, during the course of an internal investigation, you want to read an employee's email, examine the contents of his company-supplied computer, and review his telephone calls made on the company-owned cell phone. You are all set, right? Umm...not so fast.

A pair of recent cases in the United States raise the fundamental question, "do you have a reasonable expectation of privacy at the workplace?" In the United States at least, most people confronted with this question would answer a resounding no, right? I mean, the company policy makes it clear that the computer and network are company property, and that we shouldn't expect any privacy there.

However, there is a genuine divergence between what companies say and what they do. There is also a divergence between what employees regurgitate about their expectations of privacy (corporate mantra) and how they actually act. My own answer to the question, "do I have a reasonable expectation of privacy in the workplace?" – of course! What we really need to do is better define the scope of that reasonable expectation of privacy.

Policy policy policy

In the course of an average day at work, an employee leaves a great deal of "digital detritus" – a trail of activities. The ownership of these digital records, as well as an employee's privacy rights with respect to them is not entirely clear under the law. Employers provide employees with a number of tools that leave a digital trail. This may include their computers, email accounts, internet access, VPN access, regular phone, VOIP service, cellphone, alphanumeric pager, RSA SecurID token, not to mention the video surveillance, and records of badge entry and exit.

Complicating these issues are the questions of ownership, access and rights. For example, an employer may purchase a cell phone for an employee and retain ownership of the phone. Or it may allow the employee to buy the phone, but register it on a corporate plan for service. It may reimburse the employee for all telephone calls made or require the employee to demonstrate the business nature of calls reimbursed. Employees may telecommute from home using either employer or employee supplied equipment. The internet connection to the office may be paid for by the employee or the employer. When logging on remotely, does the ISP have any right to monitor content? When a VPN connection is made, who may monitor what happens on the VPN? May your employer burst into your home, seize your personal computer (that you own, but store some of their files on) and take it?

Privacy in the workplace extends beyond the electronic workplace. For example, can your employer read your personal mail, sent to your office address – even if it is marked "personal and confidential – addressee only?" Can your employer videotape you in the office? Audiotape you? What about in the restrooms, lounges, parking lots, or in your car?

It's easy to say that employees have no expectation of privacy, and even to post corporate policies and notices to that effect. But do you really mean it? And do you really enforce it? The answer to both questions is probably no.

The electronic workplace is no longer just the cubicle, desk or office. It now encompasses the coffee shop, the hotel room, the back of the taxi, the living room or bedroom. In the workplace, it also includes the water cooler, the restroom, the changing room, and other places. It's not just memos written and documents produced. It is newspaper articles read, sports scores checked, friends chatted with, lovers associated with. People increasingly are living their personal lives – including their most intimate personal lives – online, and online from within the office.

Employees traveling may use the office laptop to have a videoconference with his family, catch up with colleagues, plan a high school reunion, or even complain about problems at work with coworkers. Even unionising and organising activities may be conducted either on work property, work time, or using work supplied or reimbursed technology. The workplace itself may extend to wherever the employee can be reached by a cell phone, satellite phone, or BlackBerry. If an employee submits a hotel bill for reimbursement (including telephone and movies) that gives the employer the right to know what movies the employee is watching. Does it also give the employer the right to know the contents of the telephone call? Sure, they can decide if the call is work-related or personal, but can they arrange with the hotel to wiretap you?

In effect, we have two dichotomies in the privacy/employment context. First, the disconnect between what we say our policy is, and what we actually do. Second, the equally vast disconnect between what employees say is their expectation of privacy, and how they act. While empirically we may know that the employer could monitor us, we would likely be offended if our cubicle were wired, our keystrokes logged and captured, and our cell-phone conversations recorded.

Military intelligence

Lance Corporal Jennifer Long was issued a government computer to use on a government military network. When she was suspected of violations of the military drug use policies (and of criminal laws related to drug use), Marine Corps criminal investigators reviewed the contents of email messages she sent to another military employee who was likewise using a government issued computer over the same government network. The messages were retrieved from the government mail server and later used against Long. On 27 September, 2006, the United States Court of Appeals for the Armed forces had to decide whether Long had any expectation of privacy in these emails.

The starting point for any analysis is, of course, the DoD policy expressed on its warning banner, which stated quite explicitly:

This is a Department of Defense computer system. This computer system, including all related equipment, networks and network devices (specifically including Internet access), are provided only for authorized US Government use. DoD computer systems may be monitored for all lawful purposes, including to ensure that their use is authorised, for management of the system, to facilitate protection against unauthorised access, and to verify security procedures, survivability and operational security.

Monitoring includes active attacks by authorised DoD entities to test or verify the security of this system. During monitoring, information may be examined, recorded, copied and used for authorised purposes. All information, including personal information, placed on or sent over this system may be monitored. Use of this DoD computer system, authorised or unauthorised, constitutes consent to monitoring of this system. Unauthorised use may subject you to criminal prosecution. Evidence of unauthorised use collected during monitoring may be used for administrative, criminal, or other adverse action. Use of this system constitutes consent to monitoring for these purposes.

Seems pretty clear. No expectation of privacy. Government monitoring for any purpose. Government recording for any purpose. Government use of the recorded or intercepted communications for any purpose. Use of the system (even hacking into it) is consent to monitoring.

However, the military court, not usually known for taking a strong privacy stance against the military, found that Long did, in fact have some privacy interests in the contents of her communications. It noted that while the government said it could monitor, it rarely did. It also noted that the case was initiated when the Marine Corps Criminal Investigative Division (CID) – essentially a law enforcement agency, simply decided to inspect the servers to look for evidence of criminal activity.

As the US Supreme Court noted: "[W]hile police, and even administrative enforcement personnel, conduct searches for the primary purpose of obtaining evidence for use in criminal or other enforcement proceedings, employers most frequently need to enter the offices and desks of their employees for legitimate work-related reasons wholly unrelated to illegal conduct."

Whether you expect something to be private isn't an "all or nothing" thing. You may expect privacy for some purposes (police searches) and not for others (your boss). The lower court had concluded, "the banner relied upon by the military judge to find no privacy expectation may have limited [Long's] expectation of privacy with regard to non-law enforcement monitoring of the computer system, but that the seizure of the emails in this case was for law enforcement purposes".

That's why I am inherently suspicious of policies that state outright "you have no expectation of privacy". Of course you do. You have lots of expectations of privacy in what you do at work. For example, you don't expect that a coworker will read or examine the contents of your hard drive just cause they want to, or that you can read your bosses email. You don't leave the laptop lying around in the reception area because, after all, there is noting "private" there.

You have certain reasonable expectations with respect to your email and files on corporate or government networks. These are really not defined by policy, but rather by common sense and ordinary use. You expect that email will be read by people you send it to, and by others they send it to, by network administrators when necessary in the course of their work, and possibly by counsel or others when needed for business purposes. You also expect that it will not be read by hackers, thieves, and the merely curious. This is, after all a privacy related interest.

If nobody in the company has a privacy interest in electronic records, then how can the company resist a subpoena, search warrant, or even a warrantless search, since the courts only protect a reasonable interest in privacy? How can the company have a privacy interest and nobody in the company have one? Corporations, while a separate legal entity from its employees, can't have a privacy interest in the wake of a policy that disclaims it.

The court in Long also relied on the fact that Long had her own personal password which was not known to her supervisors, and which she was required to change to establish that she at least thought her emails were private. This is an example of bad lawyering and bad fact development by the government. The mere fact that the employee could set a password is like a 14-year-old having his or her own combination lock in the school gym with the sign next to the locker room stating that the school reserves the ability to cut off any locks. It creates some privacy rights, but not with respect to the provider of the network.

A similar result happened in late August 2006 in a federal court in California. A SWAT officer named Jeff Quoin sued his former employer for reading the contents of his government supplied alphanumeric pager. This was the same officer who, several years before, successfully sued the same police department for placing video cameras in the showers and locker rooms as part of an investigation of a missing flashlight.

The pager was purchased and owned by the police department, which paid for usage. The policy was explicit that the pagers were to be used for official government purposes only, but it appears that this policy was loosely enforced. The Police Department paid a flat rate for a certain number of minutes, and paid overage charges for excess use. If an employee exceeded the normal usage, the police might conduct an audit to see if the use was business related, or personal, and charge the employee for the personal use. If the employee agreed to simply pay the overage cost, no audit was conducted. Thus, the question raised was whether the police department had a right to read the contents of the alphanumeric pager.

In Quoin's case, the court noted that [the police supervisor] in effect turned a blind eye to whatever purpose an employee used the pager, thereby vitiating the department's policy of any force or substance. By doing so, [the supervisor] effectively provided employees with a reasonable basis to expect privacy in the contents of the text messages they received or sent over their pagers. The only qualifier to guaranteeing that the messages remain private was that they pay for any overages.

In effect, the court held that the actual policy of not monitoring content created, in the users, an expectation of privacy, which the court found to be reasonable. In other cases, courts have held that, despite a "business use only" policy, employees might be known to keep personal files on a business computer (just as they might keep personal records in an office desk, or a personal purse on a company provided desk drawer.) Thus, people may have reasonable expectations of privacy in the contents of files on a desktop, in emails or other electronic communications.

So, what's an employer to do?

These two cases put the employer in a terrible position. Even the most broadly written policy granting full rights of monitoring and consent to monitoring may not extinguish all privacy rights. But do we want to, or need to extinguish all privacy rights? I think not.

The better approach is to give yourself the right to monitor, have employees consent to monitor, and state that your failure to monitor in particular situations is not a waiver of your right to monitor. Further, you should periodically review your policies, and rewrite them in light of changed circumstances, and continue to educate employees and users about the policies and their rights.

Something along the lines of "we don’t ordinarily monitoring what people do, and assume that they will act as responsible adults, but when we learn you are doing something bad, or if we are doing routine examination, we might find something that warrants further investigation. The fact that we didn't do it in the past means nothing. We might do it in the future, so beware".

Of course, that is far too understandable for a lawyer to do, so we might have to translate it into Latin. Until then, use corporate networks and resources with care. Someone might be watching.

This article originally appeared in Security Focus.

Copyright © 2006, SecurityFocus

SecurityFocus columnist Mark D Rasch, JD, is a former head of the Justice Department's computer crime unit and now serves as a lawyer specialising in computer crime, computer security, and privacy matters in Bethesda, Maryland.