Conference 7.286::digital

First of all, Digital Human Resources policy 6.54 states:

 Because networks, computer systems and accounts are resources the
 Company provides to its employees, the Company reserves the right to
 access those networks, systems and accounts as it deems necessary.

This means that the company has the right to read your e-mail if "necessary".
Now what "necessary" means is up for debate, but you should assume that anyone
in your management chain can request access to your e-mail.  Unauthorized
snooping may be a fireable offense - it has been described as such in our
organization.

As for the voice-mail system, I would assume that it would follow the same
rules as for e-mail.  I was told when the system was introduced here that
the "greetings" we recorded might be checked to make sure they didn't violate
the rules (such as no giving e-mail addresses, etc.)

This should really not be a surprise to anyone.

				Steve

	Get good at using things like PGP to encrypt your mail, or get an
	account outside Digital and write your "my boss sucks" mail from
	that.

	Welcome to the Information Age.
								mike

I think the verdict is out on this one.

I recently read of a case where the employee sued the employer and lost, the
commentary that went with it was something along the lines of constitutional
protections for privacy only apply to Government and not to private
employers.

Then I read another one where they gave a counter argument something along
the lines of "it's ridiculous that you can have a right of privacy as 
you drive to work and then lose it as soon as you enter your office".


I think the legal ramifications associated with new technology are far
from resolved and it will be some time before sufficient case law exists
for definitive answers.

So unless you want to be a test case then don't put anything you want
to keep private in electronic form.

M

    Something else to keep in mind.
    
    Just because "E-mail" (or "Email, if you prefer) has the word "Mail"
    embedded in it, don't assume that it has the same protection as the
    traditional form of mail you send through the Post Office.  It doesn't. 
    Every reference I've ever seen indicates that electronic mail does not
    have the same protection as paper mail.
    
    There are laws that prohibit wire tapping, but there has been no ruling
    that would apply that to a company's internal network.

    Also remember that just because you send a message to an individual
    [that you think is private] doesn't mean they won't forward it to a
    large distro list......

    Re.: .4
    
    Now there's an interesting twitch.
    
    It is illegal to wiretap the public phone network without probable
    cause and an appropriate court order.  
    
    Now, suppose the company uses the public internet as a means of
    electronic communication.  Are those messages that traverse the public
    internet afforded the same level of privacy as phone conversations
    that traverse the public phone network?
    
    Have your kids got to law school. This technology is going to be a
    bigger legal quagmire than the federal superfund.
    
    gc

Re: .6

No - there is no right to privacy for Internet communications (which is why
encryption is so important.)

				Steve

We had a big stink here in Colorado Springs a year or two ago
about this. It turns out that the mayor was reading everyone's
(as in the city counsel members) e-mail. He claimed he had a
right to what was on the city systems while they had been using
e-mail to discuss votes and other decisions that were (they
thought) private. liesl

    Re: .6, .7
    
    The Electronic Communications Privacy Act of 1986 updated existing
    legislation on "rights to privacy" in telecommunications. It is
    illegal, for instance, to perform the network equivalent of wiretapping
    to intercept messages in transit on computer networks without a court
    order. It is also illegal to read someone else's electronic mail but
    there are certain exceptions (e.g. system operators). 
    
    It has not been, in my opinion, enforced to the letter or spirit that
    was originally intended. Relevant to this discussion, the act nominally
    prohibits empolyers from monitoring electronic mail unless employeees
    have been notified in advance and possibly a few other provisions.
    
    Several court cases, alluded to in the 60 Minutes report and elsewhere,
    have been molding the interpretation of the Act since it came into force.
    I agree with Steve--this is one reason why encryption technology is
    an important part of this whole issue.
    ---
    
    A search on AltaVista for "Electronic Communications Privacy Act" or
    "ECPA" will get several hits on details and the text of this Act.

From The New York Times.

May 11, 1996

      Increasingly, Companies Deny
      Employees Privacy Rights in E-mail


      By PATRICE DUGGAN SAMUELS

      When Michael A. Smyth sent an e-mail message to a co-worker in 1994
      calling his employers "back-stabbing bastards," he had little
      concern that someone else might be peeking at what he thought was a
      private message. After all, he contended that the company had
      promised him that his e-mail communications would remain
      confidential. 

      They weren't. Executives at his company, Pillsbury, saw the message
      and others like it, and Smyth was dismissed for what the company
      deemed "inappropriate and unprofessional comments." The company
      said it had never told Smyth that his e-mail messages would be
      private. 

      Smyth, a resident of Lansdale, Pa., sued Pillsbury, contending
      wrongful discharge. In January, he reached an oral settlement
      with Pillsbury, but on the same day the settlement was reached,
      and before it was filed with the court, a Federal District judge in
      Philadelphia dismissed Smyth's case. The judge ruled that even if
      the company had made a promise of confidentiality, the
      "defendant's actions did not tortiously invade the plaintiff's
      privacy." 

      Though cases like Smyth's have often been decided in favor of
      employers, companies wary of such lawsuits and eager to gain
      control over their electronic communications systems have begun
      to adopt explicit written policies concerning them. And what
      companies are telling employees is that they have little privacy in
      cyberspace. 

      "E-mail is monitored by our people to make sure it is being used
      for Intel business," said Howard High, a spokesman for the Intel
      Corporation in Santa Clara, Calif.. "It is a widely known policy
      within the company." 

      The policy of the Kmart Corporation of Troy, Mich., states that
      the company can review all e-mail messages. "Misuse of the
      e-mail system could result in denial of access to the Kmart
      computing environment, or dismissal," the statement reads. And
      to clarify the company's reasoning, the policy says that "electronic
      mail sent from Kmart travels on Kmart's electronic stationery"
      and is thus the same as if were sent on Kmart's letterhead. Every
      employee is introduced to this policy at orientation. 

      For many companies, that is not enough. At Epson America in
      Torrance, Calif., every employee signs an acknowledgment of the
      company's policy that e-mail is for company use only. Epson was
      sued six years ago by Alana Shoars, an electronic mail
      administrator at the company who said she discovered her
      supervisor reading and printing out employee e-mail messages.
      Shoars questioned the practice. A day later, she was dismissed for
      insubordination. The case was settled last year. 

      Officials at Epson declined comment. 

      Lawyers and, more recently, human resource managers have
      strongly encouraged companies to have explicit written policies
      stating that the company owns the communication system, that
      the system is intended for business purposes only and that the
      company can monitor it. 

      "Certainly, you protect yourself from lawsuits" when employees
      are notified, said Michael F. Cavanagh, a public policy consultant
      of Cavanagh Associates in Arlington, Va. "But more important,
      what you are doing is right." 

      Even those who believe that monitoring is an invasion of privacy
      would rather see employees informed of the company policy than live
      with the illusion that they are conversing in private. "This is not
      something that should be a secret," said Lewis L. Maltby of the
      American Civil Liberties Union. "They should formalize and tell
      their employees." 

      A study released this year by the Society for Human Resource
      Management, a trade association in Alexandria, Va., showed that
      while 80 percent of the organizations in the study used e-mail,
      only 36 percent of those groups had policies concerning e-mail
      use and only 32 percent had written privacy policies. 

      Those numbers are expected to increase. "We are very close to a
      time when not having a written policy will be an exception to the
      rule," Cavanagh said.

         While some companies have decided to adopt policies, coming
      up with a good one is another matter. "I feel that it is necessary to
      have a policy, but what it is, I don't know yet," said Stewart
      Cummings, manager of telecommunications customer support at
      the National Gypsum Company in Charlotte, N.C., which is
      introducing an internal e-mail system. 

      Gencorp Inc., an automotive parts maker based in Fairlawn, Ohio,
      has had an e-mail system for eight years and still does not have a
      policy. "I believe that it is something that needs to be looked at,"
      said Denni Interliggi, director of information systems at the
      company. "It just sort of snuck up on everyone." 

      The Society for Human Resource Management has urged
      companies to adopt policies and has provided a sample form for
      employees to sign that acknowledges a company's e-mail policy.
      It says, in part, "I am aware that the company reserves and will
      exercise the right to review, audit, intercept, access and disclose
      all matters on the company's e-mail systems at any time, with or
      without employee notice, and that such access may occur during
      or after working hours." 

      D. Michael Underhill, a partner with the law firm of Morgan,
      Lewis & Bockius in Washington who helped write the society's
      sample policy, advised companies in a report that "more and more
      often, e-mail messages, including 'erased' messages, provide
      crucial evidence in criminal and civil lawsuits" against a company,
      that e-mail can be used by employees to "divulge valuable trade
      secrets" and that e-mail can "distract employees who prefer to
      spend work time 'chatting' with colleagues or friends." 

      To privacy advocates, this all seems like a violation of employees'
      rights that is likely to create a workplace of stress and paranoia. 

      "What is happening is that there are policies being made that
      allow companies to read employee mail at any time they want,
      without warning or knowledge or consent," said Philip R.
      Zimmermann, the president of Boulder Software Engineering and
      a cryptologist who has created a computer program that encrypts
      e-mail messages, allowing employees to prevent their
      communications from being read by employers. 

      The software is called P.G.P., for Pretty Good Privacy, and is
      available free on the Internet. 

      The program has made Zimmermann a folk hero among
      advocates for electronic freedom. It has also attracted a three-year
      investigation by Federal prosecutors who were concerned that
      Zimmermann might be illegally exporting high-quality encryption
      technology. Zimmermann was later cleared. 

      "You don't check your constitutional rights at the door,"
      Zimmermann said. "You spend a third of your life at work. It is
      absurd to propose that we have no rights there." 

      Some companies go along with Zimmermann's view. Apple
      Computer, for example, has an explicit policy of not monitoring
      employee e-mail. 

      David Banisar, a lawyer and policy analyst at the Electronic
      Privacy Information Center in Washington, said that monitoring
      of employees was bad policy. "It does not set up a particularly
      healthful environment for employment," Mr. Banisar said. "If the
      boss says, 'We can go through your desk any time,' that doesn't
      create a good deal of good will."    But what happens if an
      employee stores or, worse, encrypts important company
      documents, and then dies? How will the company get to vital
      information? 

      Some companies say it is important to have complete access to
      electronic communication. 

      They argue that electronic mail is more like a desk drawer or file
      cabinet than, say, the telephone, for which employees have an
      expectation of privacy. 

      "Computer networks are used to transmit, sort and create a wide
      variety of information," said Richard D. Marks, chairman of the
      computer law division of the American Bar Association and a
      partner with Dow, Lohnes & Albertson. "And that information
      takes on the nature of a document. It has more permanence than
      the usually transitory telephone call." 

      Companies also argue that because they own the equipment, they
      should have the right to control and monitor its contents.
      Zimmermann disagrees. 

      "I use a company pen," he said. "If I use it to write a letter to my
      wife, does that mean they can read the letter?"  

    Good job I never criticise bosses in E-mails, only in Notes ?!
    
    I'm curious what 'rights' are in the context of E-mails that I:
    
    1) bash in on company owned assets
    2) bash in (nominally) during company 'time'
    
    btw - us Brits are aware that *all* faxes and Uk phone calls can whiz
    thru GCHQ. Scarey ? Nah, if GCHQ was that good, then my home town wouldn't
    have gotten trashed by that huge bomb on Saturday. Privacy/rights ? Hmm....
    
    
    AW

    I write what I think in mail and notes but always stop short of
    insults.However,I think there are two issues-it is true that the
    company assets should be used on compnay business but it has been well
    established that this dividing line is a bit gray.
    Mail snooping is something else and has nothing to do with assets.I am
    sure it will be established that there is no automatic and non-warned
    access to mail.
    As for being a reason or pretext-in the US employee protection seems so
    minimal that reasons don't seem necessary.Under most European law,I
    beleive that communications of any sort are private 'de facto' and I
    would have thought that the only thing that could be brought as a case
    was one of assault(which would lead to counterincrimination in most
    cases).Any case which tried to find an employee guilty of abuse of
    resources would be a bit thin to say the least..
    SO,from now on,no writing 'regards' at the end of ANY mail - it could
    be construed as personal and therefore an abuse of company resources.
    Oh,and full name and job title and no nicknames or 'bob' instead of
    'robert' since this could be construed as an insult.

    I answered a vaxmail this morning [home on a vacation day] and when
    trying to send it, I got a message saying, "file currently locked by
    another user".
    
    Well, knowing that I am the only one who knows my password [just
    changed it], and I can only log on once from home, what does this mean?
    
    

    It could mean that the mail file of the person to whom you were sending
    was locked.  They may have been compressing their mail or doing some
    other maintenance that makes the file unavailable.  I doubt that it was
    your mail file.
    
    	dave
    

Or you terminated your last VMS session improperly and YOU are the user who 
has the file locked.  Your previous session is still running, perhaps?

    :-) moia???  improper?????? Nevah, I say Nevah.  :-)
    

 .13>   I answered a vaxmail this morning [home on a vacation day] and when
 .13>   trying to send it, I got a message saying, "file currently locked by
 .13>   another user".
 
    Probably the receipient file undergoing a purge/reclaim or compress.
    
 .13>  Well, knowing that I am the only one who knows my password [just
 .13>   changed it], and I can only log on once from home, what does this mean?
    
    Humoring you in thinking that the message might have reflected on
    your own mail file it can only mean one thing: that noone else is 
    using MAIL to read your MAIL at that instant. How could they? It's locked! 
    
    You see, if one uses VAXmail to read a mail file, then that will NOT 
    lock out other users as it will allow concurrent writers to the file.
    In the background VMS/RMS is providing the locking/buffering needed.
    
    btw... technical trivia on "file currently locked by another user"
    
    This is a rather generic message not to be taken to the letter. 
    Yes, It could be another user. But it could easily be the same user 
    in a  different process. Or even the same user in the same 
    process in the same image just trying to open the file for a 
    second time whilest dissallowing sharing on the first open.
    
    Cheers,
    	Hein.                       
    
    
    
    
    

    I assume that if I have a standalone system and have the ONLY passwords
    to the system that the Corporation can't gain access to my email?
    However, they already got the information because they captured all 
    incoming and outgoing events.
    Can the Corporation demand the system password to check the content of
    my system?
    
    	Regards,

    If they get a court order and a warrant, yep.
    
    gc

    re. .19 reply to .18
    
    If the stand-alone system in question is Digital property (i.e. a
    Digital system), I would assume, from the policy, that it is Digital's
    right (i.e. the management) to get at it (like take it from the employee) 
    directly and without a court order or the like.
    
    Of course, that is my reading of the policy (as I would expect is most
    advice herein) as a 'manager' given that the machine and presumably its
    content was Digital's.
    
    But in general, policy interpretation is left to local management vs.
    the courts. I could suppose that some managers consult a lawyer every
    time they move but I doubt that is prevalent behavior. 
    
    

    re .18
    
    Having a password on a computer that is Digital's property is really
    no different than putting a lock on a file cabinet that belongs to
    Digital. Can Digital require you to remove your lock from their file
    cabinet? You betcha.

    Or they can just get a analyzer and capture every packet  your system
    takes in and puts out and get your password that way.. Not to hard to
    do..

    Re: .22
    
    That is assuming that the password is sent out on the wire, which
    it isn't necessarily.
    
    ...petri

    RE:.18 As part of the node registration your Center of Control is
    captured [based on your profile]. The Center of Control Managers name
    is also shown. They would be contacted, if needed.
    
    I presume you are having some level of incremental/full backups done on
    your system. here is another source.
    
    Also use of a PASTHRU SERVER IS IVOPMR makes the job easier if it needs
    to be done.
    
    Howard 

This might not be a good time for a spoof on how your deleted Vaxmail
bits are funneled from the bit bucket to the Corporate Data Digester
[may be pronounced "DY-jes-tr" or "DIJ-s-tr"].

Tempting though!

r

        do a $show dev/fil sys$login: and look for who has your mail file 
        open. You should get lots of 'insuffient priv' messages on the
        files you aren't allowed to see. you could do the command with 
        a /out=file.txt and then search file.txt for mail and then you get
        the pid and the process name of who has the file opened make sure
        it is your file (ie from the [directory] info). If the process
        isn't yours find out who is reading your mail. if it is yours you
        can kill it or attach to it etc to stop it.
        

An earlier reply referred to privacy guarantees for U.S. Mail and implied
that there was some difference w.r.t. EMail.

Be aware that U.S. Mail addressed to you at Digital may legally be opened
by the company.

The privacy of U.S. Mail is only guaranteed until it is delivered to the
_address_ (not the individual) shown on the envelope.  After that, any
individual at that address may legall open it.

/john

Re: .27

>Be aware that U.S. Mail addressed to you at Digital may legally be opened
>by the company.
>
>The privacy of U.S. Mail is only guaranteed until it is delivered to the
>_address_ (not the individual) shown on the envelope.  After that, any
>individual at that address may legall open it.

Not entirely true.  The Postal Service is only liable to the extent that
they deliver the mail.  That does not make it legal for anyone to open mail
once it is delivered.

I've spoken at length with the local Post Office about this because I had
some mail opened by theives looking for checks several months back.  I was
told that it is only legal for the addressee to open mail.  That is why alot
of solicitation mail says "J. Doe or Current Resident".  Though rarely
invoked, the fines and prison terms for this type of federal felony are
exceedingly steep.

The simplest way to ensure privacy within Digital with respect to hardcopy
communication is to mark it "Personal - Confidential".

Bob

Re: .28

Marking mail "Personal - Confidential" provides no protection against someone
in your management chain (or at their direction) opening your mail.  If you
want mail to be personal, have it sent home.

				Steve

    re. .28 and .29
    
    The classification "Digital Personal" is used to transmit personal data
    about individuals with respect to employment matters (perfromance
    reviews, salary info, hiring info, etc.). It is not intended for 
    private (viz. non-employment-related) mailings between individuals.
    
    

Re: .29

>Marking mail "Personal - Confidential" provides no protection against someone
>in your management chain (or at their direction) opening your mail.  If you
>want mail to be personal, have it sent home.

Possibly not, but title 18 USC section 1702 does - up to 5 years in a federal
prison and/or $2000 if convicted.  Reason enough for me not to open another's
mail.

Bob

Once a letter has been delivered to a digital mail room there are no
penalties at all for anyone who chooses to open it.

The penalties would apply if someone took it out of an official U.S. Mail
approved mail box on your house or street, but not if someone opened it
after it had been dropped on the foyer floor through a mail slot or placed
on a kitchen table, or placed in a company mailroom.

Here is Title 18 � 1702:

Whoever takes any letter, postal card, or package out of any post office or
any authorized depository for mail matter, or from any letter or mail
carrier, or which has been in any post office or authorized depository, or
in the custody of any letter or mail carrier, before it has been delivered
to the person to whom it was directed, with design to obstruct the
correspondence, or to pry into the business or secrets of another, or
opens, secretes, embezzles, or destroys the same, shall be fined not more
than $2,000 or imprisoned not more than five years, or both.

Source: http://www.law.cornell.edu/uscode/18/1702.html

Unless marked "Deliver to Addressee Only" (for which an extra fee is
applicable) a letter is considered to have been delivered to the person
to whom it was directed once it has been delivered to the address on the
envelope and removed from any official mail depository.

Your manager, or any other person for that matter, can _legally_ open any
U.S. Mail addressed to you once it reaches Digital.  And that's the law.

/john

John, I'm sure you've studied this issue, but the paragraph you quoted seems
to support .31:

>Whoever takes any letter ... which has been in any post office ... before
>it has been delivered to the person to whom it was directed ... shall be
>fined...

It certainly calls out specially taking from mailboxes, but it seems to say
that once the letter has been put in a mailbox it acquires a special protection.
Perhaps the question is around the meaning of "delivered to the person" ?

    Re .32:
    
    > . . . a letter is considered to have been delivered to the person to
    > whom it was directed once it has been delivered to the address on the
    > envelope . . .
    
    You did not give any attribution that would support that assertion.
    
    Here is Title 18 � 1702, formatted for clarity:

    Whoever
    
         takes any letter, postal card, or package
    
              out of any post office or any authorized depository
              for mail matter, or
    
              from any letter or mail carrier, or
         
              which has been
    
                   in any post office or authorized
                   depository, or
         
                   in the custody of any letter or mail
                   carrier,
         
         before it has been delivered to the person to whom it was
         directed,
    
         with design to obstruct the correspondence, or to pry into
         the business or secrets of another,
         
    or
    
         opens, secretes, embezzles, or destroys the same,
    
    shall be fined not more than $2,000 or imprisoned not more than five
    years, or both.
         
    
    So "the same" refers to, among other things, a letter that has been in
    a post office and has not yet been delivered to the person to whom it
    was directed.  If somebody opens it, they shall be fined or imprisoned.
    
                                                  
    				-- edp
    
    
Public key fingerprint:  8e ad 63 61 ba 0c 26 86  32 0a 7d 28 db e7 6f 75
To find PGP, read note 2688.4 in Humane::IBMPC_Shareware.

I just spoke with Inspector Donovan at the United States Postal Inspection
Service.  We discussed Title 18, Section 1702, and he informs me that the
phrase "before it has been delivered to the person to whom it was directed"
is interpreted as follows:

  Once mail is delivered to a company mailroom it is considered delivered
  the the person to whom it was directed, and anyone may open it.

I asked for specific references, and he referred me to the U.S. Attorney's
office.  The Duty Attorney has promised to call me back either with a case
reference or with the sad news that our tax dollars don't provide them
with enough resources to find this out.  [Call came back: no resources.  Go
to a law library and study case history if you need to understand the law.]

/john

Re: .35

Well John, the inspector you spoke to disagrees with the postmaster I spoke
with.  But I'm not going to argue the point any further.  Should mail
specifically addressed to me (as opposed "Digital Equipment Corporation" or
"Current Resident") be opened without my consent, I reserve the right to seek
prosecution to the fullest extent of the law.

Bob