What issues will we face with the use of network surveillance tool in the company network with respect to the Telecommunication Interception Act and Privacy Act ?
And what policies could be implemented to mitigate these issues ?
-
3Can I request some clarity here - Do you mean the Australian Telecommunication Interception Act of 1979 and Privacy Act of 2010? I'm guessing so, but confirm please so appropriate answers can be provided.– Rory Alsop ♦Jan 10, 2011 at 1:13
-
yes, and would be nice if can include with respect to Telecommunication Amendment Bill 2004– CoderedTrJan 10, 2011 at 2:36
-
I'm not familiar with Australian laws, but I'd be surprised if there's anything there very different from similar laws elsewhere - answers would apply equally on other locales. Am I wrong about those laws?– AviD ♦Jan 10, 2011 at 5:57
-
Well there are differences in various jurisdictions, for example in Germany you would not be able to do this easily. The national laws there are very pro-end-user privacy. Having said that, the Aussie laws look quite like UK laws. I am not a lawyer, but D.W. and Iszi's answers would be appropriate if that is correct.– Rory Alsop ♦Jan 14, 2011 at 23:07
-
@Rory, yeah I'm familiar with some of those laws - I've heard of the extreme pro-privacy in Switzerland, nice to know about Germany too. But I meant " most other places" ...– AviD ♦Jan 15, 2011 at 23:46
Add a comment
|
2 Answers
If you are thinking of monitoring the network traffic of your own employees:
The most important thing you can do is warn your users that their communications are subject to monitoring by the company at any time, and they should have no expectation of privacy in their communications.
If you are thinking of building surveillance capabilities into your networks:
One security risk is that the surveillance capability provides a way for attackers to eavesdrop on traffic without authorization. I know that surveillance capability is only intended for use by law enforcement, but building it into your systems introduces the risk that it could be misused.
For an eye-opening example of this risk, I encourage you to read up on the Greek wiretapping case in 2004-2005, around the time of the Olympic Games in Athens. In 2005 it was discovered that the Greek telecommunication carrier's surveillance systems had been compromised and were under the control of unknown external agencies, who used the surveillance capability to wiretap over 100 cell phones belonging to key government officials: the prime minister, minister of defense, minister of foreign affairs, members of parliament, and so on. The wiretapping capability had been build only for use by Greek law enforcement, but someone else took control. They wiretapped phones for 10 months before the compromise was detected; no one ever figured out who did it, but given the sophistication of the attack, it's natural to suspect foreign spy agencies.
For more on the risks of building surveillance into networks, I recommend the following articles:
Check with your legal department, but all that should be required is that you provide ample notification to users who may be monitored. These should be in the form of notices within an Acceptable Use Policy which is signed by employees and contractors prior to granting network access, as well as Warning Banners implemented in one form or another on all networked equipment and applications.
Whatever the form, your notification should cover the following points:
- The computer system being accessed is owned by [XYZ entity].
- The computer system is intended for use by authorized persons, for authorized purposes only.
- Users accessing the system consent to monitoring with no expectation of privacy.
- Unauthorized use may result in disciplinary action and/or criminal prosecution.
(I am not a lawyer, and this is not legal advice.)
