Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What issues will we face with the use of network surveillance tool in the company network with respect to the Telecommunication Interception Act and Privacy Act ?

And what policies could be implemented to mitigate these issues ?

share|improve this question
3  
Can I request some clarity here - Do you mean the Australian Telecommunication Interception Act of 1979 and Privacy Act of 2010? I'm guessing so, but confirm please so appropriate answers can be provided. –  Rory Alsop Jan 10 '11 at 1:13
    
yes, and would be nice if can include with respect to Telecommunication Amendment Bill 2004 –  CoderedTr Jan 10 '11 at 2:36
    
I'm not familiar with Australian laws, but I'd be surprised if there's anything there very different from similar laws elsewhere - answers would apply equally on other locales. Am I wrong about those laws? –  AviD Jan 10 '11 at 5:57
    
Well there are differences in various jurisdictions, for example in Germany you would not be able to do this easily. The national laws there are very pro-end-user privacy. Having said that, the Aussie laws look quite like UK laws. I am not a lawyer, but D.W. and Iszi's answers would be appropriate if that is correct. –  Rory Alsop Jan 14 '11 at 23:07
    
@Rory, yeah I'm familiar with some of those laws - I've heard of the extreme pro-privacy in Switzerland, nice to know about Germany too. But I meant " most other places" ... –  AviD Jan 15 '11 at 23:46
add comment

2 Answers

If you are thinking of monitoring the network traffic of your own employees:

The most important thing you can do is warn your users that their communications are subject to monitoring by the company at any time, and they should have no expectation of privacy in their communications.

If you are thinking of building surveillance capabilities into your networks:

One security risk is that the surveillance capability provides a way for attackers to eavesdrop on traffic without authorization. I know that surveillance capability is only intended for use by law enforcement, but building it into your systems introduces the risk that it could be misused.

For an eye-opening example of this risk, I encourage you to read up on the Greek wiretapping case in 2004-2005, around the time of the Olympic Games in Athens. In 2005 it was discovered that the Greek telecommunication carrier's surveillance systems had been compromised and were under the control of unknown external agencies, who used the surveillance capability to wiretap over 100 cell phones belonging to key government officials: the prime minister, minister of defense, minister of foreign affairs, members of parliament, and so on. The wiretapping capability had been build only for use by Greek law enforcement, but someone else took control. They wiretapped phones for 10 months before the compromise was detected; no one ever figured out who did it, but given the sophistication of the attack, it's natural to suspect foreign spy agencies.

For more on the risks of building surveillance into networks, I recommend the following articles:

share|improve this answer
add comment

Check with your legal department, but all that should be required is that you provide ample notification to users who may be monitored. These should be in the form of notices within an Acceptable Use Policy which is signed by employees and contractors prior to granting network access, as well as Warning Banners implemented in one form or another on all networked equipment and applications.

Whatever the form, your notification should cover the following points:

  • The computer system being accessed is owned by [XYZ entity].
  • The computer system is intended for use by authorized persons, for authorized purposes only.
  • Users accessing the system consent to monitoring with no expectation of privacy.
  • Unauthorized use may result in disciplinary action and/or criminal prosecution.

(I am not a lawyer, and this is not legal advice.)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.