Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Employers often monitor employee network access, even install keyloggers on their computers, etc.

But the articles I found on the internet, is about the monitoring but not what they may do with the logs.

Let's see the following scenario: I'm waiting for an important e-mail so I keep my personal e-mail account web interface open, I just logged in, an waiting and not opening any of my e-mails. So my employer won't see my e-mails' content in the logs.

Since the user name and password passed through their network. They can obtain it from the logs.

May they use the username and password to log in, look at my e-mails and use the account on my behalf without my consent? (Just because they obtained the password)

I work here in Hungary, but the company is an international company, so the proxy is somewhere else (maybe in England).

share|improve this question
    
Don't you use SSL? –  CodesInChaos Jul 28 '12 at 10:09
    
Even if I use SSL they can sniff it by using an SSL proxy and installing trusted certificates. –  Calmarius Jul 28 '12 at 10:12
1  
For legal questions please indicate jurisdiction. You have a work contract under the law of xxx, your international company is based in yyy... In France is law is very strict and the employer is not allowed to open an folder clearly labelled "personal" (of course the Windows "My Documents" is not such a personal folder). –  curiousguy Jul 28 '12 at 13:30
    
Guys, should we have a workplace tag for these questions? –  curiousguy Jul 28 '12 at 13:32
1  
You're on a home network somewhere, probably wireless, possibly not - people can steal your information there as well. If you're worried about your employer stealing your information, keep work and your personal life separate - invest in an iPhone or something. Also, most employees do this out of security concerns (trust me on this one). If you're caught doing something suspicious/ illegal, they can use such logs to possibly determine how big their problem is. –  ekaj Jul 29 '12 at 4:44
add comment

2 Answers

up vote 4 down vote accepted

An employer may not access your personal email without your consent iirc. (Consult a lawyer to be sure)

However almost all of the time when these type of practices are in place there is an acceptable use policy that also points out if you are allowed to use company ict infrastructure to read your personal email, what they will be logging and what they might do with that information.

In Belgium we follow European guidelines, our law states:

  • An employer can not monitor your surf and email behavior, unless he advertised this up front. (Like I said, this can often be found in the AUP)
  • Only after the consent of the employee an employer may look up how much he's using the internet or how much emails he is sending.
  • The content of a sent/received email can not be read unless the employee has opened them and has given consent. There are exceptions on this (for instance when the employee goes on leave and the emails need to be forwarded to another employee)

If information wants to be used as proof in court it will have to follow the above guidelines UNLESS:

  • There was a court order to gather this information
  • There was a "higher" cause, this being: theft, corporate espionage or accessing information considered illegal by the law (child porn, warez,...)
  • Employers are also encouraged to create a UAP and provide a detailed and comprehensive list of rules to tell the employee, what he can and can not use the company's ICT infrastructure for. A company can always prohibit the use of company ICT infrastructure for personal use (Facebook, personal email)

Whilst he can conclude you are using his infrastructure for personal use, he may not access the content and certainly not send emails in your name.

This will probably be similar for Hungary as this law follows European guidelines. But please refer to a lawyer to confirm!

Also my advice: If you know these things are being monitored, don't use them for any personal matter.

share|improve this answer
    
I think you mean employer instead of employee. I can't edit it myself as it is a one letter change. –  Terry Chia Jul 28 '12 at 12:06
    
@TerryChia thanks! –  Lucas Kauffman Jul 28 '12 at 13:08
    
@D.W. The answer is applicable to the asker's case as he states that he works in Hungary. Moreover, Lucas stated to consult a lawyer to be sure. –  Terry Chia Jul 29 '12 at 6:31
    
@D.W. European law is applicable. Also in the U.S. it's not allowed either to access a personal email. In the U.S. an employer may only read the email if the email resides on one of its own servers. –  Lucas Kauffman Jul 29 '12 at 6:43
    
@LucasKauffman, TerryChia, you are right, I missed that! I'm deleting my erroneous comment. My mistake. Sorry about that! –  D.W. Jul 29 '12 at 6:45
add comment

In the US, your employer can monitor your actions if they provide notice that your actions on their systems may be monitored (and probably even if they don't provide notice).

For more details, see the following resources:

  • Workplace Privacy and Employee Monitoring, from the Privacy Rights Clearinghouse. It makes clear that, generally speaking, an employer can monitor phone calls, email, use of the employer's computers and network, and other similar activities.

  • Labor Law, from the EFF. See especially the questions on monitoring.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.