Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is Google hangouts encrypted? Would my work's IT guys be able see pictures and text I send while on a work computer? Yes I know I shouldn't be sending stuff I don't want them to see while at work, but it wasn't at work. I use hangouts on my phone as well and just realized I use the hangouts Chrome plug-in at work and it was syncing all my conversations.

share|improve this question
6  
@logixologist That doesn't actually prove they are doing that though. Even if it was something so obtuse that it convinced you it was scanning what you wrote, you can't really prove that it was. You very well might be right, but let's stick to facts and not assumptions and anti-Google biases. –  patricksweeney Aug 21 at 20:44
6  
@patricksweeney that's pretty much their business model: targeted ads. Whether that's evil is personal opinion, of course. Regardless, it doesn't really have anything to do with what the OP is asking. –  DA. Aug 22 at 5:19
3  
@logixologist Google is quite open about analyzing site content (including, of course, user-generated content on Google sites such as Gmail) to select which ads to show: see 1 2 and 3. The real question is, (1) what are the limits of what these "automated systems" do with the information, and (2) can any humans access the information? –  Kyle Strand Aug 22 at 20:12
1  
In other words, those who trust Google are trusting it to limit its use of such information to the obvious functionality- and ad-related uses, rather than to, say, store it and/or sell it to other companies. –  Kyle Strand Aug 22 at 20:13
3  
@logixologist: "This means they transcripted it and then sent me unsolicited targeted ads based on a keyword." They did, of course, tell you they were going to do that when you signed up and accepted the T&C's. You may not have "solicited" their sending you ads, but you did consent to it. –  T.J. Crowder Aug 23 at 12:06

6 Answers 6

up vote 86 down vote accepted

You should assume that they can. There are various ways they can do it, but whether they actually do it depends on company's standards and practices. Some of the options:

  1. It's possible to install additional root certificates on company's machines and use that to MITM all the traffic (traffic goes through company's gateway/proxy anyway, and having friendly root certificate on user's PC allows to do a full MITM);
  2. It's possible to install "employee monitoring software", which is essentially a key logger + process monitor + screen grabber. Some tools have capacity to locally intercept received messages in chats.
  3. It's possible to use remote access/collaboration tools to monitor what's happening on the screen of a particular PC.

In short, if you don't have control over the PC you're working on (and with company's workstations you typically don't), you cannot assume it's free from such surveillance implants.

Hope that's not too scary :)

share|improve this answer
2  
Good points, you could deep packet inspection technology too –  BigBob1000 Aug 20 at 6:27
4  
Echoing the above, technically its perfectly feasible. Practically, does the data actually get looked at? As a Sysadmin myself, I would suspect not. Even on slow days, there's lots more interesting stuff to do than see if we can catch a co-worker doing something they shouldn't! :D –  GeoSword Aug 20 at 9:27
11  
@fjw It would be considered legal in the U.S. because almost every employer has their employees sign an Acceptable Use Policy that will include a provision stating something like "You have zero expectation of privacy on our network and/or hardware, and all of your communications are subject to monitoring". So the employees are giving consent to the employers to do this. –  Craine Aug 20 at 13:54
2  
Anyway, laws don't spring into existence just because it would seem sensible and consistent to have them, they exist because someone wrote them and Congress passed them. In practice that generally happens because someone lobbied for them. In the case of most copyright law that "someone" is Disney (actually more than just Disney, but media), and Disney isn't all that interested in SSL. And finally the company might not (legally speaking) circumvent SSL anyway, since the employee has chosen to use the company's root certs, that authorise the company's proxy to present itself as any domain. –  Steve Jessop Aug 21 at 0:01
4  
The only confusing part of this to me is why someone might think they have a "right" to misuse company resources. –  Michael Hampton Aug 23 at 20:26

Yes if your Google Hangouts data has synced onto your work computer the IT department could view it. However don't freak out yet, unless they are looking for it, it's extremely unlikely that they will see it.

There are three places that the IT Department could see it:

In Transit

When syncing your hangout data if your IT Department monitors traffic over the network they could have seen it. As BigBob1000 says it's encrypted (HTTPS) however many enterprises install trusted certificates on their computers and then basically Man-in-the-Middle their own computers to decrypt all HTTPS traffic. Chances are even if they were doing this they would not have recorded the data, just that you connected to Google.

At Rest

This is a more plausible issue but still incredibly unlikely, Chrome (all browsers) cache things. So rather than downloading the same image from Google a hundred times it downloads it onto your computes hard drive once, then uses that each time. I'm not sure what Chrome caches for hangouts, but an educated guess would be that it's profile pictures of your contacts and other images but not the text of your conversations.

You can clear your cache your IT Department might still have a backup but most places don't backup desktops, only servers.

In Memory

Honestly I'm just putting this one in for completeness. EDIT: After seeing Andrey's answer, he brings up a good point, this is more plausible than I though. There could be employee monitoring software that records chat logs.

share|improve this answer
1  
I think more common than any of those would be screenshots at x (or random) intervals (for the actual content) - "In Transit" is going to be more likely implemented first. –  user2813274 Aug 20 at 17:52
    
@user2813274 screenshots are probably the most efficient and fool proof way to control what the user is actually doing. –  Davidmh Aug 24 at 11:24
    
There's also the issue that even if technically able (likely) they may not be legally allowed to do so (under some jurisdictions, personal communications are confidential, and if you haven't signed some blanket statement...). So if they accidentally logged it and you discovered that, you might have a good case against them for spying. –  Ángel Aug 24 at 19:59
    
@Ángel Even assuming that's true, I don't really think it's relevant. If they see something they don't like, they can fire you. At that point, you're likely to have a long, expensive, and painful, battle. So, for all practical purposes, you should assume they can and will do it, and that you don't have any re-course. –  Patrick M Aug 25 at 8:25
    
@Patrick-m, I don't consider it too relevant to questioning if they can (I agree he should have his chats not synced), but it's interesting on the issue if they will actually go so far to do that (secretly, without notifying you). That something is illegal can be a good incentive not to do it :) –  Ángel Aug 25 at 21:31

While it's certainly possible, the more applicable question is "how likely is it that my IT department cares?" (Unless you're doing something that could get you fired or arrested, naturally.)

In addition to that, the other consideration is that it costs a lot of money to actually store everyone's web traffic, so the content of messages and web requests is generally not stored for any significant period of time - it costs a lot of money to store that information and make it searchable, and there's rarely any business reason to do so.

Take it from an IT guy - you're not that interesting, and I resent requests to "look into" other employees' activities. I have better things to do than spy on people's social media use or web browsing, so even when I'm explicitly directed to do so, I don't look any harder than I have to in order to comply with my orders. At my workplace, that involves emailing off a canned report to the requester with high level stats on a user's activities - how many web requests made over a certain period, which domains those requests were made to and a break down of those requests by website category - and this is only when I can't get away with saying "no" to requests about what some employee is doing online.

share|improve this answer

If your company has a product named "Google Vault" installed then yes your IT department, or anyone granted access to Vault, can read your unencrypted Hangouts messages and pictures.

Google Vault is an eDiscovery platform - https://support.google.com/vault/answer/2462365?hl=en

The only way they would not be able to read your Hangouts messages is if you have turned the history "off" for each chat. In Google Chat this option is named "Chat off the record". In Hangouts it is named "Hangout history". Anything typed after turning off the history is not recorded.

To see what your IT people can see: Open your Gmail in the Chrome browser and click on the "Chats" label found after expanding the "More" button. Deleting what you find in this label won't help you because once it exists it exists forever or until the Google Vault policy expires it.

share|improve this answer
1  
@Jack implies that he isn't using his company Google Apps account to send personal messages over Hangouts. As I understand, if he is using his personal account then the company can't access his Hangout chats through the Vault. Unless, of course, I'm missing something. –  pedro_sland Aug 24 at 22:18

Yes - you really should assume that anyone can read anything you do online anywhere, anytime. If they own the network then doubly so. If they own the computer you're using, triply-so-with-knobs-on.

From another angle, if you are doing stuff on the work computer or in the work environment that you don't want work to know about, you probably shouldn't be doing it. Murphys law tells us this WILL go wrong for you at some point.

Assuming the IT department are models of benevolent permissiveness and/or ignorant/incompetent, it only takes one colleague who takes a dislike to you (possibly because you spend too much damn time on hangouts when you should be working, f'rexample) to peer over your shoulder, or one computer crash mid-session, or some unexpected computer virus, or a new and exciting bug in Google Hangouts that brings your machine down, to expose whatever it is you didn't want to be exposed.

Then again, by the sound of it, the day your mobile phone gets lost/stolen someone has a load of great blackmail material on you anyway. The problem with things you put on the internet is that they're on the internet.

share|improve this answer

Depends....easy way is to simply ask the I.T. department:

You: hi, I'm curious if our IM chats and emails are backed up or stored for compliance reasons. If I need to recover a chat from google hangouts for legal reasons, is it possible?

I worked in finance where 100% of all communication was recorded in our office as per government regulations including phone calls, chats on any IM client(we had a special software dedicated to it), etc.

Chances are you are not actively monitored but your browsing habits might trip an office firewall for repeated violations which may cause some scrutiny if it's ridiculous(tons of porn, obscene bandwidth usage, constant upload/downloading 24/7 such as torrents or spotify).

Emails yes if you are using thier domain or sending to a work email domain.

EDIT: one thing to watch out for is building security. If the I.T. department set up or paid for the cameras like I did, we can 100% spy on you at any time and even have zone triggers to alert us. One D-bag I know got building security to record entry times to tag late workers without them knowing despite the company merely being a renter. If you can,tell security to deny any requests to access that information from a third party becuase it will be used against you if possible.

share|improve this answer
    
Strict country, or a sell-side trading floor: "I worked in finance where 100% of all communication was recorded in our office as per government regulations including phone calls, chats on any IM client." –  Ellie Kesselman Aug 22 at 21:14
    
USA....we got fined heavily for missing records so the company records everything. If your company has piss poor storage/recording and you get targeted by regulators....your gonna have a bad time. –  udonsoup16 Aug 26 at 16:46

protected by Community Aug 29 at 9:31

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.