Auditing, surveillance and logging are typical and common place in the workplace, understandably so. These actions are crucial to establishing metrics and performance of the network and its resources.

The surveillance can take many forms, namely:

  1. Company Cell phone passive audio recordings in and out of the workplace
  2. Key loggers
  3. Traffic including SSH traffic that was MITM'd (banking stuff, private emails)
  4. Instant messages and texts.

The CIA triad's first element is confidentiality, and in the context of IT infrastructure this relates to confidentiality of the corporation's communications and data. This leads to an uneven dichotomy where individual's rights to privacy are compromised in this effort to secure IT infrastructure.

Since laws are the threshold between what is right and wrong in the context of a country's laws, why are there no disciplines in certifications (ISC2 CISSP, SSCP, etc) that propose balancing out the right of the individual and the requirements of the corporation?

Edit: try to ask the question in a better way

  • 3
    Can you limit this to a country at the least? I feel like this will be dependent on country, and/or company. – RoraΖ Jan 18 '16 at 18:31
  • Canada/US, should have similar codes of conduct I presume. AFAIK there are no laws in either country that focus on this. – Whome Jan 18 '16 at 18:32
  • 3
    Typically in Canada/US, your workplace will have some kind of T&C either on your contract, or when you log on (often disguised as a small link). I suggest you read that. – Othya Jan 18 '16 at 18:56
  • The laws vary wildly between Canada and the US, and even between provinces and states. In BC, we need to disclose. In other provinces, it is not necessary (but still considered a good idea). – schroeder Jan 19 '16 at 0:23

Laws on computer surveillance are derived from laws regarding telephone surveillance and wiretapping. Those laws don't always fit the current situation, and the laws have not kept up with rapidly changing technology. So there are lots of holes in regulation and privacy law.

One important concept is the "expectation of privacy," where a reasonable person would expect a conversation to be private -- say inside one's home as opposed to a busy street corner. If you don't have the expectation of privacy, you can't argue that your conversation (data, web history, etc) is private. This concept governs most computer privacy laws.

To answer your questions:

  1. In the organizations I've worked at (in the US), there are no limitations, other than most IT shops are too busy to bother with weeding through collected data unless something very bad is going on. As storage gets cheaper and cheaper, the tendency is to collect everything -- just in case (the NSA is a perfect example).

  2. There are laws regarding privacy, but they vary from state to state (and apparently from provence to provence). How much security one needs is up to the organization to determine themselves, so guidelines aren't much help. I've never seen anything commonly used.

  3. The idea is that in the workplace, the company owns the computers, circuits, storage, etc, so any information you create on them belongs to the company, especially since you are being paid to be there. Again, there's also the expectation of privacy thing -- you normally don't expect your conversations at work to be private.

  4. A lot depends on what kind of surveillance, and what state it is taking place in.

Just for the record, IANAL.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.