1

An important boss in the company I work for has initiated a platform that allows any employee to submit questions to be answered in a periodical meeting which is broadcast to all employees.

This is done in an effort to allow issues to "bubble up".

The system is advertised as "anonymous" so that there is no pressure for an employee to ask about "sensitive" (e.g. issues that cannot be told to his/her boss). Of course, all questions are moderated, so that really bad ones are not ever read during the conference.

Although I have never heard of anyone having problems related to this platform, my concern is related to anonymity:

  • posting from work machine - this is clearly traceable, since all traffic goes through a proxy
  • posting from a personal device - should be anonymous, but there is a very small chance for someone to figure out the mapping between by work machine IP and other personal IPs (e.g. Gmail has an interface which displays IPs used to connect to the account).
  • posting from a personal device using an open Wi-Fi network or a proxy - I cannot think of a way to have anonymity compromised.

Question: How to ensure reasonable anonymity when submitting information to a platform?

By reasonable, I assume there are no illegal postings (e.g. disclosing of critical information, threatening someone).

|improve this question
2

When doing anything on a device owned by someone else, I suggest making one basic assumption: nothing you do on that device is private and the owner can see everything you do on it. The owner can install keyloggers or use a keylogging-enabled keyboard and install software that grabs all the network packets. With respect to a work computer, you log into that and are accountable for anything that happens while you are logged in. So you are correct that there is no expectation of privacy, irrespective of a proxy.

WRT posting from a personal device: that assumes that you're on the corporate network (or corporate guest network). They could conceivably find out who posted that, but it would take some effort.

You are correct about the personal device on a separate network, unless the site is gathering data about the device submitting questions. Here the question becomes more about determining what is "reasonable".

The most relatively secure way to do so is to do it in a way where you're not logged in with corporate credentials, so that personal device on a remote network, provided you aren't VPN'd in, should give you a decent degree of anonymity.

However, that doesn't disclose the non-technical issue. Anonymous reporting isn't always a good thing. That may be knowledge that you and only you know. Yes, you are reporting it anonymously, but someone may come to the conclusion that "only alexei knows this" and still be faced with dealing with having your anonymity compromised.

|improve this answer
  • 1
    That last paragraph is important. In fact, in a work environment, never "report stuff that may get you in trouble". If you need anonymity within the work sphere, simply don't say it. The anonymity set is too small. – entrop-x Dec 8 '17 at 15:21
  • @entrop-x don't say that. Even truths known by e.g. all IT staff need to be reported by someone for anyone up the management chain to react. A good boss will still have her/his department's back if someone tries to take revenge against all or random elements of IT, but they might be in a position where reporting this themselves would get them fired. So, your statement is not entirely true. I do agree that a company where gross problems can only be reported anonymously out of fear of repercussions is very, very sick. – Marcus Müller Dec 10 '17 at 0:23
3

Run the site that takes the employee messages both as a plain website and as a TOR hidden service. Provide an explanation on how to connect to the site via TOR if someone wishes to do so.

This way, the people who fear repercussions can connect from their personal device at home via the TOR Browser, which will make their reports as good as untraceable. Note that this applies only to the network origin of the message; depending on what's said in the message, it might lead to the original poster.

All the others who don't fear repercussions can still connect and use the site normally.

(You could also leave out the hidden service step and just use the TOR browser to connect to the site, but if the site provided a hidden service, that would drive the point home that the company is serious about user privacy).

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.