I'm the systems administrator for a company that does a lot of outbound emails and a lot of inbound emailing to potential clients.

We've had a email auditing tool running for a couple weeks that catches on to certain aspects of emails (malicious keywords, potential viruses, etc). I've noticed a spike in possible malicious emails.

During my time configuring the auditor our HR representative barged into my office and told me that it is illegal to audit a company email server due the the Snowden act (I have no idea what this is, just quoting what was said to me). My manager lost his mind, and told me I need to shutdown the auditor immediately. I tried to explain the reason behind the audits and what the audit is for, however, they requested it be taken offline. So I have disabled my auditor. The problem I have with this, is that everything is already saved by our mail server (we use GSuite) and is already audited, the only thing I was doing was routing all of them into an inbox so we can access them more efficiently if needed.

My question, is this a true statement, am I illegally auditing my users emails?

closed as off-topic by Steffen Ullrich, forest, Xander, Benoit Esnard, Tobi Nary Apr 20 '18 at 6:10

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    What is the “Snowden Act”? – myron-semack Apr 18 '18 at 21:13
  • 5
    I'm voting to close this question as off-topic because this is a purely legal question. Please try Law but add more details (especially the country) since it is unlikely that some world-wide law applies to this situation. – Steffen Ullrich Apr 18 '18 at 21:18
  • 2
    if your company owns the servers they (and presumably you) can do about whatever they want. from a management perspective, It's almost criminally negligent not to monitor your brand's communications. – dandavis Apr 19 '18 at 0:37
  • @myron-semack I'm honestly not sure, just quoting what was said to me. – CertifcateJunky Apr 19 '18 at 13:10
  • @SteffenUllrich What can I do to make this question worthy of being on topic? – CertifcateJunky Apr 19 '18 at 13:11

I have a decent background in computing and security legalities. While I agree with Steffen Ullrich that this is more of a legal question, here’s what I know. Just a disclosure, I am not a lawyer and I’m not responsible for any legal issues resulting.

Anyway, as long as your company owns their mail server’s in its entirety, and you have been granted root access to the machine, you are not gaining or exceeding your access as defined in the CFAA, and if your HR department is referring to the Freedom Act, this is applying to government surveillance to which your company is not subject to. Companies can make their own private terms of service and privacy policies. As long as it’s noted that the company email is subject to monitoring for malware and unapproved disclosure of sensitive material you should be in the clear.

In short, I’m not personally aware of any laws preventing this as long as your company owns the server entirely and you were granted root access. At that point it’s merely a matter of company policy. If I were you, I would comply with the request to halt auditing, find some case studies online and get a presentation going to give to HR and your manager to explain the benefit to the company from doing this. You may need to convince the company to hire outside legal counsel as HR doesn’t seem to be too knowledge in the subject (or maybe I don’t understand the situation fully).


Insert IANAL Statement coupled with your HR doesn't know what it's talking about and you should really be disusing with your companies lawyer about this:

  1. Electronic Communications Privacy Act of 1986 permits employers to monitor email under the basis that they:
    • Provide a network for which emails are sent
    • Have a valid business case for monitoring emails
  2. Failure to monitor can you into legal trouble, because:
    • Employers can be held for creating a "hostile work environment". This includes hostility over email.
    • Employers can be held responsible if the expose credit cards via email
    • If you have trade secrets and are not try to actively protect the secret, you going to have a bad day.
    • Good luck mitigating legal liability if your company runs into any legal troubles via email, and during discovery is revealed that they didn't do anything to stop it because some HR person doesn't understand anything.

The short answer here is if you care, you need to get your companies legal team involved now. I can almost guarantee any business lawyers you tell this too will give you there full support to turn this back on.

If you feel strongly enough, and your political position is good enough, you can even review your companies insurance policies. Legal liability for a company will quickly trump any HR drones feelings.

All that being said, you company may very well have no monitoring policy on users. In that case, you don't monitor emails, a program filters emails out.

Not the answer you're looking for? Browse other questions tagged or ask your own question.