Is Google hangouts encrypted? Would my work's IT guys be able see pictures and text I send while on a work computer? Yes I know I shouldn't be sending stuff I don't want them to see while at work, but it wasn't at work. I use hangouts on my phone as well and just realized I use the hangouts Chrome plug-in at work and it was syncing all my conversations.
-
6@logixologist That doesn't actually prove they are doing that though. Even if it was something so obtuse that it convinced you it was scanning what you wrote, you can't really prove that it was. You very well might be right, but let's stick to facts and not assumptions and anti-Google biases.– patricksweeneyCommented Aug 21, 2014 at 20:44
-
6@patricksweeney that's pretty much their business model: targeted ads. Whether that's evil is personal opinion, of course. Regardless, it doesn't really have anything to do with what the OP is asking.– DA.Commented Aug 22, 2014 at 5:19
-
3@logixologist Google is quite open about analyzing site content (including, of course, user-generated content on Google sites such as Gmail) to select which ads to show: see 1 2 and 3. The real question is, (1) what are the limits of what these "automated systems" do with the information, and (2) can any humans access the information?– Kyle StrandCommented Aug 22, 2014 at 20:12
-
1In other words, those who trust Google are trusting it to limit its use of such information to the obvious functionality- and ad-related uses, rather than to, say, store it and/or sell it to other companies.– Kyle StrandCommented Aug 22, 2014 at 20:13
-
3@logixologist: "This means they transcripted it and then sent me unsolicited targeted ads based on a keyword." They did, of course, tell you they were going to do that when you signed up and accepted the T&C's. You may not have "solicited" their sending you ads, but you did consent to it.– T.J. CrowderCommented Aug 23, 2014 at 12:06
|
Show 3 more comments
6 Answers
You should assume that they can. There are various ways they can do it, but whether they actually do it depends on company's standards and practices. Some of the options:
- It's possible to install additional root certificates on company's machines and use that to MITM all the traffic (traffic goes through company's gateway/proxy anyway, and having friendly root certificate on user's PC allows to do a full MITM);
- It's possible to install "employee monitoring software", which is essentially a key logger + process monitor + screen grabber. Some tools have capacity to locally intercept received messages in chats.
- It's possible to use remote access/collaboration tools to monitor what's happening on the screen of a particular PC.
In short, if you don't have control over the PC you're working on (and with company's workstations you typically don't), you cannot assume it's free from such surveillance implants.
Hope that's not too scary :)
-
2Good points, you could deep packet inspection technology too Commented Aug 20, 2014 at 6:27
-
4Echoing the above, technically its perfectly feasible. Practically, does the data actually get looked at? As a Sysadmin myself, I would suspect not. Even on slow days, there's lots more interesting stuff to do than see if we can catch a co-worker doing something they shouldn't! :D– GeoSwordCommented Aug 20, 2014 at 9:27
-
14@fjw It would be considered legal in the U.S. because almost every employer has their employees sign an Acceptable Use Policy that will include a provision stating something like "You have zero expectation of privacy on our network and/or hardware, and all of your communications are subject to monitoring". So the employees are giving consent to the employers to do this.– CraineCommented Aug 20, 2014 at 13:54
-
2Anyway, laws don't spring into existence just because it would seem sensible and consistent to have them, they exist because someone wrote them and Congress passed them. In practice that generally happens because someone lobbied for them. In the case of most copyright law that "someone" is Disney (actually more than just Disney, but media), and Disney isn't all that interested in SSL. And finally the company might not (legally speaking) circumvent SSL anyway, since the employee has chosen to use the company's root certs, that authorise the company's proxy to present itself as any domain. Commented Aug 21, 2014 at 0:01
-
4The only confusing part of this to me is why someone might think they have a "right" to misuse company resources. Commented Aug 23, 2014 at 20:26
Yes if your Google Hangouts data has synced onto your work computer the IT department could view it. However don't freak out yet, unless they are looking for it, it's extremely unlikely that they will see it.
There are three places that the IT Department could see it:
In Transit
When syncing your hangout data if your IT Department monitors traffic over the network they could have seen it. As BigBob1000 says it's encrypted (HTTPS) however many enterprises install trusted certificates on their computers and then basically Man-in-the-Middle their own computers to decrypt all HTTPS traffic. Chances are even if they were doing this they would not have recorded the data, just that you connected to Google.
At Rest
This is a more plausible issue but still incredibly unlikely, Chrome (all browsers) cache things. So rather than downloading the same image from Google a hundred times it downloads it onto your computes hard drive once, then uses that each time. I'm not sure what Chrome caches for hangouts, but an educated guess would be that it's profile pictures of your contacts and other images but not the text of your conversations.
You can clear your cache your IT Department might still have a backup but most places don't backup desktops, only servers.
In Memory
Honestly I'm just putting this one in for completeness. EDIT: After seeing Andrey's answer, he brings up a good point, this is more plausible than I though. There could be employee monitoring software that records chat logs.
-
1I think more common than any of those would be screenshots at x (or random) intervals (for the actual content) - "In Transit" is going to be more likely implemented first. Commented Aug 20, 2014 at 17:52
-
@user2813274 screenshots are probably the most efficient and fool proof way to control what the user is actually doing.– DavidmhCommented Aug 24, 2014 at 11:24
-
There's also the issue that even if technically able (likely) they may not be legally allowed to do so (under some jurisdictions, personal communications are confidential, and if you haven't signed some blanket statement...). So if they accidentally logged it and you discovered that, you might have a good case against them for spying.– ÁngelCommented Aug 24, 2014 at 19:59
-
@Ángel Even assuming that's true, I don't really think it's relevant. If they see something they don't like, they can fire you. At that point, you're likely to have a long, expensive, and painful, battle. So, for all practical purposes, you should assume they can and will do it, and that you don't have any re-course. Commented Aug 25, 2014 at 8:25
-
@Patrick-m, I don't consider it too relevant to questioning if they can (I agree he should have his chats not synced), but it's interesting on the issue if they will actually go so far to do that (secretly, without notifying you). That something is illegal can be a good incentive not to do it :)– ÁngelCommented Aug 25, 2014 at 21:31
While it's certainly possible, the more applicable question is "how likely is it that my IT department cares?" (Unless you're doing something that could get you fired or arrested, naturally.)
In addition to that, the other consideration is that it costs a lot of money to actually store everyone's web traffic, so the content of messages and web requests is generally not stored for any significant period of time - it costs a lot of money to store that information and make it searchable, and there's rarely any business reason to do so.
Take it from an IT guy - you're not that interesting, and I resent requests to "look into" other employees' activities. I have better things to do than spy on people's social media use or web browsing, so even when I'm explicitly directed to do so, I don't look any harder than I have to in order to comply with my orders. At my workplace, that involves emailing off a canned report to the requester with high level stats on a user's activities - how many web requests made over a certain period, which domains those requests were made to and a break down of those requests by website category - and this is only when I can't get away with saying "no" to requests about what some employee is doing online.
answered Aug 20, 2014 at 13:39
-
Not every I.T. guy feels the same as you. I bet you could come up with that one gung-ho donkey in your organization that would relish the experience of catching someone abusing company resources as part of their job. Commented Oct 30, 2015 at 12:40
-
@Kristopher Sure, that's why I said the more applicable question was whether the IT department cares. I don't. Other people/jackass control freaks might. Commented Oct 30, 2015 at 14:11
If your company has a product named "Google Vault" installed then yes your IT department, or anyone granted access to Vault, can read your unencrypted Hangouts messages and pictures.
Google Vault is an eDiscovery platform - https://support.google.com/vault/answer/2462365?hl=en
The only way they would not be able to read your Hangouts messages is if you have turned the history "off" for each chat. In Google Chat this option is named "Chat off the record". In Hangouts it is named "Hangout history". Anything typed after turning off the history is not recorded.
To see what your IT people can see: Open your Gmail in the Chrome browser and click on the "Chats" label found after expanding the "More" button. Deleting what you find in this label won't help you because once it exists it exists forever or until the Google Vault policy expires it.
-
3@Jack implies that he isn't using his company Google Apps account to send personal messages over Hangouts. As I understand, if he is using his personal account then the company can't access his Hangout chats through the Vault. Unless, of course, I'm missing something. Commented Aug 24, 2014 at 22:18
Yes - you really should assume that anyone can read anything you do online anywhere, anytime. If they own the network then doubly so. If they own the computer you're using, triply-so-with-knobs-on.
From another angle, if you are doing stuff on the work computer or in the work environment that you don't want work to know about, you probably shouldn't be doing it. Murphys law tells us this WILL go wrong for you at some point.
Assuming the IT department are models of benevolent permissiveness and/or ignorant/incompetent, it only takes one colleague who takes a dislike to you (possibly because you spend too much damn time on hangouts when you should be working, f'rexample) to peer over your shoulder, or one computer crash mid-session, or some unexpected computer virus, or a new and exciting bug in Google Hangouts that brings your machine down, to expose whatever it is you didn't want to be exposed.
Then again, by the sound of it, the day your mobile phone gets lost/stolen someone has a load of great blackmail material on you anyway. The problem with things you put on the internet is that they're on the internet.
Depends....easy way is to simply ask the I.T. department:
You: hi, I'm curious if our IM chats and emails are backed up or stored for compliance reasons. If I need to recover a chat from google hangouts for legal reasons, is it possible?
I worked in finance where 100% of all communication was recorded in our office as per government regulations including phone calls, chats on any IM client(we had a special software dedicated to it), etc.
Chances are you are not actively monitored but your browsing habits might trip an office firewall for repeated violations which may cause some scrutiny if it's ridiculous(tons of porn, obscene bandwidth usage, constant upload/downloading 24/7 such as torrents or spotify).
Emails yes if you are using thier domain or sending to a work email domain.
EDIT: one thing to watch out for is building security. If the I.T. department set up or paid for the cameras like I did, we can 100% spy on you at any time and even have zone triggers to alert us. One D-bag I know got building security to record entry times to tag late workers without them knowing despite the company merely being a renter. If you can,tell security to deny any requests to access that information from a third party becuase it will be used against you if possible.
-
Strict country, or a sell-side trading floor: "I worked in finance where 100% of all communication was recorded in our office as per government regulations including phone calls, chats on any IM client."– Ellie KCommented Aug 22, 2014 at 21:14
-
USA....we got fined heavily for missing records so the company records everything. If your company has piss poor storage/recording and you get targeted by regulators....your gonna have a bad time. Commented Aug 26, 2014 at 16:46