Hacker News Reader

Comment by zeveb | Hacker News Reader

The owner of a computing device has ultimate rights to the device. If your employer owns your computer, he has every right to inspect his device and ensure that you are not misusing it. He has every right not to permit you to connect a personal computing device to his network, and he has every right to inspect the packets you send on his network. This ought to be uncontroversial.

It should be taught in school: Don't use your work accounts for personal stuff, and don't use your personal accounts for work stuff (I'd go even further and say don't have just one personal account for everything).

View on HN

What load of BS. I don't see how my agreement to their policy should provide them with immunity to what would otherwise be criminal. e.g. That it's criminal to steal from my employer should not mean that if they suspect an employee is stealing from them they can without repercussion steal-back.

Likewise they may have certain legal rights if an employee violates their computer-usage policy -- but that shouldn't give them the right to violate the CFAA.

Checking whether an employee "completing their professional tasks" and reading their private correspondence are very different things. How is this any different (aside from prefixing the word computer) then if you had personal letters on your desk and a manager confiscated them from you (and read them) - in order to "confirm" that you were using "completing their professional tasks".

The employee was using the same messenger session for both professional and personal actions. Part of the ruling was that it was reasonable for the employer to check the logs of the session, because it was ostensibly being used for professional actions.

> His employer had discovered that he was using Yahoo Messenger for personal contacts, as well as professional ones.

> Because it believed it was accessing a work account, the judges said, the firm had not erred.

EDIT: Removed unnecessary remark.

I've worked at places where they set any pcs on the domain to accept their ssl cert. Then they mitm all your https traffic and scan everything. That would include banking, gmail, etc.

Best not to do that stuff at work. You also have to wonder about the internal wifi people put their phones on.

> that shouldn't give them the right to violate the CFAA

The key issue here is the definition of authorized access. If you create a contract with your employer whereby they give you money and you authorize them to access your digital communications (via an explicit policy) then their access is not unauthorized.

> The key issue here is the definition of authorized access. If you create a contract with your employer whereby they give you money and you authorize them to access your digital communications (via an explicit policy) then their access is not unauthorized.

Yes, for example the corporate gmail terms of use explicitly states that your employer has rights to any communications contained therein.

But I would be extremely surprised if someone logging into their personal Gmail account at work would constitutes a 'right' for an employer to access that account (and potentially look through years of personal correspondence) to verify that they were "completing their professional task" - essentially access without authorization (at least in the pre-internet days where these would have been physical letters) would have equated to theft of personal property.

> I don't see how my agreement to their policy should provide them with immunity to what would otherwise be criminal.

But it wouldn't be. It's their computer. If I use your computer, you have every right to examine every file I created while using it; you have every right to install a keylogger; it's your computer (whether it would be decent to do those things is a different subject).

It's not private correspondence if you conduct it in public; it's not private computing if you do it on someone else's computer. If you want privacy, use your own device.

Reply on news.ycombinator.com