Hacker News Reader

Comment by bdcravens | Hacker News Reader

That sounds great, but if a CEO has that level of accountability, you better believe they will want some enforcement powers to ensure no one is doing anything illegal.

"Pardon me, RcouF1uZ4gsC, it's time for your monthly scan of your computer and mobile device. Please provide all passwords to any services you login on those devices. Remember, your contract dictates that failure to comply results in immediate termination. Please take unpaid time off while we perform our scan."

View on HN

You write this like it's a dystopia, but that has been a standard practice at every decently-sized company I've worked at.

Does this not happen right now? If you have a company issued device you have no expectation of privacy on that device

I do have. I expect my employer not to snoop on the files on my work laptop, nor unnecessarily read any emails I send with my work account.

I'm not from the US so maybe that's grounds for the different expectations. And I'm not sure if my employer would actually be breaking any laws snooping on the laptop; I certainly hope so.

I think that's a little unreasonable -- it's their laptop, and their work email account, not yours.

Yes, but it's me who's using the tools, and it's my privacy that is on the line. Same goes for watercooler chat and papers on my desk, it's not different just because it's done with a computer.

I'm not sure what the situation is in the US, but here email is given the same legal status on secrecy of correspondence as old-school snail mail has. There is a way for employer to legally read emails in case of e.g. espionage suspicions, but that requires a note and follow-up with a public privacy official.

I argue that it's "you-as-employee" whose privacy is on the line, not "you-as-individual". I expect my employer to own the work I do -- that's the contract I agreed to. As they own the work, and the systems used to generate it, it seems reasonable they have unlimited access to what I'm doing.

(I do like the required notifications through HR, but it doesn't sound like that is a prerequisite to ask permission, even in more privacy-stringent places)

Here in Norway privacy matters. Just because the laptop and email account belong to the company it doesn't mean that the boss can just rummage around in it.

For instance, many years ago I was Unix sysadmin and needed to get some work done on a machine using information that been emailed to one of my colleagues. Normally I would have just given the work to him but he was on holiday and this was urgent. The information needed was in his email but I couldn't just ransack his email. I had to ask the admin of the email system to open up that account and find the relevant email for me and copy that information. The admin in turn had to notify HR that he was doing this and justify it.

Generally all this works perfectly well.

I do work for a small company, but no way my company can access any information on my machine. Any kind of company relevant code is submitted to a central git repository by me on a daily basis, but if I'm fired, the data on that machine is gone. It is protected by full disk encryption set up by me, and I know the only password to it. My contract contains no obligations for me to unlock it.

Is this unreasonable on a work computer? Any company with a well calibrated SIEM is already logging everything you do and firing off alerts when suspicious behavior is happening

Reply on news.ycombinator.com