Before employee leaves the company, its manager is responsible to get all the company data stored (by leaving employee) on another computer, then IT takes the computer and wipes all the drives, with at least two persons present.
A big portion of one of my information security jobs involved looking at employees' browsing history and emails daily. Sometimes to investigate potential misconduct (something dumb like a manager wanting to see if someone's slacking off, or something serious like suspicion of stealing information), but usually to investigate potential security issues (like if we believed a computer visited a malware-associated web page, we wanted to see how the computer ended up there).
In the US, pretty much no one bats an eye that this is considered necessary and normal. Employees who don't want to be snooped on are free to use their personal devices at work, like their phones, which of course we have no access to. But it's considered very normal that if an employer gives you a computer to use for work, that they can inspect that computer and data to and from it. No one has a feeling of their privacy being violated, because there's no expectation of privacy when using someone else's (the company's) property.
For infosec operations people in European countries, how are these things handled? How do you investigate potential breaches which originate from endpoints? Do you have to ask the employee if you can look at their browsing history? What if it's a potential misconduct investigation, where tipping someone off may result in destruction of evidence?
Excellent. Now you only have to remove the expectation of privacy in any situation from the social norms, and another big problem will be solved. You will be able to live under total surveillance without anyone feeling that their privacy is being violated, because there was no expectation of privacy to begin with.
An alternative hypothesis (crazy, I know...), is that the power imbalance in favor of the rich went very far in the US, which means that the poor have no safety net or ability to organize, so they are completely at the mercy of the whims of corporations for survival. And so, they will accept many indignities without bating an eye.
Do people in EU countries expect to use any other of their employer’s equipment for personal reasons?
Every single second that you are working, you know that your employer might be looking over your shoulder. It's like living under a microscope. For me, this is an indignity. Having to work in such circumstances would probably drive me to deep depression.
> Do people in EU countries expect to use any other of their employer’s equipment for personal reasons?
Within reason, sure. I would say that the main value that underlies all EU countries (not that we realize it perfectly, or even get close to it, of course!) is that human beings are the most important thing.
I find mainstream American values increasingly inhumane.
Within reason, sure. I would say that the main value that
underlies all EU countries (not that we realize it
perfectly, or even get close to it, of course!) is that
human beings are the most important thing.
Still, I just... would never feel "entitled" to use my employer's property for personal uses. And I wouldn't have an expectation of privacy. When I care about privacy, I simply use my own device.
Now, let me be clear. The reality of working in America is that people use their work computers for personal uses all day long. Generally nobody cares, as long as you're getting your work done.
And if somebody really needs to do something personal, they can always just whip our their phones. If I was printing out some concert tickets at work, I'd use my employer's printer. Everybody does this. But if I was going to send some sexy messages I wouldn't do it with work equipment.
So, I don't know. I just don't see the problem. There are many many problems with America, and many ways in which Europe does things better IMO. I just don't see this as one of them.
I'm not saying this is always the case in the EU, though. Obviously there is equipment where for many reasons it's absolutely vital that you don't use it for anything personal. I'm not supposed to run a torrent client on the company server, for example. You can't just "borrow" a company car for a personal trip. But when I happen to use the laptop that the company has assigned to me to work on, to do a bank payment, my boss has absolutely no business knowing the details of that transaction.
I would be okay with them knowing I visited the banking site on company time (if I used their equipment, their DNS, etc) but not with decrypting the SSL encrypted data I'm exchanging with the bank or obtaining it in some other way such as a keylogger.
Though again, I'd probably avoid the issue entirely by using my own device and data connection if I didn't trust my employer. (I'm a bit spoiled, working in IT: I'd probably know if my employer was doing shady things with the data)
How did this work? I presume they had a whitelist of Internet banking sites. But, do you really think their whitelist would include every Internet banking site in the world? I doubt it.
In addition, everyone has a personal computer in their pocket they can use if they want privacy.
I do agree that there should be more requirements to look at data, though. Managers requesting bullshit fishing expeditions to see if an employee is slacking off should be required to submit some sort of evidence before making the request. That never sat right with me, or anyone on my team. But for security issues, there was no question that there was an absolute necessity and justified reason to look at that information.
I'm asking because my concern is maybe European corporate infosec people really aren't managing, here, and are blind to some ongoing major security issues.
It's a weird idea that you have to be a complete robot at work and only ever do work things.
But the official position of the company can’t be “everyone use the company’s resources as they see it for personal use”. So it’s best to just say company resources are for company. What if someone gets hurt using company machinery for personal use? In the US, that would be cause for the company’s workman’s compensation insurance premiums to increase. Why would an employer want that kind of headache?
In practice, from doing many of these investigations, no one bats an eye or gives a single shit about what kind of non-work activities you're doing. The visit to the ticket website would just be a few entries in a long list of other web visit entries, which we'd quickly scroll past while trying to find the thing we're actually looking for (usually malware-related traffic).
Ah, but it's not someone else's device now is it? It's a corporation's device and corporation's have lobbied for laws that specifically prevent individuals for being liable for the colorations actions. If they aren't liable for the actions of said corporation, why should this be treated as two people's opposing rights of property vs privacy rather than a non human entity's property rights vs a humans privacy rights?
This is not an EU-wide regulation. The UK is currently a member of the EU, and this practice is legal in the UK. Employees do not have the expectation of privacy on employer owned equipment.
(Please, lets not devolve into a conversation about Brexit, it's an unrelated tangent)