Hacker News Reader

Comment by normalnorm | Hacker News Reader

> No one has a feeling of their privacy being violated, because there's no expectation of privacy when using someone else's (the company's) property.

Excellent. Now you only have to remove the expectation of privacy in any situation from the social norms, and another big problem will be solved. You will be able to live under total surveillance without anyone feeling that their privacy is being violated, because there was no expectation of privacy to begin with.

An alternative hypothesis (crazy, I know...), is that the power imbalance in favor of the rich went very far in the US, which means that the poor have no safety net or ability to organize, so they are completely at the mercy of the whims of corporations for survival. And so, they will accept many indignities without bating an eye.

View on HN

Expecting to have the same rights as if using your own devices when using someone else’s device that they are paying you to perform work on qualifies as an indignity to me.

Do people in EU countries expect to use any other of their employer’s equipment for personal reasons?

Of course. It's completely normal to use company stuff for your own things, within reason. I print tickets or whatever at work, from my work laptop. Everyone does that, and no one cares so long as it's not abusive.

It's a weird idea that you have to be a complete robot at work and only ever do work things.

No one cares if you print tickets at work. But the nature of communications, malware, and legal risks to an organization via computers makes it so monitoring computer activities makes sense to me.

But the official position of the company can’t be “everyone use the company’s resources as they see it for personal use”. So it’s best to just say company resources are for company. What if someone gets hurt using company machinery for personal use? In the US, that would be cause for the company’s workman’s compensation insurance premiums to increase. Why would an employer want that kind of headache?

I agree, but I think if you do that, you should accept the employer having the right to potentially be able to see that information.

In practice, from doing many of these investigations, no one bats an eye or gives a single shit about what kind of non-work activities you're doing. The visit to the ticket website would just be a few entries in a long list of other web visit entries, which we'd quickly scroll past while trying to find the thing we're actually looking for (usually malware-related traffic).

> Expecting to have the same rights as if using your own devices when using someone else’s device that they are paying you to perform work on qualifies as an indignity to me.

Every single second that you are working, you know that your employer might be looking over your shoulder. It's like living under a microscope. For me, this is an indignity. Having to work in such circumstances would probably drive me to deep depression.

> Do people in EU countries expect to use any other of their employer’s equipment for personal reasons?

Within reason, sure. I would say that the main value that underlies all EU countries (not that we realize it perfectly, or even get close to it, of course!) is that human beings are the most important thing.

I find mainstream American values increasingly inhumane.

US law holds the employer responsible for what happens on their computers. No one cares to if you check your email every now and then or read the news. But how can an organization protect itself from the myriad ways someone can damage the computer or others on the network without monitoring it?

In addition, everyone has a personal computer in their pocket they can use if they want privacy.

Yes, yes. There is always some legal reason with you guys. Somehow we manage here in Europe. Go figure...

But how do you manage? That's why I wanted to hear from infosec operations people who work in Europe. Security breaches can be a massive risk for an organization, and there are undoubtedly a lot of serious security issues, which could've turned into something much worse, that my team at my old job would've missed if we had absolutely no right to look at network and web traffic from a company computer.

I do agree that there should be more requirements to look at data, though. Managers requesting bullshit fishing expeditions to see if an employee is slacking off should be required to submit some sort of evidence before making the request. That never sat right with me, or anyone on my team. But for security issues, there was no question that there was an absolute necessity and justified reason to look at that information.

I'm asking because my concern is maybe European corporate infosec people really aren't managing, here, and are blind to some ongoing major security issues.

    Within reason, sure. I would say that the main value that
    underlies all EU countries (not that we realize it
    perfectly, or even get close to it, of course!) is that
    human beings are the most important thing.

American here: I strongly agree. And I don't like giving more power to corporations. They have too much already, and I believe that strong labor movements are one way to fight this.

Still, I just... would never feel "entitled" to use my employer's property for personal uses. And I wouldn't have an expectation of privacy. When I care about privacy, I simply use my own device.

Now, let me be clear. The reality of working in America is that people use their work computers for personal uses all day long. Generally nobody cares, as long as you're getting your work done.

And if somebody really needs to do something personal, they can always just whip our their phones. If I was printing out some concert tickets at work, I'd use my employer's printer. Everybody does this. But if I was going to send some sexy messages I wouldn't do it with work equipment.

So, I don't know. I just don't see the problem. There are many many problems with America, and many ways in which Europe does things better IMO. I just don't see this as one of them.

There's a difference between using the computer and expecting privacy on it. It's entirely possible that you're not supposed to use certain equipment for personal use, but if you do it anyway, that doesn't erode your right to privacy.

I'm not saying this is always the case in the EU, though. Obviously there is equipment where for many reasons it's absolutely vital that you don't use it for anything personal. I'm not supposed to run a torrent client on the company server, for example. You can't just "borrow" a company car for a personal trip. But when I happen to use the laptop that the company has assigned to me to work on, to do a bank payment, my boss has absolutely no business knowing the details of that transaction.

I would have to agree. A company decrypting my encrypted traffic would not be okay.

I would be okay with them knowing I visited the banking site on company time (if I used their equipment, their DNS, etc) but not with decrypting the SSL encrypted data I'm exchanging with the bank or obtaining it in some other way such as a keylogger.

Though again, I'd probably avoid the issue entirely by using my own device and data connection if I didn't trust my employer. (I'm a bit spoiled, working in IT: I'd probably know if my employer was doing shady things with the data)

How would the company know you’re just using it for a bank payment as opposed to running a torrent client without having the ability to monitor activity?

That's interesting. I did work for a company, that had itself registered as a certificate authority on the computer's browser, and for most sites, e.g. Wikipedia, it would use its own certificates and presumably monitor what you were looking at, but for internet banking, it didn't intefere.

> but for internet banking, it didn't intefere

How did this work? I presume they had a whitelist of Internet banking sites. But, do you really think their whitelist would include every Internet banking site in the world? I doubt it.

>Expecting to have the same rights as if using your own devices when using someone else’s device that they are paying you to perform work on qualifies as an indignity to me.

Ah, but it's not someone else's device now is it? It's a corporation's device and corporation's have lobbied for laws that specifically prevent individuals for being liable for the colorations actions. If they aren't liable for the actions of said corporation, why should this be treated as two people's opposing rights of property vs privacy rather than a non human entity's property rights vs a humans privacy rights?

Reply on news.ycombinator.com