1

Does a company have the right to sniff all the traffic on their network irrespective of whether it contains personal data of employees if they show a warning message which states "...are subject to having their activities on the system intercepted, monitored and recorded."

  1. Does US law states anything about this?
  2. Does company policy enforcement with such a warning override the right to not be subject to surveillance?

migrated from security.stackexchange.com Jan 27 '17 at 0:17

This question came from our site for information security professionals.

  • @georgebailey The question is not about legal implication of an action rather validity of an Risk Management Policy in accordance with US law. If you believe that it is out of scope in Infosec Community, please help me migrate the same to law community. Thanks. – hax Jan 26 '17 at 20:02
  • Don't know about US, but in the UK it is legal provided you properly warn people. – paj28 Jan 26 '17 at 20:07
  • 1
    Absolutely. Employees shouldn't be doing personal web browsing at work. By using the machine you consent to monitoring. If they're using an SSL/TLS proxy then you have to trust their CA. I never understand why people are so surprised by this. – RoraΖ Jan 26 '17 at 20:07
  • @hax, #1 and #2 seem to ask if it's legal, so yes it belongs on Law.SE and not IT Security. You could Flag the question asking a moderator to migrate. – George Bailey Jan 26 '17 at 20:09
  • 2
    @RoraΖ, Trusting the CA (to overcome standard HTTPS protections against this) is something that might already have been completed if the company is providing hardware. Of course if the company were providing the hardware then they could use other activity monitoring tools as well. (e.g. screen scraping) – George Bailey Jan 26 '17 at 20:11
4

IANAL, and as @GeorgeBailey suggests, you should ask one. That said, some aspects of your question are directly addressable with what we know.

Does US law states anything about this?

Yes. Federally this falls under the Wiretap Act, 18 U.S.C. §2511. Workplace monitoring generally falls under either the "System Administrator Exception" or under Consent. In general, continuing past a banner constitutes consent.

Does company policy enforcement with such a warning over ride the right to not be subject to surveillance?

In general, yes. You don't need to use the companies network if you don't want to consent - and they don't need to hire you if you don't want to use their network. But it's their network, and their rules apply.

There are some nuances, and courts have found that the wording of the notice has made a difference in some cases, but overall, if the systems are properly posted with banners, then the employer may capture communications. See the "Bannering and Consent" section of this article from cybertelecom.org, e.g.:

Even if no clicking is required, a user who sees the banner before logging on to the network has received notice of the monitoring. By using the network in light of the notice, the user impliedly consents to monitoring pursuant to 18 U.S.C. § 2511(2)(c)-(d).

Note that stored data is covered by different laws than communications. It's a nuance.

Is it ethical to sniff all the data without giving any other warning than the logon banner?

"Ethical" is a very different question than "Legal", and largely more subjective. Most employers require signed consent for monitoring as a condition of employment, and use banners thereafter. That is ethical by my definition, in that it meets or exceeds the requirements of the law, and does not mislead or use subterfuge. The tone of your question suggests you find it distasteful, and therefore probably it violates your personal code of ethics.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.