Employer monitoring of your activity

Another thread raised the issue of company monitoring of employee's computer activities. Regardless of your feelings about privacy you should be aware of the following (copied from my web site):

* Adding your own security features (or, at some companies, any type of software) will probably get you fired. Any special security requirements should be addressed by your company's IT department.

* The federal Electronic Communications Privacy Act (ECPA) gives employers the right to monitor all e-mail traffic and Internet activity on the company system. Assume you have no privacy rights.

* Don't record rumors, speculation or opinions (and jokes and cartoons can be considered opinions) that you aren't prepared to defend in court.

*Don't assume you can delete all records of files or activities you don't want the boss to see. Email messages and files that reside on or pass through an office LAN almost certainly have copies that are beyond your control. Even a non-networked computer could contain stealth hardware or software to monitor your activities... Spector or KeyGhost for example.

* An American Management Association study found the number of companies conducting some form of "active monitoring" of their employees is at 74 percent and email monitoring is 38 percent. Even without deliberate monitoring, inappropriate activities are often discovered by accident or as the result of legal proceedings.

End quote.............

Outside the United States your rights and responsibilities may differ but risking your job to play games or visit porno sites is stupid in any country.

Just to add to the post:

1) Ask for a copy of the company's computer and internet policy so that you know what you can and can not do.

2) If there is a must have program that you need for work let the IT dept or your boss know that you need it and get their answer in writing. This will protect you if later on they complain as to why you loaded the program or if they denied you and now wonder why there are problems.

3) Make sure that anything you write with your work computer is something that if broadcasted to the world would not get you or anyone else in trouble. This includes jokes, gossip or just ranting about the stupid meeting your boss or co-worker held.

4) Some places allow you to access the web on your breaks so while you can check your personal e-mail (web based) Keep in mind all of the above and that anything you reply to may be read by someone at your work.

I am sure that there are more things that can be added to this but I will let that task be done by others.


Doc

Doc makes some good points. I would like to add to his paragraph 3.

Quote:

---

3) Make sure that anything you write with your work computer is something that if broadcasted to the world would not get you or anyone else in trouble. This includes jokes, gossip or just ranting about the stupid meeting your boss or co-worker held.

---

That includes getting your company in trouble. Even if it is true, if publication would be embarrassing, don't type it. Once typed, it can be darn near impossible to eliminate all traces. If you want details read the Disk Security page on my web site but, in short, file systems don't delete data and applications often make copies you don't know about.

People have gone to jail based on "deleted" email and businesses have failed because confidential documents were published.

You can never be too safe so do like one of my friends and use the bosses computer when he is supposed to be at work, but has snuck off to be with his girl friend. It helps that the dummy writes his log on and password down on his phone list along with the combo to the safe. :D

I have dealt with two (well, officially three, but two for the purposes of this discussion) entirely different, 180-degree opposite-from-each-other monitoring situations in my work environments in the past year.

The first was when I was a software tester at a company last year. I was allowed to visit any site on the 'net, and my coworkers and I certainly did. We were informed through various meetings that they could see exactly what sites and URLs we visited, but nothing was prohibited. Some of my coworkers were downloading full-length movies (of all kinds) and running filesharing programs. The only thing that was prohibited in my department, the QA dept (but not other departments) was IM. So, I visited what sites I visited fully aware they could see exactly what links I had gone to. I was also very watchful of what things came through the mail server to my Outlook 6. That company ultimately laid off hundreds of us at the same time to try to revive profitability (although what sites we had visited had very little to do with it).

The second is my current situation, a support position that has a lot of potential for advancement - it's a growing company. Support personnel are NOT allowed to surf any sites outside those directly related to the technology we are working with. Nothing is forbidden by the network, you can type any URL in and go to the site - but if you're caught it's a reprimand. For frequent nethounds like me that's like dangling candy just out of reach, nyah nyah. The lack of Google especially is difficult sometimes. (Side note: I may be moving to a Systems Administrator position in the next week or two weeks - in which one of my duties would be to monitor network activity.) WinVNC is the program of choice for monitoring, and it's pretty much all-powerful. I have never tried to get around the rules, I know what monitoring is like, whether it's via backdoor trojan client or legitimate programs like pcAnywhere.

My third situation in the past year involved just surfing when bored from a computer that was there for record keeping purposes, email, and research on the net. No monitoring whatsoever.

Is there any way to (stealthily) detect if your employer is monitoring surfing?

have a look at this selection of sniffers..

http://neworder.box.sk/codebox.links.php?&key=sniff

Quote:

---

Originally posted by Dickster
Is there any way to (stealthily) detect if your employer is monitoring surfing?

---

The best way would be to simply ask - the IT department, the sysadmins, whoever would be monitoring. If they're cool they'll just tell you - whether they can see what sites you visit (my first situation) or whether they can see everything you see and everything you type (my current situation).

However, they don't have to tell you.

If you have the ability to with the current system setup, follow these instructions to see what processes are running on your system. Any monitoring programs whether trojans or legitimate will be running as a server on your system, and the person monitoring is running the client. You are serving the information to the other party, they are just watching:

Click Start->Run->Type MSInfo32->Click OK or hit enter.

That will bring up your System Information.

Click Software Environment->Running Tasks.

That will tell you all processes currently running on your system.

There will probably be some you don't recognize and don't know where they come from or what they're a part of. My suggestion is to google the names of any .exe's you don't recognize to find out what they are a part of, that is what I do.

WinVNC and most, if not all, other legitimate monitoring programs have an icon in the taskbar so you know they're running.

If you're good at the low level stuff - you could always simulate traffic between yourself and the boss's wife - just to see who's paying attention :)

Quote:

---

Originally posted by Dickster
Is there any way to (stealthily) detect if your employer is monitoring surfing?

---

Not really. If they have a proxy server (and just about any significant company does), it logs everything and the only question is whether anyone actually looks at the logs. Even without a proxy it would be possible to grab HTTP and FTP URLs in transit and log them without it being visible to either end of the connection. That normally wouldn't be worth the effort though.

Quote:

---

Originally posted by IMM
If you're good at the low level stuff - you could always simulate traffic between yourself and the boss's wife - just to see who's paying attention :)

---

Not a good idea where I live. In Texas it is too easy to get shot for messing around with another man wife, rather the affair is true or not. :(

Quote:

---

Originally posted by Tuttle


Not really. If they have a proxy server (and just about any significant company does), it logs everything and the only question is whether anyone actually looks at the logs. Even without a proxy it would be possible to grab HTTP and FTP URLs in transit and log them without it being visible to either end of the connection. That normally wouldn't be worth the effort though.

---

I'm guessing that's the situation here. There is an official policy about using work PCs for personal tasks, but everyone I work with has surfed "unofficial" sites at one time or another. (Like this one, for instance ;) ) I've also listened to net radio for months now, and no one from IT has complained.

FWIW, the way it happens where I work is something like this - every month a report is generated from the proxy logs which rates both domains and users by total transfer size, and that goes to the IT and HR managers. The top few on each list get looked at closely, and everything else is pretty much let go (unless you get on somebody's nerves and they're looking for a way to get rid of you). The end effect of the users list is that some personal surfing is fine, but if you go overboard then it attracts attention. The idea of the domains list is to make it painfully obvious if something similar to Webshots starts going through the company - people use it for a month, it leaves the rest of the list for dead in terms of bandwidth consumption, and then it gets blocked.

Considering the wealth of DLL's most applications use, how would you determine if there's a DLL tied into your system which does the monitoring?

Quote:

---

Originally posted by VerLux
I have dealt with two (well, officially three, but two for the purposes of this discussion) entirely different, 180-degree opposite-from-each-other monitoring situations in my work environments in the past year.

The first was when I was a software tester at a company last year. I was allowed to visit any site on the 'net, and my coworkers and I certainly did.

{trimmed}

That company ultimately laid off hundreds of us at the same time to try to revive profitability (although what sites we had visited had very little to do with it).

---

I'm not surprised at the layoffs. This sort of behavior is non-productive, and is conducive to business failures. Good thing for the loafers that I'm not the CEO of the companies where employees are involved in this sort of "Creative Loafing", else there would have been a lot more layoffs, a lot sooner, and maybe the companies would not have gone out of business.

Do you people, the ones doing the surfing that is, think that it is OK to waste the company time doing this sort of thing?

At my place, we do not actively monitor user activity because that would be too much, but if we see that someone is using quite a bit of bandwidth, we would look into 'why?'. Everyone is aware that we "may" monitor, but it looks they don't believe us :D

In other words play safe ;)

Quote:

---

Originally posted by Techguy
At my place, we do not actively monitor user activity because that would be too much,
{Trimmed}
In other words play safe ;)

---

I sent my son an E-Mail at his military E-Mail address, and he chastised me and told me not to do it again. I gather the military monitors such, and personal E-Mails are not approved.

The Military IG and ORI inspections also look for misuse of the military computers. Games on the computer, such as Wolfenstein, Doom, or Pinball, will get a write-up. Each base has its own method of monitoring for such, so as to prevent the Inspectors from nailing the base for misuse.

And, of course, the bottom line is that productivity is the key to success, whether Military or Civilian; and gaming, netsurfing, personal E-Mailing, and chat rooms is obviously non-productive.

BTW - Courts have ruled that the FBI can install key loggers if they have obtained a search warrant. Even if you encrypt data, they can probably determine the secret key. So, without extrodinary efforts on your part, nothing is private on either your or your employer's computer.

I have no sympathy if you are breaking the law or wasting company resources, but most of us have secrets we don't want the boss or our spouse to know (e.g., looking for a job at the competition). If there's something you don't want the world to know, DONT RECORD IT ON A COMPUTER.