RE: CRIME Surreptitious software

From: Forensic Computer Service, Inc. (sales@private)
Date: Fri Apr 30 2004 - 12:58:38 PDT


First let me state that I am not an attorney, so this should not be taken as
legal advice.

In the business arena my experience has been it is lawful to install
whatever one wants on equipment providing the company owns it, with the only
acceptable provision being that it may not invade personal privacy.  Video
cameras, for example, can be installed to monitor employees but are not
permissable in bathrooms, or other places where people have a "reasonable
expectation of privacy".

Some companies/organizations explicitly state in their policy manuals that
such monitoring/recording may be done by the company.

I'm sure there are those that will disagree with me that in Missouri we
monitored (in another life of mine) and recorded, without any previous
warning, calls made by the sales department.  Our counsel approved this
because no employee has any reasonable expectation of privacy while using a
phone system and phone lines owned by the company.

From your Email I see you are with a government agency.  I would hope they
have published policies on installing and using spyware on employees, but I
certainly don't know what's permissable and what's not in Federal, State and
local government operations.

While I personally find what you said they did below offensive, in the
private business world I see this alot and it's based on the premise that
the employee is using a company owned computer to perform his/her job
functions on company time and getting paid for it.

I would consider taking the facts and the hard evidence, up the
chain-of-command (in writing of course) and either it will be stopped and
someone gets in trouble, or, you will get told it's policy.  Either way you
force the issue to get resolved not just for your benefit but for everyone
else who works there.

Regards,

G. Chatten
FCS

-----Original Message-----
From: owner-crime@private [mailto:owner-crime@private]On Behalf Of
Rob Magee
Sent: Friday, April 30, 2004 1:36 PM
To: crime@private
Subject: CRIME Surreptitious software


Yesterday, the network team botched a silent install of Resource Monitor
(resourcemonitor.com) on my computer when I logged in. I noticed it when I
had to reboot after the install conflicted with MS's handwriting and speech
module for Office and crashed.
This software is aimed at monitoring staff application use, but goes a step
further by adding screenshot capture and keylogging.
My question is, is it legal to have silently installed keylogging software,
even though that feature may not be enabled? My understanding is that
keylogging is the digital equivalent of wiretapping, but I need some
clarification.
Thanks all.
You can respond to me at:
Rob Magee
Outreach Helpdesk Team
Oregon Department of Education
(503) 378-3600 ext. 4495
robmagee100@private <mailto:robmagee100@private>



This archive was generated by hypermail 2b30 : Fri Apr 30 2004 - 13:16:16 PDT