Ethan is correct to point out the exception to the ECPA.
Sections 2511 and 2520 of Title 18 of the U.S. Code create criminal and civil liability for improper interception of wire, oral and electronic communications. Although there are exceptions under both the U.S. Code and under state laws for system providers, relying on these exceptions is unnecessary if your company puts in place an appropriate Monitoring Policy. By explicitly requiring user consent to monitoring, your company can make access to your network and systems conditional on users accepting such monitoring. All users of your network and systems (whether employees, third party contractors or customers) should be required to consent to monitoring.
Your Monitoring Policy should specify that your company has the right to monitor all network traffic and all data stored on equipment used for company purposes that is provided to an employee or contractor by the company or by any third party contractor. Both your authorized use policy ("AUP")(governing internal and contractor use) and your terms of service ("TOS")(governing third party use) should reference this policy and explain it. In addition to informing users via the AUP and the TOS, logon banners should reference the Monitoring Policy and state that access to the network or system is subject to monitoring at any time and for any reason, and that by accessing and using the network or system, the user is explicitly agreeing to such monitoring. Also, any contracts with third parties for the transmission of data belonging to that third party or any user or customer of that third party should require that third party to consent to such monitoring on behalf of its users a!
nd customers and to indemnify your company for any damages resulting from such consent.
Monitoring traffic and behavior on your systems can allow you to detect misconduct in real time, and can create logs that will be useful in an investigation and/or prosecution. Monitoring can also decrease behavior such as employee web surfing or other violations of the AUP.
In the future, the increased use of personal technology (e.g., cell phones, PDAs, etc.) to access corporate systems will require increased and more specific consents. If, for example, you open up your document management system so that it is web accessible, an employee with a PDA and a wireless modem can download confidential information. Access to that system could require explicit consent from the user to monitoring of the activity and an agreement to provide access to the PDA on demand. (Note, such access will be easier if your company owns the PDA and provides it to the employee.)
John
================
Important They-Can-Subject-Me-To-Disciplinary-Proceedings-(Or Worse)-If-I-Don't-Include-This Disclaimer: This message provides general information and represents the my views. It does not constitute legal advice and should not be used or taken as legal advice relating to any specific situation.
attached mail follows:
This archive was generated by hypermail 2b30 : Mon Jul 16 2001 - 11:26:31 PDT