🚀 go-pugleaf

In article <15110@ccncsu.ColoState.EDU> conca@handel.cs.colostate.edu (michael vincen conca) writes:

   Aproximately 1 month ago, a certain employee was advised that he/she was
   was acting in an inappropriate manner and that they needed to make 
   certain adjustments in their attitude.  A meeting was held between the head
   manager and this employee in which the above issue was discussed.  All of
   this was summarized in a memo which was E-mailed to the employee.

   Yesterday, this employee was terminated.  He/she was allowed to gather
   their things and purge all of their personal files from the system.  Today,
   my boss asked if it would be possible to retrieve this employee's E-mail
   off of backup, find the memo, and print it out in case it was needed as 
   evidence in a possible court case.

   Now for the tough questions.
	   Is this legal?  Is this ethical?  If this person still worked
   here, I would immediately refuse.  But since they don't, do they still
   have any rights to their E-mail?  Right now, I am leaning towards refusing
   because I think a person's E-mail is theirs, regardless of their status
   with the organization.  Anyone have any other opinions on this?

If the manager cc'ed himself or even kept a copy of the email he sent the
employee, he could certainly keep that copy for a possible court case.  Of
course, the cc'ed version would be "better", but since any and all of this
could be easily forged in a text editor, I don't think it matters much.

I question the wisdom of using email for this kind of task anyway.  Anyone
using email should assume:

    -  It is not secure

    -  Anything sent from one individual to another, no matter how private,
       can be read and even rewritten, prior to delivery, by a cracker

    -  Anything a cracker can read, a cracker can email to someone else or
       post in a newsgroup

Once when doing some maintenance on the email system at Prime, I came across
a fairly sensitive personal email (regarding employee performance) from a
director or VP in engineering, so I had a talk with him about email security
and as I recall he sent a memo out saying what I am about to say:

    -  Unless you're willing to risk the message not getting through, being
       willfully changed by another person, and/or being publicized,

           PRINT A MEMO ON PAPER, VERIFY IT YOURSELF (VISUALLY) (or your
           trusted secretary can do this, of course), AND DELIVER THAT PIECE
           OF PAPER, NOT AN ELECTRONIC VERSION!

    -  Once you've printed such a memo via a computer, immediately delete the
       online version.  Something that sensitive shouldn't be online unless
       you've got a super-secure system, and even then, why take the risk when
       retyping it, even if necessary, is so trivially easy?

IF this matter had been handled via memo, especially on letterhead, instead of
via email, it would be a lot more difficult for an employee to successfully
argue in court that he or she never received it.

And, to look at things from another point of view, you don't want to find out
that an employee you just fired for not following through on your email'ed
command indeed did NOT receive the email because the mailer was in a bad mood
that day!

In summary, to take an extreme but fairly wise viewpoint:

    YOUR COMPUTER SYSTEM IS LIKE A FANCY BULLETIN BOARD.  ELECTRONIC MAIL
    IS LIKE POSTINGS ON THE BOARD WITH THE RECIPIENT'S NAME ON AN OTHERWISE
    BLANK SHEET ON TOP.  IF YOU WOULDN'T COMMUNICATE WITH SOMEONE ON A TOPIC
    VIA SUCH A TECHNIQUE, then DON'T RELY ON A COMPUTER.

(I.e. the recipient might never see it; someone else, even everyone else,
might read it; someone might change it before the recipient sees it; the
recipient might read it and pretend to never have seen it; etc.)

This extreme viewpoint is probably best for those in management who are
unacquainted with computers and unlikely to even notice if their accounts,
email boxes, etc have been tampered with.  (Basically, anyone who might
respond to an email message purporting to be from "Your System Administrator"
saying "For security reasons, please change your password to XYZZY" by
doing it!)
--

James Craig Burley, Software Craftsperson    burley@gnu.ai.mit.edu

In <15110@ccncsu.ColoState.EDU> conca@handel.cs.colostate.edu (michael vincen conca) writes:

>Yesterday, this employee was terminated.  He/she was allowed to gather
>their things and purge all of their personal files from the system.  Today,
>my boss asked if it would be possible to retrieve this employee's E-mail
>off of backup, find the memo, and print it out in case it was needed as 
>evidence in a possible court case.

>Now for the tough questions.
>	Is this legal?  Is this ethical?  If this person still worked
>here, I would immediately refuse.  But since they don't, do they still
>have any rights to their E-mail?  Right now, I am leaning towards refusing
>because I think a person's E-mail is theirs, regardless of their status
>with the organization.  Anyone have any other opinions on this?

I believe (in the UK at least) that an e-mail message has the same
legal status as a phone call, ie. none. 

But I might be wrong.

It certainly isn't ethical and would be most miffed if I knew people
were doing this to me! 

	Tim
-- 

In post <15110@ccncsu.ColoState.EDU>, conca@handel.cs.colostate.edu (michael vincen conca) says:
!!I am the system administrator for a group of research scientists in the
!!psychology department here.  Today I was presented with a rather touchy
!!situation:
!! [...Deleted...]
!!Today,
!!my boss asked if it would be possible to retrieve this employee's E-mail
!!off of backup, find the memo, and print it out in case it was needed as 
!!evidence in a possible court case.
!! [...Deleted...]
!!	Is this legal?  Is this ethical?  If this person still worked
!!here, I would immediately refuse.  But since they don't, do they still
!!have any rights to their E-mail?  Right now, I am leaning towards refusing
!!because I think a person's E-mail is theirs, regardless of their status
!!with the organization.  Anyone have any other opinions on this?

I see two possible answers here, depending in large part on your school's
past attitudes:

A)  All data on the system belongs to the school, regardless.  Under this
assumption, retrieving the memo would be in line with previous school policy.
If I were asked to restore something of this nature, I would do so, but only
after recieving a WRITTEN request from MY BOSS.  After all, the system belongs
to the school, not to me.

B)  Data is considered private.  In this case, I would not retrieve the memo
unless ordered to do so by someone VERY high up, as this would mark a
significant change in school policy.  Again, I would demand such a request in
writing.  The system still belongs to the school, but the school has
previously stated (or heavily implied) that the data belongs to individuals.

Maybe as a "way out" -- is there a draft copy on any backup?  A draft would
belong to the writer (in this case, the manager), so I see no problem in
restoring that.

And as a final step, TEACH YOUR USERS THAT EMAIL IS *NOT* THE PLACE FOR
IMPORTANT DOCUMENTS OF THIS TYPE.  AND TEACH THEM TO CC: THEMSELVES ON **ALL**
EMAIL!  Had a secretary typed up such a memo, you can be *DAMN* sure s/he
would have kept a file copy.
-- 
Jeff Leyser                                     jeffl@ncoast.org
Opinions?  I thought this was typing practice!  leyser@tsa.attmail.com

> All of
> this was summarized in a memo which was E-mailed to the employee.

	As I'm sure everyone agree's this was foolish to begin with.
 
>  Today,
> my boss asked if it would be possible to retrieve this employee's E-mail
> off of backup, find the memo, and print it out in case it was needed as 
> evidence in a possible court case.
> 
> Now for the tough questions.
> 	Is this legal?  

	Ask the institution's lawyers.  Chances are, however, that they have
never thought of these issues before.

> Is this ethical?

	For you?  If I did this, I'd log the session to a printer.  Better yet,
instruct your boss how to do it, and have him/her do it, all while logging to a
printer.  However, your boss may explode on this one.

> If this person still worked
> here, I would immediately refuse.  But since they don't, do they still
> have any rights to their E-mail?  

	This policy should be written somewhere.  Chances are it isn't, so meet
with the lawyers and get this done!
	This policy should be tailored to the prevailing customs of the
institution.  I don't think there is a "correct" answer to this.  Some may say,
the employee owns nothing, some may say everything in his/her account or any
file with his/her ID code is owned by the employee, or that ownership is given
up upon backup, or that the mail file is sacred...

	My short term suggestion is for you to do it, but before hand devise a
way to search for the file with a minimum exposure of its contents to your
eyes.  Then log your session's actions to a printer, and include it with a
printout of the file.  Don't give your boss only an electronic version. 
Perhaps have the boss print it from hir/her account.  But do this all from the
console terminal as it gets logged.

James
+----------------------------------------------------------------------------+
| James Peregrino                        |     JPEREGRINO@HBSSTG.HARVARD.EDU |
| Programmer/Analyst                     |       PEREGRIN@HULAW1.BITNET      | 
| Science & Technology Interest Group    +-----------------------------------+
| Harvard Business School                | HBS neither expresses nor implies |
| Boston, MA 02163                       | any warranty in any of the        |
| Voice:(617)495-6307 FAX:(617)495-0351  | opinions or alleged facts herein. |
+----------------------------------------------------------------------------+

Here are some legal considerations (disclaimer: I'm not a lawyer):

At least for conventional letters, the sender owns the copyright, but
the recipient owns the letter. If e-mail is to be given the same
status as conventional mail, the note (and its backups) belong to the
person who was fired.

The Electronic Communications Privacy Act of 1976 protects e-mail.
According to some experts (see the current IEEE Software), e-mail
privacy can be legally violated if notice is given (whether such
a violation is ethical is a different question.) In your case, no
notice was given, so you might be in violation of the ECPA.

Also, a person who works for a public university has a constitutional
right to privacy even with respect to school property. [From the ACLU
handbook on the Rights of Teachers:]

"An anonymous cartoon had appeared in a local newspaper ridiculing the
financial and personnel policies of the Fair Lawn, New Jersey, Board
of Education by depicting the board members a poker players,
apparently gambling away employees' salaries and jobs. Suspecting the
guidance counselor as the offending cartoonist, a board member entered
the guidance counselor's school at night, found a janitor with a pass
key, directed him to unlock the door to the guidance counselor's
suite, and observing a slightly opened drawer in the guidance
counselor's disk, pulled it completely open, revealing copies of the
cartoon. The court ruled that this action violated the guidance
counselor's Fourth Amendment rights."

The worst thing that could happen is that the e-mail is retrieved and
then a new policy is set up to retro-justify the retrieval (i.e. "The
boss can look at anyone's email for any reason at any time.")

- Carl

references: Excerpts from the ECPA of 1986 are available via anonymous
ftp from eff.org as file academic/ecpa.1986 (also see file academic/README).
-- 
Carl Kadie -- kadie@cs.uiuc.edu -- University of Illinois at Urbana-Champaign

kadie@m.cs.uiuc.edu (Carl M. Kadie) writes:

>The Electronic Communications Privacy Act of 1976 protects e-mail.

	Not to my knowledge. It "protects" cellular phones (if something
can be said to be "protected" by deterrence) because they are a service
provided by a common carrier - I don't believe it says anything about
e-mail at all.

	All the time, USENET seems to entertain itself by hypothesizing
about The Law, and what it SHOULD or should not do, but the sad fact of
the matter is that the legal system is designed so that the only way to
make a really meaningful statement of fact about a situation is to feed
a lawyer and get a decision.

	In other words, your e-mail is not protected, unless you're
willing to hire a lawyer bigger and meaner than the other guy's -
maybe then you have a chance.

mjr.

>kadie@m.cs.uiuc.edu (Carl M. Kadie) writes:
>>The Electronic Communications Privacy Act of 1976 protects e-mail.
                                                ^^^ typo, that should be "1986"

mjr@hussar.dco.dec.com (Marcus J. Ranum) writes:
>	Not to my knowledge. It "protects" cellular phones (if something
>can be said to be "protected" by deterrence) because they are a service
>provided by a common carrier - I don't believe it says anything about
>e-mail at all.

The ECPA of 1986 explicitly protects e-mail privacy. (It also, of
course, tries to protect cellular telephone privacy.) Excerpts of the
e-mail-related sections are available via anonymous ftp from eff.org
in file academic/ecpa.1986.

- Carl
-- 
Carl Kadie -- kadie@cs.uiuc.edu -- University of Illinois at Urbana-Champaign

In article <15110@ccncsu.ColoState.EDU> conca@handel.cs.colostate.edu (michael vincen conca) writes:
>Today,my boss asked if it would be possible to retrieve this employee's E-mail
>off of backup, find the memo, and print it out in case it was needed as 
>evidence in a possible court case.
>

IMHO, if the sender failed to keep a copy, he's SOL!

Why do you feel that a person's civil/privacy rights depend upon whether
he's still employed.  Are terminated employees lesser beings?


 
-- 
   <================================><===============================>
   || Christopher Landers           || PURDUE UNIVERSITY - KRAN 708 ||
   || Krannert Computing Center     || West Lafayette, IN  47907    ||
   <=================== landers@zeus.mgmt.purdue.edu ================>

burley@albert.gnu.ai.mit.edu (Craig Burley) writes:

 -  Unless you're willing to risk the message not getting through, being
       willfully changed by another person, and/or being publicized,
 
           PRINT A MEMO ON PAPER, VERIFY IT YOURSELF (VISUALLY) (or your
           trusted secretary can do this, of course), AND DELIVER THAT PIECE
           OF PAPER, NOT AN ELECTRONIC VERSION!
 
    -  Once you've printed such a memo via a computer, immediately delete the
       online version.  Something that sensitive shouldn't be online unless
       you've got a super-secure system, and even then, why take the risk when
       retyping it, even if necessary, is so trivially easy?


This is not entirely true.... mail encryption IS available and is available
for EASY use also. Encryption cuts down on chances that a "cracker" who has
access to your account, can read your mail. Unless he/she has the key....
But that does not stop them from deleting the mail. Of course any good
"cracker" wouldn't tamper with mail, as to not leave any footprints....
But there ARE people out there to destruct, sooooo....       
	True the paper version is probably safer, but since you have
purchased that multimillion dollar machine, and you also have concern
for the environment, why not do it on the ole 'puter? You would have to shred
any paper memo that was to "personal' also.... Its all a hassle to be private.

The following is the relevant sections (I think) from the ECPA of 1986, as
codifed in Title 18, United States Code.  Note particularly section
2702(b)(2), which allows access upon permission by the originator as well
as the recipient.
 
HOWEVER:  the sysadmin who asked the question works for a university,
which is sure to have staff counsel.  USE THEM.  Get a REAL opinion from
the lawyer already being paid for legal advice!

I can't empahsize that enough.  We can all easily find the federal law,
but several states have their own laws that need to be considered and the
institution may actually have thought about this and have policies (yes, I
know I'm probably dreaming.)

////excerpt begins/////

  CHAPTER 121.  STORED WIRE AND ELECTRONIC COMMUNICATIONS AND 
                  TRANSACTIONAL RECORDS ACCESS 
 
s 2701.  Unlawful access to stored communications
 
(a) Offense. Except as provided in subsection (c) of this section
whoever
 
    (1) intentionally accesses without authorization a 
facility through which an  electronic communication service is 
provided; or 
 
    (2) intentionally exceeds an authorization to access that 
facility; and thereby obtains, alters, or prevents authorized 
access to a wire or electronic communication while it is in 
electronic storage in such system shall be punished
as provided in subsection (b) of this section.
 
(b) Punishment. The punishment for an offense under subsection (a)
of this section is- 
 
    (1) if the offense is committed for purposes of commercial 
advantage, malicious destruction or damage, or private commercial
gain
 
      (A) a fine of not more than $ 250,000 or imprisonment for
not more than one year, or both, in the case of a first offense 
under this subparagraph; and
 
      (B) a fine under this title or
imprisonment for not more than two years, or both, for any 
subsequent offense under this subparagraph; and
 
    (2) a fine of not more than $ 5,000 or imprisonment for not
more than six months, or both, in any other case. 
 
(c) Exceptions. Subsection (a) of this section does not apply with
respect to conduct authorized- 
 
    (1) by the person or entity providing a wire or electronic 
communications service; 
 
    (2) by a user of that service with respect to a communication
of or intended  for that user; or 
 
    (3) in section 2703, 2704 or 2518 of this title. 
 
  CHAPTER 121.  STORED WIRE AND ELECTRONIC COMMUNICATIONS AND 
                  TRANSACTIONAL RECORDS ACCESS 
 
s 2702.  Disclosure of contents 
 
(a) Prohibitions. Except as provided in subsection (b)- 
 
    (1) a person or entity providing an electronic communication 
service to the public shall not knowingly divulge to any person or
entity the contents of a communication while in electronic storage
by that service; and
 
    (2) a person or entity providing remote computing service to
the public shall not knowingly divulge to any person or entity the
contents of any communication which is carried or maintained on
that service-
 
      (A) on behalf of, and received by means of electronic
transmission from (or created by means of computer processing of
communications received by means of electronic transmission from),
a subscriber or customer of such service; and
 
      (B) solely for the purpose of providing storage or computer
processing services to such subscriber or customer, if the provider
is not authorized to access the contents of any such communications
for purposes of providing any services other than storage or
computer processing. 
 
(b) Exceptions. A person or entity may divulge the contents of a
communication-
 
    (1) to an addressee or intended recipient of such
communication or an agent of such addressee or intended recipient;
 
    (2) as otherwise authorized in section 2517, 2511(2)(a), or
2703 of this title; 
 
    (3) with the lawful consent of the originator or an addressee
or intended recipient of such communication, or the subscriber in
the case of remote computing service; 
 
    (4) to a person employed or authorized or whose facilities are
used to forward such communication to its destination; 
 
    (5) as may be necessarily incident to the rendition of the 
service or to the  protection of the rights or property of the 
provider of that service; or
 
    (6) to a law enforcement agency,
if such contents- 
 
      (A) were inadvertently obtained by the service provider; and
 
      (B) appear to pertain to the commission of a crime. 


--
            <<<< insert standard disclaimer here >>>>
riddle@hoss.unl.edu                  |  Nebraska Inns of Court
ivgate!inns!postmaster@uunet.uu.net  |  +1 402 593 1192
Sysop of 1:285/27@Fidonet            |  3/12/24/9600/8N1/V.32/V.42bis

kadie@m.cs.uiuc.edu (Carl M. Kadie) writes:

>The ECPA of 1986 explicitly protects e-mail privacy. (It also, of
>course, tries to protect cellular telephone privacy.) Excerpts of the
>e-mail-related sections are available via anonymous ftp from eff.org
>in file academic/ecpa.1986.

>Carl Kadie -- kadie@cs.uiuc.edu -- University of Illinois at Urbana-Champaign

Could somone who has access to these file please send me a copy as i cant
get that far accross the net. 
thanks in addvance.
Shane.

In article <15110@ccncsu.ColoState.EDU> conca@handel.cs.colostate.edu (michael vincen conca) writes:
>   Yesterday, this employee was terminated.  He/she was allowed to gather
>   their things and purge all of their personal files from the system.  Today,
>   my boss asked if it would be possible to retrieve this employee's E-mail
>   off of backup, find the memo, and print it out in case it was needed as 
>   evidence in a possible court case.

I won't cover the legal aspects, since I'm not a lawyer.  Things I do
know (all of this is SMTP mail):

	1) It is possible to forge E-Mail with VERY LITTLE effort.  I
	   have done it in the past and it is UNTRACEABLE.
	2) I don't think that it is admisable evidence in a court of
	   law since it can be tampered with in a number of ways.
	   First, I can edit the mbox file (or whatever) once I get
	   the mail.  Second, Just because a mail message has user
	   foo as the sender doesn't mean that user foo sent the mail
	   message (see #1).

Basically, you can't prove that a given piece of e-mail was actually
sent by the person who claims it was sent by, unless someone saw them
send the mail message.  It is not possible, in general, to even prove
that someone got a copy and read the mail.  The accused could very
easily deny ever getting the mail message.  Unless you saw the person
read the mail, you can't prove that he did, even if you can show the
mail in his in box and then later in his out box.  User interfaces can
do some odd things to mail.  Also, the accused could argue that you
tampered with the evidence (you do have the capability to do that
(even if you wouldn't) since you are root).

Unless you gave this person a paper copy of the Memo on some official
looking letterhead, then I'd say that you wouldn't have very strong
evidence to be used in a court of law.  It would boil down to your
word against his (which is what it was before).

VMS's mail system has similar holes, btw.

Warner

P.S.  Privacy enhanced mail doesn't solve most of these issues,
although it makes it harder to forge mail (but not completely
impossible).
-- 
Warner Losh		imp@Solbourne.COM
The question to everyone's answer is usually asked from within

Something just doesn't smell right when an employer posts a notice
saying that all email may be read by the administration. It seems a
cheap way to avoid lawsuits, rather than a more difficult--but better
for the employees--policy that email is private.

I won't work for a company that doesn't value their employees enough
to let their email stay private.

Perhaps privacy enhanced mail will make a big difference.
Unfortunately, although people want to distribute free PEM, some
companies have tied it up with patent infringement threats.

Oh, well...

Sean



-- 
** Sean Casey  <sean@s.ms.uky.edu>

[...let me preface by saying the following are my personal
	opinions only and have no connection to Boeing...

    I also don't want to fan any flames, so please take a 
    Valium or something before you melt the keys down with
    an indignant response to anything below...it just an
    opinion, guys...]

It's so fun to hear the wanna-be lawyers spouting their
opinions (oh, why not...I wanna-be too :-) )

Whether the company, school, etc. has grounds to fire or
not gets determined in court maybe based on the available
evidence and should be a separate question.

It seems that the forgery-possibility issue is the big one
related to the possible court appearance in the feature.
All a lawyer has to do is say "hey...my guy never got it
so he never knew...you have a copy he signed to prove that
the contents were gone over with him?" and the co. has a 
problem related to the integrity of the e-mail message.

(speaking from company folklore and not as an employee or
representative of my employer, I hear my current employer
does everything in person on letterhead on paper for that 
reason and probably others like "ensuring the employee 
really knew their behavior was unacceptable and there were
risks...etc").

the fun part is the issue of "can a system manager go into
e-mail for info at any time?".  At a commercial company,
I believe the answer is "perhaps" with a leaning toward
"probably" if the circumstances and internal procedures make
it appropriate to do so.  

I also personally believe that snooping around anywhere
for the hell of it just because you have the system privs to
do so is both inappropriate and bordering on unethical.

[...no flame wars about "who are you to determine when the 
time is right to do so" please...each person's interpretation
is different.

also no flames about "but it doesn't matter what the 
company says, it's not right" because a company's handling 
of internal matters via procedure has an easy appeal 
procedure...sue the company for violating (insert legal 
right here) in their procedures...]

My *understanding* of the situation *here* is that everything
you create and the facilities you use to create them are
the property of the company and that they can basically do
what they wish (again, my understanding of the procedures
rather than my personal reading of them) within bounds.
There are explicit procedures related to what is an acceptable
(and unacceptable) use of company resources in general
and computing in particular with the possible penalties
for violating them spelled out. All employees have to abide
by the procedures or they won't be employees for too long.

And the answer is "no...there aren't any internal net.police
out there reading mail" or I'd have heard about it in 4+ years
of running systems and networks here.

(unless they're REAL good...  hey, maybe I should go through
 MY mail just to be safe and destroy the backup tapes...
yeah, that's the ticket...Ollie North might still be working
if he had done so, right ?)

-- 
----------------------------------------------------------------
                         Vince Skahan   
 vince@atc.boeing.com                  ...uw-beaver!bcsaic!vince
        	(lifelong Phillies fan...pity me)

In article <15110@ccncsu.ColoState.EDU> conca@handel.cs.colostate.edu (michael vincen conca) writes:
>Now for the tough questions.
>	Is this legal?  Is this ethical?  If this person still worked
>here, I would immediately refuse.  But since they don't, do they still
>have any rights to their E-mail?  Right now, I am leaning towards refusing
>because I think a person's E-mail is theirs, regardless of their status
>with the organization.  Anyone have any other opinions on this?

You're right. It is a tough question.

It seems to come down to two parts though - does whoever owns the hardware
have a right to read another another persons mail reqardless if that person
still has access to the mail.

Let me phrase my opinion by phrasing the question another way.  Suppose
you go accross the hall, tell your boss Joe that you want to write a letter
to your sweetheart during your lunch hour, and you need to borrow a piece 
of paper, a stamp, an envelope and a pen from Joe Boss.  With these items 
you go back to your office and write the letter. Now, Joe Boss gets
mad at you for some reason or another and fires you before you have a chance
to mail the letter (you accidently leave it on your desk).  DOES JOE BOSS
HAVE THE RIGHT TO OPEN AND READ THE MAIL EVEN THOUGH IT HE LITTERALLY OWNS
EVERYTHING IT WAS WRITEN ON-BY-IN. Absolutly not. The mail should be 
returned to you.  If you would like to let Joe read it then (or even have
a copy of it), then it is YOUR DECISION - NOT YOUR EX-BOSS'S.

Perry Lee Statham	Can
statham@cactus.org		You
(512) 335-3881 <h>			Grok
(512) 467-1396 <w>				It?

I recently asked my boss about e-mail privacy and several days later he
forwarded to me some news articles which described several employees who
had sued their company because of "eavesdropping" on their e-mail which
they considered private. The employees lost. The couts sided with the
company: basically speaking, the computers, the network and their use
belong to the company. Since the employees also work for the company,
then they should not use e-mail fro private business/use.

-- 
  Philip Yzarn de Louraille                 Internet: yzarn@chevron.com
  Research Support Division                 Unix & Open Systems
  Chevron Information & Technology Co.      Tel: (213) 694-9232
  P.O. Box 446, La Habra, CA 90633-0446     Fax: (213) 694-7709

conca@handel.cs.colostate.edu (michael vincen conca):
> 
> Now for the tough questions.
> 	Is this legal?  Is this ethical?  If this person still worked
> here, I would immediately refuse.  But since they don't, do they still
> have any rights to their E-mail?  Right now, I am leaning towards refusing
> because I think a person's E-mail is theirs, regardless of their status
> with the organization.  Anyone have any other opinions on this?
> 
> 								-Mike
> 

Mike,

I think that your approach is the correct one.

(The original errors were in sending the notice via email in the
first place, and that was compounded by not having a copy.  But that
is neither here nor there.)

What I would do is


a.  may a copy of the backup tape so that it can be archived in
    storage.

b.  state your position to the supervisor.  It would be nice if you
    had a copy of the university's (computer center) policy on this
    handy, or 

C.  Suggest that the both of your work with the University's Personnel
    department and Legal Counsel to see what options are available.
    You may end up with a very big meeting with a lot of folks
    involved; certainly university computer service folks.

D.  My own suggestion is that it is best to leave the backup tape
    untouched (and untouchable) and restore the files only in the face
    of real legal action.  The supervisor doesn't really NEED the copy
    NOW, s/he just wants it to cover his/her ass IN CASE.  Well, the
    ass is uncovered, and we've all got pictures of it.  So learn s/he
    should learnd to walk around that way with pride and dignity --
    s/he might just start a fashion trend !!

In all likelyhood, the employee will go off and get another job
elsewhere.  If there is an appeal, then the supervisor will have to
admit to a less than perfect implementation of his/her decision (not
really a serious error in any case -- since there must be other
documentation on the case).  At this point, you would get to the first
NEED for a document, and the whole thing would be brought up as in C,
but C would have prepared everyone for this in anycase and may have
even thought up an answer.  

See ya
Steve

>ECPA of 1986
>  CHAPTER 121.  STORED WIRE AND ELECTRONIC COMMUNICATIONS AND 
>                  TRANSACTIONAL RECORDS ACCESS 

This does not give any thing of much use for protecting privacy.
We know that computer privacy should be protected, but the law 
is not powerful enough to guarantee that. I guess the words 
"electronic communication in electronic storage in an electronic 
system" can be stretched to include email, although the excerpts
have not mentioned the words "computer" or "mail" one single time.

>(a) Offense. Except as provided in subsection (c) of this section

Note the exceptions the violators can worm their way into.

>    (1) intentionally accesses without authorization a 
>facility through which an  electronic communication service is 
>provided; or

The key here is "without authorization". The boss can authorize 
any thing in a company, since he owns the company and the computers.
So how do you determine what is autorized and what is unauthorized? 

>(c) Exceptions. Subsection (a) of this section does not apply with
>respect to conduct authorized- 
>    (1) by the person or entity providing a wire or electronic 
>communications service; 

Who is providing the email service? Is it the system administrator? 
If so, the law says that he can read any one's mail. It is kind of 
like no privacy from the mail man. Is the company's boss, or the 
company itself providing the email service, along with all the computer 
equipment? if so, then the boss can have any one's email read. That is 
like saying that the federal government can read any one's US mail, since
it is providing the service.


-KHUSHRO

So much news,  so little time ...

In article <15110@ccncsu.ColoState.EDU> conca@handel.cs.colostate.edu (michael vincen conca) writes:
[stuff about when is it legal/ethical to read email].

Here is what our Personnel department says, based upon various legal documents
and privacy seminars she, er, they have attended:

email and files in users directories are treated the same as employees desks.
They may contain "private" stuff, or stuff necessary to company operations.
Like desks, computer files are not the employee's property.  BUT, if the
company (university, etc) gives the employees the impression that it is
private, then goes and looks, an invasion of privacy suit could hold up.

So I publish a memo once or twice a year that says this: files are not private.
We have the right to look at them any time we think it is necessary to carry
out our jobs; especially since we have certain obligations to the net.

But I also tell my employees this: if I ever catch them poking around in other
peoples files without good business reasons, they will be terminated
immediately.  They have more important things to do with there time.

Our legal counsel and our personnel department agree with this policy.


-- 
kral * 408/647-6112 *               ...!uunet!drivax!braun * braun@dri.com
Whoever is calm and sensible
	is insane
		-- Rumi

braun@dri.com (Kral) writes:
[...]
>Here is what our Personnel department says, based upon various legal documents
>and privacy seminars she, er, they have attended:

>email and files in users directories are treated the same as employees desks.
>They may contain "private" stuff, or stuff necessary to company operations.
>Like desks, computer files are not the employee's property.  BUT, if the
>company (university, etc) gives the employees the impression that it is
>private, then goes and looks, an invasion of privacy suit could hold up.

>So I publish a memo once or twice a year that says this: files are not
>private.
>We have the right to look at them any time we think it is necessary to carry
>out our jobs; especially since we have certain obligations to the net.

Disk space should be given the same status as desk space. But, are you
giving disk space its due?

Many universities, as a matter of policy, say explicitly that faculty
and student office space is *private*.

- Carl

p.s. What obligations to the net require you to deny privacy to
faculty and students?

-- 
Carl Kadie -- kadie@cs.uiuc.edu -- University of Illinois at Urbana-Champaign

In article <15110@ccncsu.ColoState.EDU> conca@handel.cs.colostate.edu (michael vincen conca) writes:
>
>Yesterday, this employee was terminated.  He/she was allowed to gather
>their things and purge all of their personal files from the system.  Today,
>my boss asked if it would be possible to retrieve this employee's E-mail
>off of backup, find the memo, and print it out in case it was needed as 
>evidence in a possible court case.
>
>Now for the tough questions.
>	Is this legal?  Is this ethical?  If this person still worked
>here, I would immediately refuse.  But since they don't, do they still
>have any rights to their E-mail?  Right now, I am leaning towards refusing
>because I think a person's E-mail is theirs, regardless of their status
>with the organization.  Anyone have any other opinions on this?
>
>								-Mike
>

Assuming that the system is one that is provided by the employeer (not a
"Public" facility.  Then IMHO it is legal.  The employeer owns the contents
of that system including mail.  

Is it ethical, yes.  I tell all of the users on my systems that I can and will
read anything that gets put on the system.  My main reason for doing this is
to ensure that they know that mail is not secure.  If I where you I would
point out to your boss that e-mail should not be used used for that kind
of memo.  I have never gone snooping in users mail ( I have work to do) but
I would not hesitate to do so if I had any reason to.

If I was your boss and I ask you to get something out of somesones mail
box for a good reason like the one stated and you refused to do it, you
would be the next guy out the door.  And it wouldn't matter it the person
still worked for the company or not.

On the other hand if the boss did not have a good reason for snooping then
I would resist.  If he/she insisted I would do it but I would make sure that
the person that was being snooped found out about it.

Again this only applys to systems that are owned and operated by the 
company for employees to do company work on.  Public systems are a whole
differant ball game.


-- 
---------------------------------------------------------------------
David Hoopes                              Tallgrass Technologies Inc. 
uunet!talgras!david                       11100 W 82nd St.          
Voice: (913) 492-6002 x323                Lenexa, Ks  66214        

In a very, very confusing article, Mike Conca writes:

>I am the system administrator for a group of research scientists in the
>psychology department here.  Today I was presented with a rather touchy
>situation:

and it is explained:

>Aproximately 1 month ago, a certain employee was advised that he/she was
>was acting in an inappropriate manner and that they needed to make 
>certain adjustments in their attitude.  A meeting was held between the head

Whose attitude is being adjusted? The ones complaining or the one acting
inappropriately?  It is clear that either could expect the other to
change, but not clear which is complaining.

>Now for the tough questions.
>	Is this legal?  Is this ethical?  If this person still worked
>here, I would immediately refuse.  But since they don't, do they still
>have any rights to their E-mail?  Right now, I am leaning towards refusing
>because I think a person's E-mail is theirs, regardless of their status
>with the organization.  Anyone have any other opinions on this?

>								-Mike

Is all the E-Mail owned and read collectively, or is it considered 
the property of each person?  Did all the people involved quit 
at the same time? 

--------------------------------------------------------------------
Scott McMahan  mcmahan@cs.unca.edu      #include <stddisclaimer.h>
---------------------------------------------------------------------

In article <7129@cactus.org> statham@cactus.org (Perry L. Statham) writes:
   In article <15110@ccncsu.ColoState.EDU> conca@handel.cs.colostate.edu (michael vincen conca) writes:
   >Now for the tough questions.
   >	Is this legal?  Is this ethical?  If this person still worked
   >here, I would immediately refuse.  But since they don't, do they still
   >have any rights to their E-mail?  Right now, I am leaning towards refusing
   >because I think a person's E-mail is theirs, regardless of their status
   >with the organization.  Anyone have any other opinions on this?

   It seems to come down to two parts though - does whoever owns the hardware
   have a right to read another another persons mail reqardless if that person
   still has access to the mail.

Finally someone in this long thread has chosen to comment on the ethical
issue, and has enough sense to know that the law and the economy do not
determine ethics.  People have been fired for opposing the monitoring of
email (as, I'm sure, people have been fired for refusing to monitor
paper inter-office mail).  You take your chances.  Civil liberties may
not be important to you, or you may be desperate to keep your job.
Nonetheless, if users have been given the impression, explicitly or
by implicit convention, that they are using an unmonitored channel of
communications, it seems unethical to make use of that channel's
incidental characteristics (e.g., backup copies) for any purpose other
than such communications.  Does this mean that government wiretapping,
and spying of all kinds, is unethical?  Yes, I think it does.  Here, law
(what a government will allow in the self-interest of the governors) and
ethics part company.

My opinions are my own.  It's pretty clear that no corporation or
agency, and certainly no politician, would approve this sort of thing.
--

------------------------------------------------------------------------
  Lee Story (lee@wang.com) Wang Laboratories, Inc.
     (Boston and New Hampshire AMC, and Merrimack Valley Paddlers)
------------------------------------------------------------------------

In article <917@lhdsy1.chevron.com> yzarn@lhdsy1.chevron.com (Philip Yzarn de Louraille) writes:
>I recently asked my boss about e-mail privacy and several days later he
>forwarded to me some news articles which described several employees who
>had sued their company because of "eavesdropping" on their e-mail which
>they considered private. The employees lost. The couts sided with the
>company: basically speaking, the computers, the network and their use
>belong to the company. Since the employees also work for the company,
>then they should not use e-mail fro private business/use.
>
>-- 
>  Philip Yzarn de Louraille                 Internet: yzarn@chevron.com
>  Research Support Division                 Unix & Open Systems
>  Chevron Information & Technology Co.      Tel: (213) 694-9232
>  P.O. Box 446, La Habra, CA 90633-0446     Fax: (213) 694-7709

I attempted to send this question via email, but was unsuccessful. I was
wondering where these articles came from. It would seem that the jursi-
diction of the decisions you mentioned would be important, at least to
me anyway, since different states have different laws concering privay. 
You can send via response via email, unless you feel that it is in the
interest of the group as a whole.


Many Thanks

(Disclaimer: who would claim any of my own opinions :-) )


-- 



Paul M. Mickel				mickelp@prism.cs.orst.edu

In article <LEE.91May28164840@meercat.wang.com> lee@wang.com (Lee Story) writes:
>
>Finally someone in this long thread has chosen to comment on the ethical
>issue, and has enough sense to know that the law and the economy do not
>determine ethics...
>Nonetheless, if users have been given the impression, explicitly or
>by implicit convention, that they are using an unmonitored channel of
>communications, it seems unethical to make use of that channel's
>incidental characteristics (e.g., backup copies) for any purpose other
>than such communications.

[I'm not a lawyer, nor am I in the legal profession, so I can't speak
authoritatively on this subject; but I have discussed this at length with our
legal department and our Human Resources dept.]

In this case, at least as far as California is concerned, they are one in the
same.  If you give your employees the impression that email is a private
communication channel, you may get zapped if you fire someone using information
obtained by snooping therein.

(I seem to recall that backups of email played a very large part in the IRAN
CONTRA scandal -- some operator realized that they had copies of all the email
that one of the big whigs [Casey?] had deleted).

-- 
kral * 408/647-6112 *               ...!uunet!drivax!braun * braun@dri.com
"Talking trash, touching on truth"	-- Micheal Hedges

I remember reading an article in the Wall Street Journal several months ago.
I think it was one of the short column 5 vignettes about Law.

Some employee had his desk files searched by his employer.  It was declared
legal.  The files, the desk, and the building were owned by the employer.
I do not remember all the details - like if a file explicitly labeled
"Personnel - not realted to company business" was searched.  But this
is an interesting indication that e-mail may not be private.

SOmeone posted excerpts from some Communications Act relating to privacy
of electronic communications.  The basic paragraphs had phrases like
"authorized".  Perhaps the company is authorized?

Regards,
Richard Marks

The ethics and legality pertaining to the privacy of electronic mail are
subtle and important issues.

As regards ethics:

Surely, the ethicality of reading other people's mail depends upon
the specific setting.  Where a machine is owned by a commercial or government
enterprise and is clearly provided as a tool for the work of its employees,
there may be grounds for acting as if all information on that machine is
the property of the collective body concerned.  However, given the scope for
ambiguity here, it would still seem desireable to somehow make this explicitly
clear to users--as, for example, with a one-line notice upon login or the
invokation of the mail program.  Where the rights and responsibilities of
all parties are spelled out in advance, there is less scope for ethical
murkiness.

Even where it was stated that a host could be used for personal communications,
there might be limitations placed upon users--as for example, with regard to
the amount of system resources (esp. disk space) to be allowed such uses.
This could lead to a situation where information would have to be archived
or destroyed to free communal resources.  Again, a clear (preferably written)
policy would help alleviate future problems.

As a joint system administrator/researcher in an academic research setting,
I personally feel it a sacred duty to avoid any situation where I could even
accidentally read another person's mail, which I consider to be private
information.  I am not certain that the Regents of UC share this opinion.  
Furthermore, I am troubled by the possibility that other users do
not share this point of view, and by the ease with which a determined user
could invade the privacy of others.  To the extent that I do not take
explicit action to prevent such abuses, I suppose that I share the blame.
One technical point which has been insufficiently discussed here is the
"secretmail" mechanism of certain (all?) UNIX hosts.  I have not experimented
with this, but as I understand, this uses a DES-like mechanism to send
mail securely.  I don't know how it is stored at either end (perhaps the
encryption applies only to transmission?).  A good technical discussion
is in order here, conducted by someone more knowledgable than myself.

As regards legality: the discussion thus far has been notable for the lack
of participation by someone with legal training.  Does anyone know a lawyer
who might be interested in providing a more informed opninion on this point?

Cheerio, Rick Rodgers
R. P. C. Rodgers, M.D.         (415)476-2957 (work) 664-0560 (home)
UCSF Laurel Heights Campus     UUCP: ...ucbvax.berkeley.edu!cca.ucsf.edu!rodgers
3333 California St., Suite 102 Internet: rodgers@maxwell.mmwb.ucsf.edu
San Francisco CA 94118 USA     BITNET: rodgers@ucsfcca

>	Is this legal?  Is this ethical?  If this person still worked
>here, I would immediately refuse.  But since they don't, do they still
>have any rights to their E-mail?  Right now, I am leaning towards refusing
>because I think a person's E-mail is theirs, regardless of their status
>with the organization.  Anyone have any other opinions on this?

Something to consider: Take the backed up e-mail and send it (tapes or
whatever) to the company's corporate counsel with a cover letter
explaining the situation as best you can and without being overly
colorful. You can then choose whether or not to agree to provide
technical assistance in moving it to a more convenient media if
requested in writing from corporate counsel or equivalent. Save any
correspondence.

That would get you off any legal hook as others have made the
decision, it doesn't sound to me like you have the authority within
the company to make such a decision. What if the employee later sued
the company for invasion of privacy? Would it be fair for them to say
that you provided the e-mail? Remember, rats desert sinking ships
fast, if it got to court there'd be a good chance that everyone would
try to blame whoever recovered the mail ("We didn't know where he got
this from...")

As to the ethical matters that remain, you'd have to search your own
conscience.

There is a real issue of employees leaving, particularly not in the
most congenial circumstances, and the fear/belief/knowledge that real
business is coming into their e-mail box that needs to be attended to
(e.g. customers who need to be redirected to new staff.)

I think it's safe to assume that it's the responsibility of the
employee to inform personal correspondents that the mailbox is no
longer valid for personal mail.

There's a fine line there, but it's important to make a cut-off and
make it clear to staff when this would be (say, one week after leaving
we consider any new correspondence in your mailbox our property and
assume it to be only business correspondence which needs to be
attended to.) It's also a good reason to try to cut off
employee-employer relations as amicably as possible, but lord knows I
know how hard that can be.

The same sort of problem arises with paper mail and ex-employees who
might be receiving business correspondence to their name.
-- 
        -Barry Shein

Software Tool & Die    | bzs@world.std.com          | uunet!world!bzs
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD

> As regards legality: the discussion thus far has been notable for the lack
> of participation by someone with legal training.  Does anyone know a lawyer
> who might be interested in providing a more informed opninion on this point?

	Why not post the question to misc.legal?

	There seems a danger that this group could easily get mixed up
in legal pondering over many questions.  I would like to see more
"real-world" solutions to problems.  I don't mind ethical pondering. 
Ethical issues face sys admins all the time, but legal issues are often
out of our hands.

	My fear is to find a trail of news messages knee deep in Law,
where I can't tell what the original issue was.  I might as well read
misc.legal.

	Restrain the flames.  All this was written before my morning
cup (i.e. pot) of coffee :-)

-James
+----------------------------------------------------------------------------+
| James Peregrino                        |     JPEREGRINO@HBSSTG.HARVARD.EDU |
| Programmer/Analyst                     |       PEREGRIN@HULAW1.BITNET      | 
| Science & Technology Interest Group    +-----------------------------------+
| Harvard Business School                | HBS neither expresses nor implies |
| Boston, MA 02163                       | any warranty in any of the        |
| Voice:(617)495-6307 FAX:(617)495-0351  | opinions or alleged facts herein. |
+----------------------------------------------------------------------------+

None of the responses to this question seem to consider the fact that
the email which he was asked to retrieve was sent by the same person
who wants it. If the sender had made a carbon copy, this wouldn't be
necessary. But since the sender wrote the memo in the first place, is
this really a violation of privacy in the sense that the sender
would learn something he didn't already know?

--
The media is in the business of distorting people's perception of
reality, by emphasising the out of the ordinary.

In article <1991May30.203700.25025@amd.com> phil@brahms.amd.com (Phil Ngai) writes:
>None of the responses to this question seem to consider the fact that
>the email which he was asked to retrieve was sent by the same person
>who wants it. If the sender had made a carbon copy, this wouldn't be
>necessary. But since the sender wrote the memo in the first place, is
>this really a violation of privacy in the sense that the sender
>would learn something he didn't already know?

I think so -- since the sender didn't bother to make himself a CC, he's
really just out of luck.  If I fax something to you as my employee and
throw away the original, can I rummage through your office when you are
fired to get a copy of the fax?  no.  How is strolling through the 
backup tapes any different?
-- 
Rodney

In <9tnh_wg@rpi.edu> rodney@sun.ipl.rpi.edu (Rodney Peck II) writes:

>In article <1991May30.203700.25025@amd.com> phil@brahms.amd.com (Phil Ngai) writes:
>>None of the responses to this question seem to consider the fact that
>>the email which he was asked to retrieve was sent by the same person
>>who wants it. If the sender had made a carbon copy, this wouldn't be
>>necessary. But since the sender wrote the memo in the first place, is
>>this really a violation of privacy in the sense that the sender
>>would learn something he didn't already know?

>I think so -- since the sender didn't bother to make himself a CC, he's
>really just out of luck.  If I fax something to you as my employee and
>throw away the original, can I rummage through your office when you are
>fired to get a copy of the fax?  no.  How is strolling through the 
>backup tapes any different?

But he wouldn't necessarily have to stroll through the backup tapes. 
Certainly nobody could object to a script reading the mail.  It's just a
human reading it or data extracted from it that people object to.  The
sysadmin could write a script to search messages for only the one
selected message.  Then, when he is absolutely sure that he has
extracted the right one he has done so without "rummaging" through the
former employees mail.  This still does not answer the question of
whether it is acceptable, legally or ethically, to read that one
message, but it certainly does get that one message without and grounds
for complaint. 
-- 
-----------------------+---------------------------------------------------
Charles "Chip" Yamasaki| The opinions expressed here are my own and are not
chip@oshcomm.osha.gov  | supported or even generally accepted by OSHA. :-)
-----------------------+---------------------------------------------------

In article <9tnh_wg@rpi.edu> rodney@sun.ipl.rpi.edu (Rodney Peck II) writes:
>In article <1991May30.203700.25025@amd.com> phil@brahms.amd.com (Phil Ngai) writes:
  [stuff deleted]
>>But since the sender wrote the memo in the first place, is
>>this really a violation of privacy in the sense that the sender
>>would learn something he didn't already know?
>
>I think so -- since the sender didn't bother to make himself a CC, he's
>really just out of luck.  If I fax something to you as my employee and
>throw away the original, can I rummage through your office when you are
>fired to get a copy of the fax?  no.  
                                  ^^

Why not.  Assuming that the desk/office are on company property (assume
that the person you faxed works for the same company that you do).  What
would keep that persons ex-boss from doing just that.  Nothing.  It is
done all the time.  

We keep the files of ex employees for a long time.  I have had reason to 
go thru some of them to get information that I needed to complete my work
such as activeation keys, serial numbers, and passwords that where in the
care of the ex-employee.  I don't think that anyone can argue that those
things belonged to the company and that I had legitamite need for that
information.  What is differant about an inter office memo, fax, or E-Mail?
None.  It belongs to the company.  If someone has a reason to need something
in that persons old e-mail restore it and go thru it.


 



-- 
---------------------------------------------------------------------
David Hoopes                              Tallgrass Technologies Inc. 
uunet!talgras!david                       11100 W 82nd St.          
Voice: (913) 492-6002 x323                Lenexa, Ks  66214        

In article <9tnh_wg@rpi.edu> rodney@sun.ipl.rpi.edu (Rodney Peck II) writes:

>I think so -- since the sender didn't bother to make himself a CC, he's
>really just out of luck.  If I fax something to you as my employee and
>throw away the original, can I rummage through your office when you are
>fired to get a copy of the fax?  no.  How is strolling through the 
>backup tapes any different?

Hmmm... Suppose you deserve a refund over some business matter and you
send the details by mail/fax/email to someone who quits or is fired
before handling it.  Would you accept the excuse from the company
that "we can't give you your money because we wouldn't feel right
about rummaging through this ex-employee's office"?  How is an
internal memo any different?  In a business situation wouldn't you
expect someone to check for any unfinished business?  What about
new mail/fax/email that comes in after the person leaves?

Les Mikesell
  les@chinet.chi.il.us

In article <9tnh_wg@rpi.edu> rodney@sun.ipl.rpi.edu (Rodney Peck II) writes:
>I think so -- since the sender didn't bother to make himself a CC, he's
>really just out of luck.  If I fax something to you as my employee and
>throw away the original, can I rummage through your office when you are
>fired to get a copy of the fax?  no.  How is strolling through the 
>backup tapes any different?

I really wish people would ask their Personnel and/or Legal departments before
posting stuff like this.  If you keep personal stuff in/on company property,
then (*unless* you've been led to believe otherwise) it is *not* private.  This
has been held up on many occasions in court, and makes perfect sense, at least
to me.  I don't see how this can be construed as an invasion of privacy.
That's what *personal* property is for (*your* personal property, now someone
else's).


-- 
kral * 408/647-6112 *               ...!uunet!drivax!braun * braun@dri.com
"Talking trash, touching on truth"	-- Micheal Hedges "1-900-I-LUV-YOU"

In article <15110@ccncsu.ColoState.EDU>, conca@handel.cs.colostate.edu (michael vincen conca) writes:
> 
> Aproximately 1 month ago, a certain employee was advised that he/she was
> was acting in an inappropriate manner and that they needed to make 
> certain adjustments in their attitude.  A meeting was held between the head
> manager and this employee in which the above issue was discussed.  All of
> this was summarized in a memo which was E-mailed to the employee.
> 
> Yesterday, this employee was terminated.  He/she was allowed to gather
> their things and purge all of their personal files from the system.  Today,
> my boss asked if it would be possible to retrieve this employee's E-mail
> off of backup, find the memo, and print it out in case it was needed as 
> evidence in a possible court case.
> 
Here are some suggested actions:

1.  With the permission of the sender of the memo, go through his backups
    to find his copy of the memo and provide it to management.

2.  For your own protection, isolate a backup containing the employee's
    copy of the memo and preserve that backup in a bank vault somewhere.
    Tell management that you expect you would be able to produce it in
    response to a subpoena, but don't think it is appropriate to do so
    without legal compulsion.  ("You expect" means there is a good copy
    that you could swear is a correct copy preserved where you think
    it will not be destroyed accidentally or intentionally.)

3.  Take some precautions (unusual but not draconian) to protect the
    security of the working backups containing the ex employee's files.
    (Security against unauthorized access and security against tampering.)

If the author did not keep a copy long enough for it to get into an
overnight backup, give him a gentle education in the proper use of
mail.

With or without the author's copy, item two above should satisfy your
management and satisfy your conscience with respect to proper treatment
of private communications that pass through your hands.

dan herrick
herrickd@iccgcc.decnet.ab.com

>                                    Prehaps I should keep valuables locked
>    up (a sad commentary on our society) but one can not 'lockup' messages
>    from the privelaged account holder (root).

If you are truly interested in protecting your computer valuables, I'm afraid
it's not root you have to be concerned with, it is Senator Biden.
-- 
Rob Stampfli, 614-864-9377, res@kd8wk.uucp (osu-cis!kd8wk!res), kd8wk@n8jyv.oh

In article <51171@prls.UUCP> sccs@prls.UUCP (Source Code Control System) writes:
>
>       I view the computer as an extention of my desk.  The
>    company may own the desk, the envelope and even the paper but they still
>    have no right reading my mail.

Sure they do. Check the postal regulations--if it's addressed to you at 
work, even if their name isn't on the envelope, even if it's marked "personal".
Ask anyone at Xerox, it's a policy there (according to a former X-er I've
worked with) to open EVERYTHING that comes in. I've had the same problem at
a small company; the office manager opened everything. Until he opened
something personal addressed to the owner.... :-)

>                                    Prehaps I should keep valuables locked
>    up (a sad commentary on our society) but one can not 'lockup' messages
>    from the privelaged account holder (root).

Sure you can. There's a function called "crypt" that can eliminate your
concerns. Being root doesn't allow reading the files once encrypted.

>                                                Root's privelages are
>    available only becouse there exist a genuine administrative need for
>    them.  Using the privelage to read other peoples personal files is an
>    abuse of those powers and a violation of the trust users expect.

I disagree. As an admin, it's my job to look at anything on the system 
necessary to make sure it's up and running for ALL the users. If that 
means finding out what a 10MB file cluttering up a spool directory is,
and it turns out to be email, fine. 

What I don't do is read files I don't have reasons or orders to. There 
are some companies that monitor (i.e., capture a copy of and read) ALL
email traffic. We don't, and I'll recommend against it if the question
arises. Something else I don't do is talk about what I find in files.
That would be a violation of trust. (Resumes and job search letters
aren't uncommon, and I have in fact covered for a user in the past, 
when some files got left somewhere noticable.)

Looking when I have to is my job, not an abuse. Forwarding a copy of
email on a personal matter to the rest of the company would be.

>      In the original article, the author wondered if looking for the file
>   (memo) may be OK since the owner is now an ex-employee.  I would argue
>   that the person may be an ex-employee but he/she is not an ex-person. It
>   seems doubtfull that the correct file can be found without violating
>   the account holder's privacy.  

The point is, the files were LEFT BEHIND by the ex-employee. Therefore,
they were of no concern to the ex-employee. When someone here leaves, I
generally expect them to clear all personal stuff from their directory,
and document what's left. There's no longer any privacy to violate.

The only situations I can see where this won't happen are twofold:
1) termination by employer, and 2) death. In either of these cases,
once again, it's the admins' job to separate things. Under case 1,
I'd try to forward any non-company private stuff, including email,
to whoever was fired. Under case 2, I'm not sure what would happen--
I haven't run into it yet, and don't look forward to it.

>                                  Prehaps you could contact the individual
>   and ask if the file exist and if so, ask for the filename.  Try a
>   civil approach first - maybe it will prevent the morality issue altogether.

I don't see a morality issue coming up, unless it's unauthorized use of
company resources for personal applications. I don't balance my checkbook
on this machine, and don't keep personal/confidential stuff on here. 
There may be some things that are more my interest than the companys'
generally technical items or copies of stuff from the net, but not
personal items. I don't even keep a copy of my resume on any systems
around here.

By the way, most ex-employees aren't interested in trying to remember
filenames and such after they've left, or answering any type of questions
about what they were working on. They did have reasons for leaving,
after all. Usually, there's someone who has to take over the work that
the departing individual was doing, so they must have access to everything
left behind. Unless you think a company should stop a project just 
because a programmer leaves, to respect their privacy? Should AT&T stop
working on UNIX if one of their staff leaves? 

>      I see no problem retrieving the memo IF one knew the file name it had
>    been saved under, and the request came from the author of the memo.

However, mail is generally in a few big files that are conglomerations
of many messages, so it'd mean Mr. Admin would have to grep for the senders'
name, vi the file to verify that it was the desired message, and copy it
out. Which means Mr. Admin is going to see a lot.

I think you have an overly idealistic concept of what these computers
in the office are for--certainly not for maintaining a confidential,
secure place for you to keep mail. If it isn't work related, don't
leave it laying around. If it's on a system, expect it to be seen.

-- 
Gary Heston   System Mismanager and technoflunky   uunet!sci34hub!gary or
My opinions, not theirs.    SCI Systems, Inc.       gary@sci34hub.sci.com
I support drug testing. I believe every public official should be given a
shot of sodium pentathol and ask "Which laws have you broken this week?".

>In article <15110@ccncsu.ColoState.EDU>, conca@handel.cs.colostate.edu (michael vincen conca) writes:
>> 
>> Yesterday, this employee was terminated.  He/she was allowed to gather
>> their things and purge all of their personal files from the system.  Today,
>> my boss asked if it would be possible to retrieve this employee's E-mail
>> off of backup, find the memo, and print it out in case it was needed as 
>> evidence in a possible court case.
>> 

With all the arguments going back and forth about a company's rights
versus the employees right to privacy, it seems to have been forgotten
that the employee in the original example was _given_an_opportunity_
to purge all his/her personal files.  They were given a chance to get 
rid of materials they did not want to leave behind for others to see.
While I agree that a company official has the right to retrieve backed-up
files, I think they forfeited that right when they gave the employee the
opportunity to remove personal items.  I think that to go back and
dig something up that someone has thrown away (even though it's actually
coming from a backup file, the employee intended that it be removed, else
s/he wouldn't have deleted it) is a violation of implicit trust.  If
you are giving someone an opportunity to throw out old personal materials,
isn't it implied that you are not going to go rummaging through the trash
they put in the dumpster?

--Tony
  (tmurray@socrates.umd.edu)

conca@handel.cs.colostate.edu (michael vincen conca) writes:

<Aproximately 1 month ago, a certain employee was advised that he/she was
<was acting in an inappropriate manner and that they needed to make 
<certain adjustments in their attitude.  A meeting was held between the head
<manager and this employee in which the above issue was discussed.  All of
<this was summarized in a memo which was E-mailed to the employee.

<Yesterday, this employee was terminated.  He/she was allowed to gather
<their things and purge all of their personal files from the system.  Today,
<my boss asked if it would be possible to retrieve this employee's E-mail
<off of backup, find the memo, and print it out in case it was needed as 
<evidence in a possible court case.

<Now for the tough questions.
<	Is this legal?  Is this ethical?  If this person still worked
<here, I would immediately refuse.  But since they don't, do they still
<have any rights to their E-mail?  Right now, I am leaning towards refusing
<because I think a person's E-mail is theirs, regardless of their status
<with the organization.  Anyone have any other opinions on this?

You are overlooking one detail. The *sender* of the email has rights to it
too. He *should* have kept a copy, but since he didn't, retreiving any
messages *from* him *to* the terminated employee is perfectly legal. 
As is frequently pointed out on the net, the *sender* has copyright on email!

I'm not a lawyer, but I'd say all you *should* need is permission of
*one* of the parties to retrieve the message. Anything after that is
up to the court. And at the very least, *I* would lock up that backup
tape along with logs and the like to enable you to "prove" that it is
indeed what you claim it to be. Remember, the lawyers on *both* sides
may get interested in this, and I'd hate to have to reply to a court order
with "Sorry, that tape got re-used yesterday." 


-- 
Leonard Erickson			leonard@qiclab.uucp
personal:	CIS: [70465,203]	70465.203@compuserve.com
business:	CIS: [76376,1107]	76376.1107@compuserve.com

vince@bcsaic.UUCP (Vince Skahan) writes:

>I also personally believe that snooping around anywhere
>for the hell of it just because you have the system privs to
>do so is both inappropriate and bordering on unethical.

I've had users worried about this. After telling them that I'm
going to ignore the slur on my character, I then point out that
even if I *was* the sort of person to do that, there's just too
much stuff out there. 

I've had to go searching for "old" config files for some of the shared
programs on our LAN. Or worse yet, due to an *immediate* need to free
up space (the printer quees were crashing!) I've had to nuke "backup" 
copies made by some software. Both fairly specific. And they both
took *hours*.

I figure it would take me *days* to snoop through all the files 
(4 gigabytes is a *lot* of space, even ignoring the databases)

-- 
Leonard Erickson			leonard@qiclab.uucp
personal:	CIS: [70465,203]	70465.203@compuserve.com
business:	CIS: [76376,1107]	76376.1107@compuserve.com

In article <1991Jun06.152549.17193@socrates.umd.edu> tmurray@socrates.umd.edu (tony murray) writes:

>With all the arguments going back and forth about a company's rights
>versus the employees right to privacy, it seems to have been forgotten
>that the employee in the original example was _given_an_opportunity_
>to purge all his/her personal files.  They were given a chance to get 
>rid of materials they did not want to leave behind for others to see...
>If
>you are giving someone an opportunity to throw out old personal materials,
>isn't it implied that you are not going to go rummaging through the trash
>they put in the dumpster?

This depends, not on the implication that the employee had was permitted to
"remove" personal material from the system, but whether the company ever gave
the employee, implicitly or explicitly, the impression that any materials ever
kept on the system could be considered "personal" and/or "private".

I'm told, by our Humar Resources nee Personnel department that this example is
relevant: if the company explicitly states a policy of checking handbags, etc,
at the entrance as people come into or out of the building, then it may do so;
but if it is ever found to be irregular in its application of that policy - so
as to lull employees into forgetting about the policy - then they could be
guilty of some sort of invasion of privacy [can you tell I'm not an attorney?].
The same is true of the computer files: if you give people the impression that
some files on the system may be considered personal and private, and then you
go probing in those files without due cause, you could be in big trouble.

Remember, this has been used in very visible court cases, to wit, the
Iran-Contra case, where significant information was brought before the court
from backup tapes of email between, if I remember correctly, North and Casey.
I'm dead sure that privacy issues would have been raised if there were a chance
they could be used effectively.


-- 
kral * 408/647-6112 *               ...!uunet!drivax!braun * braun@dri.com
"Talking trash, touching on truth"	-- Micheal Hedges "1-900-I-LUV-YOU"

70465.203@compuserve.com wrote: 
->conca@handel.cs.colostate.edu (michael vincen conca) writes:
-><....  Today,
-><my boss asked if it would be possible to retrieve this employee's E-mail
-><off of backup, find the memo, and print it out in case it was needed as 
-><evidence in a possible court case.
->
->I'm not a lawyer, ...

indeed.  rather than paying much attention to any of this blather, mr
conca should ask his boss to consult a lawyer before he asks for these
files to be retrieved.  

--
# Henry Mensch / Advanced Decision Systems / <henry@ads.com>