Work, internet email and legality of 'hacking'
Discussion
Just wondered if anybody had knowledge surrounding this - I would be extremely grateful if this could stick to facts, rather than supposition and opinion please!
My father has recently left the company where he had worked for the previous six years. It has become a little acrimonious, and a bonus that had been due to him was not paid. This is now the subject of a tribunal.
Now the company he previously worked for has sent him through the post printouts of emails that my father has sent and received through his BT Openworld email account. There is no email or internet policy at the company. The content of the emails is mostly personal family stuff, although there is some communication with other former employees containing opinion about the company and senior management.
Firstly I would be interested to know how easy it is to hack these email accounts - my father insists that he never asks the computer to remember passwords.
Secondly I would be interested to know whether it is actually legal for the company to do this?
In the covering letter, the company has asked my father to go back for a meeting, and suggesting that he should take a friend. This obviously sounds rather ominous (and it would appear typical of the bullying tactics use by the new managing director), and although my father has nothing to hide, and is not particularly concerned , my mother is.
So if anybody knows the legal situation - I would love to hear what you have to say!
Many thanks
My father has recently left the company where he had worked for the previous six years. It has become a little acrimonious, and a bonus that had been due to him was not paid. This is now the subject of a tribunal.
Now the company he previously worked for has sent him through the post printouts of emails that my father has sent and received through his BT Openworld email account. There is no email or internet policy at the company. The content of the emails is mostly personal family stuff, although there is some communication with other former employees containing opinion about the company and senior management.
Firstly I would be interested to know how easy it is to hack these email accounts - my father insists that he never asks the computer to remember passwords.
Secondly I would be interested to know whether it is actually legal for the company to do this?
In the covering letter, the company has asked my father to go back for a meeting, and suggesting that he should take a friend. This obviously sounds rather ominous (and it would appear typical of the bullying tactics use by the new managing director), and although my father has nothing to hide, and is not particularly concerned , my mother is.
So if anybody knows the legal situation - I would love to hear what you have to say!
Many thanks
Ok, POP3 is pretty insecure; it sends it's password in clear-text so anyone running a packet sniffer can see where you are going and what the user/name password is.
Now why an IT spud would be packet sniffing the network without any reason is beyond me; it's not something I'd do unless I was trying to track down a problem.
As for the legality, companies time, companies equipment and companies facilities. I'm not really sure you could argue an invasion of privacy... of course if they can't provide evidence that they've recorded other peoples e-mail as well then you might be able to argue it... I'm not a lawyer though; just a "she-geek"
Now why an IT spud would be packet sniffing the network without any reason is beyond me; it's not something I'd do unless I was trying to track down a problem.
As for the legality, companies time, companies equipment and companies facilities. I'm not really sure you could argue an invasion of privacy... of course if they can't provide evidence that they've recorded other peoples e-mail as well then you might be able to argue it... I'm not a lawyer though; just a "she-geek"
I think this one is a minefield!
They have every right to sniff traffic on their network if they are investigating someone but we need to bare in mind this may not have been the way the details were obtained. There would be many ways I could catch a persons username/password when they were accessing the site through work, remote viewing the PC, installing a key logger or some type of recording device or sniffing as mentioned above. All of the listed methods are completely legal as the user is using company property and this may be monitored without restriction.
In theory if your dad accessed his email account from work and they were capturing what he was doing then it would be entirely legal and your dad may have been in breach of a company policy even if it not an I.T. policy.
If on the other hand the account was accessed outside of these parameters they may deamed to have done something wrong or be in breach of BT's email policy. It would be impossible for your dad to prove this though unless they openly admit to it.
I very much doubt any hacking took place.
I have to mention though, I am not a lawyer but just some who has worked for several large companies who sometimes carry out the above actions.
They have every right to sniff traffic on their network if they are investigating someone but we need to bare in mind this may not have been the way the details were obtained. There would be many ways I could catch a persons username/password when they were accessing the site through work, remote viewing the PC, installing a key logger or some type of recording device or sniffing as mentioned above. All of the listed methods are completely legal as the user is using company property and this may be monitored without restriction.
In theory if your dad accessed his email account from work and they were capturing what he was doing then it would be entirely legal and your dad may have been in breach of a company policy even if it not an I.T. policy.
If on the other hand the account was accessed outside of these parameters they may deamed to have done something wrong or be in breach of BT's email policy. It would be impossible for your dad to prove this though unless they openly admit to it.
I very much doubt any hacking took place.
I have to mention though, I am not a lawyer but just some who has worked for several large companies who sometimes carry out the above actions.
Edited by __LEE__ on Sunday 3rd December 20:10
__LEE__ said:
I very much doubt any hacking took place.
I have to mention though, I am not a lawyer but just some who has worked for several large companies who sometimes carry out the above actions.
I have to mention though, I am not a lawyer but just some who has worked for several large companies who sometimes carry out the above actions.
Have to admit I tend to agree with this.
Whilst I've never been asked to snoop / install key loggers and such, it's always wise to believe your being monitored whilst at work; often that goes double for the actual IT staff
If they've got both sent and received emails I'm guessing he used the account via outlook on a company machine? What do the printouts look like, do they look like normal outlook printouts with a name at the top and a thick bar under it? If its just rough unformatted text it might be a server dump or a packet capture. Print something out from whatever app your dad might have used to access his email and compare, it might give you clues as to how they got hold of the emails in the first place.
What specificaly is their problem/angle with the emails anyway? I've only been in this situation once before myself (on the employers side in a techie capacity) but from what I understood the results of the initial dirt-digging session was basically just used to say to the chap, 'are you really sure you want to go there?' You need to look at what they've got carefully and ask yourself if however bad it looks in general, is it actually relevant to the issues at hand?
HTH
Neil
What specificaly is their problem/angle with the emails anyway? I've only been in this situation once before myself (on the employers side in a techie capacity) but from what I understood the results of the initial dirt-digging session was basically just used to say to the chap, 'are you really sure you want to go there?' You need to look at what they've got carefully and ask yourself if however bad it looks in general, is it actually relevant to the issues at hand?
HTH
Neil
I think the company may be on dodgy ground on this one. If he was using a private email account then they have no rights to do this. Are any of the emails dated after he left? If so they have commited a criminal offence under the computer misuse act. To monitor email at work the employer has to inform employees that this is being done and the monitoring has to be related to the business. I do not see that emails utilising a private email address are covered by this. If he had used a company email address then it arguably is because the domain name represents the business. I would advise your father to talk to the solicitor dealing with the tribunaral that this has happend. As for taking a freind to the meeting the only freind I would take is a solicitor who specialises in employment law.
Yes.. very simple to snatch all traffic to/from any employees machine as has been stated (can do this without the need to touch the client machine.. port spanning/monitoring). I think this ultimately comes down to what sort fo desktop / internet policy the company has and when the traffic was schnuftered.
If your father was using the corporate outbound mail relay to send traffic then the company can do with it as they please, if its a private account then I believe it'll depends on dates (as mentioned previously.. was this during his employment period or afterwards) and the IT policy the company would have asked your father to adhere to when he took the job in the first place.
Sounds like a bit of a nightmare, as previously suggested.. the friend your dad should be taking to this meeting is the one with legal qualifications and a horrific hourly rate.
If your father was using the corporate outbound mail relay to send traffic then the company can do with it as they please, if its a private account then I believe it'll depends on dates (as mentioned previously.. was this during his employment period or afterwards) and the IT policy the company would have asked your father to adhere to when he took the job in the first place.
Sounds like a bit of a nightmare, as previously suggested.. the friend your dad should be taking to this meeting is the one with legal qualifications and a horrific hourly rate.
Mark,
For the company to have legal snooping rights on electronic communication, they must clearly state in either a work contract, terms of employment or communications policy document that everything is recorded. Also, unclear if the BT OpenWorld account used is the company's account or a personal account. If the company has snooped on a personal account (i.e. an electronic mailbox not owned by the company), regardless of whether or not it was connected to and viewed from the company's systems, then they have absolutely no right to do this.
No statement or AUP = no grounds.
No statement or AUP and snooping = illegal (plus they've just sent him a hardcopy of the evidence)
Strees should be able to confirm this.
M
For the company to have legal snooping rights on electronic communication, they must clearly state in either a work contract, terms of employment or communications policy document that everything is recorded. Also, unclear if the BT OpenWorld account used is the company's account or a personal account. If the company has snooped on a personal account (i.e. an electronic mailbox not owned by the company), regardless of whether or not it was connected to and viewed from the company's systems, then they have absolutely no right to do this.
No statement or AUP = no grounds.
No statement or AUP and snooping = illegal (plus they've just sent him a hardcopy of the evidence)
Strees should be able to confirm this.
M
I agree with the sentiment that if there is no policy then there is a violation of rights, and probably illegal if it was a personal email account. The policy has to have been agreed to by the employee as well - no good the management making one up and not telling anyone about it. Should be part of the employees handbook or conditions of employment to be effective.
As for taking someone to the meeting, be careful. Someone I know did this recently and took along a colleague of long standing. He got bad advice from this person, and after he left the company (he jumped before being pushed) said colleagues daughter filled his shoes. Take a solicitor versed in employment law, 'cos you never really know who your mates are.
As for taking someone to the meeting, be careful. Someone I know did this recently and took along a colleague of long standing. He got bad advice from this person, and after he left the company (he jumped before being pushed) said colleagues daughter filled his shoes. Take a solicitor versed in employment law, 'cos you never really know who your mates are.
The bit about "bring a friend" is a standard part of the Disciplinary and Grievance Procedure. Google for more info on this piece of UK legislation.
You should find that the statement actually says something like - "You are entitled to be accompanied at this meeting by a union representative or work colleague". It's really to protect your interests at the meeting and to ensure that statements that are made can be verified/recalled at a later date by both parties.
This statement however suggests that they are instigating the Disciplinary and Grievance Procedure, which would be odd when your father has already left employment. As its primary purpose is for dealing with issues during current employment.
You should find that the statement actually says something like - "You are entitled to be accompanied at this meeting by a union representative or work colleague". It's really to protect your interests at the meeting and to ensure that statements that are made can be verified/recalled at a later date by both parties.
This statement however suggests that they are instigating the Disciplinary and Grievance Procedure, which would be odd when your father has already left employment. As its primary purpose is for dealing with issues during current employment.
I used to be a mail admin and security liason at a large bank, many moons ago...
If the mails were being sent via the corporate mail client then they would be in a grey area as though the emails were being sent to and from a private address the use of corporate client would mean that it would be possible for the company to defend its snooping.
If it was sent via a web client then the company are in deep do do as it is clear that the use of the webclient would be a clear seperation beween corporate use and private. They can quite rightly moan about the use of a webmail client and take action but it is illegal to snoop on private email contents.
If the mails were being sent via the corporate mail client then they would be in a grey area as though the emails were being sent to and from a private address the use of corporate client would mean that it would be possible for the company to defend its snooping.
If it was sent via a web client then the company are in deep do do as it is clear that the use of the webclient would be a clear seperation beween corporate use and private. They can quite rightly moan about the use of a webmail client and take action but it is illegal to snoop on private email contents.
rich1231 said:
I used to be a mail admin and security liason at a large bank, many moons ago...
If the mails were being sent via the corporate mail client then they would be in a grey area as though the emails were being sent to and from a private address the use of corporate client would mean that it would be possible for the company to defend its snooping.
If it was sent via a web client then the company are in deep do do as it is clear that the use of the webclient would be a clear seperation beween corporate use and private. They can quite rightly moan about the use of a webmail client and take action but it is illegal to snoop on private email contents.
I'm 100% with Rich on this, and this is indeed current the current legal position. If the mails were being sent via the corporate mail client then they would be in a grey area as though the emails were being sent to and from a private address the use of corporate client would mean that it would be possible for the company to defend its snooping.
If it was sent via a web client then the company are in deep do do as it is clear that the use of the webclient would be a clear seperation beween corporate use and private. They can quite rightly moan about the use of a webmail client and take action but it is illegal to snoop on private email contents.
If you use company email for personal use, and indeed, during company time, then you may be guilty of misuse. Personally I have never used my company mail facility, and never will - I don't want some mail gibbon snooping through my mail, seeing what I buy on EBay etc.
However, if this is your fathers personal mail account and they have deliberately hacked it, then the company is in trouble.
If the latter is true, then if I were your father I would be seeking legal advice. If it is his personal account and other employees have accessed it, were there bank details present, etc etc etc? This sounds like unauthorised access and should be investigated.
For the record, I know someone who was given a final warning for accessing someones personal email, by perusing his work email that had his personal mail login details. He wasn't sacked because he was bloody good at his job, albeit stupid, and crap at covering his tracks.
Greg
Edited by GregE240 on Monday 4th December 09:57
ohh and even if its a company client etc, they dont have the automatic right to snoop.
If an email is obviously personal they should not read it... even then it should be done on a whim..
I caught someone accessing a employee's mail in that role and reported it. Instant Gross misconduct on the part of the snooper and they were the persons manager.
If an email is obviously personal they should not read it... even then it should be done on a whim..
I caught someone accessing a employee's mail in that role and reported it. Instant Gross misconduct on the part of the snooper and they were the persons manager.
so do I infer that the issue here is that they are trying to wriggle out of paying a bonus ?
Gotta say that generally you should wait till t's in your account before you jump - however, I agree strongly with Rich and Greg on this.
Also, take a solicitor, and not only is it the case that they may not be entitled to read your personal email (although if they have a policy telling you you can't have personal emil this is slightly different - though they still can't access it...) - but it may well be that whatever comments were made about the company were a matter of opinion and not enough to stop payment of a bonus - unless there were personally abusive or libellous statements, or breaching of an NDR etc.
Gotta say that generally you should wait till t's in your account before you jump - however, I agree strongly with Rich and Greg on this.
Also, take a solicitor, and not only is it the case that they may not be entitled to read your personal email (although if they have a policy telling you you can't have personal emil this is slightly different - though they still can't access it...) - but it may well be that whatever comments were made about the company were a matter of opinion and not enough to stop payment of a bonus - unless there were personally abusive or libellous statements, or breaching of an NDR etc.
guydw said:
so do I infer that the issue here is that they are trying to wriggle out of paying a bonus ?
Gotta say that generally you should wait till t's in your account before you jump - however, I agree strongly with Rich and Greg on this.
Also, take a solicitor, and not only is it the case that they may not be entitled to read your personal email (although if they have a policy telling you you can't have personal emil this is slightly different - though they still can't access it...) - but it may well be that whatever comments were made about the company were a matter of opinion and not enough to stop payment of a bonus - unless there were personally abusive or libellous statements, or breaching of an NDR etc.
Gotta say that generally you should wait till t's in your account before you jump - however, I agree strongly with Rich and Greg on this.
Also, take a solicitor, and not only is it the case that they may not be entitled to read your personal email (although if they have a policy telling you you can't have personal emil this is slightly different - though they still can't access it...) - but it may well be that whatever comments were made about the company were a matter of opinion and not enough to stop payment of a bonus - unless there were personally abusive or libellous statements, or breaching of an NDR etc.
My feeling is that this is exactly the case - either by wriggling or bullying.
My father left before the bonus was paid as he was completely disillusioned with the job, and was happier out of the company and risk losing his bonus, rather than seeing it through to retirement in another year or so. He is not prepared to take this all the way through the courts as the amount is not that great.
The company was built up by a self starter, entrepreneurial type who my father got on extremely well with, and he was very happy. The company was very succesful, owner made millions, then handed over the reins to his son, washing his hands completely, and allowing his son to make his own mistakes. The son is quite good with IT, but has no idea how to run a company or manage people, with the result that their top salesman have left along with others. My father was the only accountant, and in four months he has not been replaced. There is a history of people leaving and having to go through the courts to obtain what is legally theirs.
The emails being reproduced were not through the company email client. It is a small company, and there is no IT policy, and certainly nothing was signed to this effect at the commencement of employment.
I can see no other purpose for this meeting - I am aware of the requirement to allow a representative at grievance procedures, but this does not seem overly relevant given he has already left the company!
Thanks for the help so far, Rawwr - I'll drop Strees a U2U, and if anything exciting happens, I'll report back!
rich1231 said:
ohh and even if its a company client etc, they dont have the automatic right to snoop.
If an email is obviously personal they should not read it... even then it should be done on a whim..
I caught someone accessing a employee's mail in that role and reported it. Instant Gross misconduct on the part of the snooper and they were the persons manager.
If an email is obviously personal they should not read it... even then it should be done on a whim..
I caught someone accessing a employee's mail in that role and reported it. Instant Gross misconduct on the part of the snooper and they were the persons manager.
As an argument to this most companies capture network traffic for security/monitoring/performance purposes and thus if the company policy states that monitoring of a type can occur (this can cover all data) the conversation between the clients PC and external contact could be legally captured.
It would be ludicrous to not be able to capture traffic on your own network for security reasons, I mean if it was illegal to monitor your own network how would you have any idea what was going on?
I would suggest legal representation is saught about the validity of the data they have captured though.
Companies I have previously worked for have done this routinely or via a request from a line manager and once the correct paper work was completed somebody would be assigned the task of monitoring a particular user or a group of users.
We also must remember all data transmitted through a companies I.T systems belongs to the company rather than the user unless this has been explicitly stipulated.
Exige46 said:
guydw said:
so do I infer that the issue here is that they are trying to wriggle out of paying a bonus ?
Gotta say that generally you should wait till t's in your account before you jump - however, I agree strongly with Rich and Greg on this.
Also, take a solicitor, and not only is it the case that they may not be entitled to read your personal email (although if they have a policy telling you you can't have personal emil this is slightly different - though they still can't access it...) - but it may well be that whatever comments were made about the company were a matter of opinion and not enough to stop payment of a bonus - unless there were personally abusive or libellous statements, or breaching of an NDR etc.
Gotta say that generally you should wait till t's in your account before you jump - however, I agree strongly with Rich and Greg on this.
Also, take a solicitor, and not only is it the case that they may not be entitled to read your personal email (although if they have a policy telling you you can't have personal emil this is slightly different - though they still can't access it...) - but it may well be that whatever comments were made about the company were a matter of opinion and not enough to stop payment of a bonus - unless there were personally abusive or libellous statements, or breaching of an NDR etc.
My feeling is that this is exactly the case - either by wriggling or bullying.
My father left before the bonus was paid as he was completely disillusioned with the job, and was happier out of the company and risk losing his bonus, rather than seeing it through to retirement in another year or so. He is not prepared to take this all the way through the courts as the amount is not that great.
The company was built up by a self starter, entrepreneurial type who my father got on extremely well with, and he was very happy. The company was very succesful, owner made millions, then handed over the reins to his son, washing his hands completely, and allowing his son to make his own mistakes. The son is quite good with IT, but has no idea how to run a company or manage people, with the result that their top salesman have left along with others. My father was the only accountant, and in four months he has not been replaced. There is a history of people leaving and having to go through the courts to obtain what is legally theirs.
The emails being reproduced were not through the company email client. It is a small company, and there is no IT policy, and certainly nothing was signed to this effect at the commencement of employment.
I can see no other purpose for this meeting - I am aware of the requirement to allow a representative at grievance procedures, but this does not seem overly relevant given he has already left the company!
Thanks for the help so far, Rawwr - I'll drop Strees a U2U, and if anything exciting happens, I'll report back!
I think thats quite interesting then. If there is no policy then I presume normal law is enforced. It makes no difference how the email was access by the way as it is still using company I.T. equipment.
The question would be how does any possible breach in policy affect a previously earned bonus?
It sounds to me like they are clutching at straws
__LEE__ said:
As an argument to this most companies capture network traffic for security/monitoring/performance purposes and thus if the company policy states that monitoring of a type can occur (this can cover all data) the conversation between the clients PC and external contact could be legally captured.
It would be ludicrous to not be able to capture traffic on your own network for security reasons, I mean if it was illegal to monitor your own network how would you have any idea what was going on?
I would suggest legal representation is saught about the validity of the data they have captured though.
Companies I have previously worked for have done this routinely or via a request from a line manager and once the correct paper work was completed somebody would be assigned the task of monitoring a particular user or a group of users.
We also must remember all data transmitted through a companies I.T systems belongs to the company rather than the user unless this has been explicitly stipulated.
Excellent points Lee, although I'd love to know if a company has been hauled up at a tribunal or similar attempting to defend this with "it was done over our network" - I honestly don't think it would wash.It would be ludicrous to not be able to capture traffic on your own network for security reasons, I mean if it was illegal to monitor your own network how would you have any idea what was going on?
I would suggest legal representation is saught about the validity of the data they have captured though.
Companies I have previously worked for have done this routinely or via a request from a line manager and once the correct paper work was completed somebody would be assigned the task of monitoring a particular user or a group of users.
We also must remember all data transmitted through a companies I.T systems belongs to the company rather than the user unless this has been explicitly stipulated.
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff