Boss checking emails

zefer

Anyone know the legalities of a boss wanting access to the entire companies mailboxes?
Are there any laws around this issue?

meditraitor

He is fully entitled to access to emails on his equipment if you are in his employ.

kippy

Read your contract or policy on information technology.....there are a few threads on boards related to this topic too......

zefer

kippy wrote:

Read your contract or policy on information technology.....there are a few threads on boards related to this topic too......

I have. There is nothing in it about the MD having access to everyones mailbox..

zefer

meditraitor wrote:

He is fully entitled to access to emails on his equipment if you are in his employ.

I just think that it must be akin to opening someone else's post. There are 250 employees in the company and he wants access to them all..

spunkymunky

If your worried about him looking at your mail you must have stuff in there you shouldnt have. generally email is for work purposes along with the internet, Obviously, like most of here, we arent using them for work purposes. But they are fully entitled to look if they suspect you are
"abusing" it.
I seen people fired for what they have been sending and receiving

loz

I wouldn't worry - ensure you use gmail/hotmail for all non work

however if you feel paraniod - remmember that the sysadmins will already be looking at your admin shared $c $d drives, the mail admin allready reads everyones mail. the unix admin is doing the same and someone else will be laughing at all your browsing via the proxy logs !


i love my job !

zefer

spunkymunky wrote:

If your worried about him looking at your mail you must have stuff in there you shouldnt have. generally email is for work purposes along with the internet, Obviously, like most of here, we arent using them for work purposes. But they are fully entitled to look if they suspect you are
"abusing" it.
I seen people fired for what they have been sending and receiving

I am not worried about him looking at my mail. He wants it done and I dont want to get in trouble for doing something that then turns out to be illegal..
I have my reservations about doing it

Just found this:
The employer must be clear about their e-mail and Internet policies and these policies must be clearly communicated to employees. No covert e-mail monitoring is allowed by employers, except in a cases where specific criminal activity has been identified and the surveillance is required to obtain evidence and subject to the respect of legal and procedural rules. (For example, if the employer or police suspects that an employe is using workplace e-mail and the Internet contrary to the provisions of the Child Trafficking and Pornography Act 1988.
http://www.oasis.gov.ie/public_utilities/telecommunications/surveillance_of_electronic_communications_in_the_workplace.html?search=privacy+in+the+workplace

seamus

The company owns the equipment and the data on it, and in most companies the bosses have or can request access to their subordinates' mails.

There are some minor issues in regards to privacy and watching employees without their knowledge, but companies generally have the right to monitor/scan all traffic going through their network, including email. In the company's Email and Internet policy, you will see a section dealing with the company's right to scan (i.e. view) your mail.

No covert e-mail monitoring is allowed by employers,

The word "covert" is key. If he tells you that he's looking at your mail, that's not covert monitoring.

loz

zefer wrote:

Just found this:
The employer must be clear about their e-mail and Internet policies and these policies must be clearly communicated to employees. No covert e-mail monitoring is allowed by employers, except in a cases where specific criminal activity has been identified and the surveillance is required to obtain evidence and subject to the respect of legal and procedural rules. (For example, if the employer or police suspects that an employe is using workplace e-mail and the Internet contrary to the provisions of the Child Trafficking and Pornography Act 1988.
http://www.oasis.gov.ie/public_utilities/telecommunications/surveillance_of_electronic_communications_in_the_workplace.html?search=privacy+in+the+workplace

Thats very interesting - didnt even know it existed. So you will need to explain to your boss - that he needs to let EVERYONE know that he has the capability of reading everyones mail - then you will be legal !

zefer

loz wrote:

Thats very interesting - didnt even know it existed. So you will need to explain to your boss - that he needs to let EVERYONE know that he has the capability of reading everyones mail - then you will be legal !

I bet that if I did it for him and then there was trouble in the future, he would deny asking me to do it!

seamus

Whoops, didn't fully read your last post.

As loz says, just make sure the company knows that you will read their mail if it pleases you - if you have an email policy which users have acknowledged on employment, then that is sufficient. If a user says "I didn't know", but you have their signature under "I accept the Email policy", then you're safe.

For example, our policy states

Email usage may be monitored and some attachments such as executable programs, encrypted files, picture and video formats, sound files, HTML code, zipped files etc. may be blocked.

<company name> also maintains the right to review, audit, intercept, access, monitor, delete and disclose all messages created, received, sent or stored on the e-mail system for any purpose. By using <company name>’s e-mail system an employee recognizes the foregoing rights of <company name> and consents to them.

If I asked 100 users about this, you could gaurantee that 99 of them would claim to have never seen these two paragraphs in their life, but we have their signature upstairs agreeing to it.

loz

zefer wrote:

I bet that if I did it for him and then there was trouble in the future, he would deny asking me to do it!

ask him via some archivable media - email etc, a query re his request - you have proof then of his request

bcc if necessary trusted person - you team leader/manager/blah

regards IT and Security - ALWAYS COVER YOUR ARSE

spunkymunky

zefer wrote:

I am not worried about him looking at my mail. He wants it done and I dont want to get in trouble for doing something that then turns out to be illegal..
I have my reservations about doing it
provisions of the Child Trafficking and Pornography Act 1988.

Sorry didnt relise he wanted you to do, that is a predicament but as seamus shows it seems to be above board (in his company), Check the general contract for your place and if them 2 paragraphs (or something similar) are there, youre good.
If youre worried about you boss denying asking you to do it, get him to email the request to you, then you have it "in writing"

zefer

Thanks everyone for your replies.

I still think its a dodgy/unethical thing to start getting in to!
Wanting access to everything just because he feels like it..

Sleepy

Curious as to what the legal implications of him having access to mail that people weren't informed was monitored. It may be necessary to inform all staff before granting him access in order for them to delete/back up anything they feel they don't want him reading.

ifah

Our email and correct usage policy is a pop up message that precedes the login box of pc's - every user has to agree to it prior to logging on - this way we force them to agree on a daily basis - not just a signature that is filed away and they forget about months later.

I set it using the HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\LegalNoticeCaption
which is set to :
'<Company Name> Internet & E-mail Policies - Notification and Consent

and the text is in LegalNoticeText

You are about to access <Company Name>'s Network. You are reminded that use of the company's systems (including email & internet use) is limited to business purpose as per the email and internet policies which are available on XXX or from your manager. If you proceed to the logon screen you are deemed to have read, understood and agreed to abide by these policies. Email and Internet activity is monitored by the company and breach of these policies can result in disciplinary action up to and including summary dismissal.

There is a seperate more complete usage policy which is available on our intranet (XXX).

hope this helps,

zefer

ifah wrote:

Our email and correct usage policy is a pop up message that precedes the login box of pc's - every user has to agree to it prior to logging on - this way we force them to agree on a daily basis - not just a signature that is filed away and they forget about months later.

I set it using the HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\LegalNoticeCaption
which is set to :
'<Company Name> Internet & E-mail Policies - Notification and Consent

and the text is in LegalNoticeText

You are about to access <Company Name>'s Network. You are reminded that use of the company's systems (including email & internet use) is limited to business purpose as per the email and internet policies which are available on XXX or from your manager. If you proceed to the logon screen you are deemed to have read, understood and agreed to abide by these policies. Email and Internet activity is monitored by the company and breach of these policies can result in disciplinary action up to and including summary dismissal.

There is a seperate more complete usage policy which is available on our intranet (XXX).

hope this helps,

Thats a great idea. Thanks a lot