Working in the computer industry, I’m frequently asked by friends and family to have a look at problematic Windows machines. (I’m asked for help with regard to getting the bum machine back up and running, but my advice to investigate alternatives to Windows is almost never followed. But that’s another post altogether….)
Sometimes, in the course of working on these machines, the subject of information security will come up. Usually, this is the result of a conversation on wireless APs and the inherent risk in simply opening the box and plugging it in. Since a technical explanation on the dangers of plaintext protocols going over the air would be lost on most, I’ll fall back to today’s killer app, email. The gist of the message is this: “Guess what? Email ain’t private!”
To elaborate, email is a plaintext communication medium. This means that as the data stream is broken down to it most basic bits and bytes by the computers actually moving the message from place to place, it isn’t encrypted or otherwise obfuscated in any way. Back when the architects of the “interweb” were putting this thing together, privacy and security weren’t taken into account, the priorities were elsewhere. Why, do you ask?? Simply because it was a different day and age. So-called hackers and crackers weren’t an issue at the time. Times have changed, there’s no doubt, but for the most part SMTP (the protocol that moves email) has not.
Anyway, the reason I began this post is because I ran across an article which says that a recent study shows that a third of employers in the US and UK read their employees’ email. Think about that for a sec. I know people who use their workplace email address for the bulk of their correspondence with friends and family. If the study is accurate, this means 1 of every 3 of these people has this email read by someone other than the intended recipient! Email ain’t private, folks.
From the article:
“It is not something that is broadcast,” Steele said. “There are organizations where employees think they can say whatever they want to say and nobody is going to read it.”
My wife once worked for an employer who actively read company email. She casually mentioned to me one day the sorts of things that were being sent back and forth via intra-company email. I cautioned her that someone was likely looking at it. She immediately ceased to participate in these email threads. About six months later, the worst perpetrators were called into an office at the end of the day and fired. Granted, they were fired for the sheer bulk of the email; the time wasted on email was lost productivity for the employer. The lesson learned remains the same: email ain’t private.
One point of clarification: I’m not bashing employers. I believe they have the right to monitor communications, be they phone or email, for the purposes of mitigating losses due to lost productivity, neglect or corporate espionage. The phones belong to them, the network belongs to them and, like it or not, you, as a resource, belong to them for 8 hrs (or more) a day. Your time is valuable and you trade it every day for a paycheck. As long as employees are notified that they’re being monitored (did you read the forms you signed in HR when you were hired??), then employers are very much within their rights to protect themselves in these ways.
The point of this post was to make you aware this is going on. Like I said, people are usually very surprised when I explain how this works.
Considers yourselves warned.
Entries (RSS)