 |
 |
Hey all, thought this would be a great format to accomplish 2 things. Number one, if you have no idea who I am yet, please allow me to introduce myself. My name is Joseph M. Scott, and I am the new "network admin, whatever" for Housing and Food Services. You probably all were familiar with Steven Scouten..well, I'm his replacement. Number two, I would like to drop my own two cents in on this. Realistically, I have no idea why this isn't being done to start with. I find it tantamount to lunacy that we feel that we "cannot" or are "not allowed" to protect our systems from viruses. I'm pretty sure that we all have some kind of anti-virus system already up and running on whatever email package we are using internally (we run NAV on our Pegasus email). I'm not really sure who owns Pilot, but I am sure that each of our groups have users who use it on a regular basis. To put it bluntly, it is a whole in the security shema we have all attempted to setup. From what I am hearing the issue seems to be whether or not we would be in violation of AUP by doing so?? If this is the case, on what grounds does MSU uphold these policies. Are they saying that by scanning the emails for viruses that we as system admin's would be reading the emails? Are they aware that when any programs scans for a virus, that we do not see any of it happening, and even if we wish to monitor it scanning we STILL would not see the email. Are they concerned that we will write a program that will run in conjunction with the virus scanner, or in place of the virus scanner that will allow us to read the email. If that is what they believe or fear, I find that very offensive. I, for one, do not like being accused low moral values by folks whom I have never met, nor have they met me. Hey, if the post office trusts the folks that they hire off the street to sort my mail not to read it, you would think that MSU could trust us proffesionally. Ok, hard as that is to put aside, let me wonder this. Is MSU worried that by doing any of the above we would be violating the users 4th ammendment rights? Let me clarify something here; Federal law: ECPA. The Electronic Communications Privacy Act (ECPA) (18 U.S.C. §§ 2510-20; 2701-2711), is the only federal statute relevant to claims of workplace invasions of privacy by electronic means. The ECPA prohibits (1) unauthorized and intentional "interception" of wire, oral, and electronic communications during the transmission phase, and (2) unauthorized "accessing" of electronically stored wire or electronic communications. For purposes of interpreting the Act, it is important to note that an e-mail is an "electronic communication" as that phrase is defined in § 2510. In the specific context of e-mails, it is also important to determine whether an employer "intercepted" the e-mail while it was being transmitted, or whether he/she "accessed" it minutes, days, or weeks after it was stored in an employee’s computer. The ECPA contains two exceptions that are pertinent to e-mail communications. First, under the system provider exception, the prohibitions on the interception, disclosure, or use of electronic communications do not apply to conduct by an officer, employee, or agent of a provider of electronic communication services if the interception occurs during an activity necessary to the rendition of the service or to the protection of the rights or property of the provider. Whether an employer who provides an internal office e-mail system is completely exempted from the ECPA as a "service provider" is a hotly debated question, and the ramifications are important. Some commentators assert that "service providers" should include only entities such as America Online (AOL), Prodigy, etc. Others believe that employers who furnish their own e-mail systems are rightfully considered service providers and thus, fall within the service provider exception. Another theory states that even if an employer utilizes AOL or another common carrier to provide employee e-mail services, the employer is then considered an agent of the service provider and is thus, subject to the exemption. If employers are exempted under this provision, then presumably they may monitor electronic communications in order to promote quality control, prevent loss of trade secrets, investigate employees suspected of wrongdoing, deter personal use of company property, etc. To date, at least one court has held that an employer was in fact a service provider. (See Bohach v. City of Reno, 932 F. Supp. 1232 (D. Nev. 1996)). However, in the absence of clear judicial guidelines—or clear congressional intent, for that matter, as disclosed by a not-very-definitive legislative history—employers should not rely on this exception to protect their e-mail monitoring. Rather, they should look to the following exception, which provides clearer guidance to employers and employees regarding the bounds of privacy that employees can expect. Under the consent exception, an employer may intercept electronic communications if the prior consent of one of the parties to the communication has been obtained. (18 U.S.C. § 2511(2)(d) (1994)). To come within this exception, an employer need only acquire the implied or express consent of one employee in an employee- customer or employee-employee communication. It is important to remember that the ECPA does not preempt stricter statutes in states, such as Maryland, which require the consent of all parties. An employee will likely be deemed to have given consent if, having knowledge of the employer’s policy, he or she continues to use the e-mail system. To this end, a written policy is preferred because all parties will have expressly consented to its terms. Even when the policy is written, the employer would be ill-advised to monitor e- mails to a degree that exceeds the scope of the policy. For example, in the context of telephone calls, the courts agree that an employer is not privileged to continue listening to conversations of a purely personal nature. Further, a policy that merely suggests that monitoring may be done may not be sufficient to create implied consent. Now I know that we have a acceptable use policy in place at MSU, and I also know that at least for our division in order to log onto our network you must click OK that you have read and understand the policy. Seems pretty clear cut to me..