Industry


Ads by TechWords

See your link here


C. J. Kelly's picture
C. J. Kelly

A Day in the Life of an Information Security Officer

More on the HP crime

As the New York Times reports the situation, it sounds like the crime HP may have committed is only around "pretexting".  Pretexting is a method of social engineering where the caller pretends to be the owner of a phone number and seeks to obtain phone records from the phone company.  I have no problem with investigating that type of crime because I believe that HP stepped over the line in investigating the personal records of employees and/or board members.

I do not have a problem with is a company conducting an internal security investigation when done through proper channels.  It looks like the Chairwoman, Patricia C. Dunn, went through the proper channels by getting both the head of HP security and general counsel involved in the investigation.  The thing people do not understand is that the company they work for owns the network, email, phones and voicemail.  The employee to which these items have been assigned to for company use, do not own them or the records they create.  The company does.

However, the company may not investigate an employee's personal records, that are not publicly available, without the employee's permission.  Only law enforcement can do that and they need a search warrant. 

I am sure we are going to hear a lot more on this.  My only point in commenting on it is to again make sure that employees understand that there is no expectation of privacy at work.  At home, you ought to be able to do whatever you want within the law.  (That comment should start a chain of responses about the lack of privacy in general!)

What People Are Saying

What HP did apparently went

What HP did apparently went far beyond monitoring use of company infrastructure. According to a new article today in the Times, the detectives hired by HP somehow obtained private phone records of one person. "On Saturday, the company identified one of two employees who it said had been a target of scrutiny in the internal operation. It said the private phone records of the employee, Michael Moeller, director of corporate media relations, were taken."

The article said that, "The detectives also tried to plant software in the computer of an unspecified CNET reporter that would communicate back to the detectives, people briefed on the company review said."

There may be criminal charges. "Federal and California prosecutors, as well as the Congressional subcommittee, are examining the chain of detectives for possible criminal wrongdoing in obtaining phone records. The California attorney general said last week that he had enough evidence to indict people inside and outside the company."

Having been around the block

Having been around the block a few times, it amazes me as to the number of simpletons out there who think that their personal rights supercede those of the company they work for. It's not hard to miss the statement on the employment application that basically says the company owns the infrastructure, and, that if you sign the application then you agree to abide by company policy on its use. What part of "they pay for it, they own it" doesn't make sense. Think of it this way... would you lend your car out to anyone who asked to use it without some sort of condition on it's usage? Most would say NO. However if you think yes, then there is a demolotion derby coming up this weekend and it might be a hoot to enter, please leave the keys in the ashtray.

What amazes me about being

What amazes me about being simplistic is when people say "been around the block a few times" or "it's not hard to miss...". Talk about simplistic, let's start with a thing called the Boston Tea party. Oh, sorry. Wrong country?

If not (and I'll assume you actually know something about history, since you've been around the block more than once), then let's look at what it means to sign something that says "we own you". Oh, it doesn't say that? Right. You're right. It says something that means acknowledging the reality that's there - my company owns the phones, owns the email infrastructure, but (believe this or not), they don't own ME.

It's time for companies to get off our backs. I realize what the present working status of network infrastructure is, but it's wrong. The company doesn't have the right to monitor my phone calls and they need to have a harder time with my email. The days of Big Brother are about to come to an end.

One unfortunate thing about

One unfortunate thing about this affair is the spin that is used to label fraud as something less - in this case "pretexting". This is fraud and should be labeled as such. It is the equivalent of verbal forgery. (To Anonymous, there is no Bill of Rights. The current administration has done away with it. Knowing that Big Brother knows so much more about you, don't you feel more secure?)

While I understand the

While I understand the company owns the phones, the email, etc., what doesn't make real sense is how a company can usurp the rights of a United States citizen just because. Does the Bill of Rights change when I clock-in at work? Not hardly.