From: kadie@cs.uiuc.edu (Carl M. Kadie)
Subject: [comp.org.eff.talk, et al.]  net.views, response to question on sysadmins and privacy
Originator: daemon@eff.org
Organization: EFF mail-news gateway
Date: Tue, 14 Apr 1992 13:48:00 GMT


Newsgroups: comp.org.eff.talk,alt.cyberspace,alt.cyberpunk,alt.cyberpunk.movement,alt.bbs,comp.unix.questions,comp.sys.dec,comp.sys.hp
From: wagner@utoday.com (Mitch Wagner)
Subject:  net.views, response to question on sysadmins and privacy
Date: Sun, 12 Apr 92 17:26:32 GMT

EDITOR'S NOTE: This file consists of responses to the a net.views question 
posted about two weeks ago, collected from E-mail and information services 
nationwide. Phone numbers have been deleted. Administrative requests and 
complaints are at the end of the file. We will not be making use of any 
further response to this question.

Enjoy, and thanks for participating!


QUESTION #26:


When is it justified for a systems administrator to look through a
user's private files and E-mail?



     ---------------------------------------------------------------

     This question is being posted to gather responses for a regular
opinion column in OPEN SYSTEMS TODAY called net.views, in which we
publish replies to questions of interest to the open-systems
community---like this one!


--
Mitch Wagner, senior editor                                  (516) 562-5758 
Open Systems Today (formerly UNIX Today!)
600 Community Drive                                       wagner@utoday.com
Manhasset, NY 11030                                     GEnie: MITCH.WAGNER
------------------------------------------------------------------------


       ***                       ***                      ***

>From: uvm.edu!Steve.Cavrak@uunet.UUCP

Two cases -

- only when the conditions are widely known, e.g. are part of the
account allocation procedure when the user signs, for example, a
privacy and security agreement.  Privacy should be respected - but
the user should understand that it cannot be guaranteed.

- then the only case I see is when there is a systems administrative
or security need - e.g. when mail is getting misdelivered (a badly
constructed .forward), etc.

- in these cases, the files must be treated with utmost
confidentiality.

- the exception would be in case of disciplinary matters in which case
the company / university lawyer should be involved.


       ***                       ***                      ***

>From: James Tilton <willamette.edu!jtilton@uunet.UUCP>

I'd have to say I'm pretty vehemently against a system admin *ever*
looking through a user's private files and e-mail, but there are some
considerations to keep in mind here.

First, I'll start by saying that *ideally* no-one has the right to pry
into anyone else's things... "a person's right to swing his fist ends at
the bridge of the next person's nose."  You should be able to do
whatever you want, as long you respect other's rights to do the same.
The system admin, hopefully, would ideally only look through private
files after obtaining the user's permission.

However, we must keep in mind that the user is, after all, only a user.
While the ideal situation above *should* be the norm (and hopefully is),
the user really doesn't have *any* rights.  The person whose decision it
is is the machine's owner (of whom, presumably, the sys-admin is the
representative of).  The owner is the final arbiter of any dispute, and
if the user doesn't like it, they better just pack off and leave,
because you can't mandate privacy.

Another question is "what situations merit sys-admin snooping?"  Once
again, I'd like to say no, but there are considerations.  Perhaps a
question that could help define what kind of situations would justify
such actions would be "what is the sys-admin responsible for on the
system?"  For instance, is the sys-admin *responsible* for the actions
of users on his system?  Is the owner responsible?  If they aren't, then
why are they snooping?

One possible situation does rise to mind... a sys-admin on a system
which is getting filled up (w/ respect to storage space) might feel
compelled to check what files are worthwhile to keep and which are
not...  but immediately a rebuttal rises to mind: set the user's quota
low!  :)

In the end, then, a sys-admin's snooping must be considered as a
function of the sys-admin's responsibility for the user's actions...
and, of course, voyouerism is right out! :)

Pardon my ramblings,
						-James Tilton
						jtilton@willamette.edu

       ***                       ***                      ***

>From: The Procrastinator P1000 <uxa.cso.uiuc.edu!act31797@uunet.UUCP>

	I would at present consider only three conditions:
1.  When said user gives his explicit consent, while not under duress or
pressure to do so.
2.  When said user has signed an agreement allowing this as part of a contract
allowing hir to use the system which the sysadmin has charge of, at or before
the time said user begins use of that system.
3.  When there is good probable cause to believe that not doing so could 
endanger the lives, rights, or property of others.
--
Andrew Trapp       atrapp@mrcnext.cso.uiuc.edu
dreamer@uiuc.edu   act31797@uxa.cso.uiuc.edu

       ***                       ***                      ***

>From: Geoffron <tronsbox.xei.com!mephron@uunet.UUCP>

Gut reaction:  NEVER.  Considering the proliferation of Usenet newsgroups
and the various discussions therein, it's far too easy for a rabid
SysAdmin to find something incriminating.

Considered answer:  After a significant number of complaints about that user.
The number should vary, depending on how long the user has been there (some-
one who has been there for three years and just now got half a dozen complaints
against him may have had his account hacked, while someone who just got an
account may have done so for the express purpose of spewing across the net).

But only things related to the complaints should be brought to light if needed.
If the complaint was for rude language on soc.motss, bringing up the fact
that he had files from alt.pictures.bestiality is completely meaningless
to the problem at hand.


       ***                       ***                      ***

>From: "A.Galliford" (910765) <cc.flinders.edu.au!na19@uunet.UUCP>

Never, except in the case of suspected criminal conduct. A system similar
to a search warrant should be applied in these circumstances. A user's mail
is (or at least should be) private, especially any *received* mail...you
never know where it may have come from!

Anyway, I would not want MY mail read, especially without my knowledge *and*
permission.

Tony Galliford <asg@cs.flinders.edu.au, among other addresses>

       ***                       ***                      ***


>From: Michael R Linksvayer <uxa.cso.uiuc.edu!mrl28033@uunet.UUCP>

The user's and sysadmin's rights and responsibilities should be
established contractually. Thus many diverse situations can be
accomodated. If no contract exists, the user's private files and
E-mail should remain private unless there is good reason to
believe that the user's activities on the system are illegal,
creating liability for the organization, or damaging the system.
Even then the user should be consulted before files and E-mail
are opened unless there is very good reason to believe that
dangerous results of the user's activity are imminent and must
be corrected immediately.

-- 
Mike Linksvayer   m-linksvayer@uiuc.edu   

       ***                       ***                      ***

>From: "The Squire, Phish" <nike.calpoly.edu!cambler@uunet.UUCP>

In my opinion, it is justified only under extraordinary circumstances. On
a public system, as in a University, only when there are verifiable charges
against a user; Justifiable suspicion, if you will. On a company system,
a strict policy should be posted to all employees, and followed. Basically,
it should be treated as a search under the law whenever possible.
-- 
If you insist upon living in a  | cambler@zeus.calpoly.edu | Fubar Systems BBS
dream, you may be taken as mad. |                          |               
  I like my dream.              | Because all you of       | 3/12/24, MNP5, 8N1
Then you *are* mad!             | Earth are IDIOTS!!       | FSBBS 2/FSUUCP 1.3

       ***                       ***                      ***

>From: "W. A. Simon" <larry.mcrcim.mcgill.edu!root%elevia.UUCP@uunet.UUCP>

	NEVER.

	I can't imagine an instance in which the contents of the
	files (e-mail or otherwise) is of any relevance to any
	administrator, for any reason.

	I can see some organization (school or business) giving
	themselves this right (it happens), but I feel this is not
	required.  If a rule/policy was violated, the contents of
	the files is not relevant to it.  If there are rules about
	the contents themselves, then we are all in trouble.  Such
	rules are WRONG, whichever way one looks at them.

	I recommand the use of encryption.  I also advise the use of a
	different key for each correspondant.

-- 
 William "Alain" Simon
                                                    alain@elevia.UUCP
                               simonala%sid003.sidoci.com@elevia.UUCP
       ***                       ***                      ***

>From: Nathaniel Borenstein <thumper.bellcore.com!nsb@uunet.UUCP>

When he has been presented with a search warrant by a duly authorized
representative of the government.

Ultimately, either we are going to have to preserve the privacy of
electronic informaton with this kind of vigilance, or we're going to
lose a large portion of the civil liberties that Americans have
treasured for over two hundred years.
----------------------------------------------------------------
				-- Nathaniel Borenstein
				    nsb@thumper.bellcore.com

       ***                       ***                      ***

>From: "Steven C. Blair \"Unix Network Services\"" 

In 12 years of Administrative operations, there have only been 2 instances
when mgmt. has requested me do look into files/email. Both were potential
security violations, or after receiving complaints about "so and so at
your site(*not here*) were attempting to break into site XYZ.

Even when assisting users' email problem determiniations, I cover their
message, only to look at the headers. Under the Electronic Communications
Act, and Eletronic Privacy Act, there are little to NO grounds for un-
warranted email/file perusal. Employees have to keep in mind that what THEY
do on a given companies' computers is more than likely will potentially push
their management to request such an "investigation".

There is a lot of discension in whether it is "correct or not" to look
through files, though, in matters of disk space, quotas, it is OK to
look at filenames, but past that IMHO is a violation of a person's rights.

No one died, and left us GOD, so therefore, stay out of what's NOT yours,
is the guideline I live with. I encourage others to do the same!!!!!!!!!
-- 
Steven C. Blair    DELL UNIX NETWORK OPERATIONS        sblair@dell.com
==========================================================================
"One form to rule them all, one form to find them, one form to bring them"
	"all and in the darkness rewrite the hell out of them."
                       -- Sendmail ruleset 3 comment from DEC

       ***                       ***                      ***

>From: csn.org!julietbnc!tom@uunet.UUCP

I think it would be appropriate if the person had left and 
did not create a .forward file.

-- 
tom@evolving.com (Tom Dorgan)  Evolving Systems,Inc.
^D esc :quit stop   end !!*()_ halt logout logoff ^AltDel L1A b

       ***                       ***                      ***

>From: brl.mil!chidsey@uunet.UUCP

	Just last week our security meeting included our annual warning
that such snooping is part of our employment contract.  I think it is
reasonable, on THEIR computer.  On MY computer, or a third party computer,
I would expect a subpeona.  Also, they told us it could happen before they
gave us the account, and they remind us yearly.

								Irv
-- 
I do not have signature authority.  I am not authorized to sign anything.
I am not authorized to commit the BRL, the DA, the DOD, or the US Government
to anything, not even by implication.  They do not tell me what their policy 
is.  They may not have one.		Irving L. Chidsey  <chidsey@brl.mil>

       ***                       ***                      ***

>From: miavx1.acs.muohio.edu!MGJONES@uunet.UUCP

   (note: he stands for he or she throughout).

In my opinion, the sys admin has full right to look through a user's
private files and e-mail whenever he wishes _providing he did not say
he would not do so_.  If he clearly states that your private files
are truly private, than they should be.  Otherwise, if the user has
something that is truly private and personal, use U.S. Mail. This,
however, does not mean I agree that a sys admin _should_ look through
mail and files.  I ran a BBS for a year.  When the users logged in,
they got a message stating that I or any of those associated with
running the board (a co-sysop), may examine e-mail if we feel it
appropriate (there were no private files).  Appropriate meant
basically, I would only check e-mail if I heard reports of
harassment, credit card swapping, etc...  These are the only times I
feel a sys admin _should_ look at email or private files, when a
problem has been reported. When you get to larger systems, run by
many, and/or (in the case of universities) not owned by the system
administrator, this takes on a different twist.  I feel the standards
should be more strict on when the sys admin can look at a user's
files and e-mail.  Basically, the sys admin should not be allowed to
view a users files or e-mail unless a valid report of illegal
activity is reported (i.e., pirating or cracking, etc... from a
user's account).  Besides, in the case of a university, the student
is paying for that computer system, they have a right to privacy on
it. In a work environment, I feel as long as the equipment belongs to
the company, they have the right to check the files on it.  E-mail,
however, should not be viewed in any way, shape, or form.  If
problems occur in this environment, I feel the person(s) involved
should be confronted face to face, not by reading his e-mail.  E-mail
in a company tends to take on a much more serious nature and more
confidential subjects.
   Basically, my opinion is that the answer to the question depends
somewhat on the system.  I feel the sys admin should clearly state
what standard he follows.

Mike Jones
mgjones@miavx1.acs.muohio.edu
mgjones@apsvax.aps.muohio.edu

       ***                       ***                      ***

>From: Leigh Clayton <yrloc.ipsa.reuter.com!loc@uunet.UUCP>

 I don't believe that a sysop is ever justified in looking at a user's data in
plaincode without the user's prior request or at least consent. (This is based
on the level of security we've offered our clients over the last 20 years). It
may be that the user's data occasionally finds it's way in binary into a system
dump or diagnostic: such material should be used only for diagnostic purposes
and treated as confidential while in use, and destroyed as soon as possible.

../Leigh

-----------------------------------------------------------
Leigh Clayton                     loc@yrloc.ipsa.reuter.COM
    -or-                        loc@ipsaint.ipsa.reuter.COM

       ***                       ***                      ***

>From: Timothy Smith <plains.nodak.edu!tismith@uunet.UUCP>

     In response to question #26, my opinion is that a sys admin
should not be able to view another persons files until that person
has been found guilty of an offense.  If the person in question is 
suspected of foul play, his property would still be safe when it is in
his domain.  If he makes his crime public, he's toast, but if it is
just sitting in the corner of some dark directory, that should be fine.
     In a case where a person has been found guilty of some offense and
a search of his files finds evidence of another unrelated crime, that 
information should be safe until such time as they could legally be 
procured.  Basically, I would suggest that the power of search warrents
cover computers in much the same way that they cover houses.

-Tim Smith

tismith@plains.nodak.edu

       ***                       ***                      ***

>From: "Rachim Tarantino, S/W DQ Tech, HNL" <verifone.com!RACHIM_T1@uunet.UUCP>

Private files and Email are equivelent to one's personal diary or P-mail.
Hence, they should be treated as such.  The law requires a subpoena (sp?) or
warrant for one's diary to be looked through.  The same should be true for
one's files and Email.  If I found out a sys admin had looked through my
personal files or Email with out the proper legal procedings, I would have him
arrested and/or take him to court.

(Hasn't the law already been updated for this case?)

rachim.

       ***                       ***                      ***

>From: space.ualberta.ca!sherwood@uunet.UUCP

	Would you please use a different title line for each  
question.  The replies get mixed up in the news reader.
	E.g. you posted a new question regarding the propriety of an  
administrator snooping in peoples files, while the Net was still  
furiously debating the debacle of Windows NT.

	If you make it of the form 

	Netview Question #26 -- Sysadmins in User Files
	Then the discussions will be separated.
	The first two words being constant, people can still add that  
as a regex to their kill file, if they want to shut you off.

	As to the question itself:
	At most places computing is not a right, but a privledge.  I  
am quick to disable an account for any abuse of privledges.  I am  
also lenient about renenabling it after talking to the person  
involved.  

	While I have the power to read anyone's files, the only time  
I do is if I suspect that they are up to something that will impare  
other peoples data, or use of the system. 

	I've only done this once:  I checked a person's mail folder  
to see if he had received a warning that I'd sent him a few weeks  
before regarding disk usage.
	We have an open shop; all files default to world readable.   
There are encryption programs on our systems for anything that people  
really want to keep private.  

       ***                       ***                      ***

>From: Marianne Mueller <eng.sun.com!Marianne.Mueller@uunet.UUCP>

In answer to question #26: 

when the person looking has a warrent from the judge.  
(Presumably, the cops have to convince the judge they have
reason to suspect criminal activity, and that they are looking
for evidence.) 

The person looking can LOOK - can not destroy, can not take files away
"temporarily", especially can not take hardware away. 

       ***                       ***                      ***

>From: Mark Brown <testsys.austin.ibm.com!mbrown@uunet.UUCP>

 When it is the stated policy of the system, and the user is _known_ to 
be aware of that policy. This includes such statements as
	o "The University reserves the right to examine all contents of
	  the System at any time."
	o "The Company owns the System and all contents thereon."
	o "None of the contents of this BBS are to be considered
	  privately owned by the users."

 When forced to by a properly validated warrant or subpoena.

 At _no_other_time_ is it justified.

cheers,
mark brown
-- 
Mark Brown       IBM PSP Austin, TX.| I believe in the richness and mystery
                 VNET: MBROWN@AUSVMQ|   of the universe, but I don't
MAIL: mbrown@testsys.austin.ibm.com | believe in the supernatural.     -Simmons
DISCLAIMER: My views may be, and often are, independent of IBM official policy.

       ***                       ***                      ***

>From: chose.cam.org!mortel@uunet.UUCP

    From my own personal good sense, I would answer:

      1. If the user clearly agrees to have his mail monitored
	 wether it is by written consent of by setting a flag on
	 public/SYSadmin access files

      2. If the SYSadmin can get a legal mandate from a higher
	 authority(ie: police, judge,...)

      *  The SYSadmin could deserve the right to make a backup of
	 the user's file if he's suspiscious of something until he
	 can get a mandate to look through them.



    You can edit my message/correct spelling mistakes or anything
    else if you decide to use it since it's very probable I didn't
    express myself correctly.





 /\/\/\/\ Stephane Lussier, mortel@chose.CAM.org

       ***                       ***                      ***

>From: Paul Perry <ep110.wg2.waii.com!pmp@uunet.UUCP>

 When is is justified for a systems administrator to look through a
user's private files and E mail?

  Never as long as the person is still a trusted employee. 

       ***                       ***                      ***

>From: Steve Mitchell <caticsuf.csufresno.edu!steve@uunet.UUCP>

The answer to this question lies in the appropriate use agreement
that the systems administration and the user should have signed.
There are many different types of sites out there, each providing
different levels of privacy and security to their users.  A university,
for example, might provide different levels of privacy than would
a commercial, public UNIX site.  The appropriate use agreement should
clearly state the level of privacy that the user can expect for his
files and E-Mail.  This agreement provides both the administration
*and* the user with protection from any inappropriate activities by
the other party.

Any Internet site that doesn't have an appropriate use agreement
between it's administration and it's users, is only asking for 
trouble in the long run.

-- 
|#| Steve Mitchell / System Administrator                      KD6BET |#|
|#| California Agricultural Technology Institute                      |#|
|#| California State University, Fresno           steve@csufresno.edu |#|
|#| Fresno, CA  93740-0115                     "Now, Steve is happy." |#|

       ***                       ***                      ***

>From: Manjit Trehan <indycms.iupui.edu!ITMS400@uunet.UUCP>

It is never justified for a systems administrator to look through
a user's private files and email.  It is certainly justified for
a systems administrator to look through a mis-user's private files
and email.

................................................................
. Manjit Trehan  version 1.0                   ITMS400@INDYCMS .
. Indiana University Purdue University at Indianapolis (IUPUI) .
................................................................

       ***                       ***                      ***

>From: Paul Fu <cs.bu.edu!quark@uunet.UUCP>

It is not justified unless there is clear evidence of illegal activity by
said user.

And by the way, I like the OST name, but you might want to change the
description of 'net.views' at the bottom of page 77, in 30 March 1992 OST
where it says "...and UT! readers."


Paul Fu, Jr.

       ***                       ***                      ***

>From: "Per Reedtz Thomsen, UNIX Products Division" <us.oracle.com!pthomsen@uunet.UUCP>


Never. If it is company policy that the administrators are allowed to look at
peoples files and mail, this fact should be widely published around the systems
people use.

Generally, though, it is a bad idea to have people snooping in your e-mail and
private files. The inherent fear of doing something which can be considered
wrong will create a 'Big Brother is Watching You' syndrome, where people spend
a lot of time making sure the 'watchers' can't see what you are doing. This
will, of course, make people less efficient, but they are not going to give up
their private mail and files just because they are being watched.

Regards,
Per Reedtz Thomsen.


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Oracle Corporate Headquarters
Snail:	500 Oracle Parkway
	MD 659406			                           
	Redwood Shores, CA 94065	E-mail: pthomsen@us.oracle.com

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~       ***                       ***                      ***

>From: Judy <beldar.ucsd.edu!judy@uunet.UUCP>

The only time I would even CONSIDER wasting time looking through a
users' mail would be under THEIR authorization to find some work-related
issue.  Likewise with their files.  
 As a system manager, I believe respect for people's privacy is in order.
I also work closely in a group that shares data.  So we put the shared 
data in a separate directory.  Occasionally, files remain in the users'
directories that we need.  Generally accessing those is ok - but again,
I never go "snooping around" -- it is much faster to ask the user where
the file in question is.
  A system manager who snoops around obviously doesn't have enough to do!
       - Judy Gaukel   (judy@beldar.ucsd.edu)

       ***                       ***                      ***

>From: Dave Pipes x4552 <srg.srg.af.mil!dpipes@uunet.UUCP>

I have always treated this (in a business environment) as equivalent to
asking when you can go through a co-worker's desk or filing cabinets.  This
usually occurs when there are problems with the user's account or the mail
system; when the user is out and files or info known to be on the system are
needed, and a manager is aware of the search; after a person has terminated
employment and vacated the office; anytime, with the user's permission.

In a business environment, one must remember that all of the resources used
to store private messages and files are owned by the company or it's clients.
Thus, if you wouldn't keep something in your desk - which can be searched by
order of the company - don't keep it on your system.  Or encrypt - at least
the decryption takes some effort.

The SysAdmin has the responsibility of not prying in situations which place
him in the user's filesystem.  This is equivalent to not rifling your co-
worker's desks while they are out for coffee.  It is just common decency.

		David Pipes
                Unix SysAdmin

       ***                       ***                      ***

>From: Pat Farrell <cs.gmu.edu!pfarrell@uunet.UUCP>

Short answer: Only when they have a court authorized search
warrent. See US Bill of Rights, Admendment 1 concerning free
speach and Admendment 4 concerning freedom from unreasonable
search and seizure.

The long answer, which is unfortunately too long for your
column, is much more complex. This complexity does not mean
that we should ignore underlying issues and their
ramifications. Rather it suggests that the question be
examined in-depth. I recently spent three days at the ACM's
Computers Freefom and Privacy conference which was held in
Washington DC from March 18 thru 20. It discussed this issue,
and related ones, in detail in sessions running from 8:00 AM 
until midnight. Even this was not sufficient time to
completely explore the topic.

It is well established that the US Postal Service most protect
the privacy of letters that we ask it deliver for us. I have never
heard of a case where private mail was compromised. Similarly,
we expect the phone companies to respect our privacy. We allow
law enforcement agencies to obtain court orders for wiretaps,
but they are not granted unless there is substantial prior justification.

We have extended the expectation of privacy from the formerly
Government owned Postal Service to publicly regulated phone
companies, even though the phone companies are owned by
investors. We have also extended the expectation of privacy to
private common carriers, such as Federal Express and United
Parcel Service. It is taken for granted, and rightly so, that 
the employees of the US Postal Service, and the commercial 
common carriers, respect the individual customer's privacy.

It is not acceptable for a law enforcement agency, or anyone
else, to listen in to conversations of a large class of users,
looking for one that might have questionable appearences. With
that precident, systems administrators can not be allowed to
search through personal files of groups of users. Obviously,
this logic allows for, and even encourages, the use of court
authorized searches to eliminate illegal activity.

The insertion of the courts ensures that illegal activity is
properly proscribed, while allowing politically unpopular
(or polically incorrect) discourse.

The arguments supporting "looking through" private files
typicaly center arround two concepts:
	1) The computer belongs to an entity (corporation,
	university, etc.) that has a right to protect its investment; and
	2) Honest people have nothing to hide.

Concerning 1), I am not about to argue that protecting these considerable
investments is unnecessary or unwise, rather it is a critical
part of a system administrator's responsibilities. But while a
closed system, such as the accounting department of a bank,
has a clearly defined concept of ownership, Email services and
Usenet feeds change the nature of the service. That portion of
the system that supports Email and Usenet has many of the
characteristics of a common carrier. Common carriers are bound
by a difference set of law and precidents than internal closed
systems. I believe that many commercial, government, and
educational members of the Internet community are unaware of
the implications associated with these differences.

Concerning 2), while this has been expressed by as a sincere
belief by law enforcement officials and systems
administrators, it simplisticaly ignores the facts of human
history. Selective enforcement is a reality. One person's
political dissention is another's subversion. Secret files of
public and secret police are too often a reality. While the
crumbling secret police files of the former Soviet block
nations are held to ridicule, our own FBI's files on civil
rights leaders show that we too are capable of attempted
repression.

While I hope these political and philosophical points
illustrate the undesirability of electronic surveilance, there
are practical, technical concerns as well. Cryptographic
science provides simple, fast, and painless ways to ensure
privacy. Transportable source code for both the DES standard 
and RSA's public key encryption method are readily available
on the Internet. While I will sidestep the questions of how
secure DES and RSA are, each will provide a serious challenge
to system administrators who can presently 'grep' through all of
the files in a system. This can easily lead to an "encryption
arms race" in which the system administrator is unlikely to
win.

The simplistic solution to outlaw encryption leads to the not
too original bumper sticker: "when you outlaw encryption, only
outlaws will have encryption." I see no advantage to stooping
that low.

Which brings us back to the simple answer. When is "looking
through" acceptable? When you have court authorized approval.
Any other times, it is immoral and unconstitutional, which is
sufficient reason not to do it. Additionally, it is self
defeating and impractical in the long term.


Pat Farrell,      Grad Student                       pfarrell@gmuvax2.gmu.edu
Department of Computer Science, George Mason University, Fairfax, VA
#include standard.disclaimer			              

PS: I also have a day job. I'm a Senior Principal at American
Management Systems, in Arlington Virginia. I've worked in
timesharing and distributed systems since 1974. Resume
available upon request.

       ***                       ***                      ***

I'm willing for you to publish this, but only if you omit my name and
institutional affiliation.  The issues are sensitive enough that I
believe only the Vice President of Computing would be authorized to
speak for attribution.

I manage computing facilities for the computer science department in a
large public university.  We take privacy of user files very
seriously.  We try to avoid looking at user files except when there's
good reason to think that it's necessary to investigate a problem that
poses an immediate threat to the security or integrity of the system.
However it's surprising what odd things come up.  E.g. a report is due
and some critical document is in the directory of a staff member who
left the University 6 months ago.  Or a student is in the hospital and
someone working on project with them needs access to a file they were
working on in common.  In these cases a staff member will sometimes
look at a document to verify that it's reasonble to give to someone
else (e.g. the draft of a paper lists the other person as a
co-author).  In cheating cases, we sometimes will look at files to
determine which ones are likely to be relevant.  Note however that we
won't show a student's file to a faculty member except in the context
of an official proceeding that provides formal protections of the
student's rights -- what we do is make sure we preserve copies of
files that might be needed for such proceedings.  Normally we can
simply save a copy of the whole directory, avoiding the need to look
at individual files.

One limiting factor is that we don't have an official University
policy on privacy.  It is possible for my policies to be overriden.
So far the only case where this has happened was when a student was
murdered.  The police wanted to look at their email.  We resisted.  We
wanted a subpoena, and were supported by the vice president of
computing.  However we were ordered by the (former) president of the
University to comply.  It's my guess that under our current
administration this would no longer happen.  Because of the ECPA, a
number of staff claim that they would now refuse orders to divulge
email without a subpoena, even if ordered to do so by the president.
But we're hoping this won't be put to the test.

       ***                       ***                      ***

>From: Hamish More <gssec.british-telecom.co.uk!hmore@uunet.UUCP>

A : 	
	NEVER !!!

	Unless that person has left the company, and other users wish to
	try to pick-up his work. If the person concerned was sensible, he
	would have deleted his e-mail, but left his work files.

Comparison:

	When is it ok for the administrator to open your personal paper-mail
	which is addressed to you, and marked "private & confidential" ?

Keep up the good work.

How about this for another net.views question.

In a very security aware environment, how do you convince managers that
public-domain software, and or share-ware is ok to use, given the paranoia
about viruses/trojan-horses etc ??

----------------------------------------------------------------------
Hamish More				Software Development Division Glasgow
                       			BT Development & Procurement
hamish.more@gssec.bt.co.uk		229 George St, Glasgow, UK
----------------------------------------------------------------------

       ***                       ***                      ***

>From: James Jones <gmuvax2.gmu.edu!jrjones@uunet.UUCP>

it should take a court order for to allow sys. admin. to look at private files
and Email.

proven violation should result in job termination and legal liability, same
as opening someone elses US mail.

       ***                       ***                      ***

>From: paj <gec-mrc.co.uk!paj@uunet.UUCP>

1: Only after publishing their policy.  Users should know where they
   stand ahead of time.

2: In an emergency, sysadmins need to fix things.  They should be
   allowed to look at private files if this becomes necessary in order
   to keep the system operating.

3: In order to investigate suspected illegal or antisocial activities
   (e.g. cracking or virus writing).  In this case the examination
   should require the agreement of two sysadmins (or the sysadmin's
   manager if there is only one).  The reasons for the examination,
   its scope, and the results, should be formally logged.

In general sysadmins should be bound by a privacy code which states
that if they become aware of the contents of a user's files then they
will not release this information to a third party.  The only
exception to this would be if the information is to be used as
evidence in some kind of formal action against the user.

Paul Johnson (paj@gec-mrc.co.uk).	    |                            
--------------------------------------------+----------------------------------
These ideas and others like them can be had | GEC-Marconi Research is not
for $0.02 each from any reputable idealist. | responsible for my opinions

       ***                       ***                      ***

>From: Ron McRaney x441 <idicl1.idi.battelle.org!MCRANEY@uunet.UUCP>

	When is it justified for a systems administrator to look
	through a user's private files and E-mail ?

	Never.  I cannot find ONE single reason why.  As the name
	private implies and E-mail ( the postal service has laws against
	this crime ).  There are ways to find ANY type of information 
	other than to resort to 'bit-tapping' of information.

	Ron McRaney

       ***                       ***                      ***

>From: "Smith Gregory L." <sde.mdso.vf.ge.com!smith_g@uunet.UUCP>

	In my experience, it is best to deal with computer ethics by
	reconstructing the same case in a non-computer environment,
	where the rules are well-known.  This is valid since most
	computer environments simulate real-world (E-mail in particular
	models the postal service).  Therefore, files and E-mail should
	be considered like private property.  So, "When is it justified
	for an administrator (officer?) to look through a citizen's
	private property and mail?" Now, go ask a lawyer the question,
	and model the response in the computer environment.  I'm not a
	lawyer, but, I think a judge may issue a search warrent only in
	cases where you can demonstrate wrong-doing, or in event of
	death.

		Gregory L. Smith (smith_g@sde.mdso.vf.ge.com)
		Software Engineer
		General Electric 
		Management and Data Systems Organization
		Software Development & Engineering
		Valley Forge, PA

       ***                       ***                      ***

>From: David Jones <sf.pge.com!eerc01!dbj3@uunet.UUCP>

It is justified for an SYSAdmin to look through a user's private files just before changing careers.

Dave Jones
dbj3@eerc01.mr.mdss.pge.com

       ***                       ***                      ***

FROM THE GEnie UNIX ROUNDTABLE:

DELPHI [brian@UnixRt]:

        In my opinion, a Systems Administrator is allowed to look at any file
on the system whenever he/she deems it important to do so. My reasoning for
this position is that the system is owned by the company, therefore any
information on the system is owned by the company. It is the responsibility of
the SA to insure the security and physical integrity of the system, even if
that requires searching every file on the system. A Systems Administrator
searching a user's "private" files would be analogous to an employer searching
an employee's desk, he has the right to do it but it should only be done when
the employee/user is suspected of wrong doing. Otherwise, the moral of the
company will soon be destroyed. A general rule of thumb for user's/employee's
is, "Don't put it on there if you want it kept private.".


                                        Brian T. Riley
                                        Senior Technician
                                        Summit solutions
                                        Philadelphia Branch

       ***                       ***                      ***

PSYCLOPS:

     In my opinion, a system administrator is only justified in looking at a
user's private files *if* there is a serious question from higher authories
about possible abuse of company resources or criminal activities.  Otherwise,
I am of the firm opinion that each is entitled to his/her privacy, be it
electronic (computer files) or physical (desk).

I consider it just plain decency to respect other's privacy, and the computer
is just another extension of the workplace that deserves to be "off-limits"
unless interference is absoutely necessary.

                              Peter L. Wargo
                              Documentation/
                              Interleaf System Admin
                              Enable Software
                              313 Ushers Road
                              Ballston Lake, NY 12019

       ***                       ***                      ***


M.NOLAN [Mike]:
 
I guess 20 years of experience as a system administrator have tempered my
otherwise absolutist views on e-mail privacy.  Yes, the 'private' files of an
individual should be private.  Yes, the system administrator must have
complete access to the system when it is important to the administration of
the system that he/she have complete access.  Yes, if complaints are
registered that there are problems with e-mail, ranging from potential system
or programming malfunctions to violations of corporate policies or laws, the
administrator MUST have access to whatever it takes to investigate the
complaint.

The parallel to labor laws on privacy is interesting.  Employers MAY tap
phones and listen in without notifying individuals at the time if there has
been advance warning that this could happen.  (Read the instructions in your
IRS form 1040, the IRS sometimes listens in to monitor the calls you make to
their toll-free assistance line.)   However, employers MAY NOT set up security
cameras in the ladies restroom, although they would be within their right to
place guards (female, presumably) in the restroom.  (Note, I am NOT an
attorney and this should not be construed as valid legal advice. just as my
possibly faulty understanding of the legality of these actions.)

Read through the 'orange book' about class B1 security (or higher), and you'll
see that the NSA has built in safeguards such that there is ultimately a
higher authority who has permission to override security restrictions. 
(Although this will likely be logged.)

Michael Nolan, President Tailored Software Services, Inc.
nolan@tssi.com  (M.NOLAN on GEnie)

       ***                       ***                      ***

J.HART26 [Yoda]:
 
To:  MITCH.WAGNER [OpenSysToday

 >When is it justified for a systems administrator to look through a
 >user's private files and E-mail?

It would depend on the policies for use set by the organization providing the
system.  In general, I am in favor of the honor system and of _never_ reading
private messages.  If, on the other hand, the organization has policies
prohibiting certain kinds of use, and a complaint is filed that someone has
violated the policies, an investigation would be justified which _might_
include reading private mail.

Jim Hart, Supervisor of Computer Services
 Auburn School Department
 Auburn, ME  04212-0800
 USA

       ***                       ***                      ***

FROM THE COMPUSERVE UNIX FORUM:

Fm: Rene Madsen 100021,2302:

Nice question! Her's my tuppence worth ...

A user's private files and E-mail should be treated as files and mail in or on
the desk. If you leave it lying around, you will expect people to see it, but
if you lock it down - for example a directory marked private, and maybe set
700 to the owner - everyone including the sysadm should respect it and stay
out.

The reason for this being a problem at all, is the fact that standard unix
does not allow a higher security clearance than root, i.e. root can do
'anything'.

More advanced systems such as AMDAHL UTS with MLS (a 'native' unix with B2
security extensions for IBM compatible mainframes) or some of the 'big' IBM
OS, allow more security levels, so that not even root is always able to read
user files.

Having said that, I should also say that in case the employer (whatever the
jura slang is - seriouly ?) suspects that the employee
is committing a crime or such, the usual steps would be acceptable -  i.e.
similarly to 'breaking into the cupboard' - looking into the files.

Rene Madsen
Unix Consultant
Brackton Ltd.

       ***                       ***                      ***

Fm: R A Lichtensteiger [NucM 72120,2151

Case 1. Corporate System - If the conditions are clearly spelled out in the
company's Personnel Policies Manual _and_ explained to the user when the
account is granted, then it may be permissible to read his/her files & mail in
the following circumstances; if the employee terminates (ie, is dismissed or
resigns) in order to safeguard company information, if the employee is
suspected of abusing his/her access - and then only when requested by that
employee's supervisor and with the employee's knowledge.

Case 2. Public Access System (CI$...) - If the user is paying for the access,
then there are no occasions when it is appropriate for the administrator to
access the user's files. If an abuse is suspected then the administrator may
terminate the access rights after notifying the user.

Case 3. University System - Somewhere between the first two cases. If rules
for accessing student accounts are delineated in University policy manuals
then it is permissible to check into files if the system access has been
abused (sharing accounts etc.), but only if the student is notified and the
Student Services Dean grants permission.

Reto A. Lichtensteiger VAX Systems Manager Nuclear Metals Inc. 2229 Main
Street Concord MA 01742

       ***                       ***                      ***

Fm: Rene Madsen 100021,2302

With the phrase "the usual steps", i mean for example "breaking into the
cupbord". With the phrase "breaking into the cupboard" I mean opening a
employees (locked or unlocked) drawer/cupboard or otherwise normally accepted
area of personality.

I guess that in the US the rules are a bit different than here in Europa. As
far as I know you have very strong privacy rules over there, whereas normally
an employer here has any right to open an employees drawer/cupbord etc.
Normally this would not happend, as the unions, who are *very* strong here,
would make some major objections which the employer would normally avoid
unless he (seriously) expect that the employee is committing a crime as for
example stealing from the company, selling drugs, or what-not.

Brackton Ltd is computer consultancy company located in Ireland, but trades in
Europa, mainly in the Benelux area. My opinion as written here, and before,
may not necessary be those officially had by Brackton Ltd.

-Rene

       ***                       ***                      ***

Fm: David S. Brookshire 72570,2666

A System administrator is just that...the administrator of the system.  They
are God (on their net, at least).  The root account of any system is given,
usually, only to someone considered trust worthy.  If they were not...why
would they be given the access.  One of the duties of the position is to
maintain a file system.  If this means accessing a user's files...so be it.
The user should be aware that root can read their files.  If there is
something private...then download and erase it, or encrypt it.


David S. Brookshire
UNIX/VMS Consultant

Academic Computing Services
University of Maryland Baltimore County
Baltimore, Maryland 21228

COMPLAINTS AND ADMINISTRATIVE REQUESTS:


>From: topaz.cs.virginia.edu!spm2d@uunet.UUCP

Hmmmm.... "a summary posted within two weeks?" I never saw one
for the NT debate or anything before that.

Please, get your COMMERCIAL garbage off the net, as I don't
appreciate paying for your surveys.

Steve

[ EDITOR'S NOTE: Posts are summarized when we say we will do it; friend Steve 
is not paying attention.
     I don't consider this an inappropriate use of the net. These 
aren't ads or press releases; these are requests for discussion, and based on 
the volume of responses we get, I have to assume that a lot of people *DO* 
like it. However, we'll do what we can to make it easier for the people who 
don't want to read this stuff to skip it over; please forward any suggestions 
about that to wagner@utoday.com.
     I sent E-mail to Steve, telling him that a lot of people *DO* seem to 
like our posting net.views to the net, and asking whether he made money from 
computer work, or if he planned to---because if so, his requests for computer 
tips were just as much "commercial" speech as our net.view posts. Got the 
following response:]

>From: topaz.cs.virginia.edu!spm2d@uunet.UUCP

Actually, in reading the responses, a lot of people have found
your questions objectional.

Do I get paid for doing computer work? None of your business.
Do I use USENET to increase my knowledge? Yes, I do.
Your net.views contribute ABSOLUTELY NOTHING to my knowledge
of computers. USENET is a public resource to be used for
the free exchange of information, not for the research purposes
of questionable publications. In other words, I shouldn't have
to pay money in order for you to MAKE money by getting
research on the cheap. OK?

[ EDITOR'S NOTE: If we need research done, we do it, and if necessary, we pay 
for it. We don't do net.views here out of a desire to pinch pennies---we do it 
because there's no other way to get the quality of feedback we receive from 
this sort of open dialogue. Enough  said on this topic; friend Steve is 
clearly more interested in giving orders and having them obeyed than he is in 
discussing anything. Perhaps he was scared by a copy of OPEN SYSTEMS TODAY as 
a child.]

       ***                       ***                      ***

>From: rz.uni-karlsruhe.de!Christian.Finger@uunet.UUCP

Dear Mr. Wagner,

please stop posting such questions into comp.sys.hp.
This newsgroup is intended to deal with technical problems people have with 
equipment from Hewlett Packard, not to answer questions about personal views.

Yours sincere
        C.Finger

--
  .     Christian Finger         |   SMTP:
 |||    Computer Center          |   finger@rz.uni-karlsruhe.de
\|||    University of Karlsruhe  |   X.400:
    /   Am Zirkel 2              |   S = finger; OU = rz
        D-7500 Karlsruhe 1       |   P = uni-karlsruhe; A = dpb; C = de

[ EDITOR'S NOTE: Mr. Finger is right. Apologies to comp.sys.hp readers. I'm 
posting this compilation in comp.sys.hp because I said I would, but after this 
I'll be more careful about gauging the appropriateness.]

       ***                       ***                      ***

>From: "Marcus J. Ranum" <decuac.dec.com!mjr@uunet.UUCP>

	Tell you what: Why don't you learn to post with followups
redirected to someplace, so you don't have this kind of drivel all
over the net?

	You're cluttering up 14 newsgroups. Probably not a record, but
if you plan on doing it constantly, it's going to get old fast.

mjr.

[ EDITOR'S NOTE: Mr. Ranum is also correct; my apoligies to the entire net on this one. Now and henceforward, we'll be directing followups to comp.unix.questions.]