Emails being watched

stonecoldsteveaustin

I might try that lol

onomatopoeia99

stonecoldsteveaustin wrote: »

Is this possible or am I being paranoid?

All of it is possible, but the employer should tell you, either through your contract of employment or other document (e.g. company handbook, statement of IT policy etc) if they are monitoring communications.

RIPA is an arcane piece of legislation and much of it is iniquitous, but it appears to place a duty on operators of private communications networks not intercept communications without the consent of both sender and recipient. The Telecommunications Regulations Act allows some monitoring as "lawful business practice" in some defined circumstances, but employees must be informed that this may take place. Article 8 of the ECHR grants a right to privacy which sits above all of this.

Covert monitoring of a private network is a no-no and appears illegal in most circumstances except very serious ones e.g. when a crime is suspected (e.g. covert CCTV to detect who is responsible for thefts) or serious health and safety issues that could affect other employees.

This is my interpretation of some of the relevant legislation, based on (1) my complete lack of legal training and (2) running a private network at work which is completely unmonitored, as I decided monitoring was a legal minefield so best not to go anywhere near it (it's against my principles anyway and my employer has never asked for anything to be implemented).

An actual lawyer would be better placed to advise you.

tronator

bod1467 wrote: »

In theory you could digitally sign your emails. That way only you and the recipient could read them, but you'd need to share your digital public key with them...

The word you were looking for is "encrypt", not "sign". Signing an email only makes sure that nobody can tamper with the content of the email in transit. It is still readable by everyone.

Collabora

bod1467 wrote: »

In theory you could digitally sign your emails.

would not work if its a work computer as the email certificate would have to be assigned to the mailservers IP which is run by the company

tronator

Collabora wrote: »

would not work if its a work computer as the email certificate would have to be assigned to the mailservers IP which is run by the company

I don't know what "email certificates" you are talking about, but the ones I know (S/MIME and PGP) are installed in the email client.

And it would surprise me if there are any certificates which have an IP hard coded in them. The way you usually install a certificate on a server is to also have the private key installed there. This could be any server anywhere.

GrumpyPL

All companies are required to monitor email usage actually. Some will do this and only flag up certain keywords within emails, but some will copy all email sent & received by your work account to your boss or someone slightly up the chain. It will be read so best thing is to keep all work emails strictly work. Don't worry too much, remember your boss will probably be reading the email of everyone in your office, not just yours.

stonecoldsteveaustin

thanks everyone

bod1467

tronator wrote: »

The word you were looking for is "encrypt", not "sign".

You are, indeed, correct. thanks for clarifying.

Strider590

stonecoldsteveaustin wrote: »

Thanks all, I have nothing to hide at all it's just the sneakyness (If that's a word) of it all I don't like

Make sure your emails are well written, make sure you always do/say the correct thing and use this to your advantage.

If you want to send private email, use your own account.

Remember this probably means they monitor your web usage too.

I use my phone for personal email/browsing OR I resort to accessing my laptop at home via an encrypted remote desktop connection, should I ever need a full sized browser for personal use (during my lunch breaks) or to access my POP3 based email accounts.

This way I leave no obvious trace of any activity whatsoever on the works PC, server or in the network logs.

Collabora

tronator wrote: »

I don't know what "email certificates" you are talking about, but the ones I know (S/MIME and PGP) are installed in the email client.

And it would surprise me if there are any certificates which have an IP hard coded in them. The way you usually install a certificate on a server is to also have the private key installed there. This could be any server anywhere.

well as running a web hosting business and use these daily an email digital certificate is assigned to the main mail server where the email was set up as it is set up the the domain and not particular email. so same the site is mseclient.com. you would set the email cert to *@mseclient.com and then if you set up the email me@mseclient.com then whoever set up that email can activate the digital cert for that domain, but the recipient does not need to know the encrypted code, they can open the email by following instruction.