Is privacy important?
The nature of this question keeps changing. Should we sacrifice a little privacy to make the world safer? To make it more convenient?
It seems that this question is no longer academic for me.
At work we got a new piece of equipment. A network analyzer to go with our firewall. Our Network Analyst, who is responsible for the firewall has been testing it out.
It seems that there is very little information that is hidden from him.
Oh. I know the information has always been there, for anyone with the right tools and enough time. But this has raised the stakes. He can read in near real time what you are saying on IM or what web page your are reading. Who you are logged in as.
If he were inclined, he could know just about anything I did on line, with no more effort than you are expending to read this blog.
He let our Network Engineers know about the capabilities of this device by reading verbatim an IM conversation between to of them.
The reaction in the room was unanimous: Fuck this.
Like I said, we know that nothing is safe or secret in the electronic world. We know that better than most people. We also know the pure volume of stuff happening on the network at any given moment should mean that whatever we do is just part of the noise.
Not anymore.
Of course, the argument always goes— if you have nothing to hide, you have nothing to fear.
Like most old arguments, it’s dead wrong.
Typical Chat conversation:
jeckles:dude
shutter:what’s up!
jeckles:that meeting was lame!
shutter:oh yeah?
jeckles:fuck yeah. you should have heard the dumbass shit that so and so was saying.
shutter:hahahhaha. I know so and so is such a tool… why do they invite him to those meetings
jeckles:to make me nuts, I think
Harmless. Just a little venting between co-workers. I’m sure it happens all the time. But what if ’so and so’ got access to the logs of the analyzer? Yeah. That would be bad.
And even if I refrained from criticizing or insulting anyone on IM, would it still be OK?
No.
Imagine if your boss offered you overtime to work on a project. You declined because you had plans for the weekend. You don’t tell your boss that your plans are to watch all 12 hours of LotR, its none of her business. But when you tell your buddy about your plans and she sees the logs…
What if some one was planning to quit? That’s not illegal or immoral, yet you wouldn’t want anyone at work to no about it before you told them.
The scenarios are endless. The fact remains that recording personal conversations is wrong. It’s probably legal, but what’s legal and what’s right often don’t line up.
There is a need to monitor what happens on a network and to control the kinds of traffic that is on the network. But there has to be a way to do it without spying on your own employees. I’d rather have IM blocked than monitored.
So what happened at work?
We downloaded and install a tool to encrypt our IM. Our Network Analysts blocked our IM. Our CIO said, “You guys can encrypt it? Send me the link.” Our Analyst backed off.
But this isn’t going to go away.
What should you take out of this? Two things.
Protect your privacy. If you think you have nothing to hide, you underestimate the ill will people can possess.
And if you IM me while I’m at work, assume what ever you type is being read. Cause it probably is.