Legal issues with keyloggers (salvaged from /dev/null)

[astcell]

There is this really cool website called www.google.com where you can type in "key loggers" and they will give you tons of answers for free. They even have something called Google Ads on the right side of the screen that will have relevant advertising.

And your brother has access to another site called www.fbi.gov because what you plan to do is illegal.

How about just password protecting your computer, either at the OS or BIOS level?

[Content added by TheCotMan:]
This was a reply to a post from a user who asked a question better researched with google, here.
The following posts emerged with a new topic and were salvaged from that previously /dev/null-ed thread.

[Deviant Ollam]

because what you plan to do is illegal.

is it actually illegal to setup logging on your own equipment in order to monitor for people misusing it? sounds to me like this might not be "his" computer in the truest sense... but rather their parents bought it and it sits in his room. still, from what little i know of the law in this area, he might not be guilty of that severe a violation.

[KeLviN]

there were some law suits about employers monitoring employees on company computers while at work that might apply here either way.

[astcell]

is it actually illegal to setup logging on your own equipment in order to monitor for people misusing it? sounds to me like this might not be "his" computer in the truest sense... but rather their parents bought it and it sits in his room. still, from what little i know of the law in this area, he might not be guilty of that severe a violation.

Yup, it is. You would have to have a discalimer on the screen or login to let him know that the keystrokes are being recorded, and you would need evidence that he accepted the restrictions, and knew about it for every single keystroke he made. And then maybe you would win the court case, but you would still be broke.

Now if you are the parent you have a few more rights.

Maybe you can scare him off by saying you are going to use monitoring software. May of the monitoring software sites address the privacy issues, how you must be the owner of the PC to do it, and what you need to do to let users know about it, and potential legal ramifications if you do not listen to them.

[Voltage Spike]

You would have to have a discalimer on the screen or login to let him know that the keystrokes are being recorded, and you would need evidence that he accepted the restrictions, and knew about it for every single keystroke he made.

First of all, I admit that I'm clueless here, but I'm going to have to agree with Deviant Ollam in that it just feels wrong. Installing a keylogger on my own laptop is illegal if I know that other people sometimes use it without my authorization? What if I didn't know about the other users?

I suppose the question is, to what lengths do I have to go before installing the logger is legal? Perhaps I always break the law if I am running a keylogger and someone else breaks into my system?

Also, does this apply to other logging software? If not, why are keyloggers treated specially?

I think what I really need is a few years of law school.

[Floydr47]

This seems to be a "damned if you do, damned if you don't" grey area of the law. I seem to remember a case last year where a woman (who didn't own a computer) had a room mate that dowloaded music over a p2p network using her (the room mate's) laptop. Up to this point all seems well. The homeowner had commited no legal infraction, the room mate was the one downloading "illegal" files. However, the RIAA still filed suit against the homeowner claiming that the telephone line used was the property of the homeowner and that when the room mate used the telephone jack to download files (that the homeowner believed to be research for homework) that made the homeowner responsible for the content of the files being downloaded because the telephone line was billed to her. More or less although she was not really guilty of anything, she was sued as an accessory by providing the means in which to download the files in question.

As confusing as the laws are these days, VoltageSpike, I believe it would take more than a few years in law school...a few centuries might be more helpful.

[Ridirich]

Floyd, didn't we have a discussion about the RIAA a while back? Reason I ask is there seems to be something hokey 'fitting' together...IE RIAA and other 'companies' can install keyloggers on your PC, but according to ast, you are not allowed to install your own on your own machine. Seems there is a loophole somewhere....

[astcell]

You CAN install it on your own machine, they advertise it as a way to remember things you types, sort of a backup.

Maybe it you change the wallpaper to THIS PC IS BEING MONITORED and added a logon statement that pops up at logon you will have been prudent enough. After all, you can argue that it is your machine, you never expected anyone else to use it. :>

[Floydr47]

The point I was trying to make was that "Carrier" may still be responsible for his brother's activities on his computer even if he is not aware of what those activities are. The best solution in his case would be a strongly encrypted password or to make his personal computer entirely inaccessable to his brother. I was just using the case with the RIAA as an illustration...

[Voltage Spike]

RIAA and other 'companies' can install keyloggers on your PC

Do you have an actual instance of this? I can't see any court allowing private party wiretaps ... err ... searches. I almost forgot that keyloggers aren't wire taps.

[Ridirich]

I remember a discussion about it...haven't had time to search for it recently.

[Floydr47]

It would seem to me that a person could only claim invasion of privacy if that person had a reasonable expectation of privacy. By using an employers (or anyone elses) equipment in a manner not in accordance with the rules of the company then a reasonable expectation of privacy couldn't be expected. I don't see any way that the 1st or 4th amendment could be applied to the use of keyloggers in a business setting. If an employee is using the equipmen for any other purpose (shopping on line, watching porn, playing games, writing personal e-mails) then he is in fact "stealing" from his/her employer. The old saying "Time is money" applies here.

[Voltage Spike]

By using an employers (or anyone elses) equipment in a manner not in accordance with the rules of the company then a reasonable expectation of privacy couldn't be expected.

That line of reasoning is very flawed. So if I use the equipment in a manner completely in accordance with the AUP, then the employer cannot monitor me? But if the employer can't monitor me, how does it know when I am violating the AUP so it can monitor me? Maybe, like law enforcement, the employer should have reasonable cause before installing a keylogger?

I don't see any way that the 1st or 4th amendment could be applied to the use of keyloggers in a business setting.

Limitations on the government are not limitations on business (although the one often patterns itself after the other).

If an employee is using the equipmen for any other purpose (shopping on line, watching porn, playing games, writing personal e-mails) then he is in fact "stealing" from his/her employer.

If the employee is thinking about work while at home and isn't compensated, is the employer "stealing" from the employee?

If the employee is engaging in these activities and employer doesn't notice without direct monitoring (i.e., he gets his work done), is there really just cause for the privacy violation?

[Floydr47]

My line of reasoning would be flawed from an employee's view point but not that of the employer. When the employer purchases equipment for the company he has the right to expect the equipment to be used for company purposes exclusively. He should also have the right to install any monitoring device necessary to achieve that end. If an employee is thinking about work at home then it is a sign that the employee is dedicated, work oriented, and ambitious. The employee will at a future date be compensated through promotions, raises, and/or bonuses for his dedication. If the employee is "getting his work done" and still has time to use company equipment for his/her own personal use then the employee has too light of a work load, this also would be reflected by monitoring the employees activities, more work could be accomplished in the time that the employee is wasting by using company equipment for personal use.

[Voltage Spike]

My line of reasoning would be flawed from an employee's view point but not that of the employer.

It's flawed regardless of perspective. It states that the employee loses an expectation of privacy for breaking the rules but that the employer is free to take away privacy in order to verify the employee is following the rules. At what point does the employee have an expectation of privacy, then?

If an employee is thinking about work at home then it is a sign that the employee is dedicated, work oriented, and ambitious.

It works both ways. If the employee is taking care of home issues at work, then the employee is free to be more productive at work (since he would have to take time off otherwise) and has more free time at home to think about work. The employer is rewarded by more employee output.

If the employee is "getting his work done" and still has time to use company equipment for his/her own personal use then the employee has too light of a work load, this also would be reflected by monitoring the employees activities, more work could be accomplished in the time that the employee is wasting by using company equipment for personal use.

You are going to renegotiate my contract for more pay now that you have me performing more work than we agreed on, right?


There are many problems with these debates. One such problem is that nothing is so clear-cut as the arguments you or I laid out above and it always depends on the situation. Another is that we have a strong culture of employer's rights with little regard for employee rights.


PS: I love your signature, Floydr47. Very cool.