Legal issues with keyloggers (salvaged from /dev/null)

[Ridirich]

I do see Floyd's point though, Voltage.

I mean, I hate keyloggers with a passion, but I seriously can see them used in this manner to make the work enviroment a safer and more efficient place.

Think about it. You have an employee on a computer who keeps messing up his PC, tech support can check his keystrokes to see if he is doing in maliciously to get out of work, if he is simply a fool who needs education or if it is a real problem with the machine.

This can also be used to make sure no one else takes credit for your work.

So, in all honesty I can see this in a business setting.

I used to work in a telemarketing situation(shame on me, but it paid the bills) and people would dick around on the machines and download virii that would be contracted to the entire network. From an employee's perspective that's time I did not get paid. Time some asswhipe stole money from me.....and less money I had for food that month. I would not have minded a keylogger on that machine, especially since it was not my machine.

So, from the employee and employer aspect I agree with this setting, and in all honesty this setting, or parents protecting their kids are the only two settings I can agree with.

[Voltage Spike]

I do see Floyd's point though, Voltage.

As do I. I'm simply trying to enlighten those that haven't considered the other perspective.

Of course, all of it strayed from the primary point of can an employer do this...

You have an employee on a computer who keeps messing up his PC, tech support can check his keystrokes to see if he is doing in maliciously to get out of work, if he is simply a fool who needs education or if it is a real problem with the machine.

Your scenario describes a reactive response (and one that could obtain the permission of the employee, I might add). This is very different from a proactive invasion of privacy.

people would dick around on the machines and download virii that would be contracted to the entire network.

Again, this doesn't justify an invasion of privacy. The infection would still have happened, a technical solution that doesn't involve spying would have been more effective, and it sounds like your complaint was that it happened multiple times with a known employee (which could, again, be reactive).

I can envision scenarios where it would be problematic to track down the culprit without total information awareness, though...

I would not have minded a keylogger on that machine, especially since it was not my machine.

hehe, isn't that almost always the case? I believe a pastor wrote a poem about this one time.

parents protecting their kids are the only two settings I can agree with.

Nice try. I'm not getting pulled into this topic again. I learned long ago that gut feeling always trumps logic when it comes to children.

I will comment that neither case requires undisclosed monitoring privileges. Based on earlier comments, both cases would not be allowed, either. That brings us back to law enforcement only (where it is not considered a wiretap for unknown reasons).

I'm still shocked about the treatment of logging on my own PC. I suppose it's like having a hole on my property that an intruder falls into, though.

[Floydr47]

Most employers have an employee sign a "consent to search" form when they hire on. The form usually gives the employer the right to search an employees locker, work station, person, vehicle and personal files. In the case of someone who is a designer of some type, whether it be engineer or software designer, for instance, the intellectual property of that person is actually property of the company if work was done on the project on company time. Keyloggers offer employer a way to protect the property that belongs to them. In another instance, should there be an office Romeo (or Juliette), who spends his/her day sending offending or suggestive e-mails to fellow workers, a keylogger can protect the employer from a possible sexual harassment suit. In this instance the keylogger is protecting the other employees in the office by keeping a record of the improper conduct of the offending employee and providing grounds for his/her dismissal. In my line of work a person doesn't have to consent to a search, he/she has every right to refuse, but the employer also has the right to hire someone who will consent to replace the former employee. As my boss is fond of saying, "there is a hungry man looking for your job, don't start getting too well fed."

[Voltage Spike]

Most employers have an employee sign a "consent to search" form when they hire on.

I keep trying to steer the conversation in this direction, but now I'm just going to say it: is a search really the same as a wiretap? The United States government doesn't think so ... except when it takes the form of computer surveillance. Note that a wiretap order is more difficult to obtain than a search warrant.

should there be an office Romeo (or Juliette), who spends his/her day sending offending or suggestive e-mails to fellow workers, a keylogger can protect the employer from a possible sexual harassment suit.

Again, keyloggers (especially secret ones) do not prevent behavior. Scenarios with externally observable results (e.g., email) do not require keyloggers.

As my boss is fond of saying, "there is a hungry man looking for your job, don't start getting too well fed."

What a perfect example of the employer's-rights culture I mentioned earlier. Conveniently enough, it may also explain how we developed such a culture.



I suppose I forgot to mention in all of this that the act of logging (mechanically) and the viewing of such logs are vastly different in my mind. Most of the above posts assume the latter.

[Ridirich]

I don't think it's the same as a wire tap. Here's why:

A wire tap only allows a person to listen to incoming/outgoing phone calls on a land line(you need the right frequency to listen to a cell-phone, and this is not litterally the same as a wire tap, but is an action that meets the same end). All you get is audio.

Keyloggers allow access to not only 'spoken' stimulus by viewing the strokes, but also visual. It would be litterally the same as installing a camera in someone's house and bugging their apartment then spying on them while they lived their daily lives, and I think this should not be allowed.

However, a company computer is on the companies' domain(land) and is being 'lent' out to the workers for the sole purpose of working. Nothing more, nothing less. It's not to send a dirty message to your significant other(or recieve one), if you want to do that, use text messages on your cell phone. I seriously think a company should be allowed to use this...as well as a parent for the 'net nanny' feature of it.

Now, I know you don't want to go down this road, so simply don't adress this part if you don't want to, but I would like others to hear this theory.

We have 'cyber stalkers'. These people meet 'children' anywhere from the age of 5 to the age of 16. They then sexually abuse them or the children go missing and no one knows what happens to them after that.

Imagine if a parent was able to see these conversations and review them to tell the police where the stalker met the child? I mean...it IS the parent's computer(unless the child purchased it, then by all rights it is the child's...but that's another thread), and by all rights they can do what they want to their system as long as it does not harm another, right?

I don't see this much differance between using it in those two instances to keep people safe, and using various tools to 'hack' your own sandbox on a private network for educational means. It accomplishes the same goal if you have good intentions...keeping people safe.

Then again, I've heard "The road to hell is paved with good intentions."

[Voltage Spike]

is not litterally the same as a wire tap

I mean wire tap in the generic sense of active monitoring.

Keyloggers allow access to not only 'spoken' stimulus by viewing the strokes, but also visual.

Maybe some more advanced keyloggers, but we don't have to assume this is the case.

installing a camera in someone's house and bugging their apartment

But doesn't the government already do this with an appropriate court order?

We have 'cyber stalkers'. These people meet 'children' anywhere from the age of 5 to the age of 16.

I'd like to point out that kidnappings account for less than 2% of juvenile violent crime, less than a quarter of those kidnappings are by strangers, and most of these occur in outdoor environments as opportunity allows ... so we are talking about far less than a quarter percent of all the violent things that happen to children. Just for perspective.

Imagine if a parent was able to see these conversations and review them to tell the police where the stalker met the child?

Remember when I mentioned the act of logging versus the viewing of the logs. Here is a perfect example of where the distinction is important.

Oh, and a keylogger probably wouldn't help here unless it also logged other aspects (such as those you mentioned above).

by all rights they can do what they want to their system as long as it does not harm another, right?

It's interesting that the loss of rights of a citizen is not considered harm to you. *shrug*

(Okay, that was a low blow ... especially since most people start with the false position of "children have zero rights" and proceed.)



With respect to search versus wiretap, I believe the FBI's reasoning was as follows:

• Obtain search warrant
• Plan keylogger during execution
• Wait
• Obtain search warrant
• Retrieve keylogger during execution

Tada! No monitoring involved at all! The FBI simply found a device filled with keystrokes.

Any reason why this wouldn't work for phones (i.e., install an on-site recording device...)?

[Floydr47]

I have been watching the local news and have heard about the use of keyloggers by parents to monitor the on-line activities of their children. In my mind, when a child becomes of age, or when that child leaves home, then that child has a reasonable right to expect privacy. During the formative years it is the responsability of the parent to know everything that happens in the child's daily routine. I say this as a parent and grand-parent. My reasons behind this are that children need protection, in order for a parent to properly preform their duties as a parent they must be informed as to the type of people their children are in daily contact with. This site deals with security, with protection. Just as a parent has the right to be informed of the activities of his/her child and has the right to know what is going on in the home, a business owner has the same right to know what his/her equipment is being used for. I had a friend a few years back, "Bob". Bob had worked hard and saved money to buy his dream car. A friend of his "Ann" borrowed his car one day to run some errands. Turns out that the errands she wanted to run was to deliver some drugs to a drug dealer. She was arrested with possesion of the drugs. Bob's car was seized by the West Texas Narcotics Task Force. Now she is in prison and Bob's car was impounded and sold at police auction. Bob is still making payments on his dream car so his credit isn't ruined.
The owner of a business faces a similar problem, if an employee is conducting illegal activities with a company computer then the business owner faces the loss of his equipment should it be seized by the police as evidence when the employee is caught by the police. In the setting of a large corporation this wouldn't be a great loss, but to a small company it could be a loss that destroys the business. The owner of a business has a right to protect his business using whatever means necessary. Just as he would use a security package to protect his equipment on-line he must also use keyloggers to protect his business from dangers within the office. The only ones who have anything to fear from keyloggers are those who are doing wrong, most people would think no more of a keylogger installed on their office machine than they would of a security camera in the parking lot. There has been talk of an employee's right to privacy but what of an employer's right to protect his/her business?

[Ridirich]

As far as I am concerned as a parent of two children, here are what a child can expect as their rights:

1) Right to life. A child should not be in fear of their own demise, especially not from their parent, guardian or another familiar adult.

2) Right to have needs provided. We, as adults do not have this right. We have to go to work to earn the money to pay for these needs. As a child we had this right, by our parent providing our clothes, shelter, food and other things that a child needs for their development.

3) Right to education. Every child deserves the right to be educated.

4) Right to own their bodies. Every child has the right to tell someone "do not touch me", under reasonable circumstances. It is theirs, they have to live with it, they own it. Obviously in the case of safety this is trumped(IE, if they try to run into the road, or are in the mall and need to hold a parent's hand, etc), and in some households is also trumped during punishment, be it a spanking or an escort to the corner. Parenting is very hands-on, but does not give the parent permission to violate their child either.

5) Right to privacy within reason. This includes the bathroom, their bedroom(again within reason, if you smell hemp, obviously you need to check it out), their journals...etc. It does not include spending time on the computer nor phone conversations with older people than the child who have peaked an interest. (If, when my daughter turns 15, and a 30 year old man calls all the time..yes, I will listen to the calls. You are damn right.)

6) Right to protection. The right to protection trumps any and all previous rights in the case of an emergency, and also trumps the right to privacy if there is reasonable cause for such.

7) Right to keep what they worked for. I think that if a child has earned something, then it is theirs. If the child worked hard and baught their own computer, quite obviously the parent then cannot fiddle with it without the child's expressed permission. Same with cars and games...or anything else that can be purchased through honest work.

Until a child is 18, 'adult' rights do not apply to them. They do not have the right to bear arms, the right to vote...etc. These are things that it is the parent's responsibility to educate them on and prepare them for.

In the end, yes, I want the state/government to have less rights in reguards to our children and for the parents have more. If this costs 'citizens' who are minors and not emancipated nor adult to lose 'rights' they never had to begin with, then yes, it should be done.

[Floydr47]

While I am mostly in agreement with your bill of right for children, I do find fault with #7.

7) Right to keep what they worked for. I think that if a child has earned something, then it is theirs. If the child worked hard and baught their own computer, quite obviously the parent then cannot fiddle with it without the child's expressed permission. Same with cars and games...or anything else that can be purchased through honest work.

I don't disagree with what a child buys with money earned from the fruit of his/her labors is their own personal property, what I do disagree with is that the telephone line which enters my home is in my name and I am legally responsible for what is received or transmitted through that line. The problems with a car or games are obvious. Which brings me right back to the point that a parent or an employer still has the legal right to know how his/her equipment is being used. If a child were to be making death threats against fellow students in grade school via the internet using MySpace.com (as is the case here in my town currently), then the parents and the police have a right to monitor those transmissions, given the history of such events (Columbine).

Until a child is 18, 'adult' rights do not apply to them. They do not have the right to bear arms, the right to vote...etc. These are things that it is the parent's responsibility to educate them on and prepare them for.

I disagree with this merely because I did the "Early Enlistment" for the Army when I was 16.5 years old and spent my 17th birthday in the AFEES center taking my physical. So, I was carrying an M-14 before I was old enough to vote.

The point I am making is that if an employer is providing the computer, providing the access to the internet, providing the work space, paying the employee for the work being done, and bearing the legal responsibility (by providing internet access) should an employee misuse company equipment for illegal activities, does that employer not only have the legal but also the moral right to protect his business by using monitoring equipment? The laws are struggling to keep up with new developments in IT, it seems that before laws can be passed that the technology has already moved on. Quite possibly before concrete laws on the legality of the use of keyloggers in the workplace are are finally put into effect, keyloggers will be a part of the past.

[Deviant Ollam]

Bob had worked hard and saved money to buy his dream car. A friend of his "Ann" borrowed his car... She was arrested with possesion of the drugs. Bob's car was seized by the West Texas Narcotics Task Force. Now she is in prison and Bob's car was impounded and sold at police auction.

i would posit that Bob's gripe is with the horrid and, in my mind, wildly unconstitutional policies of asset forfiture written into the "Rockafeller" style drug laws. a citizen should be able to lend a neutral item to a friend (an item such as a car or a computer... we're not talking about a gun or other specialized item that could be considered a risk) and not have to devote an assload of time and resources toward monitoring what happens with the item in that other person's posession. the law should clearly recognize and designate who is responsible for a criminal act and THAT person alone should bear the punishment.

if an employee is conducting illegal activities with a company computer then the business owner faces the loss of his equipment should it be seized by the police as evidence when the employee is caught by the police.

i would say this is a similar matter. of course, in a situation like this, even if the employer is exonerated of any wrongdoing, they still would have to contend with the mess of siezure of evidence, probably shutdown of the business for a week or more, etc etc. all in all, the notion that the property of an innocent person can be confiscated ever in this country terrifies and disgusts me... and it is the driving force behind a lot of this "monitor everything" hysteria. some of it is rooted in desire for security, but also a lot of it is just people covering their own asses.

[Ridirich]

While I am mostly in agreement with your bill of right for children, I do find fault with #7.


I don't disagree with what a child buys with money earned from the fruit of his/her labors is their own personal property, what I do disagree with is that the telephone line which enters my home is in my name and I am legally responsible for what is received or transmitted through that line. The problems with a car or games are obvious. Which brings me right back to the point that a parent or an employer still has the legal right to know how his/her equipment is being used. If a child were to be making death threats against fellow students in grade school via the internet using MySpace.com (as is the case here in my town currently), then the parents and the police have a right to monitor those transmissions, given the history of such events (Columbine).

I was not talking about the PC being online, and should have made a point of that. I 100% agree with you about the ISP thing though. It's the parents who pay for it, and it is the parents who will get in trouble for any nefarious activities from their IP.

I disagree with this merely because I did the "Early Enlistment" for the Army when I was 16.5 years old and spent my 17th birthday in the AFEES center taking my physical. So, I was carrying an M-14 before I was old enough to vote.

I think at the age of 18 all rights of this country, including drinking and carrying concealed weapons should be allowed. All states in this aspect should be uniform and they need to make up their minds and decide, 21 or 18? I mean, you still need to take tests and earn a permit once you are of age anyway.

As for you disagreeing with me about the "Until a child is 18 'adult' rights do not apply to them.." portion of my post, I don't know if you saw this:

If this costs 'citizens' who are minors and not emancipated nor adult to lose 'rights' they never had to begin with, then yes, it should be done.

If you joined the militairy, you fall under the 'emancipated minor' law, so far as I know.

[Floydr47]

This is an article from our local news that illustrates the problems we are currently having in our community:

Virtually Safe? ... Pt. 3: The Watchful Eye

By Ty Fernandes
NewsWest 9

ODESSA, TEXAS - In the last two reports NewsWest 9 has told you how a fight among a group of girls at Nimitz Junior High led to violent expressions on the internet.

Instead of chatting online, these girls were threatening each other on their pages of a popular website called myspace.com.

myspace is a place where kids can chat with friends, and make new ones. But some parents tell NewsWest 9, they're worried. That's because anyone can create a profile, and talk to your kids.

But now, there's a way you can follow your kids' activity online, and help ensure they are safe while 'surfing' the web.

All you need is a computer and - in one case - about $40, and you can see every single thing your child receives and sends out online.

And, you have a choice ... you can tell your kids they're being monitored, or keep it a secret.

Imagine if your 13-year-old daughter had objectionable pictures - of a sexual nature - sent to her online? Well, that's exactly what happened to an Odessa teen, after she met an older man on myspace.

"Anybody can send anything to your child, or your child can send anything out," said teenager Troy Owen, who says he is 'against' myspace. "And, that's where the problem is, I have with myspace."

The 13-year-old girl would like to remain anonymous ... so, we'll call her 'J.'

She started getting messages from a stranger on myspace. The chat started out innocently. But, then, the man wrote, "how old are you? I'm 23."

J responded with the truth, saying, "10 years younger than you, I'm 13."

Apparently, the girl's age didn't matter to the man, who kept on sending messages, and then sent pictures in which he's posing naked.

J's mother knows how easy it is for sexual predators to contact her daughter. That's why she bought Guardian software for their computer, to protect her.

Kids who surf the net can jump from site to site within seconds. And, you may think it's hard to see exactly what they're doing. But its easier than you think ... you can go to a website for monitoring software, like Guardian's, and review the different levels of services they offer ... and the fees they charge for their software.

When you decide which one you want, you can download it. Or you can call, and they will send you a CD.

"I think they should, because this is going to help out kids overall," said Karan Motley, who has a myspace page of her own. "Just being young, they're influenced into doing things they shouldn't be. And, it's much harder for them to do something like that if they don't have access."

myspace can be all fun and games for some. But, if you don't watch what your child is doing, and who they're chatting with ... that could be a serious mistake.

"That's too young, to be meeting people from all over like that," said Trey Motley, who also has a myspace page, commenting on J's problem.

"I just think they're too young," Potillo commented. "They're trying to get pediphiles out ... but that's inviting them, 'come on over, I'm here.'"

As a parent, you can choose how you want to monitor your child. You can look at everything they do, down to the key stroke.

And again, you can tell your child they're being watched, or you can keep it a secret.

Sorry, I would have linked to the story but couldn't due to password protection. The on-line fight between girls at Nimitz Jr. High has already led to the arrest of one 14 year old girl for making terroristic threats (she had threatened to cut another girl from "head to toe" with a razor). In light of this situation, I have to say that I fully support any legislation that would legalize keyloggers or any other type of monitoring equipment/program for use by parents with minor children.

[Ridirich]

I think that post sums it up...

Something to think about though, and I am sure we had a convo about this before:
Myspace.com in of itself is not bad. It is simply a venue for people to meet. What people do at that point is not the domain's fault. Blaming a domain for a problem is short sighted, and in all honesty this could happen at a free forum one kid makes, a chatroom, or various other places, and does not just include myspace.

I remember someone saying 'Guns don't kill people, people kill people.' Same applies for websites.