[clue-talk] 4th Amendment rights for electronic messages

[Nate Duehr]

Interesting!  (I was behind on my SANS reading!)

Outsource your e-mail, you can no longer look at employee's use of it, 
unless you tell them.

Fascinating!

More fodder for CLUE-Talk!

-----

  --Appeals Court Grants 4th Amendment Protection to Electronic Messages
(June 19, 2008)
The 9th US Circuit Court of Appeal has ruled that employers may not
access employees' text and email messages if the company has contracted
with an outside organization to transmit those messages.  According to
the ruling, employers may only access employees' email if the messages
are stored on an internal server.  The original case was brought by
Ontario, California police officers who sued after a wireless provider
gave the police department records of text messages they had received.
This is the first federal appellate decision to provide 4th Amendment
protection to electronic messages.
http://www.usatoday.com/tech/news/techpolicy/2008-06-19-privacy-work-communications_N.htm?csp=34
http://www.latimes.com/business/la-me-text19-2008jun19,0,933444.story
[Editor's Note (Schultz): The Fourth Amendment protects individuals from
unreasonable search and seizure. As such, a strong case can be made for
employees whose contest the right of employers to intercepted and read
employees' email. The fact that this ruling basically allows companies
access to employees' messages if a company's mail servers are involved,
but not when mail services are outsourced is a fascinating twist to this
controversial legal issue.
(Skoudis): If this decision holds, it has some pretty important
implications on outsourcing of messaging services.  On numerous
occasions, I've had CIOs tell me that they were thinking about dumping
their costly and difficult-to-maintain internal mail infrastructure and
going to something like a private branded Gmail.  A ruling like this
would certainly complicate such plans, especially for enterprise
incident handlers.
(Veltsos): While the city had notified employees of its email and text
message monitoring policy, it had not consistently applied such policy
across its workforce and chose instead to focus on a few individuals.
Employers must take notice and review their outsourced communications
service contracts to ensure a balance of right-to-monitor, employee
privacy expectations, and consistent policy enforcement. ]