Subject: Re: electronic mail privacy at the workplace

From: [email-masked] (Elizabeth Schwartz)
Date: Tue, 27 Apr 1993 01:34:05 GMT

In article <cokely.735586414@karch> [email-masked] (Scott Cokely) writes:

>Hypothetical:
>You're the system administrator.  Something has gone awry with your
>/var/spool/mail directory, and it's filled up.  You can't send mail
>to the users because of a catch-22.  You go the the directory, and
>note that a couple of users have massive mailboxes.  Suspecting
>a lack of uudecode-savvy, you tail one of the mailboxes.  At the
>end of this user's mailbox you find incriminating evidence that this
>user has been sending/receiving projects that are confidential to
>the Company.  You report your findings to your supervisor, who 
>escalates it up the chain until the employee is terminated, and a
>possible lawsuit is in the works.

>Questions:
>1) At what point did the sysadmin violate the user's privacy?

   When the sysadm did a tail, "suspecting a lack of uudecode-savvy."
The sysadm did not need to read the mail file to clean up the mail
spool. On our system, we just move large mail files out of the mail
spool into the user's home, compress them, and then send the user
mail telling them what we did and why. In the case of repeats we can
ask to talk to the user. If a user refuses to talk to us, we have
various options at that point, including backing the files onto tape
and deleting them from the system.

A mail file should not be read just to see what the user is "up to."

(on our site, we do make an exception in one case: when we have
confirmed beyond reasonable doubt that the account has been cracked,
and frozen the account.) 

--
System Administrator                  Internet: [email-masked]
MACS Dept, UMass/Boston               Phone   : 617-287-6448
100 Morrissey Blvd                    Staccato signals
Boston, MA 02125-3393                      of constant information....