Subject: Computer privacy at Helsinki U of Technology

From: [email-masked] (Jyrki Kuoppala)
Date: 15 Sep 1993 17:08:35 GMT

In article <[email-masked]>, kadie@eff (Carl M. Kadie) writes:
>According to the the Chronicle of Higher Education (Volume 40, Issue 4):
>"An attempt to bar broad searches of a computer system's contents
>at Oregon State University has produced an emotional debate among
>network users" (Page A24)

Also at Helsinki University of Technology there is an ongoing
privacy/admin policy discussion on local newsgroups.  The discussion
started from a court where the University sued some persons over
unauthorized used of University computers, "outsiders" (I think mostly
high schoolers or people having recently graduated from high school at
the time) for unathorized use; and some HUT students as accessories to
unauthorized use who had shared their accounts and passwords.

The suspected unauthorized use was investigated by reading files and
login sessions of users, and a memorandum enclosed as part of the
court proceedings includes around a dozen email messages plus quotes
from login sessions and IRC logs.  The investigation (reading of the
files and sessions) was done by a person who is not an ordinary
administrator of the system, and based on the discussions it seems
that reading users' files and traffic for other reasons than keeping
the system going or helping users with their problems is not a normal
practice at HUT.

The discussion has mostly been about the policies on whether it's OK
for administrators to read files, and if so, how and on what grounds
it should be done.

Finland has legislation to protect email privacy similar to phone and
snail mail traffic protection.  It is illegal for even the police to
eavesdrop on phone or other telemessage traffic, and one student
suggested that perhaps in the next court meeting the accused and the
accused switch places.  However, the wording of the law is such that
it only protects email or telemessages in transit, and thus the
protection doesn't seem to extend to files when they contain received
email.  As part of the process to reform the criminal code, it is
planned to extend the email protection and though I don't have
details, apparently the proposal also includes legal protection for
protected files in general.

//Jyrki