Subject: [sacm] Legal aspects of System monitoring

From: [email-masked] (Martin Rex)
Date: Sat, 4 Aug 2012 04:14:47 +0200 (CEST)

A message on the DANE WG mailing list mentioned this WG and 
the document http://www.ietf.org/id/draft-waltermire-sacm-use-cases-01.txt

I have made a first read of the document and I'm wondering whether
people on this list are aware of the legal issues such an idea creates.

In Germany, an employer monitoring a company-owned PC that an employee uses
for communication (EMail, VoiP, IM) would be unconditionally illegal.

-Martin

---

From: Tony Rutkowski <[email-masked]>
Date: Sat, 04 Aug 2012 10:11:56 -0400

Hi Martin,

Really?  That is not consistent with comments
I've seen concerning German law.

To be *unconditionally* illegal, would
preclude almost any rationally required
maintenance or threat mitigation.  It is
fair to observe that recent German
Constitutional Court decisions impose
constraints, but they certainly are
not "unconditional."

--tony

---

From: [email-masked] (Martin Rex)
Date: Mon, 6 Aug 2012 18:32:21 +0200 (CEST)

Tony Rutkowski wrote:
> Martin Rex wrote:
> Really?

No kidding!

>
> That is not consistent with comments

There is a significant amount of mis-information floating the internet.
And a mindboggling large number of lawyers are making wild guesses, rather
that doing research.

The decisions of the german federal constitional court (GFCC) have been
quite consistent over the past decade about what with respect to
encroaching on the general right of personality, informational
self-determination, freedom of conduct and created a "fundamental right
to the guarantee of the integrity and confidentiality of information
technology systems".  The court has set the minimum requirements that
are prerequisite to such encroachment, such as the prerequisite of a
clear formal statute law, which needs to be limited to situation where
real facts create probable cause.

The original GFCC decision in german language is quite comprehensible
(to me, at least), while I'm having some difficulties understanding
the english translation (and the english translation is shorter!?).

BVerfG-Entscheidung "1 BvR 370/07 vom 27.2.2008" Randnummer 196-
http://www.bverfg.de/entscheidungen/rs20080227_1bvr037007.html#abs196

english translation of "1 BvR 370/07 vom 27.2.2008"
http://www.bverfg.de/entscheidungen/rs20080227_1bvr037007en.html#abs130

> maintenance or threat mitigation.

It is possible to perform maintenance and threat mitigation entirely
without "monitoring" systems.

A mere threat is insufficient for monitoring, if that involves collecting
PII data, i.e. data from which a persons conduct can be infered.

>
> It is fair to observe that recent German

One of the prerequisite is a clear formal statute law,
which currently does not exist for the purposes "sacm" is about.

quoting from the above GFCC decision:

  2. The fundamental right to the guarantee of the confidentiality and
  integrity of information technology systems is not unrestricted.
  Encroachments may be justified both for preventive purposes, and for
  criminal prosecution.  The individual must only accept such restrictions
  of his or her right which are based on a statutory foundation that
  is constitutional. 

This currently makes collecting data about peoples conduct "unconditionally"
illegal for most practical purposes (exempting from prosecution only
individual occasions of justified self-defence against an imminent
vicious attack based on real facts that create probable cause).

This applies to all surveillance that impairs persons "freedom of conduct".
The majority of past decisions of specific events was about surveillance
with a camera, but the GFCC decision makes it crystal clear that
this applies to *any* kind of surveillance.  Different to monitoring of
computer systems, there is statutory law for camera surveillance,
that allows optical surveillance under certain conditions
(Art. 6b BDSG "BundesDatenSchutzGesetz).

The lack of a formal statutory foundation makes surveillance illegal
and entitles subjects to "cease and desist" rulings and sometimes
damages.

In one more recent (and constitutionally correct) rulings, an employer
had put up a camera that had in view not only the entrance door, but
also two workplaces.  The employees protested against this camera,
but the employer would not "fix" it, so at least one employee sued,
The court confirmed that this camera surveillance at the workplace
was illegal due to its chilling effect alone, and since it had been
installed for a whole year, the employee was arwarded 4 month of income
as damages (for the chilling effect).

Another recent decision was about evidence from a covert video
surveillance showing an employee taking a package of cigarettes
on two occasions, where the German Federal Labour Court
(the supreme court for labor related issues) remanded the decision
to the trial court because it had failed to establish whether the
covert video surveillance really met all constitutional prerequisites
otherwise the video surveillance would have been illegal and not
be admissible as evidence in court.
(German decision: http://lexetius.com/2012,2351)

The German Federal Constitional Court neutered numerous laws during the
last decade due to lack of clarity and/or overbroad encroachment of
the personal right of self-determination and the right to confidentiality
of telecommunications.

See also the GFCC decision about the scanning of license plates
(the decision 1 BvR 2074/05 vom 11.3.2008 in german)
http://www.bverfg.de/entscheidungen/rs20080311_1bvr2-07405.html

where it confirmed that data collection requires formal statue law,
and that the law in question wasn't limited to probable cause and
therefore unconstitutional.

The only currently existing formal statue law in Germany, that could be
used in some limited fashion for "Monitoring" is Art.100 TKG,
  http://www.gesetze-im-internet.de/tkg_2004/__100.html
but that statue is clearly limited in purpose, it will not allow that data
to be used for automatic surveillance of "employee conduct" with respect
to "company-defined policies".  Employers try hard to avoid TKG for their
networks (for which they will have to formally register), but that also
means that they do not have a formal statutory law for performing any
kind of surveillance/monitoring as described in Art. 100 TKG for systems
that are used by employees for telecommunications and a significant part
of their daily activies.

-Martin

---

From: <[email-masked]>
Date: Mon, 6 Aug 2012 11:42:55 -0500

None of the efforts we are talking about for SACM are targeted toward PII or individuals. They are targeted at the configuration of the platforms deployed in the enterprise to assure they comply with the site's security policy.  PII is not collected. This is not monitoring of individual or employee actions.  I am not a lawyer and will not speak as one. We will let the lawyer's decide at the appropriate time.

Kent Landfield

McAfee | An Intel Company
Direct: +1.972.963.7096
Mobile: +1.817.637.8026
Web: www.mcafee.com<http://www.mcafee.com/>

From: Martin Rex <[email-masked]<mailto:[email-masked]>>
Reply-To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Date: Monday, August 6, 2012 11:32 AM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Cc: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [sacm] Legal aspects of System monitoring

Tony Rutkowski wrote:
Martin Rex wrote:

Really?

No kidding!

-Martin
_______________________________________________
sacm mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sacm

---

From: Luis Nunez <[email-masked]>
Date: Mon, 6 Aug 2012 13:16:00 -0400

Looking at it another way I could see security automation as a way to discover if a system is configured to meet privacy policies .  

Security automation is an enabler for transparency  so that individuals and organizations may understand the complex computing environment.

Thanks for bring up this issue.  As a community we may want to look at building content around privacy controls.

-ln

On Aug 6, 2012, at 12:42 PM, <[email-masked]> wrote:

> Web: www.mcafee.com
> From: Martin Rex <[email-masked]>
> Reply-To: "[email-masked]" <[email-masked]>
> To: "[email-masked]" <[email-masked]>
> Cc: "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
>> [email-masked]
> [email-masked]

---

From: [email-masked] (Martin Rex)
Date: Mon, 6 Aug 2012 19:21:05 +0200 (CEST)

[email-masked] wrote:
>
> None of the efforts we are talking about for SACM are targeted toward
> PII or individuals. They are targeted at the configuration of the
> platforms deployed in the enterprise to assure they comply with the
> site's security policy.  PII is not collected.

For many "office PCs" and even more so "laptops", the user using this
device is implied, and a lot of actions of the devices are the result
of user conduct.  So monitoring (collecting, processing&storing) the
behaviour of such devices constitutes the collection of PII data.
(And many monitoring activity actually collects the name of the user
running a process or opening a network connection along with it).

"comply with a site's security policy" is a deceiving way to
describe constant electronic surveillance to compare employee conduct
with a company policy.

>
> This is not monitoring of individual or employee actions.

As soon as an employees action could be infered from the data
that is monitored, a formal statute law is required in Germany.

Whether the collected data is used in that fashion or not,
does not matter at all.

Monitoring important central servers, which are used only for
a short time or very limited purposes, would probably be OK.
Monitoring end user systems, which are being used for a large part
of the working day, or for telecommunication, will usually be illegal.

You have to realize that the problem here is not a security policy
by itself.  But trying to enforce compliance by constant electronic
surveillance of end user systems will probably be illegal in most cases
in Germany.

-Martin

---

From: Michael Hammer <[email-masked]>
Date: Mon, 6 Aug 2012 17:38:53 +0000

Martin,

If what you say is true, then Germany can probably kiss any Cloud operation
goodbye 
to some other country, since by your definitions all Clouds would be
operating illegally.  

You cannot ask an implementation to ensure privacy and security, and at the
same time 
make it illegal to use the very mechanisms needed for that assurance.

Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Martin Rex
Sent: Monday, August 06, 2012 1:21 PM
To: [email-masked]
Cc: [email-masked]; [email-masked]; Tony Rutkowski
Subject: Re: [sacm] Legal aspects of System monitoring

> site's security policy.  PII is not collected.

For many "office PCs" and even more so "laptops", the user using this device
is implied, and a lot of actions of the devices are the result of user
conduct.  So monitoring (collecting, processing&storing) the behaviour of
such devices constitutes the collection of PII data.
(And many monitoring activity actually collects the name of the user running
a process or opening a network connection along with it).

"comply with a site's security policy" is a deceiving way to describe
constant electronic surveillance to compare employee conduct with a company
policy.

> This is not monitoring of individual or employee actions.

As soon as an employees action could be infered from the data that is
monitored, a formal statute law is required in Germany.

Whether the collected data is used in that fashion or not, does not matter
at all.

Monitoring important central servers, which are used only for a short time
or very limited purposes, would probably be OK.
Monitoring end user systems, which are being used for a large part of the
working day, or for telecommunication, will usually be illegal.

You have to realize that the problem here is not a security policy by
itself.  But trying to enforce compliance by constant electronic
surveillance of end user systems will probably be illegal in most cases in
Germany.

-Martin

---

From: [email-masked] (Martin Rex)
Date: Mon, 6 Aug 2012 19:46:54 +0200 (CEST)

Michael Hammer wrote:
> If what you say is true,

It is.

>
> then Germany can probably kiss any Cloud operation goodbye to some
> other country, since by your definitions all Clouds would be
> operating illegally.  

There are a number of aspects about Cloud services which are currently
operating in the legal void.  When the Facebook mess becomes sorted out,
they'll realize that they've been doing many illegal things all those
years.

> 
> You cannot ask an implementation to ensure privacy and security,
> and at the same time make it illegal to use the very mechanisms
> needed for that assurance.

As I've mentioned, there is the narrowly tailored exemption of Art. 100 TKG
  http://www.gesetze-im-internet.de/tkg_2004/__100.html
but this clearly limits what aspects of a security policy could be
enforced with it.  But do not underestimate the "paperwork" associated
with each individual investigation authorized under the exemption
of Art. 100 TKG.

-Martin

---

From: Gunnar Engelbach <[email-masked]>
Date: Mon, 06 Aug 2012 13:58:07 -0400

As work progresses it's worth keeping this in mind to see if these 
differences can be addressed -- but not if it means compromising the 
ability for everywhere else to effectively implement and monitor system 
security.

The consequence would be that Germany will be increasingly vulnerable 
relative to elsewhere, and that's their decision to make.

---

From: Tony Rutkowski <[email-masked]>
Date: Mon, 06 Aug 2012 13:58:51 -0400

Maybe this is getting off-topic, but could
you provide some citations to "German law."
These assertions seem like rather extreme
interpretations of something.  It certainly does
not comport with the understanding of the
law that my German government colleagues
have.

--tony

---

From: [email-masked] (Martin Rex)
Date: Mon, 6 Aug 2012 20:52:32 +0200 (CEST)

> you provide some citations to "German law."

I already did:

http://www.ietf.org/mail-archive/web/sacm/current/msg00446.html

Maybe you misunderstand how the constitutional protections work.
The German Federal Constitutional Court ruled:

                    The individual must only accept such restrictions
  of his or her right which are based on a statutory foundation that
  is constitutional. 

In order for TelCos to be allowed to monitor their networks, they
desperately need Art. 100 TKG as the "statutory foundation".

If an employer wants to monitor end user PCs that are used by employees
for the greater part of their working and for telecommunications,
then a similar "statutory foundation that is constitutional"
will be required.  There currently exist *no* such statutory foundation
that employers might use other than Art. 100 TKG, and without it,
constant surveillance/monitoring of end user systems will be illegal,
and individuals are entitled to "cease and desist rulings" and potentially
awarding of damages.

That is what "the individual must only accept such restrictions" is about.

And this decision and ruling of the GFCC is legally binding for
the legislator, courts&judges and the executive branch.  That's
what Art. 31 (1) BVerfGG is about:

http://www.gesetze-im-internet.de/bverfgg/__31.html

> law that my German government colleagues have.

Ask them for the specific "statutory foundation" (name and article of law)
that would authorize the collection of such data.  The GFCC has established
this requirement as a prerequisite.

If lawyers or judges "forget" to justify their decision with a suitable
"statutory foundation", then their decision will be shredded on appeal
to the GFCC and remanded, like this one here:

  http://www.bverfg.de/entscheidungen/rk20090811_2bvr094108.html#abs17

where GFCC sends a pretty clear message about the severe failure of the
trial court and appelate court to identify a "statutory foundation"
that would allow them to issue a speeding ticket based on analysis
of an unconditional video surveillance of traffic.

-Martin

---

From: Tony Rutkowski <[email-masked]>
Date: Mon, 06 Aug 2012 15:20:26 -0400

Hi Martin,

This is helpful for doing followup research
and analysis.  Yourconstruction is arguably
a bit on the extreme side.

However, there are 192 nations out there;
and many of them have bizarre requirements
and constructs that often have nothing to
do with reality.  The IETF generally focuses
on protocols, structured information, and
platforms, and lets the implementers deal
with the local environment.

In the ITU-T, the German BNetzA routinely
inserts the same phrase in almost every standard
that is developed, and everyone moves on.

    Some specific national and regional regulation and legislation may
    require
    implementation of mechanisms to protect personally identifiable
    information.

--tony

---

From: [email-masked] (Martin Rex)
Date: Tue, 7 Aug 2012 05:42:36 +0200 (CEST)

> a bit on the extreme side.

Just to the contrary.  There is stuff described in
  http://tools.ietf.org/html/draft-waltermire-sacm-use-cases-01

which is clearly illegal for personal end-user systems
(Office PC,Laptop,Tablet,SmartPhone)

The shit hits the fan in Section 3.2 with these:

   o  User/host behavior

   Possible desired outcomes to address:

   o  Change in state is recorded and reported

   o  User/system activity is recorded and reported

   o  User/system access is terminated or altered

and gets worse up to the extreme

   3.5. UC5: Automated Forensics Investigation

which is a complete no-go.

> However, there are 192 nations out there;

The European Court of Human Rights showed to share many of the same
concerns as the German Federal Constitutional Courts, and proved on at
least two occasions I'm aware of to be be more sensitive/concerned
than the GFCC.

>     Some specific national and regional regulation and legislation
>     may require implementation of mechanisms to protect personally
>     identifiable information.

That statement is insufficient an misleading.  The problem is not
insufficient protection of the collected PII, the problem is the
unbounded collection of PII with the complete lack of a probable cause
prerequisite ("wholesale surveillance").

The "fix" to the previously mentioned unconstitutional covert video
surveillance of traffic required to changes:

  (1) a technical change to the monitoring equipment so that instead
      of unconditionally recording all traffic, it would only
      perform video recordings (i.e. collect PII) for vehicles
      after detecting that they were over the speed limit
      (=probable cause)

  (2) The trial courts correctly identified a "statutory foundation"
      for justifying the evidence admissibility in Art 100h StPO
        http://www.gesetze-im-internet.de/stpo/__100h.html

You would have to limit most in Section 3.2 and later to situations
where facts create probable cause _before_ collecting and evaluating
the data, and limit all collections upfront(!) to probable cause.

(2) is not applicable to employers that want to monitor end-user equipment,
it is clearly limited to law enforcement.

And for 3.5, automated forensics for system in entirely unjustifiable 
for an end user system.  There is a constitutional requirement for due
process that includes an educated and case-specific decision involving
at least one human being (exceptional emergency) or several humans (regular),
real facts and and probable cause, and reliable accountability whether
the human decision is within certain discretionary limits.

Process-wise all those "security policies", when implemented in automated
fashion, result in even more counter-productive and discrimitating action
than the security theater that the TSA is performing on airtravel passengers,
i.e. in "zero discretion" policies that are often dumb because they
seriously inconvenience everyone all the time, without making anyone
measurably safer.

-Martin

---

From: Anton Chuvakin <[email-masked]>
Date: Mon, 6 Aug 2012 21:55:43 -0700

> the data, and limit all collections upfront(!) to probable cause.

If you do that (reduce to 'probably cause') it won't really be
'monitoring', now will it? It would be 'investigation.'
Monitoring is how you realize  that you have a cause to investigate.

P.S. This email thread is crazy :-)

--
Dr. Anton Chuvakin
Site: http://www.chuvakin.org
Twitter: @anton_chuvakin
Work: http://www.linkedin.com/in/chuvakin

---

From: [email-masked] (Martin Rex)
Date: Tue, 7 Aug 2012 08:38:51 +0200 (CEST)

Anton Chuvakin wrote:
>
> Martin Rex <[email-masked]> wrote:
>>

Which is exactly what I wrote in my initial message in this thread:

> for communication (EMail, VoiP, IM) would be unconditionally illegal.

What puzzles me is that monitoring of end-user systems is not at least
recognized as highly unethical for jurisdictions where it is not
outright illegal.

The US legal system seems seriously skewed on some aspects.

While there seem to extremly strong "fruit from the forbidden tree"
provisions in the US that may exclude illegally obtained evidence from
prosecution even in cases of murder, the appear to be effectively
zero privacy protections for employees at the workplace (or outside
their homes or without curtains closed...).

-Martin

---

From: Tony Rutkowski <[email-masked]>
Date: Tue, 07 Aug 2012 07:10:56 -0400

Hi Martin,

Could you take this discussion, including
your political commentary concerning
countries, to another appropriate venue.

I am a lawyer and very familiar with the
subject matter.  Your constructions here are
extreme even in the jurisdictions you
reference. You have every right to voice them
- in the appropriate forum. This is not a
forum for advancing socio-political views.

--tony

---

From: Stephen Hanna <[email-masked]>
Date: Tue, 7 Aug 2012 07:15:46 -0400

I am certainly no expert on European law in this area.

However, I will note that monitoring and auditing
corporate information systems and networks is common
practice in corporate environments. Generally, the
Acceptable Use Policy includes consent to monitoring
and audits. For example, look at the SANS template for
an Acceptable Use Policy available at

http://www.sans.org/security-resources/policies/Acceptable_Use_Policy.pdf

In some environments (universities and libraries),
intellectual freedom may trump security in some cases.
However, even universities generally include provisions
for monitoring when necessary. For example, here are a
few policies for universities in the USA, UK, and Germany:

http://www.it.ufl.edu/policies/monitoring.html
http://www.admin.ox.ac.uk/statutes/regulations/196-052.shtml
http://www.cip.bv.tum.de/en/cippools-/termsofuse

These policies were chosen at random, not deliberately
to support one point of view or another. But they are
remarkably similar in many respects.

I observe that the Technical University of Munich permits
monitoring of user behavior and forensic analysis under
appropriate circumstances.

So I conclude that the techniques and technologies for
monitoring user behavior and system configuration are
used around the world. However, there is a constant
balance between user privacy and system security. The
nature of this balance may vary depending on the
jurisdiction and on the application (military networks
vs. corporate vs. university vs. home). There's a nice
discussion of this balance in the (ISC)2 Guide to the
CISSP CBK (Second Edition) on pages 516 and 517.

In the SACM group, we're talking about developing
technology that will help corporations to better secure
their computer systems and networks. We should
carefully note the importance of maintaining balance
between user privacy and system security and
obeying all relevant laws, rules, and regulations.
However, it would be foolish for us to think that
we can come up with one policy that would apply in
all circumstances. Instead, we should permit system
and network owners to establish and implement their
own policies. At least, that's my point of view.

Thanks,

Steve

---

From: Michael Hammer <[email-masked]>
Date: Tue, 7 Aug 2012 13:32:11 +0000

Martin,

In the U.S. so long as the employer explicitly points out to the user that
he is using the employers equipment, and that such use is for business
purposes only, and all other activity is prohibited, and that the employer
will be monitoring to ensure the employer's equipment is used for business
purposes only, it is in line with common business practice to do so.

This is just the online version of an employer noticing his employee
spending all his time reading Playboy at work and being on the phone talking
to his girlfriend, and telling him to get back to work.  Don't tell me that
is permissible behavior in Germany.

Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Martin Rex
Sent: Tuesday, August 07, 2012 2:39 AM
To: Anton Chuvakin
Cc: [email-masked]
Subject: Re: [sacm] Legal aspects of System monitoring

On 8/3/2012 10:14 PM, Martin Rex wrote:
> In Germany, an employer monitoring a company-owned PC that an employee 
> uses for communication (EMail, VoiP, IM) would be unconditionally illegal.

What puzzles me is that monitoring of end-user systems is not at least
recognized as highly unethical for jurisdictions where it is not outright
illegal.

While there seem to extremly strong "fruit from the forbidden tree"
provisions in the US that may exclude illegally obtained evidence from
prosecution even in cases of murder, the appear to be effectively zero
privacy protections for employees at the workplace (or outside their homes
or without curtains closed...).

-Martin

---

From: [email-masked] (Martin Rex)
Date: Wed, 8 Aug 2012 02:46:27 +0200 (CEST)

> purposes only, it is in line with common business practice to do so.

I'm aware of the almost complete lack of privacy protections
in the US outside one's home as well as the lack of personality&privacy
protections at the workplace.

This concept is not universally transferable to legislations with
data protection laws.

Don't get me wrong here.  This type of monitoring is OK and useful
for servers and computers/devices with very dedicated purposes.
But unconditional constant electronic surveillance of user behaviour
and/or user data will be illegal in Germany for a personal computing
equipment (workplace PC,Laptop,Tablet,Smartphone,...) that is used for
telecommunications and a significant amount of the working time.
Notices and orders by your employer can grant you additional rights,
but they can not take away or restrict your constitutional rights.

This could mean that for some workplaces the employer might have to
install/provide two computing environments, one for telecommunications
(Email,VoiP,IM,Internet-Browsing) and the other for access to highly
sensitive data, which is _not_ used for telecommunications, so that
the employer is permitted monitor the latter (but there are still limits,
because profiling user behaviour will still be illegal without
either formal statute law or probable cause).

The seperate computing environments need not be distinct physical devices;
depending on how it is set up, virtualization might be sufficient to provide
two seperate computing environments, with one of them being completely
excluded from unconditional monitoring of any user actions and user data.

What many folks (and unfortunately still many labor lawyers and several
entry-level labor court judges in Germany) still fail to understand,
is that "for business purposes only" does *NOT* remove or restrict the
individual's privacy rights for telecommunication *AT ALL*.
That's an urban legend in Germany--admittely, one that is quite commonplace,
but nevertheless unconstitutional and legally untenable.
The German Federal Constitutional Court has decided this over a decade ago,
and been repeating it in at least 4 rulings since then.  The German Federal
Labor Court has confirmed this (and the resulting inadmissibility as
evidence) twice for voice telephone calls (that happened to be appealed
that far).  Other specific scenarios have not been appealed to the GFLC,
but the GFCC ruling on which the GFLC decisions were based, are quite
explicit that the constitutional protection applies to all non-public
telecommunications alike (phone,fax,Email,SMS,IM), everywhere where
the person is (the right protects the person), independent of the
nature of the content, and independent of whether public or confidential
information is communicated, and irrespective of the ownership of the
telecommunication equipment that is used.
GFCC decision 1 BvR 1611/96 (09-Oct-2002)

> to his girlfriend, and telling him to get back to work.

What would be "actionable" here in Germany is *NOT* each individual
occurrence of any particular of these activities.  What is actionable
is when the combined amout of worktime that you spend on other things
but working, and for which you still demand pay, exceeds the threshold
of what is considered "socially acceptable".  There are a number of
activities which are not "productive", such as small-talk with
colleagues, going to the rest-room, taking a break for smoking,
getting some water or a coffee, whathaveyou.

The employers control over what an employee does during unpaid overtime
or during "socially acceptable" paid non-working time is limited.
If an employee would be doing just occasional private online-banking
(adding up to less than an hour per month), then it will often not be
actionable even when the employer has an explicit policy Internet
use for Business purposes only. (I'm aware that some lawyers and
a few german entry level labor court have differing opinions,
but none of these are based on facts&statutes.  If there are two
contrary court decisions, then matching them with decisions of
the GFCC helps in distinguishing correct, questionable and
invalid decisions.

The issue at hand is constant electronic surveillance without probable
cause.  In Germany, that unconditionally requires a sufficiently precise
"statutory foundation" by the parliamentarian legislator in order not
to be illegal.  The situation of employment is special, because the
German legislator has placed an explicit obligation onto the employer
to respect and protect the personal rights of his employees
in Art. 75 (2) BetrVG:

  http://www.gesetze-im-internet.de/betrvg/__75.html

How this applies to unconditional electronic surveillance can be seen
in the decision of the German Federal Labour Court (GFLC)
1 ABR 21/03 (29-06-2004)

  http://lexetius.com/2004,2335#27

So even a loss (alleged/assumed theft) of 300 Letters&Parcels per month
is a subsidiary of the postal services can NOT justify constant and
unconditional CCTV surveillance at the workplace, even though each
such theft is a felony, punishable with up to 5 years prison term.

A successor attempt for CCTV surveillance 4 years later was found mostly
acceptable by GFLC, because of the many safeguards&limitations that
had been added to the procedures.  Usage of any collected surveillance
data was strictly limited to prosecuting crime, *NOT* for purpose
of detecting non-compliance to any policies.

>
> Don't tell me that is permissible behavior in Germany.

You're primarily asking the wrong questions and your reasoning/deduction
on this issue is logically flawed.  Having the "privilege" to define
policies does not imply that there are no limits in the means you
are permitted to enforce them.

While requiring employees to work naked might be fairly effective
in helping to reduce theft by employees.  I assume that there are
limits to what an employer can rightfully demand, even in the US.

http://dilbert.com/dyn/str_strip/000000000/00000000/0000000/000000/10000/2000/800/12808/12808.strip.gif
http://dilbert.com/dyn/str_strip/000000000/00000000/0000000/000000/10000/7000/100/17112/17112.strip.sunday.gif
http://dilbert.com/dyn/str_strip/000000000/00000000/0000000/000000/20000/0000/900/20906/20906.strip.gif

When looking at issues like this:
http://blog.alexanderhiggins.com/2012/03/28/congress-decides-employers-demand-facebook-password-107972/

this send shivers down my spine.

In Germany, there is no prerequisite of a criminal statute to make this
illegal, because it is also unconstitutional.  However, the european
data protection directive (and its national incarnation in EU members
states) will very likely apply, making this directly punishable--not just
"cease and desist else get punished"-able.

-Martin

---

From: [email-masked] (Martin Rex)
Date: Wed, 8 Aug 2012 04:51:26 +0200 (CEST)

> I am certainly no expert on European law in this area.

And I can comment only on the situation in Germany.

> http://www.sans.org/security-resources/policies/Acceptable_Use_Policy.pdf

The monitoring of servers and dedicated devices is OK, the
monitoring of data that is _not_ related to user activities/conduct
is also OK, but the surveillance of user activities at the workplace
of the users telecommunication and the user data resulting from
that telecommunication is clearly illegal in Germany.

I'm well aware that there is plenty of illegal activity commonplace
in many companies in Germany, but that does not make them any less illegal.

When the 1 ABR 21/03 (29-Jun-2004) decision about CCTV surveillance
at the workplace was appealed to the German Federal Labour Court,
the employer argued that were already performing CCTV surveillance
in that fashion in 50 other subsidiaries (which for Germany means
there have likely been _at_least_100_ labor lawyers involved in those
other cases and found it non-objectionable), and two lower courts
in this decision, but the German Federal Laber Court tore it to shreds
with unprecedented explicit and clear determinations of why this activity
was unconstitutional, quoting prior decisions of its own and decisions
of the Constitutional Court.

Therefore looking at the folklore on the aspect of electronic surveillance
is a bad idea, because of the longstanding systemic error, that is evident
from the GFLC decision 1 ABR 21/03.  For the most part, that mess
hasn't been cleaned up yet.  Someone living in a jurisdiction based on
case law may significantly underestimate the meaning&effect of that GFLC
decision.

After the Constitutional Court decision about the unconstitutionality
of that particular video surveillance technology for traffic, there
was a huge flurry of trials and appeals, and those appeals which made it
all the way up (two even to the Constitutional Court), were quite
obviously by clueless lawyers, who had not cared to actually read
and comprehend the 4-page GFCC decision, or they would have immediately
realized that their appeal are pointless (waste of time and money), because
the two issues to which the GFCC had objected, had been fixed.

> intellectual freedom may trump security in some cases.

It is actually the other way round.  In a company setting, the usage
of a specific computer is typically not "voluntary" (i.e. you do not
have to option to "not" use it, or to use your privately-owned equipment
instead, in educational settings, specific pieces of equipment are
not assigned to specific individuals over a long period of time,
and in the educational setting Art. 75 (2) BetrVG does not apply,
that requires employers to respect and protect employees personal rights.

> used around the world.

As I said, it is a terrible bad idea to infer what is legal from
the folklore, in particular for a jurisdication that is primarily
based on statute law, not case law.

I'm really glad that the two works councils of these two postal
subsidiaries took their video surveillance issue up to the
GFLC (1 ABR 21/03, 1 ABR 16/07), because the decisions are quite
elaborate and directly applicable to all kinds of electronic
surveillance (and that looks _very_ intentional).

> their computer systems and networks.

I believe that there should be a distinction between two types
of systems/devices, personal-use systems that may be subject
to privacy protection, and backend,server and networking equipment,
where this does not apply.

>
> We should carefully note the importance of maintaining balance
> between user privacy and system security and obeying all
> relevant laws, rules, and regulations.

Without the possibility to distinguish these two types of equipment,
you will face the situation that products implementing this will not
be usable in certain markets (German being one of them) once they
are subjected to serious legal review, much like that particular
unconstitutional traffic video surveillance equipment had to be
updated/replaced all over Germany after the GFCC verdict, with the
technical capability to limit surveillance to probable cause.

-Martin

---

From: [email-masked] (Martin Rex)
Date: Wed, 8 Aug 2012 05:33:47 +0200 (CEST)

Tony Rutkowski wrote:
> 
> I am a lawyer and very familiar with the subject matter.

Great!

Simple Task:  Tell me the name and article of the German statute
that would authorize the constant electronic surveillance of
all employees and without probable cause.

I'm not aware of such a statute, but according to the legally
binding decision of the German Federal Constitutional Court,
such a statute is a prerequiste and it must be so clear that
this statute applies to this situation that an average human
being can understand it (otherwise that statutue would either
not be applicable or unconstitutional).

Over the past 6 years I've met a few labor lawyers, and whenever
I asked them to back up their claims with statute & article,
they completely chickened out.

-Martin

---

From: David Solin <[email-masked]>
Date: Fri, 03 Aug 2012 21:31:14 -0500

This is about monitoring in a configuration compliance sense, not 
monitoring in a keyboard-logging sense.  I am quite certain that there 
are many large companies in Europe that monitor configurations on 
company-owned machines that employees use for communication, because 
IBM, BMC, CA, HP, etc. all sell such products, widely, in Europe.

Is there a specific regulation, and part of the document that concerns you?

Personally, I think the word "monitoring" is a loaded term that, from 
the perspective of the market, has a meaning quite different from what 
we're talking about.  But it's probably way too late to change it, since 
it's the "M" in SACM.

Regards,
--David Solin

---

From: Shawna Turner-Rice <[email-masked]>
Date: Tue, 7 Aug 2012 15:19:41 +0000

+1 on: We should carefully note the importance of maintaining balance between user privacy and system security and obeying all relevant laws, rules, and regulations.
However, it would be foolish for us to think that we can come up with one policy that would apply in all circumstances. Instead, we should permit system and network owners to establish and implement their own policies.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Stephen Hanna
Sent: Tuesday, August 07, 2012 4:16 AM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [sacm] Legal aspects of System monitoring

However, I will note that monitoring and auditing corporate information systems and networks is common practice in corporate environments. Generally, the Acceptable Use Policy includes consent to monitoring and audits. For example, look at the SANS template for an Acceptable Use Policy available at

In some environments (universities and libraries), intellectual freedom may trump security in some cases.
However, even universities generally include provisions for monitoring when necessary. For example, here are a few policies for universities in the USA, UK, and Germany:

These policies were chosen at random, not deliberately to support one point of view or another. But they are remarkably similar in many respects.

I observe that the Technical University of Munich permits monitoring of user behavior and forensic analysis under appropriate circumstances.

So I conclude that the techniques and technologies for monitoring user behavior and system configuration are used around the world. However, there is a constant balance between user privacy and system security. The nature of this balance may vary depending on the jurisdiction and on the application (military networks vs. corporate vs. university vs. home). There's a nice discussion of this balance in the (ISC)2 Guide to the CISSP CBK (Second Edition) on pages 516 and 517.

In the SACM group, we're talking about developing technology that will help corporations to better secure their computer systems and networks. We should carefully note the importance of maintaining balance between user privacy and system security and obeying all relevant laws, rules, and regulations.
However, it would be foolish for us to think that we can come up with one policy that would apply in all circumstances. Instead, we should permit system and network owners to establish and implement their own policies. At least, that's my point of view.

Thanks,

Steve

---

From: Michael Hammer <[email-masked]>
Date: Wed, 8 Aug 2012 20:14:15 +0000

Martin,

Your conflating two distinct things, what is done outside of work (facebook
passwords) and what occurs during work just confuses the issues.
Second, we are not talking personal equipment here, but company equipment
and systems.  
I guess you are saying that theft and misappropriation of service and
property of the employer is not protected in Germany.

Mike

-----Original Message-----
From: Martin Rex [mailto:[email-masked]] 
Sent: Tuesday, August 07, 2012 8:46 PM
To: Michael Hammer
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: Re: [sacm] Legal aspects of System monitoring

Michael Hammer wrote:
> 
> In the U.S. so long as the employer explicitly points out to the user 
> that he is using the employers equipment, and that such use is for 
> business purposes only, and all other activity is prohibited, and that 
> the employer will be monitoring to ensure the employer's equipment is 
> used for business purposes only, it is in line with common business
practice to do so.

I'm aware of the almost complete lack of privacy protections in the US
outside one's home as well as the lack of personality&privacy protections at
the workplace.

This concept is not universally transferable to legislations with data
protection laws.

Don't get me wrong here.  This type of monitoring is OK and useful for
servers and computers/devices with very dedicated purposes.
But unconditional constant electronic surveillance of user behaviour and/or
user data will be illegal in Germany for a personal computing equipment
(workplace PC,Laptop,Tablet,Smartphone,...) that is used for
telecommunications and a significant amount of the working time.
Notices and orders by your employer can grant you additional rights, but
they can not take away or restrict your constitutional rights.

This could mean that for some workplaces the employer might have to
install/provide two computing environments, one for telecommunications
(Email,VoiP,IM,Internet-Browsing) and the other for access to highly
sensitive data, which is _not_ used for telecommunications, so that the
employer is permitted monitor the latter (but there are still limits,
because profiling user behaviour will still be illegal without either formal
statute law or probable cause).

What many folks (and unfortunately still many labor lawyers and several
entry-level labor court judges in Germany) still fail to understand, is that
"for business purposes only" does *NOT* remove or restrict the individual's
privacy rights for telecommunication *AT ALL*.
That's an urban legend in Germany--admittely, one that is quite commonplace,
but nevertheless unconstitutional and legally untenable.
The German Federal Constitutional Court has decided this over a decade ago,
and been repeating it in at least 4 rulings since then.  The German Federal
Labor Court has confirmed this (and the resulting inadmissibility as
evidence) twice for voice telephone calls (that happened to be appealed that
far).  Other specific scenarios have not been appealed to the GFLC, but the
GFCC ruling on which the GFLC decisions were based, are quite explicit that
the constitutional protection applies to all non-public telecommunications
alike (phone,fax,Email,SMS,IM), everywhere where the person is (the right
protects the person), independent of the nature of the content, and
independent of whether public or confidential information is communicated,
and irrespective of the ownership of the telecommunication equipment that is
used.
GFCC decision 1 BvR 1611/96 (09-Oct-2002)

> spending all his time reading Playboy at work and being on the phone 
> talking to his girlfriend, and telling him to get back to work.

What would be "actionable" here in Germany is *NOT* each individual
occurrence of any particular of these activities.  What is actionable is
when the combined amout of worktime that you spend on other things but
working, and for which you still demand pay, exceeds the threshold of what
is considered "socially acceptable".  There are a number of activities which
are not "productive", such as small-talk with colleagues, going to the
rest-room, taking a break for smoking, getting some water or a coffee,
whathaveyou.

The employers control over what an employee does during unpaid overtime or
during "socially acceptable" paid non-working time is limited.
If an employee would be doing just occasional private online-banking (adding
up to less than an hour per month), then it will often not be actionable
even when the employer has an explicit policy Internet use for Business
purposes only. (I'm aware that some lawyers and a few german entry level
labor court have differing opinions, but none of these are based on
facts&statutes.  If there are two contrary court decisions, then matching
them with decisions of the GFCC helps in distinguishing correct,
questionable and invalid decisions.

The issue at hand is constant electronic surveillance without probable
cause.  In Germany, that unconditionally requires a sufficiently precise
"statutory foundation" by the parliamentarian legislator in order not to be
illegal.  The situation of employment is special, because the German
legislator has placed an explicit obligation onto the employer to respect
and protect the personal rights of his employees in Art. 75 (2) BetrVG:

How this applies to unconditional electronic surveillance can be seen in the
decision of the German Federal Labour Court (GFLC)
1 ABR 21/03 (29-06-2004)

So even a loss (alleged/assumed theft) of 300 Letters&Parcels per month is a
subsidiary of the postal services can NOT justify constant and unconditional
CCTV surveillance at the workplace, even though each such theft is a felony,
punishable with up to 5 years prison term.

A successor attempt for CCTV surveillance 4 years later was found mostly
acceptable by GFLC, because of the many safeguards&limitations that had been
added to the procedures.  Usage of any collected surveillance data was
strictly limited to prosecuting crime, *NOT* for purpose of detecting
non-compliance to any policies.

> Don't tell me that is permissible behavior in Germany.

You're primarily asking the wrong questions and your reasoning/deduction on
this issue is logically flawed.  Having the "privilege" to define policies
does not imply that there are no limits in the means you are permitted to
enforce them.

While requiring employees to work naked might be fairly effective in helping
to reduce theft by employees.  I assume that there are limits to what an
employer can rightfully demand, even in the US.

http://dilbert.com/dyn/str_strip/000000000/00000000/0000000/000000/10000/200
0/800/12808/12808.strip.gif
http://dilbert.com/dyn/str_strip/000000000/00000000/0000000/000000/10000/700
0/100/17112/17112.strip.sunday.gif
http://dilbert.com/dyn/str_strip/000000000/00000000/0000000/000000/20000/000
0/900/20906/20906.strip.gif

When looking at issues like this:
http://blog.alexanderhiggins.com/2012/03/28/congress-decides-employers-deman
d-facebook-password-107972/

In Germany, there is no prerequisite of a criminal statute to make this
illegal, because it is also unconstitutional.  However, the european data
protection directive (and its national incarnation in EU members
states) will very likely apply, making this directly punishable--not just
"cease and desist else get punished"-able.

-Martin

---

From: Michael Hammer <[email-masked]>
Date: Wed, 8 Aug 2012 20:18:52 +0000

This totally ignores the reality of how systems, services, and particularly
Cloud works today.  
Makes me wonder if those lawyers ever used Gmail.
So, I guess you are saying that as long as all the data and processing 
occurs on a company server (aka in a Cloud), then it is ok to monitor all
they want.  :)
Problem solved.

Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Martin Rex
Sent: Tuesday, August 07, 2012 10:51 PM
To: Stephen Hanna
Cc: [email-masked]; [email-masked]
Subject: Re: [sacm] Legal aspects of System monitoring

> 
> However, I will note that monitoring and auditing corporate 
> information systems and networks is common practice in corporate 
> environments. Generally, the Acceptable Use Policy includes consent to 
> monitoring and audits. For example, look at the SANS template for an 
> Acceptable Use Policy available at
> 

The monitoring of servers and dedicated devices is OK, the monitoring of
data that is _not_ related to user activities/conduct is also OK, but the
surveillance of user activities at the workplace of the users
telecommunication and the user data resulting from that telecommunication is
clearly illegal in Germany.

I'm well aware that there is plenty of illegal activity commonplace in many
companies in Germany, but that does not make them any less illegal.

When the 1 ABR 21/03 (29-Jun-2004) decision about CCTV surveillance at the
workplace was appealed to the German Federal Labour Court, the employer
argued that were already performing CCTV surveillance in that fashion in 50
other subsidiaries (which for Germany means there have likely been
_at_least_100_ labor lawyers involved in those other cases and found it
non-objectionable), and two lower courts in this decision, but the German
Federal Laber Court tore it to shreds with unprecedented explicit and clear
determinations of why this activity was unconstitutional, quoting prior
decisions of its own and decisions of the Constitutional Court.

Therefore looking at the folklore on the aspect of electronic surveillance
is a bad idea, because of the longstanding systemic error, that is evident
from the GFLC decision 1 ABR 21/03.  For the most part, that mess hasn't
been cleaned up yet.  Someone living in a jurisdiction based on case law may
significantly underestimate the meaning&effect of that GFLC decision.

After the Constitutional Court decision about the unconstitutionality of
that particular video surveillance technology for traffic, there was a huge
flurry of trials and appeals, and those appeals which made it all the way up
(two even to the Constitutional Court), were quite obviously by clueless
lawyers, who had not cared to actually read and comprehend the 4-page GFCC
decision, or they would have immediately realized that their appeal are
pointless (waste of time and money), because the two issues to which the
GFCC had objected, had been fixed.

> 
> In some environments (universities and libraries), intellectual 
> freedom may trump security in some cases.

It is actually the other way round.  In a company setting, the usage of a
specific computer is typically not "voluntary" (i.e. you do not have to
option to "not" use it, or to use your privately-owned equipment instead, in
educational settings, specific pieces of equipment are not assigned to
specific individuals over a long period of time, and in the educational
setting Art. 75 (2) BetrVG does not apply, that requires employers to
respect and protect employees personal rights.

>
> However, even universities generally include provisions for monitoring 
> when necessary. For example, here are a few policies for universities 
> in the USA, UK, and Germany:
> 
> These policies were chosen at random, not deliberately to support one 
> point of view or another. But they are remarkably similar in many 
> respects.
> 
> I observe that the Technical University of Munich permits monitoring 
> of user behavior and forensic analysis under appropriate 
> circumstances.
> 
> So I conclude that the techniques and technologies for monitoring user 
> behavior and system configuration are used around the world.

As I said, it is a terrible bad idea to infer what is legal from the
folklore, in particular for a jurisdication that is primarily based on
statute law, not case law.

I'm really glad that the two works councils of these two postal subsidiaries
took their video surveillance issue up to the GFLC (1 ABR 21/03, 1 ABR
16/07), because the decisions are quite elaborate and directly applicable to
all kinds of electronic surveillance (and that looks _very_ intentional).

> 
> In the SACM group, we're talking about developing technology that will 
> help corporations to better secure their computer systems and 
> networks.

I believe that there should be a distinction between two types of
systems/devices, personal-use systems that may be subject to privacy
protection, and backend,server and networking equipment, where this does not
apply.

>
> We should carefully note the importance of maintaining balance between 
> user privacy and system security and obeying all relevant laws, rules, 
> and regulations.
> However, it would be foolish for us to think that we can come up with 
> one policy that would apply in all circumstances. Instead, we should 
> permit system and network owners to establish and implement their own 
> policies. At least, that's my point of view.

Without the possibility to distinguish these two types of equipment, you
will face the situation that products implementing this will not be usable
in certain markets (German being one of them) once they are subjected to
serious legal review, much like that particular unconstitutional traffic
video surveillance equipment had to be updated/replaced all over Germany
after the GFCC verdict, with the technical capability to limit surveillance
to probable cause.

-Martin

---

From: [email-masked] (Martin Rex)
Date: Thu, 9 Aug 2012 03:03:55 +0200 (CEST)

Michael Hammer wrote:
> This totally ignores the reality of how systems, services,
> and particularly Cloud works today.  

Nope.  Some of the cloud services seem to be ignorant of the legal
setting in which some of their (alleged) target customers operate, probably
because of a lack of legal protections&requirements in the countries
where the cloud providers themselves operate.
>From the business perspective of cloud providers this might be
perfectly resonable conduct in _their_ jurisdiction.

> Makes me wonder if those lawyers ever used Gmail.

I'm not talking about unsubstantiated laywer opionions here,
I'm talking about real, applicable statutes and past decisions of the
German Federal Courts and the Federal Constitutional Court,
i.e our highest appellate courts.

> occurs on a company server (aka in a Cloud), then it is ok to monitor all

When user behaviour/conduct and user data is not monitored, then
the constitutional protections do not apply, independent of where
the server is located.  Cloud or local server is a completely
irrelevant technical implementation detail for deciding which
PII can be legally monitored (collected, processed and used
by someone else than the data subject and for which purposes)
and which information can not.

This is why it will be illegal to outsource storage&processing of data,
that is subject to data protection law (respectively the european data
protection directive) to cloud offerings that are operating outside
of a jurisdiction with comparable strict data protection statutes
as in the EU, unless each individual data subject that is affected
voluntarily agrees.  For data that an employer collects about its
employees in Germany, Art. 75 (2) BetrVG requires that the principle
of proportionality is satisfied even when all affected employees
would voluntarily agree.

There seems to be a thorough misunderstanding of how the constitutional
protections of fundamental rights in German Basic Law work.

These constitutional protections are provided in an abstract fashion,
and require a _white-listing_ with statutes from a parlamentarian
legislator (federal or state) that must narrowly define which
encroachments of the fundamental rights are to be legal under
which preconditions, PLUS, when it is about collecting PII,
the statute must list the exact purposes for which the information
may be legally used.

Criminal statutes are a _black-listing_ approach (and need to be,
that is a requirement in most constitutions and the european human
rights convention).  The problem with black-listing is, that it
can often be evaded / worked around.

When a legislater wants to provide a reliable protection of rights,
then a sensible statue will contain a very broad "this is illegal
unless explictly permitted by some other statute" provision (=the
basis for white-listing) along with several narrow definitions of
puishable crimes (black_listing).  

The reason is obvious: legal weasels will find ways to evade the
black-listing.  This is where the white-listing requirement
comes in as backup.  While not permitting any direct punishment,
a broad "this is illegal unless..." white-listing requirement
provides sufficient grounds for temporary and permanent injunctions
(which themselves can be backed by punishments).

When a customer of a large German ISP with a flatrate DSL subscription
realized that the ISP was keeping records of the DHCP assignments of
the temporary IPv4 address on the external interface of the DSL customers
router for several months, he demanded from the ISP to delete this
information in a timely fashion when it is no longer used, because
it is PII, and holding on to this information is not explicitly
permitted by the exemptions of the TKG (german federal telecommunications
act) unless it is necessary for billing.  Billing a flatrate subscription
does not require that assignment.  The ISP denied the request and the
customer sued.  The court ordered an injunction that the ISP must
delete the data in a timely fashion (14 days).  The ISP appealed,
the appeal was rejected, and the injuction was backed with
a two-stage punishment for further non-compliance, a fine of Euro 100k
and if that doesn't work. a 6 month prison term for the active CEO.

http://www.heise.de/newsticker/meldung/T-Online-darf-nur-fuer-Rechnung-noetige-Verbindungsdaten-speichern-168803.html

The Federal Court of Justice rejected the second appeal by the ISP
(on formal grounds).

http://www.kein1984.de/bgh-entscheidung.pdf

There is no doubt that criminal statutes are a better deterrent,
but that doesn't mean that the "this is illegal, unless ..." provisions
would not work.  Injunctions can be backed by convincing
punishments, where necessary.  I assume that these can be quite
effective motivators for corporate entities to comply.
Though it can sometimes be a tedious process to get a decision
and hopefully an injunction.

For comparison, the criminal proceedings of an illegal surveillance
(monitoring of phone records of ~60 individuals) trying to find an
information leak, as summarized on Wikipedia, resulted in one manager
getting a 3.5 year prison term.
Several of the (technical) folks, who were involved in actually
monitoring the phone records, had to pay fines in the Eur 5k-10k range,
on the premise that they were just following order and not aware
to be actively commiting crimes.
Two Ex-CEOs made a settlement with the company, paying Eur 600.000 each.

http://de.wikipedia.org/wiki/%C3%9Cberwachungsaff%C3%A4re_der_Deutschen_Telekom

-Martin

---

From: Michael Hammer <[email-masked]>
Date: Thu, 9 Aug 2012 01:55:21 +0000

Martin,

What you state below was also expressed by what a German friend of mine
clarified for me many years ago:

In Germany, everything is forbidden unless a law says it is allowed.
(whitelist)
In the USA, everything is allowed unless a law says it is forbidden.
(blacklist)

I guess we feel we have a fundamental human right to freedom that is natural
and not by government fiat.

There is also a disconnect over when a company tells an employee not to put
any PII on the system owned by the company, 
and the employee proceeds to do so anyway, it is somehow the company's fault
if they detect that PII.

Lastly, you are stating that Germany's laws apply globally and over-ride any
other country's laws.
I beg to differ.

Cheers,
Mike

-----Original Message-----
From: Martin Rex [mailto:[email-masked]] 
Sent: Wednesday, August 08, 2012 9:04 PM
To: Michael Hammer
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: Re: [sacm] Legal aspects of System monitoring

Michael Hammer wrote:
> This totally ignores the reality of how systems, services, and 
> particularly Cloud works today.

Nope.  Some of the cloud services seem to be ignorant of the legal setting
in which some of their (alleged) target customers operate, probably because
of a lack of legal protections&requirements in the countries where the cloud
providers themselves operate.
>From the business perspective of cloud providers this might be perfectly
resonable conduct in _their_ jurisdiction.

> Makes me wonder if those lawyers ever used Gmail.

I'm not talking about unsubstantiated laywer opionions here, I'm talking
about real, applicable statutes and past decisions of the German Federal
Courts and the Federal Constitutional Court, i.e our highest appellate
courts.

> occurs on a company server (aka in a Cloud), then it is ok to monitor 
> all they want.  :)

When user behaviour/conduct and user data is not monitored, then the
constitutional protections do not apply, independent of where the server is
located.  Cloud or local server is a completely irrelevant technical
implementation detail for deciding which PII can be legally monitored
(collected, processed and used by someone else than the data subject and for
which purposes) and which information can not.

This is why it will be illegal to outsource storage&processing of data, that
is subject to data protection law (respectively the european data protection
directive) to cloud offerings that are operating outside of a jurisdiction
with comparable strict data protection statutes as in the EU, unless each
individual data subject that is affected voluntarily agrees.  For data that
an employer collects about its employees in Germany, Art. 75 (2) BetrVG
requires that the principle of proportionality is satisfied even when all
affected employees would voluntarily agree.

These constitutional protections are provided in an abstract fashion, and
require a _white-listing_ with statutes from a parlamentarian legislator
(federal or state) that must narrowly define which encroachments of the
fundamental rights are to be legal under which preconditions, PLUS, when it
is about collecting PII, the statute must list the exact purposes for which
the information may be legally used.

Criminal statutes are a _black-listing_ approach (and need to be, that is a
requirement in most constitutions and the european human rights convention).
The problem with black-listing is, that it can often be evaded / worked
around.

When a legislater wants to provide a reliable protection of rights, then a
sensible statue will contain a very broad "this is illegal unless explictly
permitted by some other statute" provision (=the basis for white-listing)
along with several narrow definitions of puishable crimes (black_listing).  

The reason is obvious: legal weasels will find ways to evade the
black-listing.  This is where the white-listing requirement comes in as
backup.  While not permitting any direct punishment, a broad "this is
illegal unless..." white-listing requirement provides sufficient grounds for
temporary and permanent injunctions (which themselves can be backed by
punishments).

When a customer of a large German ISP with a flatrate DSL subscription
realized that the ISP was keeping records of the DHCP assignments of the
temporary IPv4 address on the external interface of the DSL customers router
for several months, he demanded from the ISP to delete this information in a
timely fashion when it is no longer used, because it is PII, and holding on
to this information is not explicitly permitted by the exemptions of the TKG
(german federal telecommunications
act) unless it is necessary for billing.  Billing a flatrate subscription
does not require that assignment.  The ISP denied the request and the
customer sued.  The court ordered an injunction that the ISP must delete the
data in a timely fashion (14 days).  The ISP appealed, the appeal was
rejected, and the injuction was backed with a two-stage punishment for
further non-compliance, a fine of Euro 100k and if that doesn't work. a 6
month prison term for the active CEO.

http://www.heise.de/newsticker/meldung/T-Online-darf-nur-fuer-Rechnung-noeti
ge-Verbindungsdaten-speichern-168803.html

The Federal Court of Justice rejected the second appeal by the ISP (on
formal grounds).

There is no doubt that criminal statutes are a better deterrent, but that
doesn't mean that the "this is illegal, unless ..." provisions would not
work.  Injunctions can be backed by convincing punishments, where necessary.
I assume that these can be quite effective motivators for corporate entities
to comply.
Though it can sometimes be a tedious process to get a decision and hopefully
an injunction.

For comparison, the criminal proceedings of an illegal surveillance
(monitoring of phone records of ~60 individuals) trying to find an
information leak, as summarized on Wikipedia, resulted in one manager
getting a 3.5 year prison term.
Several of the (technical) folks, who were involved in actually monitoring
the phone records, had to pay fines in the Eur 5k-10k range, on the premise
that they were just following order and not aware to be actively commiting
crimes.
Two Ex-CEOs made a settlement with the company, paying Eur 600.000 each.

http://de.wikipedia.org/wiki/%C3%9Cberwachungsaff%C3%A4re_der_Deutschen_Tele
kom

-Martin

---

From: [email-masked] (Martin Rex)
Date: Thu, 9 Aug 2012 06:01:50 +0200 (CEST)

Michael Hammer wrote:
> 
> Your conflating two distinct things,

Nope, but you're still ignoring the differences between
the US legal system and the German legal system.

>
> what is done outside of work and what occurs
> during work just confuses the issues.

Nope.  In Germany, dignity and personality rights are fundamental
basic human rights, inseperable from the individual. You do not
have to deposit them in a jar and leave it with the security guard
at the entrance when you come to work, to pick it back up when you leave.

>
> Second, we are not talking
> personal equipment here, but company equipment and systems.  

Nope, we are talking about collecting and processing PII data.
Who owns which parts of the computing equipments that are involved
in collecting the PII data is almost completely irrelevant (in Germany!).
You're still wandering in the black-listing forest.

PII is kind of an intangible asset to be owned and controlled
by the data subject.  Other intangible assets, for example copyrighted
works, also do not change ownership as an implicit side effect
of being copied to a physical media that does not belong to the
copyright owner.

But then, the US notion of copyright also lacks the concept
of the author/creator personality rights, in particular the
Art12 UrhG privilege, which is an integral part of the German
copyright, and non-transferable except by inheritance after death,
so elaborating on the copyright analogy might easily lead down
the same rathole if one is stuck to the US copyright concept.

  http://www.gesetze-im-internet.de/urhg/BJNR012730965.html#BJNR012730965BJNG000701377

ISPs, mobile phone, landline, VoiP, Mailhoster and an employer supplying
telecommunication equipment to employees are all subject to the
telecommunication confidentiality protection from Article 10.1 of
the Basic Law (Grundgesetz).  They obtain no rights to the information
that traverses their systems or in stored on them, whether it is
Voice Mailbox, SMS, Email, fax, whatever, when they're subject to
German jurisdiction.  What these entities may legally do with the data
while it is stored on or traversing their equipment, and what actions
are criminal offences, is largely described in the German
telecommunications act (TKG), Art. 88ff.

  http://www.gesetze-im-internet.de/tkg_2004/BJNR119000004.html#BJNR119000004BJNG001800000

-Martin

---

From: [email-masked] (Martin Rex)
Date: Thu, 9 Aug 2012 10:15:48 +0200 (CEST)

> Lastly, you are stating that Germany's laws apply globally and over-ride any

I actually did not mean to say or imply that.  I would appreciate when
you could quote the relevant text that you interpreted in that fashion
so that I can try to improve my communication skills on legalese issues.
(I'm native german and a novice in english/US legalese terminology).

> any PII on the system owned by the company, 

I'm beginning to understand that the confusion is coming from
a terminology misunderstanding.  Either the US term "PII" refers to
just an insignificant small subset of what is called PII in Europe,
or the existing descriptions of what it means are just thoroughly
confusing and misleading.

Data protection is even more about control (who gets to know what about
a data subject), than it is about confidentiality.  And it encompasses
all information "ANY information related to", not just the identifier (name)
and the few example attributes that are typically quoted
such as address, date-of-birth, gender, religion, ethnic origin.

Quoting from the english version of the European Data Protection Directive:

  http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:NOT

  For the purposes of this Directive:

  (a) 'personal data' shall mean any information relating to an identified
  or identifiable natural person ('data subject'); an identifiable person
  is one who can be identified, directly or indirectly, in particular by
  reference to an identification number or to one or more factors
  specific to his physical, physiological, mental, economic, cultural
  or social identity;

PII includes
  - every single datum that an individual creates,
    every keypress, every mouse-move, even the length of the pauses
    between keypresses, body movements (breathing, twinkle, ...)
  - every datum that is (or can be with moderate effort) directly
    or indirectly related to an individual describing characteristics
    of the individual, showing actions/activities, opinions, thoughts

>
> and the employee proceeds to do so anyway,
> it is somehow the company's fault if they detect that PII.

It is impossible for an individual to create information that is *NOT* PII.
It may be possible to anonymize PII after its creation, or at least
ensure that it is re-distributed in anonymized fashion, but
reliable anonymization may sometimes turn out to be difficult in reality.
And not necessarily wanted.

-Martin

PS: and if you're wondering how this interacts with copyright,
    and whether there is some kind of "automatic" transfer of ownership
    of copyrights based on an employment contract, that is a very long
    and different story, there are specific statues which kinds of rights
    on which kinds of works are transfered by an employment contract,
    and at least in Germany the non-transferable "publication privilege"
    from the author/creator personality right in Germany's copyright
    statute (Art 12 (1) UrhG) precludes any automatic transfer,
    and transfer of rights on contents of non-public telecommunication
    is a seperate can of worms.

---

From: Michael Hammer <[email-masked]>
Date: Thu, 9 Aug 2012 16:55:34 +0000

Martin,

Your wording stated that it did not matter where in the world the server was
located.  It is possible for a user in Germany to subscribe to a service
anywhere in the world, and the Cloud operator may not even know that has
happened, since this could be completely self-service, or the identities
used may not have any way to identify it as a German user.  So, in effect
you are criminalizing a company for the behavior of the user.

Mike

-----Original Message-----
From: Martin Rex [mailto:[email-masked]] 
Sent: Thursday, August 09, 2012 4:16 AM
To: Michael Hammer
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: Re: [sacm] Legal aspects of System monitoring

Michael Hammer wrote:
> 
> Lastly, you are stating that Germany's laws apply globally and 
> over-ride any other country's laws.
> I beg to differ.

I actually did not mean to say or imply that.  I would appreciate when you
could quote the relevant text that you interpreted in that fashion so that I
can try to improve my communication skills on legalese issues.
(I'm native german and a novice in english/US legalese terminology).

> 
> There is also a disconnect over when a company tells an employee not 
> to put any PII on the system owned by the company,

I'm beginning to understand that the confusion is coming from a terminology
misunderstanding.  Either the US term "PII" refers to just an insignificant
small subset of what is called PII in Europe, or the existing descriptions
of what it means are just thoroughly confusing and misleading.

Data protection is even more about control (who gets to know what about a
data subject), than it is about confidentiality.  And it encompasses all
information "ANY information related to", not just the identifier (name) and
the few example attributes that are typically quoted such as address,
date-of-birth, gender, religion, ethnic origin.

http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:NO
T

PII includes

>
> and the employee proceeds to do so anyway, it is somehow the company's 
> fault if they detect that PII.

It is impossible for an individual to create information that is *NOT* PII.
It may be possible to anonymize PII after its creation, or at least ensure
that it is re-distributed in anonymized fashion, but reliable anonymization
may sometimes turn out to be difficult in reality.
And not necessarily wanted.

-Martin

---

From: Michael Hammer <[email-masked]>
Date: Fri, 10 Aug 2012 00:41:42 +0000

Dave,

If it were only that simple.  When we start using addresses to be identities,
and many of these change as you hop through systems, and
you have all sorts of encapsulations, then it is anybody's guess
where something really came from or who they really are.

Let's say you have a US user of a US service provider with certain ID's and IP 
addresses,
Who travels to Germany and gets new visited network IDs and IP addresses (take 
LISP mobility as an example).
That user then uses a cloud service that actually processes data that exists 
in the US, but a window on that data is sent to the user.
Whose law governs the behavior here?

Some countries would have us erect giant firewalls like the Chinese have to 
monitor every last bit,
so we would know what is inside versus outside the geographical borders to 
ensure that countries laws are enforced.
The unintended consequence might be less privacy not more.

Mike

-----Original Message-----
From: David Misell [mailto:[email-masked]]
Sent: Thursday, August 09, 2012 7:26 PM
To: Michael Hammer
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: Re: [sacm] Legal aspects of System monitoring

Michael,

Isn't that a problem of the AS number in which the service is, maybe that 
needs to appear in the contract bindings?

Just a thought, if we go back to Saltzer RFC 1498:
-  a name identifies what you want,
-  an address identifies where it is, and
-  an route identifies a way to get there.

Clearly the how you get there is just as relevelnt today!

dave
On Thu, 2012-08-09 at 16:55 +0000, Michael Hammer wrote:
> Martin,
>
> Your wording stated that it did not matter where in the world the
> server was located.  It is possible for a user in Germany to subscribe
> to a service anywhere in the world, and the Cloud operator may not
> even know that has happened, since this could be completely
> self-service, or the identities used may not have any way to identify
> it as a German user.  So, in effect you are criminalizing a company for the 
> behavior of the user.
>
> Mike
>
>
>
> I'm beginning to understand that the confusion is coming from a
> terminology misunderstanding.  Either the US term "PII" refers to just
> an insignificant small subset of what is called PII in Europe, or the
> existing descriptions of what it means are just thoroughly confusing and 
> misleading.
>
> Data protection is even more about control (who gets to know what
> about a data subject), than it is about confidentiality.  And it
> encompasses all information "ANY information related to", not just the
> identifier (name) and the few example attributes that are typically
> quoted such as address, date-of-birth, gender, religion, ethnic origin.
>
>
> > and the employee proceeds to do so anyway, it is somehow the
> > company's fault if they detect that PII.
>
> ensure that it is re-distributed in anonymized fashion, but reliable
> anonymization may sometimes turn out to be difficult in reality.

--
Kind Regards,
dave
David S. Misell,
07710380044

---

From: [email-masked] (Martin Rex)
Date: Fri, 10 Aug 2012 20:33:30 +0200 (CEST)

Michael Hammer wrote:
> 
> Your wording stated that it did not matter where in the world the server
> was located.  It is possible for a user in Germany to subscribe to a service
> used may not have any way to identify it as a German user.

Now we're talking completely past each other.

The previous discussion was about employer vs. employees.  When it is a
german employment contract and the workplace is in Germany, then German
jurisdiction will apply, and this will be independent where the employer
is processing his data, on a local server or abroad.  Local laws and
regulation may limit which kind of data and data processing an employer
may legally "offshore" into other jurisdictions.

That is not to be confused with a vendor/service provider to customer
relationship, where vendor/service provider and customer are living
in different jurisdictions from the beginning.  Normally, the local
laws and regulations where the vendor/service provider is operating
apply.  But this _may_ limit to which "netizens" the vendor/service provider
may "legally" offer services, in particular when there actually exists
a national subsidiary in the jurisdiction of the netizen/customer.

Examples: Online Gambling, Online (re)distribution of copyrighted works,
Online pharmacy.

>
> So, in effect you are criminalizing a company

I wrote illegal/unlawful ("rechtswidrig"), _not_ criminal ("strafbar").
but I'm not sufficiently familiar with english/US legalese terminology,
to know whether my use of english terminology is appropriate.

The way I understand "criminial" is that it fits an existing criminal
statute and is directly punishable (i.e. all previous offenses are
punishable), whereas when some conduct is merely unlawfully infringing/
encroaching on rights, and the affected person can obtain injunction
(backed by punishment), but only continued or future
infringments/encroachments will be punishable.

> 
>                                             for the behavior of the user.

I don't understand the latter.  If the company is infringing on the
users rights, then it is liable.  User rights may result from
the jurisdiction under which the services are being offered, from
the contract between vendor/service provider and the user, and from
international treaties that may apply to the goods/services.

-Martin

---

From: Michael Hammer <[email-masked]>
Date: Fri, 10 Aug 2012 19:08:11 +0000

Martin,

Yes, language and culture is always challenging.

Yes, we have both criminal and civil categories as well, but only one
supreme court.
(btw, I used to live across from the Bundesgerichtshof (sp?) in Karslruhe on
Herrenstrasse.)

The former tends to be driven by statutes, and the latter from tort law from
English common law.

The U.S. constitution was designed to limit government by specifying
explicit powers, with all others going to the States and the People.
The Bill of rights outlines individual rights, but you have to interpolate
to find anything about privacy.

There is also the concept of contract law.  And if two parties agree to a
contract, so long as it isn't explicitly prohibited, then it is lawful.
You alluded to contracts earlier, but noted that German law has placed
additional restrictions on that.

So, this seems to devolve to which laws apply, and the key factor is a
person resident in Germany 
must have a German employment contract, and under those terms, these privacy
laws would apply.

BTW, I was there under the Status of Forces Agreement and hence German Law
did not always apply to me,
much to the consternation of some German government folks who came to knock
on my door and insist 
that I provide answers to their census and I told them to go pound sand.  :)
So much for privacy.

Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Martin Rex
Sent: Friday, August 10, 2012 2:33 PM
To: Michael Hammer
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: Re: [sacm] Legal aspects of System monitoring

Michael Hammer wrote:
> self-service, or the identities used may not have any way to identify it
as a German user.

The previous discussion was about employer vs. employees.  When it is a
german employment contract and the workplace is in Germany, then German
jurisdiction will apply, and this will be independent where the employer is
processing his data, on a local server or abroad.  Local laws and regulation
may limit which kind of data and data processing an employer may legally
"offshore" into other jurisdictions.

That is not to be confused with a vendor/service provider to customer
relationship, where vendor/service provider and customer are living in
different jurisdictions from the beginning.  Normally, the local laws and
regulations where the vendor/service provider is operating apply.  But this
_may_ limit to which "netizens" the vendor/service provider may "legally"
offer services, in particular when there actually exists a national
subsidiary in the jurisdiction of the netizen/customer.

I wrote illegal/unlawful ("rechtswidrig"), _not_ criminal ("strafbar").
but I'm not sufficiently familiar with english/US legalese terminology, to
know whether my use of english terminology is appropriate.

The way I understand "criminial" is that it fits an existing criminal
statute and is directly punishable (i.e. all previous offenses are
punishable), whereas when some conduct is merely unlawfully infringing/
encroaching on rights, and the affected person can obtain injunction (backed
by punishment), but only continued or future infringments/encroachments will
be punishable.

>                                             for the behavior of the user.

I don't understand the latter.  If the company is infringing on the users
rights, then it is liable.  User rights may result from the jurisdiction
under which the services are being offered, from the contract between
vendor/service provider and the user, and from international treaties that
may apply to the goods/services.

-Martin

---

From: <[email-masked]>
Date: Fri, 10 Aug 2012 16:43:38 -0500

All,

While this is a very stimulating conversation, it has little to do, at present, with the work of this potential working group.  As was requested before by others,  PLEASE take this to the appropriate forum. This list is NOT it.  If you are responding to these types of message, please don't.

Thank you.

Kent Landfield

From: Martin Rex <[email-masked]<mailto:[email-masked]>>
Reply-To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Date: Friday, August 10, 2012 2:33 PM
To: Michael Hammer <[email-masked]<mailto:[email-masked]>>
Cc: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [sacm] Legal aspects of System monitoring

Michael Hammer wrote:

-Martin

---

From: Adam Montville <[email-masked]>
Date: Fri, 10 Aug 2012 21:46:00 +0000

On 8/10/12 2:43 PM, "[email-masked]"
<[email-masked]> wrote:

>While this is a very stimulating conversation, it has little to do, at
>present, with the work of this potential working group.  As was requested
>before by others,  PLEASE take this to the appropriate forum. This list
>is NOT it.  If you are responding to these types of message, please don't.

+1

---

From: Luis Nunez <[email-masked]>
Date: Fri, 10 Aug 2012 18:08:32 -0400

+1

Thanks
-ln

Sent from mobile phone