Fun Thread! Watch out for "Private messaging"

[lynn_ha]

It's always good idea to treat private messaging as "public"

​

It is absolutely the best advice to threat the use of "private" messages as though they are "public" and can be read by anyone (working with a network) who wants to excess private messages! This goes for the workplace also not just review boards! I had a bad experience with private messages at my workplace and found out one of the ladies was reading our private messages, so be warned "it's not private!!
One of my co-workers had met me in the lunch room & warned me that one of the other girls was reading everyone's private messages as recreation & enjoyed all the gossip of which she was spreading around the office. I was very lucky I wasn't chatting about my escort business, thinking I was perfectly safe!

Have you also been aware that someone was accessing your private messages?
I now delete everything so it can't resurface later!

​

 

[shakenbake]

Rest assured that there will often be ways to resurrect deleted messages from servers, even some time after they have been deleted. Be careful with private messages on workplace servers.

 

[lynn_ha]

Rest assured that there will often be ways to resurrect deleted messages from servers, even some time after they have been deleted. Be careful with private messages on workplace servers.

shakenbake, what about deleted emails when I'm receiving them from work, can they also be retrieved and read? I'm working on a local LAN

 

[Promo]

shakenbake, what about deleted emails when I'm receiving them from work, can they also be retrieved and read? I'm working on a local LAN

If your work is running an enterprise class Email server (i.e. Microsoft Exchange, Lotus Notes), the Email server can be configured to keep every email in-to, out-of or even deleted emails for whatever retention period configured. The idea is, for example, if company mgmt needs to go back in time to review threads regarding a customer sale, they can see everything. Even if Emails were deleted by the user. We have our server set-up to retain and archive for 1 year - it really only costs disk space which is relatively cheap.

The retention period for online email services (Google, Hotmail, Bell, Rogers, etc.) isn't public information, but I've been told by people who would know that it's ~60 days on the servers and back-ups are kept for 90-120 days.

Same holds true for most corporate and Internet based Instant messaging (IM) services.

Last tidbits,
- Unless the email and IM servers employ an encrypted database, anyone with access to the server or application can read your messages. In theory only authorized IT staff can access the servers, but that doesn't guarantee they are 100% trustworthy. If the database is encrypted, only staff with the privileged passwords will be able to un-encrypt user emails. It takes allot of CPU power to securely encrypt 100s or 1000s of emails a second, so not surprisingly many companies don't run encrypted databases.

- Even when an email is deleted, the actual file on a hard drive is not immediately deleted, the sector(s) it occupies are simply marked as available. It could take a few minutes to possibly weeks before the sectors are overwritten thus destroying the original content - it depends on how heavily utilized the drive/storage pool is used. That's why it's possible to recover deleted files.

- If a drive is replaced (perhaps because it's too small), a good IT shop will use a Mil-Spec program to overwrite the drive several times with a specific sequence of 1s and 0s in a random order. Not all IT shops are good and as a result your private data could be compromised

- If a drive fails, it's possible it's just the interface or only a handful of sectors on the drive platters, thus leaving a large percentage of the content intact. It's also possible certain failures prevent a proper erasing of the drive. A good IT shop will physically destroy the drive, but some do end up in the trash with your private data intact.

- Lastly, the email you sent is received by someone. No guarantee that person's PC is 100% secure or they could forward it to someone else without your knowledge or permission. Ask Hillary ......

Bottom line: treat ALL of your electronic communications as insecure and never put anything in writing that would compromise you.

 

[lynn_ha]

If your work is running an enterprise class Email server (i.e. Microsoft Exchange, Lotus Notes), the Email server can be configured to keep every email in-to, out-of or even deleted emails for whatever retention period configured. The idea is, for example, if company mgmt needs to go back in time to review threads regarding a customer sale, they can see everything. Even if Emails were deleted by the user. We have our server set-up to retain and archive for 1 year - it really only costs disk space which is relatively cheap.

The retention period for online email services (Google, Hotmail, Bell, Rogers, etc.) isn't public information, but I've been told by people who would know that it's ~60 days on the servers and back-ups are kept for 90-120 days.

Same holds true for most corporate and Internet based Instant messaging (IM) services.

Last tidbits,
- Unless the email and IM servers employ an encrypted database, anyone with access to the server or application can read your messages. In theory only authorized IT staff can access the servers, but that doesn't guarantee they are 100% trustworthy. If the database is encrypted, only staff with the privileged passwords will be able to un-encrypt user emails. It takes allot of CPU power to securely encrypt 100s or 1000s of emails a second, so not surprisingly many companies don't run encrypted databases.

- Even when an email is deleted, the actual file on a hard drive is not immediately deleted, the sector(s) it occupies are simply marked as available. It could take a few minutes to possibly weeks before the sectors are overwritten thus destroying the original content - it depends on how heavily utilized the drive/storage pool is used. That's why it's possible to recover deleted files.

- If a drive is replaced (perhaps because it's too small), a good IT shop will use a Mil-Spec program to overwrite the drive several times with a specific sequence of 1s and 0s in a random order. Not all IT shops are good and as a result your private data could be compromised

- If a drive fails, it's possible it's just the interface or only a handful of sectors on the drive platters, thus leaving a large percentage of the content intact. It's also possible certain failures prevent a proper erasing of the drive. A good IT shop will physically destroy the drive, but some do end up in the trash with your private data intact.

- Lastly, the email you sent is received by someone. No guarantee that person's PC is 100% secure or they could forward it to someone else without your knowledge or permission. Ask Hillary ......

Bottom line: treat ALL of your electronic communications as insecure and never put anything in writing that would compromise you.

Thanks so much Promo, I really appreciate your effort and all the trouble you went to posting your information. I'm sure a lot of members will find this information very useful when sending emails from the workplace. I certainly find it an eye opener!

 

[shakenbake]

Thanks so much Promo, I really appreciate your effort and all the trouble you went to posting your information. I'm sure a lot of members will find this information very useful when sending emails from the workplace. I certainly find it an eye opener!

Promo answered your question much, much better than I could ever answer it. Thanks Promo!

Bottom line, crumbs are left everywhere your e-mails go, and enough to be able to track down your activities.

 

[lynn_ha]

Promo answered your question much, much better than I could ever answer it. Thanks Promo!

Bottom line, crumbs are left everywhere your e-mails go, and enough to be able to track down your activities.

It really is very risky to write anything down in the from of text on any media device. shakenbake, I'm glad I was lucky enough to be given the heads up before I got caught in the workplace or straight friends & family! I have sent a lot of sensitive emails from my work and I guess I'll have to be a bit more careful!

 

[Promo]

It really is very risky to write anything down in the from of text on any media device. shakenbake, I'm glad I was lucky enough to be given the heads up before I got caught in the workplace or straight friends & family! I have sent a lot of sensitive emails from my work and I guess I'll have to be a bit more careful!

Workplace privacy is an interesting paradox. As an employee you have the legal right to a certain level of workplace privacy, unless you have signed some of your rights away as part of your employment / hiring contract. Many people don't bother to fully read what they sign and don't realize what rights they have surrendered.

Employers may have the attitude that while on their premise, using their PC, email application and network, that they "own" anything you do including all your emails. This is actually not true. Under current law, employees have a reasonable expectation of privacy (I'm not a lawyer, so my wording isn't legalize). If you send a private Email to your SO, your employer is not allowed to disclose the contents or act upon the information unless it breaks a law (i.e. you admitted guilt to a crime, disclosed company confidential data, etc.). They can read your emails if they have business reasons to ..... but they can't act upon anything that isn't illegal. Same idea if you had a non-work conversation on a company phone (i.e. some companies record telephone calls for quality purposes) or if you sent a text to your SO on a company phone during your break.

That said ...... If your company required you to sign an "Acceptable Use Policy" and/or "Corporate Privacy Policy Agreement" document (they can have a 100 other names), you may have given up some of your rights to confidentiality / privacy. These documents are mainly focused on making sure you don't watch porn at work, don't use corporate resources for personal gain, don't disclose confidential or proprietary information etc., however often other items are slipped into the documents such as: they can use your photo in corporate advertising or documentation without permission, they can datamine your emails and phone calls without your knowledge, they can record your movements throughout the day using your corporate cellphone without your knowledge.

Some will argue that if you aren't doing anything wrong, who cares? An employer can fire you any time without explanation as long as they pay severance ..... what I'm talking about is there is some information we don't want anyone to know under any circumstances. Example: suppose your employer is tracking your movements via your corporate cellphone unknown to you during the business day and you decide to go for a 30 min SP session during your lunch hour.

I realize I'm simplifying the legal aspects of this as there are many nuances best described by a lawyer and the law changes over time, but hopefully you get the jist of my points.

 

[lynn_ha]

thanks so much Promo!
I'm very great full to be made aware of how different firms can go after your private information. It's certainly been an education for me.
I work for a law firm & I really wouldn't want to be found out!
Have a fantastic weekend & thanks very much for your time