Accessing Blocked Websites.

[Cookie]

[...]I'm gonna get one and test it to see how good they really think it is..... interested to find out cookie storage and reg entries etc, will let ya know what I think.

That's the ticket. It certainly would have it's uses in domestic situations - at least I might not go to breakfast to find my 12 year old has printed out all my dodgy web surfing history from the night before! Unless he installed one of these the night before that is : http://www.keyghost.com/ Heh heh.

[Lias]

The best way to get around IT dept (sorry chaps) is this Secure surf, have me order in already

That device still has to use the corporate proxy, and hence will still show up in logs. All its really doing is removing most (Possibly all but I doubt it) forensic evidence of your activities on that individual PC.. Not a silly idea for using internet cafes but hardly a way around a corporate proxy.

The proxy logs are still going to show SOMETHING going through. Even if it puts all its requests via an anonymizer service once the anonymizer service is blocked its fucked (and lets face it any half decent corporate network blocks them as fast as they pop up).

Here's how the process works.
Secure browser wants www.hotporn.com, and www.hotporn.com is blocked by the corporate firewall.
First it asks the corporate proxy for http://www.anonymizer.com/cgi-bin/wi...347824589dfsdf or something like that
www.anonymizer.com requests the page from www.hotporn.com, obfuscates or encrypts it, and sends it back to the proxy.
The proxy thinks the pages come from www.anonymizer.com and allows them through, and you see www.hotporn.com on your PC.

If the proxy starts blocking www.anonymizer.com too, then things start going to poo for you :-)
And if its anything like my network, all BLOCKED hits show up in the logs..
So I see you trying to goto www.hotporn.com and getting 403'd, then all these requests to www.anonymizer.com and faster than you can say "Formal notice of investigative meeting" I've sent a report to HR via my manager, you go down for serious misconduct and security is showing you the door.

I know of at least 3 staff who've resigned this year at my work due to "jump or be pushed" letters from HR, and I believe a few more may have gotten away with it purely because it was in their redundancy notice period and managers were being nice.

PS: ITs generally accepted that only the IT department is allowed porn on the work PC's because we write the rules for the lusers not ourselves :-)

[Biohazard]

Exactly what he said

[sAsLEX]

and faster than you can say "Formal notice of investigative meeting" I've sent a report to HR via my manager, you go down for serious misconduct and security is showing you the door.

I know of at least 3 staff who've resigned this year at my work due to "jump or be pushed" letters from HR, and I believe a few more may have gotten away with it purely because it was in their redundancy notice period and managers were being nice.

And how is looking at porn/trademe/bank account so bad that they can sack you ?? Where if you swear at customers write swastikas on holocaust victims houses , steal from the company then they still cant fire your arse?!

I mean sure if they were stealing shit from the company but a little harmless surfing on what could be their own time!? ridiculous

[Sniper]

Lias, you are one of the greats

To back up what Lias said. No matter what you look at, most good IT chaps know what to look for. If suddenly you are visiting www.a-bug.com most the time during the day and we have the slightest inkling or knowledge that you are not a bug person, then you will be checked out.

No matter what, if needs be, images and certain pages will be stored in your cache and bored people like me will browse through your personal files and see what you are not meant to be doing.... but thats only if there wasnt a privacy act

[Lias]

And how is looking at porn/trademe/bank account so bad that they can sack you ?? Where if you swear at customers write swastikas on holocaust victims houses , steal from the company then they still cant fire your arse?!

I mean sure if they were stealing shit from the company but a little harmless surfing on what could be their own time!? ridiculous

Whats the bet that guy (painter wasnt he?) hadnt signed a contract agreeing to obey several reams of A4 worth of policy covering everything under the sun?

If you work here, you agree not to break the rules, and you agree that if you break the rules there will be consequences upto and including dismissal. Hell were not even particularly harsh about it, do the research there are several documented cases of employees being fired for sending personal emails on a corporate network that specifically stated that the network was for work use only. Others have been fired for posting comments on blogs about their place of employment, let alone been fired for surfing porn!

As for "on their own time" the computer, and the network are provided by the employer to you as a tool for work related use. You dont inherently have the right to do anything personal with them, even on your own time. Most companies that have a computer usage policy will allow for some personal use, others wont. We actually have a relatively liberal internet usage policy here. Basically aslong as your not surfing porn, streaming media, download craploads of anything (Ie excessive usage) or try to bypass our list of blocked sites we dont really care what you do. I have personally worked for firms where personal internet surfing was verbotten, and personal email use was tolerated only within strict guidelines. We also generally only push for formal HR action in the case of serious porn surfing, most other things we let slide with a permanent loss of internet access.

If a company gives you a signwritten company car to use during the performance of your duties, does that give you the right to drive around in it openly smoking pot and with 3 naked hookers in the back? I dont bloody think so and if you did you'd soon find the car taken off you if not being outright fired. Exactly the same thing applies to computer and internet usage.

[Ixion]

,,Others have been fired for posting comments on blogs about their place of employment, let alone been fired for surfing porn!

,,.

Very dodgy that one, only in USA I think and prolly only in the laughably misnamed "right to work" states (ie right to sack without any reason).

Could be caught up in a general 'duty of loyalty" thing in NZ, but it would have to be pretty bad, not just "XX is a shit company to work for" stuff. It's called freedom of speech.

Main reason IT don't like pron sites is (a) they're riddled with nasty shit and (b) if someone's downloading pron, it's bound to cause complaints from other , boobily-envious workers. and (c) when you enter a pron site it almost certainly captures your IP. Management don't really like the idea that Joe is perving on the kiddyporn site again, and the company's IP address (and thus name) is going into the police file. Could be embarassing.

There are ways around proxy servers, but really, it's not worth the trouble and risk of aggro from manglement.

[Ixion]

Interesting legal decision on this point, just out
http://www.stuff.co.nz/stuff/0,2106,3721288a11,00.html

[Cookie]

Very interesting Ixion.

If what was reported is correct, with multiple users using the same username and password, the defense case is pretty damn easy to put together.

I can't see that the company has a leg to stand on during an appeal because surely they need to prove *who* was doing what. Obviously dodgy activity going on but they can't just punish people in the hope that they get some of those involved in the actual activity.

As usual, there is often more to the story blah blah but that's my 2 cents anyway.

[Wolf]

Main reason IT don't like pron sites is (a) they're riddled with nasty shit

Viruses, spyware, keyloggers - funnily enough, porn is popular enough to make it worth using as a lure to get people to visit.

(b) if someone's downloading pron, it's bound to cause complaints from other , boobily-envious workers.

And the Puritans. Or people with a serious idea about Corporate Image. At a previous job a tutor came into the IT Sanctum Sanctorum extremely pissed off that he had had a night class for some of Hamilton's top businessmen and he got them to turn their computers on and most of the machines in the lab had porn pics set as the wallpaper (by the students who regularly used the room) - he did not deem it a suitably professional image and felt the institute had lost face in front of some extremely important people.

(c) when you enter a pron site it almost certainly captures your IP. Management don't really like the idea that Joe is perving on the kiddyporn site again, and the company's IP address (and thus name) is going into the police file. Could be embarassing.

Our general policy - governing everything, not just Computer Use - says that an employee must not behave in a manner that calls the company into disrepute or would render the company liable for criminal proceedings. Getting your corporate IP range implicated in a kiddie porn ring would certainly qualify as a breach of that article.

[Wolf]

Very interesting Ixion.

If what was reported is correct, with multiple users using the same username and password, the defense case is pretty damn easy to put together.

Prosecution has a damn easy job in Mr Bisson's case - serious breach of network security, giving out your login to 23 people - in so doing, he accepts responsibility for the actions of all of them. You can't prove which employees surfed the bad sites, but Bisson admitted to giving them access - reinstate the apprentices and watch 'em like a hawk, sack Bisson for breaching security.

I always tell our employees, "do not give your login and password to anyone, if you do and the othe person deliberately or accidentally breaches the Acceptable Use Policy or the law, the logs will show your account to be at fault - you will be the one facing suspension, dismissal or possibly criminal charges."

If the breaches are serious enough - illegal - they would probably still be sacked even if the prosecution could not prove it was them who actually commited the crime. They provided the means for one to be committed, after all.

[sAsLEX]

Ok this is similar to the EULA's that we have all agreed to at some time. Now has anyone read any of them? They make them like a Clancy novel in length and throw in legal jargon to make them difficult to follow as well, hence no one reads them just ticks the box.

[Wellyman]

We found a way of getting on tardme at school, but I can't remeber right now but you do a search on something in google and follow one of the links and you can get into tardme, thats all i cann rember.
WM

[Cookie]

Prosecution has a damn easy job in Mr Bisson's case - serious breach of network security, giving out your login to 23 people - in so doing, he accepts responsibility for the actions of all of them. [...]

Fair comment Wolf - which is partly why I said there may be more to the story.

A lot of companys have "Acceptable Use" and network policy documents that the users never see, or have only had waved briefly under their noses when they first arrive.

Maybe every now and then something bad happens, and HR send out an email saying "Read This", thinking that has legally innoculated themselves for next time.

My understanding is that the best protection from the company's point of view is a copy of the company policy signed by the employee. Even click-through login screens with warnings (like the EULA" type thing sAsLEX referred to) is weak protection in NZ.

I'm not saying this is right or wrong, but the company really needs to have clear evidence that the worker has read, understood and signed the agreement before they can sack them outright for a single infringement.

Of course, there are more ways than one to get rid of someone but in a highly unionised workforce such as Air NZ, I would expect a battle on my hands.

[Wolf]

I'm not saying this is right or wrong, but the company really needs to have clear evidence that the worker has read, understood and signed the agreement before they can sack them outright for a single infringement.

Only to a certain degree, there are some things that could be deemed that a person should realise. How many people would give their company pass keys to all and sundry?

Giving out your login is giving your access to the entire system to someone else - sensitive data, company records, the ability to delete important information, etc - it is no different than giving someone your key to the secure areas.

People do not generally give their keys to others as it could be disastrous, why should they give out their access to the computer system?

As far as signed agreements not to make personal emails or other things that are not "intuitive", fair enough.