evilrouters.net

There was a recent thread on Slashdot about workplace monitoring (sorry, can’t find it now). The timing was quite a coincidence, as this topic had just come up (sorta) at my workplace.

I work at an educational institution, and while I don’t specifically sit and watch for certain traffic (unless I have a good reason, of course), I do have automated tools that detect and alert me to certain things. One thing that’s picked up is peer-to-peer file-sharing traffic. I’m not going to say I’m for or against the whole file-sharing stuff — my opinion is really irrelevant. The point is, on our school’s computer, it’s forbidden.

So, a few weeks ago, I’m at home, dialed in over a blazing fast 28.8kbps modem connection (this was before SBC got my DSL hooked up). I’m checking up on stuff and notice (at about 6:45pm), some BitTorrent traffic on the network — big no-no. I did a few things to see where it was coming from and then looked up the extension of the phone in that classroom. It just so happened that our webmaster guy is the one who was teaching the class in there this evening. I rang him up in the classroom and told him that I was at home checking on things and would he please let his students know that running BT on the school network could get them into major trouble. He said he would and we hung up.

Apparently, this prompted a discussion of BitTorrent and P2P stuff, in general. The student in question (who I identified the next day and e-mailed) apparently stopped by our Help Desk after class and was asking questions of Chris, the guy who was manning the office that night. He was curious how I could see what he was doing, even when I was at home. Chris apparently gave him the “we can see everything you do” spell, but that left him unsatisfied.

I sent him an e-mail the next day explaining why we forbid the use of P2P software, how it’s detected, and reminding him that when he signed the paper stating that he’d read and agreed to the stuff in the Student Handbook, he acknowledged that “administration” (i.e. me) had the ability to monitor all Internet traffic.

It got me thinking that most employees probably aren’t aware that this stuff is even possible. There are roughly 125 full-time employees in my building and, due to our close work with all other departments, most of them know that this is possible and that it is being done. I’m guessing that most other workplaces, however, don’t even notify their employees that they can do it (it’s not required, AFAIK), or that they are doing it.