Monday, October 29, 2012

Privacy's Double-edged Sword - Protecting Good and Bad Guys

In our 'always on and connected world' there is certainly enough evidence of how the respect of privacy is a good thing. There are enough of my peers in the privacy space who have taken it as their God-given duty to protect us from ourselves, as if God spoke to them like He did to Abraham.Yet the tendency towards paternalism aside, and as much as the cry for more privacy protects us good citizens, it also  protects some bad guys as well.

In a the recent decision from Canada, the Supreme Court of Canada  indicated that employees may have a reasonable expectation of privacy for information that may reside on work-issued computers, at least where personal use is either permitted or reasonably expected. Sounds simple enough. But here is the nuance.

A high school teacher had a school-issued laptop in his possession that he was permitted to use the for incidental personal purposes as well . As a system administrator, he was also able and responsible for policing student use of their school-issued laptops, and could therefore access hard drives of student laptops.

The school had a robust Acceptable Use policy that stated, among other things, incidental personal use of laptop was allowed; teachers’ email correspondence was private, subject to certain conditions; all data and messages generated or handled by school hardware were the property of the school, and, finally, that users should not expect privacy in their files.

While an IT staff member was performing some routine maintenance on the teacher's machine, he found a folder on the laptop that contained nude and partially nude photographs of a female student . The technician told the school principal and the photographs were copied to a CD. The principal seized the laptop, and turned both the laptop and the CD over to the police. The teacher was then subsequently charged with possession of child pornography and unauthorized use of a computer.

The reason the Supreme Court interceded is because the police who reviewed the laptop, did so without a proper search warrant. They ruled that the teacher did have a reasonable expectation of privacy in his use of the laptop, as the school policy indicated that users were allowed some incidental use of the machine.

Though the Court did not rule specifically on the issue of how and if employers can monitor their employees and employees use of company or school owned equipment, the matter does highlight that the umbrella of privacy does protect both good guys and the bad guys from the same rainstorm. Though the teacher's behavior and activities indicate some deplorable and nefarious activities that are wholly inexcusable in any context, one must also recall that Lady Justice is most often depicted with a set of scales suspended from one hand, upon which she measures the strengths of a case's support and opposition. If you look closely, you will also notice that she is also often seen carrying a double-edged sword in her other hand, symbolizing the power of Reason and Justice, which may be wielded either for or against any party. Good or bad.