[Closed] My work emails are being CC to a secret email account without my knowledge?

blimey that seems a bit convoluted. Most email servers will just keep a copy of all traffic through them when configured right.

Why would they inform you - presumably everything you send is company business and therefore they have the right to know what it is?

I though spot checks were ok but not constant monitoring but I cannot remember the reason- some union type legislation course iirc

Is it just you or to everyone?

wwaswas - Member
blimey that seems a bit convoluted. Most email servers will just keep a copy of all traffic through them when configured right.

Why would they inform you - presumably everything you send is company business and therefore they have the right to know what it is?

this.

seems totally unnecessary, but completely within their rights. They own all your work emails, so the can do what they like with them.

Dave

Junkyard - Member

I though spot checks were ok but not constant monitoring but I cannot remember the reason- some union type legislation course iirc

Is it just you or to everyone?

I think it could be everyone, I only found out when all my outgoing ones bounced for some reason and noticed the extra cc email account in all my sent messages?

wwaswas - true, just wondering should we have been informed emails will or might be monitored, thats all?

If they are monitoring you, they have to inform you, however this is usually covered by some form of IT policy document that everyone signs when employed (and usually updated every few years.

You have a right to privacy, even when using a company email system, and they would legally have to justify reading your emails beyond "we wanted to see what he was doing".

However it would be an awkward legal battle to fight.

should all be set out in a policy somewhere: what is isn't acceptable, and the measures they take to monitor/enforce.

If it isn't, any action they do take as a consequence of their monitoring is highly unlikely to be enforceable. I would seek to clarify the policy post-haste if I were in your shoes.

Most places will actually permit a reasonable level of non-business related email traffic. Our place does (one of the 'big' IT services companies).

Any mildly intelligent governance is likely to have taken into account that complete prevention is not viable and a massive overhead, better to encourage sensible use by providing a good policy, and treating people like adults :

Ski - do you know they're reading them as you send them or just keeping copies in case there's specific queries/legal issues with clients later on?

i copy all my work emails to david.cameron@thehoosesofparlyment.gov.uk just to annoy him.

(its pretty normal for businesses to automatically keep a copy of all work emails, should be set out in a policy somewhere and you should've read all the policies and procedures like a good employee.)

If it isn't, any action they do take as a consequence of their monitoring is highly unlikely to be enforceable. I would seek to clarify the policy post-haste if I were in your shoes.

Will do, I have not seen anything yet in writing regarding their email monitoring/usage policy, its only a small firm and their contract of employment looked quite basic to say the least 😉

You need to start inviting this mysterious email account "holder" to meetings and sign them up for some porn 'n' shit

wwaswas - Member

Ski - do you know they're reading them as you send them or just keeping copies in case there's specific queries/legal issues with clients later on?

It looks like they are keeping copies of everything sent, my guess its been set up the same for everyones email account who works here too.

Just though, maybe I should fire off an email to this secret email account asking them what their policy is?

😉

Maybe they are just using it as a free email archiving solution.
How many people in the company? All that crap flying into one mailbox... Weird.

DezB - Member

Maybe they are just using it as a free email archiving solution.
How many people in the company? All that crap flying into one mailbox... Weird.

40 tops, I guess its been set up that way, so the boss can monitor it all from one account?

Has your company muted job losses? Cost-cutting etc?

The only reason why I could see a company doing that is if they are looking for reasons to get rid of (an) employee(s) on the cheap.

Either that or your employer (feels that they have)/has a genuine concern.

I'm a cynical paranoid type though.

[i]40 tops, I guess its been set up that way, so the boss can monitor it all from one account?[/i]

It would be a full time job to monitor all that. Hasn't the boss got anything else to do?
I suspect they are keeping it just in case its needed for some investigation.

hora - Member

Has your company muted job losses? Cost-cutting etc?

The only reason why I could see a company doing that is if they are looking for reasons to get rid of (an) employee(s) on the cheap.

Either that or your employer (feels that they have)/has a genuine concern.

I'm a cynical paranoid type though.

Yes Hora, had my one to one 'friendly' chat with the boss last week, letting me know cuts are planned if things dont pick up.

4 were made redundant last month, expecting another 4 to go next month too.

Its all getting a tad messy, nasty, the knife is well planted in my back 😉

Do you have a work Blackberry or other device? My work use a "work around" to make sure that inboxs are sync'd between devices, and are automatically cc'd to my Blackberry,

It maybe less scary than you thought?

ski. One tactic used to minimise any payout is a gross misconduct.

You probably don't but no personal emails from now on and all work emails are double-read!

In addition, is your internet usage monitored?

I'm hopefully WAAY off.

I have all the work emails I send bcc'd to myself so that the 'sent' box on both my pc's is in sync.

[i]In addition, is your internet usage monitored?[/i]

I suspect they are too stingy to invest in something so advanced.

hora - Member

ski. One tactic used to minimise any payout is a gross misconduct.

You probably don't but no personal emails from now on and all work emails are double-read!

Never had Hora, but thanks for the advice.

In addition, is your internet usage monitored?

I use my phone for this place, work web access use is only work related.

Got nothing to hide, but it does feel a bit big brother tbh.

I worked for an employer once (private sector) who took on a loads of temps all once. Then binned the ones they didn't like for misuse of the company (ancient, mainframe) email system. Give them some rope, etc.

Friend worked with a guy who had put in over 3 decades of service for their professional services employer. Said employer was looking to shed costs/the managers had to meet budget-cut targets. They found something in his work and used it to sack him for misconduct. Nice. Friend was next but she was very professional so they merely resorted to messing up all her paperwork, scattering it around etc. This was the last straw and she left. I too was once heaved out for something an Administrator had done because the MD didn't like me.

True story. Two people caught at a company I used to work for, for internet abuse. One owned up, sacked. The other said "it wasn't me, I must have left my computer unlocked when I went home, very sorry" got a disciplinary.

You can work out for yourselves what the moral of that story is...

I hope no-one actually thought their company provided email was private. It's standard practice to monitor this stuff, they will probably never read it, but they need to be able to get at it should the need arise.

i'd ask if you are concerned but i suspect its an archive - more amd more companies are being asked to produce email correspondence and in some countries it has to be retained by law

i've been in contract disputes that have hinged on email correspondence between long moved on employees in both party companies and maintaining backed up archives makes a lot of sense when one party produces a printed out email but none of the responses or background and caveats

edit ...and if you're sending stuff you wouldn't want your employer to read, then whose problem is that?

It's an odd approach but I suspect all work email is monitored to some extent these days - all ours for example would be stored on a central mail server, so someone being able to audit it would be no great surprise.

Like you said, if you have no guilty conscience then there is nowt to worry about, but yeah you should have had to sign up in agreement with the IT policy.

If they are monitoring you, they have to inform you, however this is usually covered by some form of IT policy document that everyone signs when employed (and usually updated every few years.

This. Companies can read your email and monitor your web usage, but they [i]must [/i] tell you they're doing it, it's a legal requirement. Contrary to what others have suggested, they cannot do what they like with your emails.

As above, it seems an odd way of doing things but any reasonable sized company will always place a statement about allowing you to be monitored. Most will put it in computer misuse or email and internet policy. Chances are you'll have signed or accepted it with a click without reading it properly, most people do.

We present ours to our staff on a monthly basis when they access the internet. There's a brief paragraph and a link to the full policy. None of them read it, they see it every month so click it quickly so they can get to manunited.com or something as fast as possible.

The first thing virtually everybody says when they get pulled up in an investigation is 'you never told me you were monitoring me' or something similar because that what some dickhead down the pub has told them to say. As soon as we point out where we told them this they generally go a lot quieter.

I've not heard the 'someone else must have been using my computer' defense for a while though. But that's because we also have a policy around that too. 😉

I've not heard the 'someone else must have been using my computer' defense for a while though. But that's because we also have a policy around that too

i've worked with several companies where failing to log out was a disciplinary offence for exactly that reason

a quick acid test for the mean spirited boss it to ask the employees to print off their internet favourites and tally up the work related ones and the non-work related - once did this with a sales team whose resource consumption always went sky high when any major sporting event was on - it was a discussion that went along the lines of either you do it - think about and then do the right thing or i get the IT Manager to do it and give me answers

I would talk to your IT team as this reminds me of a case that I remember as I used to work with the guy...
http://www.networkworld.com/news/2009/051409-amx-email-espionage.html
Basically he got into an ex-employees email server and arranged for all emails to be cc'd to his email account, he was with a rival company at the time.
I presume you know the address of the cc'd emails?

I've not heard the 'someone else must have been using my computer' defense for a while though.

It's still their fault, is why. Either they've done it, or they've not taken adequate steps to protect their login. They're accountable regardless of whether they did the deed personally or not.

I worked for an employer once (private sector) who took on a loads of temps all once. Then binned the ones they didn't like for misuse of the company (ancient, mainframe) email system. Give them some rope, etc.

Anyone know how to check if this is happening to their emails, as I now want to see if mine are being looked at like this??

I guess ski sent to a non-existent address and got a bounce back. Try that?

not sure you can see a BCC or what would be the point

OP: [i]I only found out when all my outgoing ones bounced for some reason and noticed the extra cc email account in all my sent messages?[/i]

Surely a more reasonable explanation is that all bounced emails get automatically CCed to an administrator email alias, so the sysadmins can see when there might be potential issues?

Edit: Or is the OP saying that every email he/she sends is CCed to some other alias too?

Have you considered reporting it?

Could be that it's not sanctioned / official, but something someone's doing for self-serving purposes. It's a -very- weird way of monitoring / archiving emails, which makes me question its validity. Either that or your IT bod is a loony.

Anyone know how to check if this is happening to their emails, as I now want to see if mine are being looked at like this??

There's no way you can readily check. Even if you could reliably test for the situation the OP describes, there's a dozen other (better) ways of storing email. Without direct access to the mail server it's impossible to tell who's doing what, and even then there could be other things upstream; your mail could be filtered by a third party before it hits your server and / or after it leaves, for a number of reasons.

If you're concerned, your best course of action is probably just to ask your employer. Remember, they are legally obliged to tell you if they're accessing your email or monitoring your internet usage, so even if they tell you they don't and are lying that means they subsequently can't use it against you without breaking the law.