office network monitoring question

[lmn85]

hey folks,

Pretty basic question here from someone who isn't all that techy:

I work for a small company. I exclusively use my personal computer (Macbook Pro) for all of my computing at work. When at the office, I connect to the internet via an open wireless network from a router that is plugged in via a CAT5 cable at a desk out in the common area of the office.

Is it possible for my internet usage to be traced/tracked while I'm on their network? I'm talking sites visited, google search queries, etc...?

The company runs it's own server located on site. According to the screen saver, it is running Windows Server 2003 R2.

No one in the office is particularly adept at IT, however the company has a 3rd party IT company which set everything up initially and handles all issues on an ongoing basis. There are 13-15 total users on the network


What do you guys think? Is it possible for my web usage to be tracked? And by the way, I'm asking if they can do it technically, not whether they can do it legally.

Thanks!

A bit more info:

In my specific case, I'm number 3 on the food chain at this company. I'm contemplating making some management decisions that will potentially put me at odds with one of the two owners. He is the type of guy who may use anything and everything as ammunition against me if he has the ability to do so. I need to know if there is any chance he could access and reliably track my web browsing history and/or google searches? This individual was formerly upper management at a Fortune 500 company and very much has a "big brother" attitude when it comes to employees as well as a reputation for being sly when it comes to office politics. Furthermore, this individual was responsible for contracting out the IT system and is the point of contact with the 3rd party IT management company.

 

[kbp]

Open wireless network as in no security log-in???

 

[Ghiedo27]

I think it's safe to say any regular web traffic could be snooped in on by anyone inside the range of open wireless, let alone someone with direct wired access between your laptop and the service provider. You could easily make a case for at least setting up WPA2 on the router.

Whether or not the co-owner paid the contract guys to implement some sort of tracking and single out your laptop somehow is another issue. That would take a bit more effort assuming you're using a best buy type router with the defaults.

 

[lmn85]

Yes, that is correct. there is no security login. The wireless router was brought to the office by an employee who hooked it up to the network cable at his desk. It was not part of the initial IT setup. It is not officially allowed, nor disallowed. I may be the only person who uses it, I don't really know. As I said, no one in the office is particularly IT-savy (myself included).

 

[Harvey]

The owner doesn't have to know much about IT. All he has to know is who to ask, and as you said, and the IT company he hired reports to him.

Assume your network usage can be tracked on the company's on site server, and act accordingly. Even then, given your relative position in the food chain and your acknowledged conflict with the owner, I don't like your chances of survival within the company if you can't work out your differences amicably.

 

[unokitty]

Two parts to your answer:

One
Can they technically monitor what you do on your computer?
Sure. Though, if you used tools like a MAC changer and a VPN, you could make it a bit of a challenge.

Even if you used those tools a technician with physical access to your computer could install a key logger that would show me exactly what and when you did anything.

Two
Can they legally monitor what you do on your computer?
It depends.
In part, it depends on the company policy. For example, if a company has a policy that states that company resources are to be used exclusively for company work and that employees should have no expectation of privacy and that company resources, including employees, can be monitored at any time, then it likely could be legally enforced.

On the other hand, absent a policy and a warning banner, some courts have ruled that employees can have an expectation of privacy.

It probably would be prudent to learn what the company policy states concerning connecting your computer to the company network. And if you anticipate trouble, it would be prudent to have another job arranged as well as to have local legal council on retainer.

A couple of things to remember.
I am not a lawyer. I am not giving legal advice.
Even if you are right legally, you may need to hire, and pay in advance, a lawyer to defend those rights.

Unless you already have your resume updated and have alternatives, it may not be prudent to get into a pissing contest with an owner of the company that employees you.

Best of luck,
Uno

 

[imagoon]

Can you be tracked? Absolutely. Someone with the know how and hardware could tell you the date and time to the millisecond when you clicked on google.com

Legal to track? Likely yes. Unless you own it, they could take the stance of a) used without permission b) opened a security hole [inadvertent attack etc] or c) "provided for business use only".

Very rarely will you get "expectation of privacy" in a business environment.

 

[JackMDS]

Allow an employee to put a Wireless Router as described (secure or not) is a stupidity No matter what.

Between us, as number 3 in the business you Not should allow this Wireless thing, and for sure Not use it yourself.

That said pertaining to you main issue. Since the Wireless Router is connected to the business server every thing that any one does can be followed and recorded.


😎

 

[lmn85]

Thank you everyone for the input, particularly in light of my lack of sophistication in this area.

I have a few points of clarification:

1.) I personally own the laptop I use at work. I paid for it, and it comes home with me every night. Tracking would have to occur only on the server side, I know there is no client side software on my notebook.

2.) how specifically could an individual track activity of a non-company owned laptop on a company network without Client side software.

3.). I can access the server if I want to, in fact, I'm nearly certain I've got the username/password for it written in a notebook in my desk already. Would there be a specific program to look for? Operating system on the network is Windows Server 2003.

If there are any IT professionals out there with specific knowledge in this area, I'd be interested in a more in-depth consultation with due consideration, Please send me a PM.

Thank you!

---

This post crosses the line. Members may not post to ask how to circumvent their employer's rights and/or the security of their employer's network.

Harvey
Senior AnandTech Moderator/Administrator