Email Abuse

[poorsapper]

First of all i work in a hospital and with the new government HIPAA standards we have to keep a close look at security. We have a user that we suspect is sending confedential information out and also abusing the system. i have message tracking in the IMC. I am seeing the logs that the server is keeping but when i go to the tracking and start searching for what the user has sent there is nothing there. i test other accounts including my own to see if it is working and it isnt. i have been keeping these logs for about a week now. I have all the email that she is getting go to her account and another account that i have made. but i cant find out how to get all the email that she is sending. This is very important that we get this information so that if the government fines us for it then i wont get my butt in trouble. Thanks any help that is givin.

Jim

 

[covski]

The government stipulate you CAN NOT read users email. There was a grey area saying that you could get away with it if you let them know, but this loop has now been closed.

 

[Grenage]

covski,

Are you sure about that? It would make absolutely no sense that a company was not allowed to read emails coming from it's own computers.

I was always under the impression that as long as the employee had signed a document detailing that their emails could be read if desired, it was fine. Do you have a link to any documents refering to this?

 

[covski]

I did the FAST certification recently, I'm confident that you can not read there email no matter what they have signed.

 

[Grenage]

Isn't FAST only concerned with Software Piracy ?

 

[poorsapper]

Well i have found out that i can. ALL Employees that come into this hospital sign a agreement that at anytime we have the right to see any and all data coming in, going out, and going across our network, which was reviewed by a team of lawyers the hospital has to ensure we was in our rights to protect ourselves. So with that out of the way is there a way to do it with 5.5 or 2000 or even 2003 if the need be. Or maybe there is a third party software that we can use to do it.

 

[Grenage]

Thats what I thought.

It sounds like you need something along the lines of message journaling. This allows you to place a copy of all outgoing (or/and incoming) mail to a mailbox of your choice.

 

[covski]

Guys,

FAST are the Federation Against Software Theft. They deal with all aspects of law surrounding pretty much everything that can be done with a computer.

A few months ago I spent a couple of days at the law society in Holborn on one of their certification courses. During which we were lectured by actual lawyers who told us in no uncertain terms that you CAN NOT read personal mail no matter what may or may not be in the contract pertaining to email usage.

I really advise that you check up on this before you read someones email.

 

[Grenage]

I cannot believe this can be, that would be a most rediculous law.

 

[akonwar]

I have done it using message journaling though for test purpose only. It was long time back so fogot the registry key.It involves setting a registry key. Try searching the web for message journaling

 

[fuego007]

First of all, the federal courts have ruled that e-mail sent on a corporate network belongs to the company, not the sender. You certainly can open and monitor mail from any user on the system, but you should have a signed from a corporate officer before doing so.

If you set the diagnostics logging setting for Message Archival in the IMC properties to medium, a copy will be kept of all incoming and outgoing SMTP messages. Be careful with this, as it could cause your hard drive to fill up fast.

You would have to then go through each message to find what you are looking for, but this may work for you.

Bob

By the way, listen to YOUR lawyers, not what someone says a lawyer told them. Always get legal advice first hand!

 

[TravTrav]

Covski,
I am not sure about strictly government computers, but I am in the military, and our users have to sign a government authorized form that says they will not use the email system for personal use, and I have seen email used as evidence in court martials for troops that were having affairs and stuff like that. The government falls under a little different rules then people at hotmail or excite.