The latest NSA leak is a reminder that your bosses can see your every move – Washington Post

The Washington Post's Devlin Barrett explains how an arrest of a government contractor was made so quickly in the NSA document leak to The Intercept. (Whitney Leaming/The Washington Post)

It took just days forauthorities to arrest and charge a federal contractorwithleaking classified intelligence to the media. Court documents explain in detail how the 25-year-old woman suspected in the leak,Reality Leigh Winner, allegedly printed off a copy of a National Security Agency report on Russian tampering in the U.S. elections and mailed it to a news outlet.

What helped federal authorities link Winner to the leak were unrelated personal emails she had sent to the Intercept news site weeks before, which surfaced when investigators searched her computer. But how were officials able to gain access to her personal accounts? The answer, according to some former NSA analysts, is that the agency routinely monitors many of its employees' computer activity.

The case offers a reminder that virtually every American worker in today's economy can be tracked and reported and you don't even have to be the NSA to pull it off.

[What we know about Reality Winner, the contractor accused of leaking an NSA document]

She emailed the Intercept using her work computer, said Michelle Richardson, a privacy expert at the Center for Democracy and Technology, a Washington think tank. They can monitor the traffic on their systems, look at thesix people who printed the doc, and see that she was the one who had contact.

The NSA didn't immediately respond to a request for comment.

Employee monitoring issoextensive in American society that it may be difficult for workers to know just how far they might have to go to avoid it.Itis a $200 million-a-year industry, according toa study last year by 451 Research, a technology research firm, and is estimated to be worth $500 million by 2020.

[How Congress dismantled federal Internet privacy rules]

Monitoringtechniques have become quite sophisticated, enabling employers to track notonly what websitestheir workers visit, but also when they plug in USB storage devices, move or copy files, and what programs theyrun, privacyexperts say. One companyevenallows bosses to play back videos of what took place on a user's screen and can collect communications activity both on traditional email programs as well as popular webmail services.

Employee monitoringrecently came tolight in ahigh-profile lawsuit involving Uber and Waymo, the self-driving car company owned by Google's parent firm, Alphabet. In accusing former Waymo employee Anthony Levandowski of stealing trade secrets and taking them to Uber, Waymo said it was able to determine that Levandowski installed inappropriate software on his company-issued laptop, then downloaded thousands of confidential files before putting them on an external storage device he connected to the machine.

[Supreme Court to decide if a warrant is needed to track a suspect through cellphone records]

Despite Levandowski's attempt to then erase forensic fingerprints by reformatting the laptop's hard drive, Waymo said, the company was nonetheless able to gather the requisite evidence likely using monitoring technology, analysts said.

Even workers who don't report to an office every day are subject to monitoring. The proliferation of GPS devices in smartphones now means that even truck drivers can be tracked. Arecent report from the technology research firm Aberdeen Group found that nearly two-thirds of companies with employees who work in the field were tracking their employees with GPS.

The earliest forms of modern employee monitoring date to the early 1910s, when companies would use mechanical counters to track how quickly workers were typing on their typewriters, according to Jitendra Mishra and Suzanne M. Crampton, who co-wrote a study in 1998 on the topic.Theynotedthatwhat has changed in more recent years is the method of supervision and the extent of information gathering capabilities available. That includes phone and video surveillance, keystroke logging and other forms of monitoring.

[Booz Allen Hamilton employee left sensitive passwords unprotected online]

Since then, numerous court cases have givenemployers a remarkable amount of freedom towatch their workers. In 2010, the Supreme Court heard a case involving two police officers who had been punished at work after it was discovered that they had used their mobile devices to send personal text messages. The officers argued that the police department's search of their devices was unconstitutional under the Fourth Amendment, but the court unanimously ruled against them, saying it was a reasonable search and that the officers should have known that their work devices might be inspected.

Privacy advocates have been pushing for years to have Congress review various communications privacy laws in light of updates to technology. Many argue that the 1986 Electronic Communications Privacy Act does not provide enough protections to consumers today because many emails, text messages and other content can be summoned by law enforcement with little more than a subpoena.

ECPA was first passed in 1986 before Congress could imagine the wealth of personal information that would be stored on third-party servers rather than private hard drives, the Electronic Frontier Foundation, a technology advocacy group, has said.

Congresstook a step toward updating the country's digital privacy laws in February, when the Housevoted to approve the Email Privacy Act. While the bill has largely stalled, it proposes requiring a warrant for searching emails that have been sitting in an account for more than 180 days.

Still, given the other case law surrounding employee surveillance, it's important to note that changes to the ECPA mightnot putan end to routine employer monitoring. Soyou might still want to be careful with what you do on your devices at work.

Excerpt from:
The latest NSA leak is a reminder that your bosses can see your every move - Washington Post