The insider threat and employee privacy: An overview of recent case law

Abstract

The detection of insider threats is one area of ongoing work at the CERT® Insider Threat Center. This paper addresses the legal landscape surrounding employee privacy in the workplace. While this broad area implicates many different types of law, this paper focuses on some current issues that employers may want to be aware of when implementing policies and practices to mitigate the insider threat, including monitoring of current employees. Electronic, physical and other methods of monitoring are discussed, which can reveal insider threat indicators. Relevant federal and state laws are also discussed.11Although the objective of this paper is to provide an overview of recent legal challenges in this area, it should not be used as a substitute for the advice of a licensed legal profession. Neither Carnegie Mellon University nor the Software Engineering Institute offer legal advice. The materials presented in this article are provided for informational purposes only. These materials are not offered as and do not constitute legal advice or legal opinions. The transmission or receipt of this article does not constitute or create an attorney-client relationship between the sender and the receiver. This article should not be used as a substitute for the advice of a licensed legal professional. ® CERT® is a registered mark owned by Carnegie Mellon University.