32

The macbook was lent to me by the employer himself. And I encrypt my macbook. Can my employer force me to unlock the laptop any case.

Jurisdiction: New Delhi, India

In case that they can force me to unlock, Can I wipe the hard disk before handing over the laptop?

  • 59
    It was given as in "to work on project XYZ, you need macbook, so here, take this one" or it was given as in "your work on project XYZ was exceptional and we would like to reward you with this macbook"? In first case, it was never yours to begin with. – Mirek Długosz Dec 7 '17 at 11:47
  • 12
    You'd need to add a jurisdiction at the least, but if your company actually asked (and this isn't a hypothetical) you need to ask a lawyer, not us. – Erik Dec 7 '17 at 12:23
  • 4
    Is it a work computer or a gift for your own use ? – Max Dec 7 '17 at 14:22
  • 9
    Why are you opposed to opening it? – David K Dec 7 '17 at 14:43
  • 28
    Surely they can just enter root for the username and nothing for the password themselves? 🛎 – Paul D. Waite Dec 7 '17 at 17:09
95

Yes they can.

You have made the classic misunderstanding - it's not your Macbook, it's your employer's Macbook which they have assigned to you to use. It remains however their property.

The finer details of what the company can access on a device they have assigned for your work use depend upon the legal jurisdiction this is taking place in, and what data they are trying to access.

India

You have very little protection in India, while it is "recommended" that employers obtain employees consent for monitoring of their electronic conduct, it is not mandatory and Indian law does not otherwise protect employees’ rights to privacy with regard to electronic device usage. If the device belongs to the company then they have the absolute right to access the device under Indian law. (Accessing any of your personal social media or email accounts is a murky area in Indian Law but there's some cyberstalking provisions that would probably make it illegal, IANL though!)

US

In the US if the password is preventing access to the entire system (such as a BIOS password or disk encryption) then they can require you to give up access to it. In extreme cases you can even go to jail if you don't!

As regards protection of your personal files and data on a work device it largely depends upon what their policies say so you need to start reading that fine print ASAP, generally if they have reasonable cause to suspect some violation of policy or duties or other misconduct then they can access your computer to investigate and this trumps your Reasonable Expectation of Privacy - see Leventhal v. Knapek (consenting to the employer monitoring or accessing your data doesn't remove the Reasonable Expectation of Privacy from a Fourth Amendment perspective but that only protects against the government looking at it sans warrant and prevents the company consenting to the same on your behalf see US v. Ziegler)

EU

You are somewhat more protected in the EU - individual files/emails etc on work devices have a limited amount of protection via Article 8 of the Human Rights Act ("Right to respect for private and family life") - this means that if something is of an evidently personal nature then it can only be accessed by the company if there is a legitimate business need for them to do so and this access is limited to the minimum number of personnel necessary to fulfill this need. The fact that the company may monitor or access personal communications or files also needs to be made known in advance to the employee (IT policies, employee handbook etc.)

This protection only applies to things that are "evidently personal in nature" though - if there is company data on your Macbook (or the company could reasonably believe that there is company data on there) and we're talking about a full disk encryption scenario then they can absolutely require you to give up the password. If, once decrypted they see a folder called "Personal Files" (for example) then they wouldn't be allowed to access that folder without satisfying the "business need" and prior notification requirements etc mentioned above.

This is where the legal minefield that Lillienthal mentions in the comments below comes in and each individual case and it's circumstances would be considered on it's own merits by the courts.

As an example in 2007 a Romanian man was suspected of sending personal communications on a work device during work hours. The company read his yahoo messages and saw evidence of him doing just that and fired him. It went to court and in January 2016 the European Court of Human Rights (ECHR) ruled in favor of the company, as the judge in that case put it:

"not unreasonable that an employer would want to verify that employees were completing their professional tasks during working hours"

This ruling was subsequently reversed by the Grand Chamber of the ECHR earlier this year, not because the company wasn't allowed to read the personal information but rather that they had intruded further into the man's personal life than was necessary to satisfy their business need and that they had failed to notify him in advance that his communications may be monitored. Basically they had failed to correctly follow procedure.

TL;DR - Depending on where you are access to personal files and data may be protected, access to the entire computer is not.

  • 5
    This is a very common misconception and I don't where why people think that. I would also advise OP to check the policy around the computer use before installing their own encryption. There may be a policy that forbids it! From my own experience, there is usually some clause that states everything on the computer belongs to the company. So don't put anything on there you wouldn't want them to have. – SaggingRufus Dec 7 '17 at 11:41
  • @Lilienthal Can you give an example where this wouldn't be the case? I'd guess it would be somewhere in Europe, since they usually have stronger privacy laws. – David K Dec 7 '17 at 12:44
  • 30
    @DavidK The EU indeed has much stricter DPR and privacy laws. For example, even if a PC or email account belongs to the employer, they (can) contain private and personal information belonging to the employee. I know that in several EU countries employers are not allowed to reuse or access such mail accounts even if they only should have been used for business purposes. By the same token laptops are often legally considered to be protected and can't just be accessed on a whim. It's not a gray area: it's a very, very fractured black-and-white hellscape and navigating it takes a team of lawyers. – Lilienthal Dec 7 '17 at 12:53
  • 1
    @Lilienthal: I think you might have been looking for the term “chisel of lawyers”. ;-] – David Foerster Dec 7 '17 at 19:48
  • 1
    @mr.eightnoteight whether you can wipe the drive instead is going to depend very much on what the data is that's on there and the legalities regarding your employer accessing that data - if there is anything on there that they would be considered to "own" I suspect you'd be on highly dodgy ground but this aspect is really one for a lawyer to answer – motosubatsu Dec 8 '17 at 9:22
0

"My work supplied MacBook" is actually their work-supplied MacBook. It is not yours. But this all depends on the situation, and what you mean by "force". They can't hold a gun to your head. They may be legally allowed to tell you "remove the encryption or collect your papers".

If you leave the company and refuse to remove the encryption from the laptop, so your successor cannot use it, then the company will likely ask you to pay for the computer.

It's a works computer. There should be no private information on it. Many people have private information on their computer, in that case the second rule is that there should be no private information that you don't mind your boss to see. So everything on your computer should be company property, with the exception of private things that are harmless.

If you wipe the computer before you turn off encryption, and that destroys work that the company paid you to do, and that paid for work is now gone, I'd fully expect them to sue you for the damages, so don't do that. And if the company suspects you of wrongdoing and wants to check your computer for evidence, then wiping your computer tells them that the evidence was there and you destroy it, and you'll likely be fired. Here's an extreme case: You are suspected of defrauding your company, so they want to know the contents of your laptop. You delete everything. They fire you and sue you for damages for the suspected fraud. Any court will assume that deleting everything implies that there must have been evidence against you on the laptop, and will judge against you.

If the employer wants their laptop back to hand it to someone else, which is entirely their right, and there is no suggestion of wrongdoing or suspicion, I would strongly recommend to delete anything private that you don't want them to see, and then remove decryption. And don't delete anything without consulting a lawyer, or when ordered by the company.

  • wiping your computer tells them that the evidence was there and you destroy it - Citation Needed – IDrinkandIKnowThings Dec 13 '17 at 21:19

Not the answer you're looking for? Browse other questions tagged or ask your own question.