Does a company have the right to perform MITM SSL stripping attack on their employees?
<p>Does a company have the right to sniff all the traffic on their network irrespective of whether it contains personal data of employees if they show a warning message which states "...are subject to having their activities on the system intercepted, monitored and recorded."</p>

<ol>
<li>Does US law states anything about this?  </li>
<li>Does company policy enforcement with such a warning override the right to not be subject to surveillance?</li>
</ol>

<p>IANAL, and as @GeorgeBailey suggests, you should ask one.  That said, some aspects of your question are directly addressable with what we know.</p>

<blockquote>
  <p>Does US law states anything about this?</p>
</blockquote>

<p>Yes. Federally this falls under the Wiretap Act, 18 U.S.C. §2511.  Workplace monitoring generally falls under either the "System Administrator Exception" or under Consent.  In general, continuing past a banner constitutes consent.</p>

<blockquote>
  <p>Does company policy enforcement with such a warning over ride the
  right to not be subject to surveillance?</p>
</blockquote>

<p>In general, yes.  You don't need to use the companies network if you don't want to consent - and they don't need to hire you if you don't want to use their network.  But it's their network, and their rules apply.</p>

<p>There are some nuances, and courts have found that the wording of the notice has made a difference in some cases, but overall, if the systems are properly posted with banners, then the employer may capture communications.  See the "Bannering and Consent" section of <a href="http://www.cybertelecom.org/security/ecpaexception.htm" rel="nofollow noreferrer">this article from cybertelecom.org</a>, e.g.:</p>

<blockquote>
  <p>Even if no clicking is required, a user who sees the banner before
  logging on to the network has received notice of the monitoring. By
  using the network in light of the notice, the user impliedly consents
  to monitoring pursuant to 18 U.S.C. § 2511(2)(c)-(d).</p>
</blockquote>

<p>Note that <em>stored data</em> is covered by different laws than <em>communications</em>.  It's a nuance.</p>

<blockquote>
  <p>Is it ethical to sniff all the data without giving any other warning than the logon banner?</p>
</blockquote>

<p>"Ethical" is a very different question than "Legal", and largely more subjective.  Most employers require signed consent for monitoring as a condition of employment, and use banners thereafter.  That is ethical by my definition, in that it meets or exceeds the requirements of the law, and does not mislead or use subterfuge.  The tone of your question suggests you find it distasteful, and therefore probably it violates your personal code of ethics.</p>

privacy