The news reports I read indicated that Wal-Mart's legal team had not signed off on the telephone monitoring. If so, this is an error in process which led to inappropriate monitoring of conversations. Note, however, that Wal-Mart notifies employees in no uncertain terms that it has the ability to monitor telephone and computer traffic. In my opinion, employees should expect it. But in this case, it is apparent that the process for authorizing telephone monitoring may not have been followed.

The second issue is related to the monitoring of wireless traffic. Again, this seems to be related to issues in process/oversight. The reports speak of the monitoring of pages and text messages; I believe that these are most likely blanket terms being used to refer to 802.1x and Bluetooth protocols. If the "systems technician" also engages in penetration testing for the company, he/she would have the tools to intercept this type of traffic.

Just because the tools can be used appropriately in one context does not automatically mean that they should be used in other contexts (i.e. corporate investigations). In this case, it appears that non-employee traffic was intercepted as a result of using these tools. Frankly, in an open area, this would be difficult (if not impossible) to prevent. There should have been processes and procedures in place to address this scenario (for example, purging the data immediately; ceasing the monitoring activity immediately; etc.).

This incident is a good illustration of why some companies conduct routine background checks and audits of their security personnel. "Old school" security concepts such as separation of duties and job rotation are proven and effective ways of helping to prevent these types of situations. Further, security professionals should receive copious training (formal or informal) related to ethical and legal issues which may arise in the course of one's employment.

(Please note: by raising the issue of specific preventative measures, I am not implying that Wal-Mart did not have preventative measures in place. They may have. Another reality that we have to face here is that situations such as these can spin out of control very quickly. There is no substitute for sound judgment and good decision making skills.)