I was asked by a client what my thoughts where on monitoring email usage of their employees, and I thought this would be a great topic for a web log entry.  It seems that the issue of privacy is a wide and varied subject. Privacy is also the subject of many cases against companies with mixed results on which way the cases go.  I’d like to discuss the need for monitoring in the workplace, and what steps can be taken to protect your personal privacy and your business.

Monitoring Internet and Email Usage

Personal privacy in the workplace has come under scrutiny over the years. Even before the Internet proliferated into the lives of everyone on earth, businesses have had to deal with privacy issues of a verity of situations.  From the ability of companies to search lockers used by their employees to random drug testing performed to ensure compliance to company policies, businesses have being dealing with privacy for a long time.

As we grow into the new era of information technology, today, employees' privacy lawsuits often involve employer monitoring of email and the Internet.  You would think that if you had a personal password and protected your inbox and outbox as well as other information that you would have an expectation of privacy.  No you don’t.  The information in any communication that occurs on the company network can be captured and reviewed.  The problem of proving invasion of privacy is the unfamiliarity of communication technology and how information is passed from one point to another. 

When you send an email from a company computer, your email program sends it to the company mail server.  Your email is stored not only in your sent items folder, but on the server as well and a copy of it is sent to the email server of who you sent the email to.  At any time the server or network administrator can review that email.

So then it seems that a big question comes up and needs answering. The question is why do businesses need to monitor Internet and email usage?  There are some very good technical reasons as well as social reasons for why businesses need to monitor the traffic on their network.

In today’s age where a virus can send a mass of emails from your computer, one defense is to use special software that is installed on the server to find this type of behavior and put a stop to by letting a technician know to check your computer. It is very unusual for a person to be able to send 100 emails in a minute. Also industrial espionage can be detected to prevent company secrets from being leaked out through the very network of communication that the company owns.  Social reasons include putting a stop to sexual harassment, death threats, defamatory, degrading, and communications that create hostile working conditions by employees, also industrial espionage can be detected to prevent company secrets from being leaked out through the very network of communication that the company owns.

What can a Business do to protect itself?

While there is no 100% method to protect a business from lawsuits, the following suggestions can be a great help in preventing or winning any litigation against the firm involving privacy concerns.

Include email and Internet monitoring with other policies. Having an email and Internet usage policy may not be enough.  Integrate the policies with the company’s harassment and non-discrimination policies.  Showing that all communications on business equipment, electronic or otherwise, are treated as business communications and may be monitored will protect the company from some litigation. Also state that any communication in violation of company policy is explicitly prohibited.

Limit use of business equipment to business purposes.  Explicitly state that use of company equipment for personal communication is subject to monitoring and, if necessary, disciplinary action.  You can forgive the occasional “I’ll be late coming home tonight”, or “what do you want from the store”, but let them know that it shouldn’t be used excessively for personal use.

Reserve right to review and monitor.  Notify all employees as soon as policy is in effect or when hired that the employer will treat all messages sent, received, or stored by business equipment will be considered business messages, which the company has the right to review and disclose.  Any incidental use of any communication system owned by the company for personal use will be treated no differently from other communications on company owned equipment.  Explicitly state that any communication that an employee wishes to keep private should not be done on company equipment.

Include notice and content clauses.  Since an employment agreement is made via contract, include in the policy a clause that states that the employee is aware of and agrees to any monitoring of communications conducted on business equipment.  This acknowledges that they understand the policy and intends to comply.  It’s their fault if they sign a contract without reading it and not understanding the company policy.

Define appropriate Internet use. A business provides Internet access and communication equipment for use by the employees, the business can define appropriate guidelines regarding its use.  Incorporate penalties for specific violations and communicate them to the employees, and enforce them consistently.

What can an employee do to protect their privacy?

While any communications technology can be monitored in some way, the following suggestions will at least keep the honest people honest and may keep you out of the hot seat with your employer.

Use personal equipment for personal communications.  This may not be a viable option depending on the company you work for and the industry you work in.  I imagine working for a government entity or a company with government contracts may not allow personal cell phones or laptops.  I’m certain that emails of “I miss you honey” and “I made it safely to the hotel” is forgivable and would not garner any disciplinary action.  Use of a personal cell phone shouldn’t be a problem with many employers, unless used excessively, but you are paying for the service on that phone so they can’t get ay anything on it.

Don’t use business equipment for anything you want to keep private.  If your business is footing the bill for equipment you use, that equipment may need to be turned in for service.  If you need to keep things private bring your own if you can.  A laptop provided by the company may need service some day. Do you really want someone looking at all the photos you have of yourself or your kids?  If you have inappropriate content on that laptop they may find it and take disciplinary action which they have the right to do.

There is no anonymity.  Everything on a computer is traceable unless you have skills to hide your tracks or have someone else’s login information, if you do something they can trace it.  It’s not just email, they can track websites that employees visit, log what you type on your keyboard even if you erase the document that you typed it in. Instant messengers have become popular and you’d think that it would be private, but they can monitor conversations on all the popular IM networks.