When Vidmar Motor Co., a car dealership in Pueblo, Colo., was hit by the Sircam virus last year, IT director Shawn Vidmar found an unpleasant surprise as she inoculated the company's computers.

"I started looking at cookies on people's computers and some of the E-mail 'sent' files, and I realized how much misuse was happening," including off-color jokes that could be construed as sexual harassment, Vidmar says. She also noticed a direct correlation between people who had been complaining about not having enough time to do their jobs and the number of cookies they had in their temp files. That was more than enough to prompt her to monitor employees' Web and E-mail use. "I'd been meaning to do it, but it hadn't been at the top of my mind," she says. "This brought it to the top."

Vidmar has plenty of company. More than half of large companies, 38% of midsize companies, and 20% of small companies use software for surveillance of employee Web use, according to a recent survey by InformationWeek Research. Businesses monitor E-mail, Web surfing, and, increasingly, instant messaging. Some are even letting employees watch how they're being monitored -- in effect, letting workers police themselves.

More companies are keeping an eye on employees' technology use

It's part of a growing trend. The market for Web-monitoring products will reach $250 million this year, up from $180 million last year, research firm Giga Information Group says, while the market for E-mail-monitoring products will hit $165 million, up from $110 million last year.

Some 52% of large companies, 40% of midsize companies, and 29% of small companies say they're monitoring to prevent inappropriate use. "My big fear was that someone would take offense at something that an employee had sent and sue," Vidmar says. "I didn't want to lose a company my grandfather had built since 1947 to an errant E-mail."

That's not the only concern. The desire to boost productivity and keep confidential information secure are compelling businesses to take a closer look at the way employees use technology. Still, some businesses don't monitor workers' use of technology. Sometimes, companies assume that there isn't a problem, but they're often surprised by the degree of employee misuse when they finally use monitoring software, says Gartner analyst Bill Gassman. Many companies, especially smaller ones, would rather not spend money on monitoring unless they have reason to suspect significant abuse, he says.

Instant messaging is one technology prompting increased monitoring as its use in the workplace grows. IM use in U.S. companies grew from 2.3 billion minutes in September 2000 to 4.9 billion minutes last September, according to research by ComScore Media Metrix. "There's still concern that it's a largely unmonitored channel," says Jonathan Penn, a Giga analyst.

There are products available to monitor instant messaging, such as Raytheon Co.'s Silent Runner and Policy Central by Security Software Systems Inc., which is used by U.S. Steel Corp. But businesses that use those products, particularly large companies, are reluctant to discuss how they're monitoring instant messaging.

The National Football League's Houston Texans use Vericept Corp.'s content-management software to monitor all network activity, including IM. Director of IT Nick Ignatiev uses it to make sure confidential data about the expansion team's plays and strategy isn't leaking outside the organization. "I don't care if people are exchanging recipes," he says. The software is programmed only to look for specific keywords. "I don't think the Internet should be censored as much as some people want it to be," he adds.

Gartner's Gassman agrees. "The risk reduction has to be balanced with a Gestapo-like mentality that reduces trust between employers and employees and can reduce productivity," he says.

Still, the risk of exposing confidential information rises as employees communicate electronically. "Companies are very concerned about proprietary information going out by mistake," says Susan Getgood, VP of marketing for SurfControl plc, which makes Web- and E-mail filtering software.

That's why the company has added a virtual learning agent to its E-mail filter. It's designed to learn what companies' proprietary information looks like and then prevent it from being E-mailed outside the firewall. "That way, financial statements won't get inadvertently mailed to analysts the week before an earnings announcement," she says.

As companies continue to tighten their belts and do more with less, worker productivity is increasingly important. Some companies use monitoring systems to make sure workers are working, and sometimes employees are more than happy to comply. "I actually had someone ask me if I could block them from an online auction site at work," says Gary O'Hara, manager of IT at A.W. Mendenhall Co., an Elk Grove Village, Ill., company that distributes food-service, janitorial, and industrial packaging products. "It wasn't anything reprehensible, but they felt it was something they struggled with periodically."

Improved productivity has been the greatest benefit since Mahle Inc. started using software from SurfControl to monitor Web use and block sites, says Danny McCampbell, a senior network analyst at the Morristown, Tenn., supplier of engine components. The software showed that about 70% of employees' overall Web use was personal. But after about six months of monitoring and blocking, there was little personal Internet use at work.

Like most companies, Mahle blocks pornography sites because of concerns over legal liability. That's caused some legitimate business sites to be blocked, particularly those originating in Europe. "We're a German company, so a lot of the sites accessed by our customer-service folks are in Europe," he says. McCampbell notes that Europe's pornography laws are different from those in the United States: "They'll pretty much plaster porno ads on any public Web site," McCampbell says.

When Mahle customer-service reps did product research and tried to access business sites they'd visited previously, they were temporarily blocked when those sites had banner ads with adult content. Executives' secretaries encountered the same problem when they visited European travel sites to make reservations for managers. "They want you to come and visit a brothel while you're in town, so they have banner ads to that effect," he says. McCampbell says unblocking those sites isn't a problem, but he monitors URLs for a couple of months after he unblocks them to make sure they're being accessed by the appropriate employees.

Vendors are providing employers with more flexible ways to control employees' Internet use. Within the past year, both Websense Inc. and SurfControl have added time-quota features to their Web-monitoring products, setting parameters for the number of minutes an employee can spend on particular sites during a day. That lets businesses limit the time an employee spends checking stock quotes or sports scores.

Still, many business-technology managers say the greatest challenge is educating users about policy changes. Even if the changes are established by the human-resources department, it isn't the first department that users will call with questions. McCampbell took several calls a day for the first three months after his company installed SurfControl to explain why certain sites were blocked. "We sent out a memo to 1,600 employees, but not everybody gets it or understands it," he says. He sent any questions he couldn't answer to HR.

One way to help employees understand policies is to let them watch how their activity is being monitored. That's part of the premise behind Fatline Inc.'s FastTracker, a Web-monitoring product that's available as software or as a hosted service. FastTracker provides an employee view, so workers can see what's being recorded.

That feature was very appealing for Konstantine Zoganas, director of IT for Hosokawa Micron Group, a maker of powder- and particle-processing equipment in Summit, N.J. "It's hard enough to try to sell employees on monitoring," he says, but giving workers the opportunity to police themselves made monitoring more palatable. When the company began using the product in March, the percentage of business activity versus nonbusiness activity on the Web was about 50-50. Today, it's closer to 70% business, 30% nonbusiness, Zoganas says.

Sometimes, the need for monitoring isn't enough to compete with other budget priorities until a problem arises. That's the case at a large telecom company that had been testing IM-monitoring technology from Cordant Inc. "I wrote up a formal evaluation and recommended that it be deployed, but there wasn't any money in the budget for it," says a network messaging architect at the company, which he refused to identify. The company's security and legal teams had expressed interest in having a product that could selectively log IM conversations, he says. Cordant's product let managers search employees' IM conversations by keyword, and it was able to correlate messages, too.

From an engineering perspective, the telecom employee was keenly interested in usage statistics that Cordant provided. He wanted to know his top 10 IM users, the peak times for the company's IM activity, and the average conversation length. "I hoped that would help me determine where my peaks and bottlenecks are," he says.

But his company is under severe financial constraints and decided it couldn't afford to deal with potential legal problems resulting from knowing what employees say on IM. You might pay in the future with legal problems, "but today, it's free," he says.

That attitude may change, however. Last month, he got a call from the internal investigations department asking if he could help retrieve a couple of IM conversations. He reminded them that he hadn't been given the tools to assist them. "I guarantee you, they'll call me three or four more times, and all of a sudden the money will magically appear."