News
Commentary
12/12/2003
12:27 PM
Commentary
Commentary
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Why Employees Surf. And Why You Should Stop Them

Once you allow nonbusiness or non-IT-sanctioned applications to be installed, the network is at risk.

Employees are using the office network for personal use because they are working hard, and need to get other things done, often during work hours (56%). Others are surfing when bored. Monitoring personal Internet use may help identify those who are being under-worked or under-challenged. Deadwood who surf to fill their days are better off making way for someone who will actually do their job. Finding those who are good workers, but need some help balancing their work and private lives, also is a valuable byproduct of monitoring. Some employers are addressing these needs and reducing the stress level of valued employees by bringing dry-cleaning, postal, and other day-to-day services to the workplace to help their employees manage their personal lives.

Seventy-nine percent of those responding reported checking personal E-mail and instant messages from work. And most of those are using either their free Hotmail or equivalent accounts (30%) or their own subscriber accounts, such as AOL (26%). Forty-three percent are using their business E-mail accounts for personal correspondence.

Each nonbusiness use has its special risk-management problems. Employees permitted to use their personal E-mail or instant messaging accounts from work computers are using personal E-mail or IM applications on your system and may be accessing password-protected correspondence. Once you allow nonbusiness or non-IT-sanctioned applications to be installed, the network is at risk.

Network administrators need to have full control of everything on their network. In addition, unless the company approves software before installation, there's no guarantee that the software is legal, free of malicious code, or licensed, all of which could have serious security and legal ramifications.

And allowing password-protected correspondence, unless the employer knows the password and controls that access, is an invitation to litigation. Allowing password-protected correspondence also is often used as evidence that employees have reasonable expectations of privacy, which can then be problematic when the employer seeks to monitor and control Internet communications and use.

Then there's the problem of attachments, encrypted communications, and encoded E-mail (Web-bugs and the like), as well as spam clogging your network. So, the knee-jerk reaction is to block access to Web-based E-mail and instant messaging and prevent the installation of apps for AOL, MSN, and other subscription services. But that has its problems, too.

If employees still conduct personal E-mail communications from work, their only choice will be their business E-mail address. And that actually may be more of a legal problem than using a personal account. Third parties have relied on the use of a business E-mail account to sue the company itself when the employee does something actionable using that account. In addition, everywhere they surf, they leave your business IP behind. From downloading music on P2P sites (7% reported downloading music, software, or movies) to posting hate messages on bashing boards to sending sexually explicit E-mail attachments or messages, company execs may find themselves the deep-pocket defendant under respondent superior theories of liability. That's why most well-crafted acceptable-use policies prohibit all personal E-mail and IM correspondence. An employer, even if it wants to allow reasonable personal communications, may find itself between a rock and a proverbial hard place.

Some decisions are easy. Fourteen percent of those responding indicated that they used their workplace access to search for new jobs or compare compensation on their current job. Blocking access to the leading job-search sites is a quick fix to having employees rub salt in their employer's wound by wasting their employer's time and using that wasted time to find another job.

Six percent admitted to using the workplace computer to chat online. Web-based chat, Internet Relay Chat, and other chat applications can be easily blocked as well. (Besides not being terribly productive, chatting is ripe pickings for spam-harvesting programs.) The 14% who play games (including managing their fantasy sport teams online from work) can surf on their personal time by having access blocked to the more popular game sites. (Given that often good-natured wagers accompany the fantasy gaming, blocking access from work can limit legal risks as well.) P2P can be blocked for anyone not needing P2P access for work, thus reducing the risk that the Recording Industry Association of America will look into your employee's surfing practices.

So, how do you give your employees what they want and need without exposing yourself to legal and security risks unnecessarily? Several employers, recognizing the need for personal Internet use during the workday, have set up kiosks. These allow personal access outside of the workplace network and don't carry the same vicarious legal risks as using the company's network and IP address. Employees can then surf and access what they need, and send reasonable numbers of personal communications without jeopardizing the employer. The lack of privacy at the kiosks also minimizes the likelihood that employees will be doing something they shouldn't.

There's no easy answer here. But being flexible and trying to address employees' needs, while protecting your legal flank, is the goal. And asking your own employees what they think and what they need is a good place to start.

Return to main story, The Privacy Lawyer: Crack The Online Whip

Parry Aftab is a cyberspace lawyer, specializing in online privacy and security law. She can be reached at parry@aftab.com.

Comment  | 
Print  | 
More Insights
The Business of Going Digital
The Business of Going Digital
Digital business isn't about changing code; it's about changing what legacy sales, distribution, customer service, and product groups do in the new digital age. It's about bringing big data analytics, mobile, social, marketing automation, cloud computing, and the app economy together to launch new products and services. We're seeing new titles in this digital revolution, new responsibilities, new business models, and major shifts in technology spending.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Tech Digest Septermber 14, 2014
It doesn't matter whether your e-commerce D-Day is Black Friday, tax day, or some random Thursday when a post goes viral. Your websites need to be ready.
Flash Poll
Video
Slideshows
Twitter Feed
InformationWeek Radio
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.