Debra Slater, an attorney with Weiss Berzowski Brady LLP, had a client with a workplace Internet horror story. "I represented a company where a management level employee was taking young females into his office to take a test on his computer that he downloaded on the Internet," Slater said. "The test contained sexual questions, and the females were scored afterwards. The young employees were intimidated, and when finally someone blew the whistle, the employer was able to track down the information and fire him." That company used software to monitor the manger’s use of the Internet and was able to document his inappropriate behavior.
The monitoring of employee Internet and e-mail usage is a growing and controversial trend for businesses.
Before e-mail and Internet access became available at nearly every workstation in most companies, the most common problems of inappropriate behavior at work were harassment and discrimination.
However, the computer has transformed the modern workplace, and it has introduced a new set of potential litigation vulnerabilities for employers.
Instead of taking a break to stand around
the water cooler to talk with co-workers, many employees send instant messages, forward jokes
via e-mail and write e-mail messages using slang and sometimes derogatory statements to friends and spouses.
"E-mail is now the smoking gun in litigation," said Jonathan Ingrisano, an attorney for Godfrey & Kahn S.C., a Milwaukee law firm.
Legally, employees should have no reasonable expectation of privacy at the workplace, especially when using a computer, e-mail account and Internet connection that are owned by the company, several local employment lawyers say.
Employees should understand that their Internet activity can be monitored at any time. Their e-mails can be quarantined based on keywords contained in the message, and any message sent using the company e-mail account can be retained without an expectation of privacy, Ingrisano said.
However, the emergence of the computer and the blending of people’s professional and personal lives have created a complex set of questions for employers:
Where do companies draw the line between prohibiting inappropriate Internet usage and invading the privacy of their employees?
Where do companies draw the line between protecting themselves against litigation and creating a hostile workplace in which employees do not feel trusted?
How does aggressive enforcement of a company’s Internet use policy affect the morale of the employees, and therefore the loyalty and productivity of those employees?
"I advise employers not to have a policy that says employees can only use the Internet and e-mail for business, because it is not (realistic)," said Doris Brosnan, an attorney for the von Briesen & Roper S.C. law firm in Milwaukee. "Everyone is going to use (Internet and e-mail) occasionally for personal use. The policy should be the same as the policy for the telephone, where occasional and appropriate personal use is acceptable."
Although local labor attorneys disagree over how restrictive employee e-mail and Internet policies should be, they agree that employers should have written policies, and those policies should outline what is considered inappropriate. The policies should also give the employer reasonable means to discipline an employee for the misuse of the systems, several attorneys say.
"The federal Electronic Communications Privacy Act says that the computer system is the property of the employer and that the employer has the legal right to monitor Internet activity and e-mail activity," said Nancy Flynn, executive director of The ePolicy Institute. "We recommend that employers notify employees as part of their policy program and say, ‘We have the legal right and plan to exercise it, and you have no reasonable expectation of privacy.’"
The ePolicy Institute is a Columbus, Ohio-based training and consulting firm that provides information on e-mail and Internet policies.
Flynn is the author of six books regarding policy creation, abuse and e-mail etiquette, and she frequently acts as an expert witness in lawsuits involving e-mails.
The 2005 Electronic Monitoring & Surveillance Survey, conducted by the The ePolicy Institute and the American Management Association (AMA), found that 55 percent of the 526 U.S. businesses polled are retaining and reviewing employee e-mail messages and 36 percent of employers are tracking content, keystrokes and the amount of time employees spend at the keyboard.
"The primary reason employers are concerned is because e-mail is the electronic equivalent of DNA evidence," Flynn said. "In a workplace lawsuit, you can take it to the bank that e-mail will be subpoenaed."
Still, employers need to be careful about creating a "Big Brother" culture that can be counterproductive at the workplace, experts say.
Providing full disclosure about monitoring policies to employees can be beneficial, said Dan Kittman, an attorney for Reinhart Boerner Van Deuren S.C.
One of Kittman’s local clients had a difficult time retaining employees after word spread around the office that the company was monitoring employees without their knowledge, he said.
"The No. 1 reason to have a policy is to make employees aware that someone may be watching," said Michael Huitink, an attorney with Godfrey & Kahn, S.C.
Many employees are unaware that their employers have the right to monitor their computer usage, Huitink said.
If employers make sure that employees understand the policy and the company’s legal rights, fewer incidents of misuse and harassment will occur, Huitink said.
"Incidental personal use of Internet and e-mail is known to cement employee loyalty and increase productivity," Brosnan said. "Every employer should have a good harassment and other inappropriate behavior policy that addresses inappropriate and appropriate communication in the workplace."
The policy should make employees aware that they can be disciplined and even terminated for improper behavior with their computer, Brosnan said.
With a good policy in place that prohibits inappropriate behavior, personal use of the computer in the workplace can be both allowed and acceptable, Brosnan said.
"Our position is that employers should ban the transmission of jokes via e-mail, because when you tell a joke, there is always one group or individual that is going to be the brunt of that joke, and if not, the language may be X-rated or obscene. That type of content is what triggers lawsuits," Flynn said. "It does not matter if the e-mail was sent internally to one person or to a team. If one person is offended by the message, then you are likely to end up on one side of a lawsuit."
In addition to enacting an employee computer usage policy, an employer also must make sure that it abides by its policy.
"In the old days, litigation for race discrimination and harassment was based on written memos and conversations. People are a little more guarded when writing on company letterhead," Brosnan said. "Now, with e-mail, you see more documentation for everyday conversation, where before it would have not been documented. Now, we can see proof of whatever was going on, and I think it can create a lot of liability for employers."
The 2004 Workplace Email & IM (Instant Messaging) Survey from the AMA and The ePolicy Institute found that one in five companies polled have had employee e-mail subpoenaed by a court or by a regulator, and 13 percent of companies had to go to court to battle a workplace lawsuit triggered by e-mail.
"Electronic discovery is becoming a significant weapon, and it is the first request lawyers make in an employment case these days," said Jon Levine, an attorney with Michael Best & Friedrich LLP.
In his practice, Levine has seen cases in which local companies have used software to monitor e-mail and Internet usage and discovered abuses.
"I am frankly aware of circumstances where an employer who was monitoring discovered that an employee was using the Internet to communicate with under-age children," Levine said. "There are cases where employers have actually helped authorities with criminal investigations because of the monitoring."
Slater recalled a situation in which an employee was using the company computer to start her own online business.
Monitoring employee computer usage also serves as security for employers to protect a company’s proprietary information.
"In the past, salespeople that resigned or were terminated could not walk out of the office with lists of clients, but it is so much easier to transport information electronically, and without a policy, an employee could transfer that information," said Kelly Smitsdorff, an attorney with Wessels & Pautsch, P.C. "It is much more difficult to file a claim against an employee to get that information back."
Smitsdorff has also seen instances in which employees used company computers to search and apply for other jobs online.
Still, an effective Internet and e-mail policy should help a company facilitate a productive workplace, instead of creating a Big Brother type of culture, Smitsdorff said.
"There is so much more you can do online as individuals," Smitsdorff said. "Employees can send a note to their children or fill a prescription online and should not feel that the employer is watching if they are doing this within the parameters of the policy."
The ePolicy Institute recommends employers ban the use of personal e-mail accounts, such as Hotmail, because those accounts can’t be monitored by the employer, Flynn said.
"I am a big advocate of the ‘three E’ approach, which is: establish a written policy that lays out clearly the rules of the policy; educate employees on the policy; and enforce the policy with a combination of software designed to monitor employee activity, correspondence and attendance and make sure there is disciplinary action in place for those employees that violate the policy," Flynn said.
The 2005 Electronic Monitoring & Surveillance Survey found that an increasing number of employers are taking disciplinary action against or even terminating employees who misuse e-mail and Internet policies.
Lutheran Social Services (LSS), a Milwaukee-based nonprofit organization, has 2,500 employees in Wisconsin and Michigan and implemented an e-mail and Internet usage policy in 1999 to set parameters for employees, said Michael Hoffman, vice president of human resources.
"Usage cannot interfere with the duties of the employee’s job or interfere with the system," Hoffman said. "Most importantly, the employees cannot use the Internet to do something that is counter to our mission. We are a faith-based nonprofit organization."
LSS has not installed blocking software for the Internet because of the numerous sites and job functions that exist in the organization, Hoffman said.
Licia Streich, chief financial officer of Total Comfort of Wisconsin Inc., a Pewaukee-based mechanical contractor, said the company’s primary concerns are making sure employees are representing the company appropriately when sending e-mail messages.
Total Comfort has had an e-mail and Internet usage policy in place for eight years, and the bulk of the policy concentrates on prohibiting inappropriate content, Streich said.
"We regularly utilize e-mail directories and files to recreate things that have happened, for instance call logs for customers," Streich said. "We allow limited personal use and recognize that at times, it is an expedient way for employees to manage their lives. We only ask that employees do it on their own time and that it does not become disruptive or interfere with their work."
Total Comfort has not experienced any problems with employee usage of their computers, Streich said.
However, with 225 employees and growing, Total Comfort is considering using software that blocks inappropriate Web sites and monitors employee e-mails, Streich said.
"We are working very hard to control our growth, and this is one way that we do it," Streich said. "We continue to have fairly strong policies and pay attention to them."
"It is in the employer’s best interest to take proactive measures by putting in place a policy and using software to prevent policy misuse from happening," Flynn said. "A policy is only as good as the employee’s ability and willingness to comply."
Are we going too far?
The Electronic Monitoring & Surveillance Survey shows the growing numbers of American companies engaged in electronic monitoring of their employees.
2001 2005
Companies that use software to block
connections to inappropriate Web sites 38% 65%
Employers that monitor the amount of time employees
spend on the phone and track numbers called 9% 51%
Companies that use video monitoring to counter
theft, violence and sabotage 33 % 51%
Employers that use video surveillance to track
employee on-the-job performance 6% 10%
Source: American Management Association (AMA) and the ePolicy Institute.
aMonitoring software
A variety of software programs are available for employers interested in electronic monitoring of their employees. The programs include:
Guardian Monitor Pro 9.0: Monitors Web sites, e-mail, instant messages and peer to peer sites; records keystrokes and downloaded files; full multi-user monitoring. www.guardiansoftware.com.
Websense: Web filtering, Web security and desktop security solutions. www.websense.com.
SpectorPro: Records PC and Internet activity. www.spectorsoft.com.
Employee Monitoring: Records Web-based e-mail (Hotmail, AOL and Yahoo!), file attachments, downloads and Instant Messenger. www.employeemonitoring.net.
UltraView Plus: Monitors in real time from any location; blocks Web pages based on content and Web address; reads incoming and outgoing e-mails, logs keystrokes, takes screenshots and records all online and offline activities. www.awarenesstech.com.
Setting a smart policy
Five things to consider when implementing an employee e-mail and Internet usage policy:
1. Make sure employees understand that the company can monitor computer usage.
2. Make sure employees understand that a third party also may look at computer usage.
3. The policy should make employees understand that e-mails generally stay in the
computer system even after employees delete them.
4. Employers should have an appropriate record retention and deletion policy tailored to the company’s needs.
5. A policy should describe computer usage that is considered appropriate, as well as usage that is inappropriate.
Source: Godfrey & Kahn S.C. attorneys Michael Huitink and Jonathan Ingrisano
Real-life horror stories
Local attorneys have plenty of horror stories of clients whose employees used company computers for inappropriate purposes in the workplace. Among them:
• A manager invited young female workers into his office to take a test of sexual preferences he had downloaded off of the Internet. After a whistleblower alerted the employer, the company retrieved the information from the computer to document the improper behavior and legally justify its firing of the manager.
• A woman filed a lawsuit against a company, alleging sexual harassment by her supervisor. The company used an e-mail retrieval system to find an e-mail from the woman that showed that the sexual relationship was consensual.
• An employee planning to leave a company e-mailed proprietary information to his personal e-mail account before he left. Through an e-mail monitoring software program, the employer became aware that the sensitive information had been pirated.
• An employee used a company Internet connection to communicate in a sexual manner with underage children. The company used e-mail monitoring software to discover the problem and assist in the surveillance of the criminal behavior.
• Employees started their own online businesses while at work, using the company’s computer and Internet connection. Employers used monitoring software to identify the practice and justify the firing of the employees.
• Employees looking at pornographic sites at work have been disciplined and even terminated by employers with monitoring software.
aElectronic record retention
Employment litigation cases increasingly are requiring electronic documents, according to Nancy Flynn, executive director of The ePolicy Institute.
Companies that are involved in a lawsuit that cannot bring forth documented proof needed in their case can get into trouble if the court finds that they intentionally destroyed evidence or if the company failed to comply with its record retention policy, said Michael Huitink, an attorney for Godfrey & Kahn S.C, a Milwaukee law firm.
"Tailor the retention to the business purpose," Huitink said. "Figure out the business need, put it into the policy and enforce it."
Companies should maintain the electronic records necessary for their business archives or to meet legal requirements if they are a federally regulated company, said Jonathan Ingrisano, also an attorney with Godfrey & Kahn.
In addition to industry guidelines, business owners should asses their storage goals and decide whether their goal of retention is to safeguard in the event of a business disaster or to create an archiving system, Huitink and Ingrisano said.
"Once a company is aware of a dispute, it should then freeze its document destruction policy for retention until the dispute is cleared," Ingrisano said. "The company should be insulated (in a court case) if a company has a retention policy and has followed it."
When documents that a company should be able to retrieve according to its record retention policy are not on the system, the court may bring in a forensic expert to mirror the company’s server and search for the documents, Huitink said.
"It is bad enough when a forensic expert is brought in, but even worse when the server shows that the company thought it deleted the information," Huitink said.
– By Elizabeth Geldermann, of SBT
June 24, 2005, Small Business Times, Milwaukee, WI
