One-Third Of Companies Monitoring Email

dotpavan writes "While studies have shown that spying on workers tends to make them less productive, that hasn't stopped approximately 1/3 of all U.S. companies from employing email monitoring tools. 43% of those companies employ staff to check outgoing emails. This seems like quite a waste. While there are some times when it makes sense to monitor emails (or it's required by law), most of the time, this seems like a complete waste of money. Not only are you upsetting workers and decreasing productivity, the benefits are pretty hard to spot. The number of "problem" emails tends to be incredibly low. If someone really wants to send out inappropriate emails, they're going to figure out some other way to do so, such as via a free webmail account somewhere. Yet, the companies are buying up expensive tools and hiring staff to watch just in case they catch the one or two problematic emails that go over the corporate network."

Comments

Automatic or manual?

[Will_Malverson]

Does that count companies like mine, that once bounced email back to me because I described a process as "sucking up all the CPU time", only to be told that 'suck' or 'sucking' is not allowed in our email?

Re:Automatic or manual?

[NetNifty]

When I was back at school, the network admin blocked the word "sex" in email, and the web. It even filtered out some of the intranet (yes, he even made it apply to the school intranet) because the pages referred to schools in Sussex and Middlesex.

Re:Automatic or manual?

[CSMastermind]

You know it's my senior year of highschool, for the past 5 years I've gotten around every filter my school has had up, and I've spent my time in computer classes finding expolites in the network that let me do everything from changes grades to veiw teachers emails (They had a great way of asigning network user names and passwords to teachers their username as their last name and the first inital of their first name, then the password was 'blackhawk', the name of the school.) Well last year my school decided to start hiring students to fix it's computers. Now that I'm leaving they asked if I would give them an evulation of their network and holes in it's security. I'm not sure what I'll tell them. I'm thinking of being honest and explaining that their efforts are good but misdirected (for example they have certain universal network usernames with no passwords and the computers that keep the grades are on the same network as all the other school computers so you can login to them from anywhere in the school...well actually anywhere if you have TightVNC *rolls eyes*). But I'm worried that they would only close up the holes I point out and coutinue to use filtering polices that don't make sense (they use SonicWall...which blocks great sites like Disney)

Re:Automatic or manual?

[B'Trey]

This is a geek site, right? And if you're on a company system, there's a good chance you're using Outlook. That means you can send HTML email. (And very probably can even if you're not using Outlook.) So take advantage of a few spammer tricks. Insert an HTML tag into the middle of any words you think might be flagged:

cu<B></b>nt

The recipient won't see the tags at all but they'll fool most content filters.

Shouldn't take very long to hack up a macro or VB script to automatically search and replace for a list of common terms.

So who said HTML email was good for nothing?

Mea Culpa

[TFGeditor]

At the magazine I edit, many of the department email address forward to me before they go to the department editors. Part of the reason is that some of the department editors can be, shall we say, less than diplomatic when dealing with incorrigible readers. Part of my job is to ensure that exchanges do not become denigrating or insulting, and to avoid lawsuits.

Re:so what?

[Chess_the_cat]

Wouldn't work in my office. All webmail is banned. They don't want anyone downloading attachments because of the threat of viruses. Any incoming mail sent from outside the network is automatically stripped of its attachments by the corporate firewall.

The numbers seem way off

[Anonymous Coward]

Around 15% of companies employ somebody to read outgoing email? I suspect 15% of companies don't even give their employees email access. Don't forget, we are talking farms, supermarkets, tailors, all sorts of small businesses too. Companies aren't just big corporations with hundreds of employees. They are the little guys too.

A single email killed my startup

[soft_guy]

I worked for a company that was developing a software product for a single large customer. This customer is a very large technology company that had various factions in it that were for or against our product.

My boss who was the engineering VP had told everyone repeatedly to be very careful about the kind of emails to send to them.

The email that killed us was a "reply all" to a thread announcing that a build of our product that was available for evaluation. An engineer hit "reply all" and then proceeded to write a highly negative diatribe about the build. The reason why he did that was he was upset that he hadn't had time to put in a fix for some particular hardware configurations. Of course, we had months of development left in the project and his fix would have been in the next build. However, he did not state this very precisely, nor did he consider his audience.

The folks who did not like our product (because they percieved it to be a threat to their political power within the company) used his email to convince the CEO of the customer company to cancel our project.

I was in an "Oh Shit" meeting the next day with our CEO and the rest of senior management. Our CEO stated that he wanted to throw the engineer who sent the email off the roof of our building (which is maybe 25 floors). Ultimately this email lead to the layoff off of 130 out of 150 employees during the middle of the resession (November 2001) and ultimately the company limped along for another year before folding. Fortunately for me, I was positioned exactly right (politically) to be able to stay, but a lot of really good people lost jobs at the worst possible time.

If that email had *not* been sent, we might have hung on long enough to ship the product. If that had happened, it would have meant that the people in the "customer" company would havee been promoted, our company would have made some money and maybe been acquired. I'd probably still be working there.

That said, I have no problem with companies monitoring email.

Lawsuit insurance...

[rsilvergun]

let's say employee X seends an email saying how much he hates minority group A, or how Secretary B should really be dating him if she wants to get ahead. Lawsuit city. Now, the resonable thing to do is sue the person who committed the crime. The profitable thing to do is sue the corporation, who then has to go out of it's way to prove they were doing something to prevent this kind of behavior.

Moreover, with all the top heavy companies these days, all those managers have to find something to do with their time. You can only implement so many inane policies before the well runs dry.

Another argument for a union...

[dominion]

Whenever unions are brought up on Slashdot, they're usually in the context of low wages or long hours.

But here's another prime example of where some kind of union could prevent this kind of invasion of privacy (and waste of money). But without any kind of organization that can negotiate on the behalf of the employees, most workers just have to take it.

Now before the Libertarians get their briefs in a bunch, no, a corporation has no legal responsibility to respect the freedom of speech of it's employees. Yes, employees are free to find another job. But sometimes those excuses just aren't good enough.

Some monitoring is almost a necessity

[tuxlove]

IMHO, companies should not actively monitor, but they should keep a "paper" trail for a certain amount of time. I am against active monitoring, but if a problem arises it is crucial to have history to refer to. My company keeps email records for contractors only, but doesn't waste the resources (or ethical capital) to examine them. However, at least once it has proven invaluable. We once caught a contractor stealing trade secrets and transmitting them to a cohort via email. He probably would have gotten away with it otherwise.

corporate secrets

[Pompatus]

A friend of mine used to work in the IT department of a major casino. Apparently all casinos have a huge database of everyone that plays, what they play, how often, etc.. This database is highly valuable to other casinos. I've heard that rival casinos will pay 10-20k for it.

So someone with access to it is about to sell it. Naturally all the email filters are in place and she was smart enough not to try that. So she figured she would just print it out and walk out with it. She got caught, however, when she called the IT department because the print server crashed. Apparently, sending a 10,000 page document to a print server doesn't quite work as well as one might hope.

Late to the party, but here is my two cents anyway

[Jailbrekr]

Any company would be foolish NOT to implement some sort of email monitoring or archival. Why?

1) Liability. If something is sent by company equipment, by a company employee, it becomes the companys responsibility. At my current employer, we had a customer service rep go rogue and send a nasty, racist email to a customer via yahoo mail, using our equipment. We narrowly escaped a lawsuit by doing some serious sucking up. thankfully, we kept logs of all web based activity and were able to prove who it was and fire their ass in a quick and apparantly pleasing manner (to the victim at least).
2) Productivity. Believe it or not, but email can be used to do some serious slacking off. At my previous employer, I was asked to implement an email monitoring system and figure out precisely how much time was wasted by the employees. The worst offender was found to have 48% non work related emails by volume. That translated into approximately 2 hours of wasted time PER DAY.
3) Theft. I have been witness to two attempts at theft using email. The first one, we had insufficient evidence. The second one however was nailed inside of 2 hours. She was stealing confidential customer lists on behalf of the former sales manager who, unbeknownest to me, was having an illicit extramarital affair with her. If there was no monitoring, she would have gotten away with it.

The lack of any real world knowledge or experience is quite apparant in the person who submitted this story. Email monitoring is, unfortunately, a necessary evil. HAving said that, I would like to emphasize that I am talking about MONITORING, and not BLOCKING. Using word filters is dumb. Its better for them to send it and catch them after the fact than to prevent them from sending it in the first place. Better for them (the ones likely to abuse company resources) to think they can get away with it and nail their ass, then to force them to get all sneaky and find ways around the monitoring.

Re:Corporate culture

[soft_guy]

Yes, we had other problems. Yes, there were probably some other things we should have done besides have a human monitor on the email. For example, the other company had a re-org and my boss wanted our CEO to go out there and meet with their CEO during the re-org to make sure our project wasn't transferred to any manager in the "enemy camp", but our CEO thought it would be better not to do that. Something about "don't poke a stick into the hornets nest". In retrospect, my boss was right. He also wanted to have a Program Manager personally approve any outgoing email to that other company, but the COO thought it was too "Nazi like" and the IT department didn't want to set that up.

Privacy?

[nurb432]

What privacy ?

You are AT work on the COMPANY OWNED premises, using computers owned BY THE COMPANY, being paid to ONLY produce. ( unless you have a job that pays you to not do anything.. )

If you want privacy, go home where you have that right. But dont expect it at the office, as you DONT have that right. Pretty simple.

Somewhere you have more rights

[puhuri]

Exprit of current law in one small country:

All messages, identification data and location data are confidential unless this Act or another Act provides otherwise.

The only reason to study (unanomymised) message identification data for other purposes than resolving technical problems is below:

...corporate or association subscriber may process identification data if this is necessary to detect, prevent, investigate and commit to pre-trial investigation any non-paying use of fee-based network services, ...

Note, that it is not allowed to read identification information unless it is matter of fraud. And in no case corporate subscriber is allowed to screen or learn the content of messages. (Virus scanning is allowed in other chapter.)