Dicey ethical dilemmas

Before you track employees' Web surfing habits, make sure your company has a clearly defined policy.

By Deborah Radcliff
Network World, 05/29/00

The head of marketing thinks one of his subordinates spends too much time surfing the Internet. He asks you to monitor the employee's e-mail, URL stops and Web downloads, and wants the logs on his desk in a week. Do you:

a) Blindly obey and set up watch on the employee without his knowledge or permission?

b) Check the employee guidelines?

c) Ask the opinion of corporate counsel?

Thanks to the Internet, network professionals are running into ethical dilemmas like this with increasing frequency. Most of these ethical issues deal with perceived privacy rights, whether it is the privacy of employees, consumers or the corporation's intellectual property itself.

The 10 commandments of computer ethics
Sample policies

"Technological access to information and processing power today is unprecedented. Over the past 12 months, this has converged with a hot issue: privacy," says Chris Zoladz, vice president of information protection for Marriott International in Bethesda, Md. Having transferred from the internal audit group, Zoladz now defines and builds policy around IT ethical issues such as privacy and employee's systems usage.

Karen Coyle, a longtime volunteer with Computer Professionals for Social Responsibility in Palo Alto, says such issues are often left to the IT department to address. "I lecture on privacy all the time, and I explain that this really isn't a computer issue, it's a business issue," Coyle says. "People blame computers for this, but there have always been things to distract us at work."

Both Zoladz and Coyle agree it all boils down to policy. That policy should be clearly understood by employees, consumers or whoever else expects a reasonable right to privacy.

During the last year, e-businesses have adopted policies and common disclosure templates to inform consumers how their data will be used. However, most employers have all but ignored internal policies, says Zoladz, who previously spent 13 years at Ernst and Young providing auditing services for clients.

Not only are networking professionals in the dark, so are users. Most employers fail to set acceptable-use policies and procedures for how information access is granted and who owns the information, Coyle and Zoladz say. Even worse, they say, employers often fail to inform employees that their computer use is being monitored.

"In most cases, employers have not made it clear what they consider appropriate use of computer technology," says Coyle, who by day builds computer library systems for the California Digital Library in Berkeley, Calif. "Most people I lecture to aren't even aware that they have no right to privacy at work, that their e-mail belongs to the company."

Currently, Marriott is building an employee-policy guideline, tentatively titled the "information protection agreement," which will inform employees of their expected behaviors in three areas:

Information security and confidentiality, which includes the privacy of customer and corporate data.

Electronic communications, which dictates the expected behaviors for use of e-mail and Internet resources.

Software use, which states that all business software must be licensed.

Marriott's policy also covers action taken when suspected misuse is identified. For example, Zoladz realizes that some requests to monitor employees may be motivated by company politics. So, to protect Marriott against a wrongful dismissal suit, any monitoring request requires the review and signature of two to three people inside the Marriott organization - and Zoladz has the final sign-off.

"We make it clear to employees that they should have no expectation of privacy on the Internet and e-mail here at work. But that doesn't mean we routinely look at what they're doing," Zoladz says.

Policies like these are the exception rather than the norm. Until businesses wake up to the issue, the impetus falls on networking professionals to raise awareness and begin the process of building ethical computer-use policies, Coyle says.

"The business side is not going to think of these things," she says. "Part of our job ethic is we should be the ones to speak up."

The 10 commandants
of computer ethics

Thou shalt not use a computer to harm other people.
Thou shalt not interfere with other people's computer work.
Thou shalt not snoop around in other people's computer files.
Thou shalt not use a computer to steal.
Thou shalt not use a computer to bear false witness.
Thou shalt not copy or use proprietary software for which you have not paid.
Thou shalt not use other people's computer resources without authorization or proper compensation.
Thou shalt not appropriate other people's intellectual output.
Thou shalt think about the social consequences of the program you are writing or the system you are designing.
Thou shalt always use computers in ways that insure consideration and respect for fellow humans.

Source: Computer Ethics Institute, Washington, D.C.

Back to top