Keeping an eye on e-mail

By Paul McNamara
Network World, 10/5/98

While some still consider the tactic too Big Brotherish, employers increasingly are using e-mail surveillance software to guard against sexual harassment lawsuits and the loss of trade secrets.

Evidence of the trend re-mains largely anecdotal, according to e-mail administrators and industry experts. However, many believe that content-filtering of workplace e-mail will become commonplace with the maturation of server-based applications from vendors such as Content Technologies, Trend Micro and Worldtalk, which recently announced its E-Mail Surveillance Program.

As the list of high-profile court cases involving workplace e-mail grows - topped by Microsoft's tug of war with the U.S. Department of Justice - liability considerations are prevailing more often over concerns about privacy rights. This means employees caught red-handed by e-mail filters can and do lose their jobs, as bosses increasingly fear being accused of fostering a hostile work environment.

A case in point is Union Bank of California, which has 250 offices worldwide staffed by 9,800 employees, many of whom regularly interact with customers via e-mail.

"Our legal department at the bank didn't want any adverse publicity based upon someone flaming our customers and our business partners through Internet e-mail," says Bob Justus, manager of open server software support. Union Bank has deployed Content Technologies' MIMEsweeper as a Simple Mail Transfer Protocol relay host and is in the early stages of instituting the software's content-filtering features.

"There is a lot of internal policy that has to be established before you start actually intercepting e-mail," Justus cautions. The bank's human resources and legal departments are involved in determining the specifics of what Justus hopes will become a stringent monitoring program.

There's ample reason to believe such measures are warranted, experts say. For example, a Worldtalk E-Mail Surveillance report prepared for one unnamed company found 11% of the firm's internally generated messages contained objectionable language (see chart). Filtering software can bounce such messages back to the sender for cleansing and/or to a manager for appropriate disciplinary action.

Another company gravitating toward e-mail monitoring cites a different primary motivation for the move.

"I am more concerned with trade secrets and other proprietary information leaving the company than a lawsuit based on harassment," says Jerry Fain, manager of information technology at Winter, Wyman & Co. in Waltham, Mass. He is looking for software that "would help track large amounts of information being transferred via e-mail," a feature available in today's filtering software.

Fain says privacy concerns expressed by filtering opponents are misplaced. He compares e-mail surveillance to "locking the doors at night and keeping our server away from the general population."

One industry expert believes it's only a matter of time before the vast majority of organizations embrace that viewpoint, especially given that courts have consistently ruled that workplace e-mail is company property.

"Within a year or two, filtering is probably going to become standard," says Joan Feldman, president of Computer Forensics, a Seattle company that helps lawyers dig up electronic dirt and helps companies avoid being sued over the same dirt. "I don't see people being able to get around it."

Companies forced by litigation to scour their e-mail repositories for relevant messages can spend $50,000 to $150,000 on the search alone, Feldman says, never mind the specter of a multimillion-dollar judgment. Having an e-mail monitoring system in place not only reduces the likelihood of being sued but also makes that initial discovery process less costly, she adds.

Of course, not everyone is convinced of the need for e-mail surveillance.

"We don't filter or monitor e-mail," says Alky Poulias, LAN administrator for xpedx, a division of International Paper in Covington, Ky. "If someone is going to expose trade secrets, there are always other ways besides e-mail - they can print or fax sensitive documents, or discuss it over the phone."

This type of attitude can be altered in a heartbeat, according to Ari Newman, a product manager for Worldtalk.

"There are some organizations that I have run into that have said this is against our corporate culture, and we're not going to do this until the brick comes through the window," Newman says. "The minute something does get leaked or the minute they do receive a sexual harassment lawsuit, their corporate policy will change and they'll start doing filtering."