* How one company enforced its acceptable-use policy with no money
A member of our survey panel related to me how he solved the problem of employees abusing Web access and e-mail.
The rest of today’s newsletter is in his words, with light edits. Many thanks to the individual who provided this to me:
“The human resources group had gotten a few complaints by supervisors and others that some employees were Web surfing to ‘non-business’ sites, and some of that included adult sites. The company policy was ‘everybody’ had e-mail and Web access. Although all employees had signed an ‘Acceptable Use Policy,’ they still violated the rules they had signed.
“HR asked the IT group what could be done. We offered some commercial solutions, but at that point budgets were very limited. I hit on the idea that if we processed the firewall proxy log we could send, via e-mail, each user a summary every day of where they had surfed the prior day and they would get the picture that they could be tracked. It did involve a little custom programming, but it was not a huge task. I offered the HR group the idea that they would not see the log, but each employee would see their own and only after some ‘grace’ period would we send a copy to HR if individual employees did not stop. The HR group [told employees] that this new e-mail would start arriving shortly in each mailbox and that the purpose was to help them better understand where they were spending their time. It was clear that HR would not see these e-mails, at least initially, although they reserved the right to look if it was ‘required.’
“During seven days of test data collection (before implementation of the project) we saw more than 75 people out of about 250 surfing to some very objectionable sites. Some others spent hundreds and even thousands of screen refreshes per day on eBay and other obviously non-business sites.
“After the log file was processed and stored in a SQL database, the data for the day was processed and a summary e-mail was generated for each user. If it was in the ‘adult’ category, then the ‘screen by screen’ log detail was listed with time stamps. The e-mail was sent only to the user with a note and phone number to call IT if they had questions. Many called (and many did not), but within a few days the ‘non-business use’ dropped to nearly zero. Not a single employee got a single reprimand in the initial implementation, but the mission was accomplished.
“So, with a budget of zero, we solved a serious productivity and legal issue by just letting people know what ‘could’ be collected.”
