Investigating Employees' E-Mail UseCo-host Steve Inskeep talks to Elizabeth Charnock, CEO of Cataphora. The California-based firm helps companies in legal matters by investigating patterns of employee e-mail use.
Co-host Steve Inskeep talks to Elizabeth Charnock, CEO of Cataphora. The California-based firm helps companies in legal matters by investigating patterns of employee e-mail use.
STEVE INSKEEP, host:
When companies do spend the money to sort through emails, some turn to Elizabeth Charnock. She's CEO of a company called Cataphora. It sorts through millions of emails for many companies. And a search for corporate information is liable to turn up dirty jokes, health problems, evidence of crimes. Charnock says that's a change from the paper files that people used in the past.
Ms. ELIZABETH CHARNOCK (CEO, Cataphora): You get sued and the guys with uniforms and name tags would come and clear out your filing cabinet. You wouldn't have personal correspondence of a sensitive nature, for example, in your filing cabinet. You wouldn't put dirty jokes in your filing cabinet.
INSKEEP: You now have...
Ms. CHARNOCK: Whereas...
INSKEEP: ...situations, do you, where someone gets sued because of some stock trading, say, and all this other information comes up completely unrelated. Embarrassing or criminal acts gets swept up and exposed.
Ms. CHARNOCK: Oh, it happens all the time. People mocking a coworker, and then it comes out as what's known as a hot document in a lawsuit or an investigation. And it's not just egg on the face of the person; it's egg on the whole company and it can be a career-changing event in a non-positive way.
INSKEEP: In a non-positive way, what a great, great way to put it.
(Soundbite of laughter)
Ms. CHARNOCK: And what we see a lot of are huge numbers of emails that have phrases like delete this email, you know, all in capital letters, or don't worry, they'll never know, or you really don't want to know.
(Soundbite of laughter)
INSKEEP: Is it true that...
Ms. CHARNOCK: By the thousands.
INSKEEP: ...and is it true that you can't delete an email; it's impossible?
Ms. CHARNOCK: Unless you're very fortunate, it's impossible. It can get backed up before you know it, it could've been sent to other people, it could be archived without your realizing it. So really emails are like the cockroach of the electronic world. It's very difficult to get rid of.
INSKEEP: And I suppose part of your business is not only collecting this stuff but helping people to search through it in an effective way. Is that getting easier and easier as time goes on?
Ms. CHARNOCK: Actually, in some ways it's getting harder and harder. Because since we've been in business, the average size of an email - I'm not talking about the attachment but just the text in line - has shrunk by more than 50 percent. This has a lot to do with all of us who have our Blackberries and Treos and also the informality of instant messages.
Mr. CHARNOCK: And so you have a much more complex problem than you had before because you have to take these little bits and nuggets of content and reunite them to understand a decision-making process.
INSKEEP: And who's employing you exactly?
Ms. CHARNOCK: Large corporations, but sometimes smaller ones as well, individual white collar defendants, sometimes government agencies.
INSKEEP: What kinds of government agencies?
Ms. CHARNOCK: Three letter ones.
(Soundbite of laughter)
INSKEEP: Well, I'm just, you know, thinking about three-letter agencies like CIA, NSA, agencies like that?
Ms. CHARNOCK: There's a great many three-letter agencies.
INSKEEP: How many emails could you search in an hour if you applied every bit of capacity you have?
Ms. CHARNOCK: Well, we routinely get collections of over ten million items, even for very routine cases.
INSKEEP: Ten million items - I mean, that's anything that might have crossed a company's desk.
Ms. CHARNOCK: Yes. Like, for example, in a particular division that was responsible for the manufacturing for a particular product they could say, hey, you know, if there was a defect in this, we want to see every email, every instant message, every Word document that anybody ever got, and without the judge necessarily realizing how many millions of items that might amount to.
INSKEEP: Do you think there's any limit to how much you can surveil someone throughout their electronic communications?
Ms. CHARNOCK: If you throw in everything that's possible to now have from card key accesses to cell phones to of course email and instant message and travel and expense reports and calendars, you'd be astonished by how clear a picture you can paint of behavior. And again, you would not normally do it but if there's tens of millions of dollars at stake, that's a point at which people start to get very interested in the behavior of the key litigants or actors in the investigation.
INSKEEP: Have you ever done a search on yourself?
Ms. CHARNOCK: No.
INSKEEP: Anything to find?
Ms. CHARNOCK: Everybody has fits of pique that get memorialized in email. I thinks that's just human nature.
INSKEEP: Elizabeth Charnock is CEO of the software company Cataphora. Thanks very much.
Ms. CHARNOCK: My pleasure.
INSKEEP: Okay. I'm on our Web site here and we've got some tips on how to email without worry. The summary is: don't email, but you can go find the tips at NPR.org. And tomorrow our series continues with email and encryption.
(Soundbite of song)
Unidentified Woman: (Singing) ...there's a story, a very sad tale of intrigue, romance and electronic mail, a dangerous form of information and the perils of instant gratification...
NPR transcripts are created on a rush deadline by Verb8tm, Inc., an NPR contractor, and produced using a proprietary transcription process developed with NPR. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of NPR’s programming is the audio record.
Ever wonder whether your boss is looking over your shoulder as you write e-mails from work? You're not being paranoid. Companies large and small have turned to monitoring employee e-mail, looking for everything from proprietary data leaks to cyberslacking.
E-mail creates the electronic equivalent of DNA evidence, according to the ePolicy Institute, which conducted, along with the American Management Association, surveys of e-mail monitoring among U.S companies. That means your electronic paper trail can be restored and reviewed — and can also be retrieved as part of a future lawsuit's discovery process.
Here are some suggestions on how to e-mail without worry.
Expect Zero Privacy. Employers are increasingly monitoring staff e-mails, instant messages and Internet usage. According to a 2007 American Management Association survey of 304 U.S. companies, 43 percent of employers store and review employees' e-mail messages. Nearly 30 percent of them have fired workers for e-mail misuse — for violating company policy, for using inappropriate or offensive language, for excessive personal use, and for breach of confidentiality. So unless your company states otherwise, assume your employer is monitoring your workplace communications, including e-mails and IMs, according to Sharon Nelson, head of Sensei Enterprises, a computer forensics and data recovery company in Fairfax, Va. Nelson suggests that before you hit send, conduct this three-part test: imagine your e-mail in a major newspaper, imagine your mom reading it and imagine it winding up on a billboard along the highway. "If it passes these tests, then it's fine," Nelson says.
How Do They Do It? Computer monitoring takes several forms. Most employers use software to automatically monitor e-mail, but many hire staff to read and review chunks of random e-mail, the survey found. Time stamps allow employers to gauge time spent on personal e-mail. And if you're afraid your boss may have it out for you, be careful: she could be monitoring your e-mail for when you slip up. So avoid using obscene, pornographic, sexual, harassing, discriminatory, defamatory, menacing or threatening language — anything that could make you a liability in your employer's eyes.
Will I know? Not generally. Two states — Connecticut and Delaware — require that employers notify employees when they're being monitored. And while an alert at log-in is a best practice for all companies, monitoring e-mail is generally unregulated. Besides, Nelson says, it's a universal given that the computer you work on is your employer's equipment. That has been "tested in the courts over and over again. It's their equipment. It's their right" to monitor. As head of Sensei, she says "I even assume I'm monitored" by Sensei's vice president of technology.
G-Mail Is No Refuge. Employers can still recover and read Internet-based e-mail like Yahoo! Mail or Hotmail when it's opened from a work-based computer. That's because the e-mail is saved to your local, company-owned hard drive. For this reason, personal e-mail from your attorney opened on your company's computer may result in waiving the attorney-client privilege.
But I Hit Delete! Computer forensics firms like Sensei can recover work e-mails that you thought you deleted. Over time, e-mail is overwritten from your work's server, but don't expect to know whether it's an e-mail from five days ago or five years ago, Nelson says. She recalls a case involving three stockbrokers who claimed they did not leave with the company database when they separated from their employer.Their e-mail logs indeed said the information had been deleted just before they left, but there was also evidence that their Palm Pilots had been synced up to their computers and, sure enough, forensics discovered the database on their handheld devices.
Disclaimers Aren't Worth a Darn. Most experts agree the sometimes ridiculously long disclaimers at the bottom of e-mails are worthless, Nelson says. "They're rote. Nobody's reading them." However, she adds, a lawyer may tell you to include them on your e-mails anyway.
Avoid the AutoComplete. One of the most frequent e-mail blunders is the AutoComplete function featured in programs such as Microsoft Outlook. AutoComplete predicts the e-mail address as you type, and if you're not careful, your message could wind up in a very different inbox than the one you intended. Case in point: the New York Times broke a story early this year that Eli Lilly and Co. was in settlement talks with the government after a lawyer associated with the company accidentally e-mailed confidential information to a Times reporter instead of to her colleague with a similar name. Either double-check that your e-mail's recipient is who you intend, or try disabling your AutoComplete function.
Watch out for copyrighted material. You wouldn't make photocopies of a chapter of a book and distribute them, would you? Same goes for electronic publications. So watch out before you send your co-workers and friends a magazine article that your company subscribes to. Say, for example, your company of a few hundred has only a handful of subscriptions to a magazine, but an article is distributed companywide. The publisher is losing out on all that subscription revenue, and your company could be liable. And if the publisher sued, your forwarded e-mails would be discoverable (and your company may be scanning your e-mail to head off potential copyright infringement lawsuits). Kim Jessum, an intellectual property attorney with Stradley Ronon in Philadelphia, suggests that before forwarding articles, find out what's permissible under the contract with the publisher: Your contract may allow for printing rights, which means you can make a printout copy of the article available to staff.