Ever wonder whether your boss is looking over your shoulder as you write e-mails from work? You're not being paranoid. Companies large and small have turned to monitoring employee e-mail, looking for everything from proprietary data leaks to cyberslacking.
E-mail creates the electronic equivalent of DNA evidence, according to the ePolicy Institute, which conducted, along with the American Management Association, surveys of e-mail monitoring among U.S companies. That means your electronic paper trail can be restored and reviewed — and can also be retrieved as part of a future lawsuit's discovery process.
Here are some suggestions on how to e-mail without worry.
Expect Zero Privacy. Employers are increasingly monitoring staff e-mails, instant messages and Internet usage. According to a 2007 American Management Association survey of 304 U.S. companies, 43 percent of employers store and review employees' e-mail messages. Nearly 30 percent of them have fired workers for e-mail misuse — for violating company policy, for using inappropriate or offensive language, for excessive personal use, and for breach of confidentiality. So unless your company states otherwise, assume your employer is monitoring your workplace communications, including e-mails and IMs, according to Sharon Nelson, head of Sensei Enterprises, a computer forensics and data recovery company in Fairfax, Va. Nelson suggests that before you hit send, conduct this three-part test: imagine your e-mail in a major newspaper, imagine your mom reading it and imagine it winding up on a billboard along the highway. "If it passes these tests, then it's fine," Nelson says.
How Do They Do It? Computer monitoring takes several forms. Most employers use software to automatically monitor e-mail, but many hire staff to read and review chunks of random e-mail, the survey found. Time stamps allow employers to gauge time spent on personal e-mail. And if you're afraid your boss may have it out for you, be careful: she could be monitoring your e-mail for when you slip up. So avoid using obscene, pornographic, sexual, harassing, discriminatory, defamatory, menacing or threatening language — anything that could make you a liability in your employer's eyes.
Will I know? Not generally. Two states — Connecticut and Delaware — require that employers notify employees when they're being monitored. And while an alert at log-in is a best practice for all companies, monitoring e-mail is generally unregulated. Besides, Nelson says, it's a universal given that the computer you work on is your employer's equipment. That has been "tested in the courts over and over again. It's their equipment. It's their right" to monitor. As head of Sensei, she says "I even assume I'm monitored" by Sensei's vice president of technology.
G-Mail Is No Refuge. Employers can still recover and read Internet-based e-mail like Yahoo! Mail or Hotmail when it's opened from a work-based computer. That's because the e-mail is saved to your local, company-owned hard drive. For this reason, personal e-mail from your attorney opened on your company's computer may result in waiving the attorney-client privilege.
But I Hit Delete! Computer forensics firms like Sensei can recover work e-mails that you thought you deleted. Over time, e-mail is overwritten from your work's server, but don't expect to know whether it's an e-mail from five days ago or five years ago, Nelson says. She recalls a case involving three stockbrokers who claimed they did not leave with the company database when they separated from their employer.Their e-mail logs indeed said the information had been deleted just before they left, but there was also evidence that their Palm Pilots had been synced up to their computers and, sure enough, forensics discovered the database on their handheld devices.
Disclaimers Aren't Worth a Darn. Most experts agree the sometimes ridiculously long disclaimers at the bottom of e-mails are worthless, Nelson says. "They're rote. Nobody's reading them." However, she adds, a lawyer may tell you to include them on your e-mails anyway.
Avoid the AutoComplete. One of the most frequent e-mail blunders is the AutoComplete function featured in programs such as Microsoft Outlook. AutoComplete predicts the e-mail address as you type, and if you're not careful, your message could wind up in a very different inbox than the one you intended. Case in point: the New York Times broke a story early this year that Eli Lilly and Co. was in settlement talks with the government after a lawyer associated with the company accidentally e-mailed confidential information to a Times reporter instead of to her colleague with a similar name. Either double-check that your e-mail's recipient is who you intend, or try disabling your AutoComplete function.
Watch out for copyrighted material. You wouldn't make photocopies of a chapter of a book and distribute them, would you? Same goes for electronic publications. So watch out before you send your co-workers and friends a magazine article that your company subscribes to. Say, for example, your company of a few hundred has only a handful of subscriptions to a magazine, but an article is distributed companywide. The publisher is losing out on all that subscription revenue, and your company could be liable. And if the publisher sued, your forwarded e-mails would be discoverable (and your company may be scanning your e-mail to head off potential copyright infringement lawsuits). Kim Jessum, an intellectual property attorney with Stradley Ronon in Philadelphia, suggests that before forwarding articles, find out what's permissible under the contract with the publisher: Your contract may allow for printing rights, which means you can make a printout copy of the article available to staff.