The standard policy is that a company will permit reasonable use of the Internet by employees is restricted in the same way that reasonable use of the telephone is allowed, in that it cannot be used for any illegal activities, or for improper use that may damage the reputation of the employer.
A "tickler" system would typically monitor employees every 4 to 6 weeks, checking Internet traffic, email use and Web visiting pattens and look for anything odd. The tickler is now considered a standard tool for HR and IT departments. Keyword tracking is also a monitoring tool.
Occasionally material is noticed by HR that is inappropriate in a work context and it necessary to issue a warning of gross misconduct or sack the employee if necessary. So employers must have a policy in place that advises that they are being watched.
Yaman Akdeniz points to a draft code being developed by the Information Commissioner, which is more limited than the DTI regulations, focusing on monitoring employees for the prevention of hacking and other technical crimes. "When it comes to monitoring content of communications, they should be subject to data protection laws. Just because you are ill, for example, your employees can't monitor or open your emails unless you authorise them," Akdeniz says.
The top three 'employee exit crimes' are outlined by Robertson:
- Taking confidential intellectual property with you as you leave employment. "One out of every three senior employee that leaves will take confidential information. Your target there is your competitor. When people have exit interviews, they should be reminded of the obligation that they have returned everything that belongs to the company. Then if it becomes clear that material has been removed you have a breach of contract against an employee."
- Causing sabotage to the existing employer. "This can come in two forms. One is damaging equipment, although that is on the whole very rare. More likely is removing stuff from files so that when the employee leaves it makes it more difficult to pick up the pieces of the project."
- Badmouthing the former employer, going to the customers and ruining the effect of the goodwill. "This reflects badly on the person smearing their previous employer so is generally counterproductive."
Robertson points out that in the course of retrieving intellectual property, companies should avoid involving customers or other third parties. For example, a company might be alerted that a former employee has taken source code to a competitor when a customer decides to shift to a competing product; any action you take could backfire. "You would then be involving your customer in your dispute, which is never good business. What you tend to have is the customer doesn't want to deal with either the former employee or you anymore," Robertson says.
Equally, managers must avoid making their remaining employees feel like criminals through over-zealous monitoring -- an issue that has moved into the limelight since the events of 11 September.
Since September, employers in the private and public sectors have stepped up monitoring, but sometimes with the risk of creating a siege mentality. In Australia the government have been described as out of control and in a panic about terrorist acts. The chairman of Electronic Frontiers of Australia Kim Heitman told ZDNet Australia, "The threat of terrorism might pass but the threat to civil liberties will be set in concrete."
