Don't assume e-mail sent from work, even if deleted, goes unseen

You'd better think twice before hitting the Send button on your work e-mail program. That off-color joke, sexy image or snide comment about the boss's IQ could be hazardous to your professional

Friday, March 10th 2000, 12:00 am

By: News On 6

You'd better think twice before hitting the Send button on your work e-mail program. That off-color joke, sexy image or snide comment about the boss's IQ could be hazardous to your professional health.

While the convenience and pervasiveness of e-mail communication on office computers has undoubtedly boosted worker efficiency, it leaves a digital record easily monitored by employers.

New e-mail security programs such as MailMarshal are being used to continuously scan employee e-mail for key words -- everything from performance review to names of managers, sex and jerk. Other products, such as one called Spector, can take snapshots of employees' monitors, rendering encryption and other privacy tools ineffective.
"Your employees will hate Spector," the SpectorSoft Web site (www.spectorsoft.com) boasts, "because Spector records EVERYTHING."

Stuart Maskell, director of marketing for MailMarshal (www.nwtechusa.com), says the company's software is selling briskly. Employers are using Marshal security products to cut down on inappropriate use of their computer networks. About a third of all firms contacted in a recent Computerworld magazine survey report that they regularly monitor e-mail. Mr. Maskell believes the percentage is closer to half.

"And in a year," Mr. Maskell says, "we predict it'll be 80 percent."

A recent American Civil Liberties Union study estimates that more than 20 million workers have their e-mail, computer files or voice mail searched by employers. Another study of the workplace estimated that 25 million employees -- nearly one-quarter of the entire workforce -- are subject to electronic monitoring of some sort.

With the rise in workplace technologies, both employers and their charges are wrestling with the balance of e-mail privacy expectations and the need for secure, productive work habits.

Although many companies have established policies that vaguely warn against personal use of e-mail accounts, a growing number of workers are being surprised by surreptitiously compiled dossiers of their e-mail activities.

For example, during a New York Times human resources investigation last year, managers stumbled on potentially offensive e-mail sent by or forwarded to other employees in the office. That led to a wider investigation, culminating in the firing of 22 people in Norfolk, Va., and one in New York. About 20 more workers -- who the company determined had received offensive messages but didn't forward them to others -- received warning letters. Most of the fired employees were otherwise in good standing; one had just received a promotion, and another had recently been commended as "employee of the quarter."

Other cases are popping up across the country, and employees are mounting arguments that their privacy is being invaded without adequate notice. But case law is still spotty for this new medium. In general, employers are given wide discretion on how to regulate use of their Internet and e-mail services, experts say.

"While idealistically, if you're in the workplace you should be working, on the flip side, our work environment demands more and more each day -- more of a commitment, more of ourselves being invested in our work," says Laura Pincus Hartman, University of Wisconsin-Madison's Grainger Chair in Business Ethics. "We're all human, and we need to be able to carry on our lives, even in the workday. There needs to be some sort of autonomy that employees can exert in the workplace."

Meanwhile, company officials -- including Microsoft chairman Bill Gates, whose company has been accused of monopolistic practices in a U.S. Justice Department suit -- have faced embarrassing legal setbacks from e-mail records preserved by court orders.

Additionally, e-mail can be used to transmit sexual propositions or X-rated material between office workers, leading to complaints by offended parties. And concern about e-mail-borne viruses, chain letters, hoaxes, leaks of trade secrets, time-wasting and other unproductive Internet activities by employees are often well-founded.

Rising clashes

As e-mail becomes a utility of the modern workplace, clashes are bound to escalate.
"Workers may be in for a little surprise if they're not careful," says Marc Rotenberg, director of the Electronic Privacy Information Center, or Epic. "Workplace privacy issues aren't among those remaining for Congress to hear. But it would not be shocking to see more and more states making moves if these cases increase."

Even before the arrival of the Internet, employees were suing their bosses for conducting secret searches of their desks and voice mail.

A smattering of regulations, including state and federal wiretap laws, have established some guidelines. Under the federal wiretap law, for example, an employer cannot listen to an employee's personal telephone conversations unless the employees have been notified that their conversations are monitored. In many cases, monitoring is required for those in customer service phone pools, for example.

But laws on workplace surveillance in the new electronic world are largely nonexistent.

Until recently, state courts have generally held that e-mail monitoring requires the same sort of notice to employees as for physical searches of their work desks, says Mark S. Dichter, chairman-elect of the American Bar Association's Labor and Employment Law Section and an attorney with Philadelphia's Morgan, Lewis & Bockius LLP.

If an employee is given a key to his desk by the boss and the employer doesn't keep a copy of that key for himself, then the employee should reasonably expect the contents would remain unsearched, Mr. Dichter says. Likewise, if a boss says nothing about personal use of the company e-mail system, employees could generally expect it to remain private.

"What's happening now -- because there's been so much publicity about employee monitoring -- the employer who wasn't explicit about it has still argued that employees don't regard it as a private means of communication anymore," Mr. Dichter says. "But we always advise employers to tell employees they may be monitored so there's no misunderstanding."
In recent cases, in fact, state courts have ruled that, even without notice, employers have a right to search e-mail.

"We're seeing that even where there is some notice, even very vague notice at the beginning of employment, courts have held there should be no expectation of privacy with e-mail," says Dr. Hartman.

Seminal case

The bellwether case came in a Pennsylvania lawsuit brought by Michael A. Smyth against his employer, The Pillsbury Co., in 1996. Mr. Smyth received certain electronic messages on his home computer from his supervisor over the company e-mail system. He then exchanged e-mail that contained offensive references and threats concerning the company's sales management.

Specifically, Mr. Smyth's e-mail derided the company's sales management team, threatening to "kill the backstabbing {ellipsis}" and referred to a holiday office party as the "Jim Jones Kool-Aid affair." Company executives saw a printout of that message, then read all of his e-mail messages and terminated him for "inappropriate and unprofessional comments" over the company system.

Mr. Smyth proved that the company had repeatedly assured employees that all e-mail would remain confidential and privileged. But a state court ruled that the company didn't have to tell Mr. Smyth a thing. It was Pillsbury's equipment, the court ruled, so the company was entitled to examine its contents.
On one extreme, businesses may include vague, oral notice that office e-mail is for business use only. On the other, numerous software design firms have devised pop-up screens whenever e-mail is sent from a company terminal, warning, "This message may be reviewed."

"Most firms find themselves in the middle somewhere," says Dr. Hartman.
Mr. Rotenberg of Epic says that by its very nature, e-mail at work presents sticky problems for employers. Many workers, especially those new to Internet computing, seem to regard electronic mail as a "high-tech water cooler" where they are free to kibitz, gripe, gossip and exchange entertainment.

"Persons tend to be very casual about their e-mail communications," says Mr. Dichter. "The warning is: Don't be so casual about it.

Recognize that you're creating a big memo, you're not just having a phone conversation."
Adds Dr. Hartman: "We all kind of understand how a telephone works. But with computers, people don't really understand it at all. That's one of the unanticipated implications of new technology we're finding. Telephones are clear. Computers are not.

"When you push delete, it says it's 'deleted.' But it's not deleted. Many employees in these recent cases specifically hit delete, thought the messages were gone, then got fired because they weren't."

Copies of all messages may be logged on company servers, as well as on Internet service provider machines through which e-mail passes on its way to the destination mailbox.

At a subsidiary of Chevron Corp., e-mail containing such jokes as "25 reasons beer is better than women" were used along with other evidence in a sexual harassment claim that was settled in 1995 for $2.2 million.

Powerful ammunition

And in high-profile cases such as the recent federal antitrust action against Microsoft, deleted e-mail has been reconstructed to provide powerful ammunition to government attorneys seeking to show anti-competitive company practices.

"Employers are really in the middle of those situations so often," says Mr. Dichter. "We feel strongly employers should be informing employees about potential monitoring. But that doesn't mean that because someone transmits a single off-color joke, they'll be fired. Employers run the risk of a lawsuit. Employers don't win lawsuits by employees.

It's a question of whether they just pay the employee -- or the employee and his lawyer."
In fact, strict, poorly enforced e-mail monitoring can backfire on bosses, says Dr. Hartman.

"You don't have the manpower to go through every voice mail and e-mail," she says. "If you use it just to catch people and if you use it only when you're trying to get rid of someone, then you're encouraging people to try and get around the system. That's certainly not the message you're trying to send."

To help employers monitor their equipment for misuse, Mr. Maskell's company and others are developing sophisticated, customizable tools.

"If your corporate e-mail policy is the law," says Mr. Maskell, "MailMarshal is the enforcer."
By funneling all corporate e-mail through a Windows NT server equipped with WebMarshal, a similar product, for example, the boss can immediately pinpoint problems by scanning Microsoft Exchange for keywords and unusually active computer network users.
Recently, Wired magazine compiled a list of words that employers use for scanning. They include: bimbo, alarm pad, David Duke, risumi, fondle, ATF, job offer, ammonium nitrate, reefer, I'll show him/her, anarchy, signing bonus, meth, copyright, Puerto Rican, stress, pipe bombs, unfair, Aryan and performance review.

Mr. Maskell says he's been surprised at some of the uses found for his company's products.

A Phoenix securities firm, he says, employed WebMarshal to scan for guarantee because salespeople were putting the company at legal risk by giving customers unreasonable expectations for profit. A law firm in Australia adopted the program after an employee was caught signing his company communications with the image of a naked woman.

Attorney Chapman Tripp says he began scanning to cut down on mail delays and mistakes.

"Our clients were experiencing delays receiving or sending e-mail ... because our bandwidth was continuously consumed by entertainment material," says Mr. Tripp. "The cost of increasing the bandwidth to cope was prohibitive. There are the additional problems of e-mail-borne macro viruses and the loss of intellectual property through e-mail unintentionally sent to the wrong address."

A freight company using MailMarshal found that one employee was sending and receiving up to 10 messages every business hour. It turned out the employee, a keen dog breeder and ecologist, was conducting all sorts of nonbusiness activities using the company machines.

"Our company philosophy is that we don't want to totally lock down the employee," says Mr. Maskell. "That's why you can actually set up our products to allow, say, unfettered access to the Internet and e-mail during the lunch hour, for example. The intent is not to say you don't have access to the Internet. It depends on the corporation."

Staff Writer Doug Bedell can be contacted by writing dbedell@dallasnews.com.