Rock and hard place

I presume the CFO is at the appropriate level to request this and I would say he is being very lenient to allow the CEO to continue using the corporate e-mail.

If the CFO has not done this, send an e-mail to the CEO informing him of the level of monitoring you have been instructed to perform. Tell the CFO ahead of time and copy him on the message. You may want to clarify what the CFO means by monitoring for "how much", whether that means mail box size or number of e-mails.

I would find this a strange practice to allow a CEO to continue to use a corporate e-mail and you may want to suggest to the CFO that the company proceed with a phase out procedure. Perhaps 1 month of continued access, then having the company forward e-mail to a private address for 1 month, then having the company reply with the private address and not forward for 1 month, and then kill the account. I just pulled the 1 month out of the air, but this gives the CEO 3 months to get his act together and use his own e-mail account.

Do what your boss says, but also let the CEO know. This provides the best solution all round and makes everyone aware of what is going on. If you receive complaints from the CEO, don't comment, just forward them to the CFO. This is between them and you are only the messenger.

If the outgoing CEO is being kept on the payroll through November then for all intents and purposes he's an employee. There's no problem or impropriety with him maintaining his e-mail account on the company system.

After that, once he officially severs, he should be removed from the system. You need to clarify more than you have why his e-mail account would remain on the system after November, especially if he's working on deals not for your company. That's personal business and opens your company up to potential liability if you allow continued e-mail use since he could be construed as acting as a de facto agent for your company.

You've been asked to put in place a minimal, and appropriate, amount of monitoring. By measuring volume the CFO is trying to make sure the CEO doesn't try to download the company database, and by not monitoring the actual trasmission transactions you're avoiding ethical issues, if not legal ones.

I wouldn't worry about this. You're doing the right thing acceding to your CFO's request and you're doing it the right way by doing it yourself (obviously you want to document everything you're doing at a granular level every step of the way). It may be that your new CEO made this request to your CFO who handed it down to you, which is not something you should be concerned about. You just need to make sure your new CEO and your CFO are on board about cutting off your old CEO's e-mail privileges the moment his employment status ends.

You don't have a location specified in your profile - I'm just hoping you're in the US - if you're UK based, or working in the US for a UK company, you have legal problems right now and need to rapidly CYA!

If you're in the UK, pm me - quick!

GG

Also forward that report to the former CEO so he's aware that his activity is under some level of scrutiny. This will probably hasten his finding a new address.

I wonder what the big deal is. Why doesn't this guy just start auto-replying now that by 1-Dec his new address will be weasel@....? Is he trying to save money? Is he trying to imply that he's still affiliated with the company? Is he trying to get leads on new business that he can foist from the old firm? It seems to me that there is really no good reason for the company to allow this, unless he's going to be working on a consulting basis.

I completely agree that a request of this nature is purely ethical. I have been tasked with requests like this many times in my career. My issue with this one is that I believe the request is purely to serve the CFO's desire to be nosey. Why not want to know WHAT he's sending/receiving and not just the volume if there's a question regarding his actions?

Why do you think you have an ethical dilema? The CEO's email belongs to the company, just like that of any other employee, regardless of the content. When using company hardware and software for email there is no reasonable expectation of privacy. Management has every right to have the CEO's email account monitored. You may find this work assignment unsettling, but that's beside the point.

A simple solution may be to inform the CEO that his company email is being monitored, and then offer to show him how to set up a hotmail account.

All you need do is monitor the amount of E-Mail going through that account. It should be an easy process particularly as you have not been asked to actually monitor the e-mail content just the usage.

I would hope that the Departing CEO is using this time to contact everyone in his address book to inform them of his new E-Mail address and picking up any stragglers who contact him personally. I would think that the usage would be minor and tapper off as time goes by as all of the old CEO's contacts learn of his new address.

If the CFO has the Authority you have to follow his instructions and since he has been quite specific follow them to the letter and just monitor the actual usage and don't take note of anything else. While this is unusual I take it that the CEO is leaving on good terms so I would see this as a period of time where he can get his personal contacts converted to his new E-Mail address.

Just do as you are told nothing more and nothing less. If you just monitor the throughput of that particular E-Mail account you are not really invading any ones privacy as you are not actually reading any of the e-mail just seeing how much it is being used and I wouldn't even monitor it to the stage of seeing how much is incoming and how much is outgoing just the total through put.

Col

I think there is a limit for everything. The basic system, which i follow in my office is, after a employee's resignation, we will block his email id. but monitoring a mailbox is not a adwiseable idea from my point of view. we will inform to the particular employee about not to use the email id for personal usages. we will give time to change his contact information / registration inforamtion from office id to personal id after a simple verification. i suggest to inform your CEO regarding this issue and do your assigned work....

i'm almost inclined to agree with your cfo. folks who leave the company don't get to use company resources for any purpose, and management is always responsible to ensure that company resources are used judiciously ... it sounds (to me) like your outgoing ceo is putting you in a difficult spot by asking for access above and beyond what he's entitled to (and admitting to use that doesn't support the firm's business), and it sounds like the cfo may be aware that the outgoing ceo is using the firm's resources for other business.

so: do what your boss asked you to do ... and keep track of what you report to the cfo just in case. at least in the u.s., email content and email access belongs to the firm (as much as a laptop does), and it sounds like management is doing their job here.

I work also for a large comapny and we have in place a strick policy for such things. In a nut shell contact your HR dept. and ask them if this has been approved it will save you a ton of headachs down the road. In these cases even our legal dept. is involved.

In my view the new CFO should have the courage to tell the old CEO not to use the company?s resources for personal gain as other people's livelihood is involved.

I don't think it is actually legal to monitor user's emails without informing them that you are.
It is the same as call monitoring and video recording. You have to inform people thay are being monitored.
This should be done by an email and web access policy and should be signed by all employees.

The CEO has a right to know how company property is being used, including email. If the new CEO asked for the old CEO's email to be monitored then do it and monitor it. Just make sure what you are doing is legal or things could get nasty.

I have to do this with all of our employees. Not a very comfortable position. However, as explained to me by our retained Law Firm, we had to post this in our Employee Handbook as well as declare it on our Log In Screen. Futhermore, targeting one individual vs ALL employees seems a bit unethical, aside from the fact that E-Mails, correspondence etc belongs to a company when done on Company equipment. Politics aside, you need to stand up to your CFO and tell him how you feel about it. If for nothing more than to clear the air and get the burden off your back. I can see and Understand the stress you are going through. For what?! Is your CFO going to be there wiping the drewl off your chin when you are 95 yrs old? Life is too short man! Reach down, grab a hold, and tell him what you think. If he doesn't respect you for it, then it is probably someone you don't want to work for. Next thing you know, he will be asking you to do other things that are a little grey. Then what..
My opinion. I am sure not everyone agrees, but I have been there, am there and done that.
Cover yourself first and make sure you are within the legal limits of the law in all aspects.Good luck hombre.. I feel for ya.

I am Lead Network Admin for a major corp. I deal directly with the President of corporation, and he has made requests in the past after a employee has quit or been terminated. I currently have six ex-employee company emails being redirected to him, they arrive neatly in labeled folders if outlook. I have asked him to email me the request to do so for each instance. So not only am I not looking at the emails personally, but I have written documents of the request to redirect them. I agree it does not seem ethical, however the emails are property of the corporation as far as I know and anyone not smart enough to use a personal email for personal reasons deserves to get spied on.

Not all companies have a clear chain of command. If your company does, and your CFO is not directly above you, be sure your supervisor is aware of this new requirement. Also, be sure to document the request, all reports, and other comments or discussions on this topic. Personal logs, notes and documentation may be helpful if this task turns into a problem for you.

Finally, in the banking business we have an internal auditor that employees can go to and discuss job tasks that the employee feels may violate laws. If your company has this type of audit control, it may be good to consult their advise.

I've been through (almost exactly) the same. It was a stressful experience because spying on another employee is not the primary task of a sysadmin. It was against my (personal) principles to do it but I wasn't left any other alternative. And I was afraid my colleagues would avoid me like the plague when it became known I spied on a colleague.
Over here (The Netherlands) there are tougher laws on privacy which prohibits actions like these. Furthermore, after my experience I made a protocol in which the role of the sysadmin is cleared in these circumstances. Also, the exact procedures which must be followed for such an action were written down (subsidiarity rules). It was eventually accepted by the works council. Since sept 2003 such a protocol is mandatory by Dutch law. And I was backed by Dutch law in case this protocol wasn't conclusive.
The only advice I can give you: suggest a protocol and talk about it with your CFO and get it accepted and published company wide. Also announce every x weeks/months there will be a random sample taken from the network traffic. This way you make sure colleagues won't use the excuse they didn't know of any sampling.

In the UK, the email system etc is owned by the company. Permission may be given for private usage, but as company property it remains within the power of the authorised personnel to check all mail not marked obviously as personal.
I have always told my users that all their mail including personal is monitored by default as part of company policy. It isn't but the very believe affects the quantity and quality of messages, it also saves arguments later.

We had various management changes in a short period of time and some were allowed to keep the address active and some weren't, but we had to keep tabs on them to make sure they were not "landing the company in it" as emails from a company are legal contracts to a degree.
If the company has seen fit to give overall control of IT to the CFO then he has the ability to issue relevant instructions as part of his remit.

As a civil libertarian by conviction, I usually support privacy issues very strongly, but not in this case. As internet usage has grown in the workplace, it has become evident that there really is no privacy available to anyone who uses the internet as a practical matter. Therefore, everyone is already forewarned. If one has secrets to transfer, then I would suggest Certified Mail Return Receipt Required by Recipient. As far as ethics go, now that all businesses of import use the internet to conduct B2B transactions and communications, it is even more important that security concerns be paramount. To this end all employee inter/intranet activity, including the content of email should be subject to random oversight. There are trade secrets, fiduciary responsibilities, monetary transactions, and other sensitive matters that are subject to actionable consequences if security is breached. Since all responsible computer usage policies usually state that personal use of the companies' resources is either prohibited or subject to inspection, the idea of personal privacy is ludicrous. Now your former CEO, who is no longer employed, but maintains his email address as a courtesy and not for your company's business cannot expect privacy. A good sense of ethics, which you obviously have, precludes spying just for the sake of it, but former employees do not enjoy that as a right. Your CFO's request is actually benign. Monitoring the volume of use should be standard anyway. If he had a suspicion that it might be used as a portal or some such nefarious reason, then detailed monitoring would be in order. In cases where there are real ethical concerns, you would be correct to ask for a written order detailing the extent to which monitoring takes place. In fact, if there is no policy for just such a circumstance, you as IT Director should create such a policy and have it signed off on by the executives. In this case, I wouldn't even bother to ask for the order in writing. Believe me, the former CEO already knows that he could be monitored for content. And all you are doing is seeing if he is using excessive amounts of resource. You are already an ethical person who can obviously be trusted not to snoop for pleasure. Don't give it another thought.

I think that you are looking at a situation that is a matter of corporate policy. In short, exactly what is the corporate policy on the monitoring of email? Is there one and, if so, does this situation fall within the parameters of that policy? Also, if there is a policy, the policy should outline the procedures to follow (who to contact, who may initiate the request, etc.) If there is no policy in writing, get details on exactly how the boss wants this handled in writing then get a policy put into place ASAP.

What I have not found in your message is the manner in which you were given this request. I would insist on having the request in writing. The simple reason is CYA. If a question is raised later regarding why you were monitoring the ex-CEO's email, what proof do you have that you were following the request of you boss? Have the request in writing and you have proof.

Finally, on the issue of allowing a former employee to maintain an email account with the corporation, many have raised liability issues. This is very true. But again, exactly what is the corporate policy on ex-employee email accounts? If there is no policy stipulating what to do, then someone needs to establish one. HR may have some generic information that covers this (for example a broad statement that an ex-employee will stop enjoying corporate benefits -- except retirement -- 30 days after seperation ... such a policy would cover email accounts as well).

CYA. Find out what the corporate policies are regarding the situation and follow them. If there are no policies that cover this, then get someone higher to put something in writing, follow that written directive and then encourage them that a corporate policy needs to be established.

Good luck!

I would ask the CFO to send you a written request with his name on it for this either an email or an inter-office memo. Especially since you have expressed your concern to him and was told to do so anyway.

You have an ethical delimma in your hands and it depends strongly on your personal values and beliefs. If these say it is wrong to do what you are tasked to do, then you need to voice it up. It could cost you your job, but you will feel good about it, since your values and beliefs have not been violated.

On the other hand, if you have an 'Acceptable Use Policy' (AUP) in place, then you should read it and determine if what you are tasked to do is in the prints. I have one in place and I monitor Internet/e-mail usage of all my users. I report irregularities and excessive usage to higher management, leaving them to decide the actions. I have no guilt because it is my job and the AUP, which forms part of the HR manual, warns all employees of where the company stands on this polcy. If you are in this situation, and you have an AUP in place then you should not feel guilty about performing your task even if it means someone will loose his/her job.

dv370,

You're being asked to do something distasteful but within the rule of law (I believe). Unless expressly stated, it's my understanding that employees have no expectation of privacy with respect to telephone or email communication using company facilities.

That said, given the nature of what the CFO is asking for he/she should be prepared to make such a request in writing and sign it. It's not unreasonable for you to ask for specific names of people on the board of directors who authorized such actions and have the letter cc'd to one of those board members.

FWIW

Inform theCEO and Go a head and do what the CFO wants you to do that way you have applied your cord of ethics.

You are in a tough spot my friend. I would recommend that you document everything, because this is likely to go bad for you. If you refuse the CFO, you could get fired on the other hand, if you don't refuse you could get fired too. Document everything! Good Luck!

Based on your heiarchy, you supposedly report to the CFO. Since he is your superior, I would do as he requested. However, I would send the CFO an email with what he requested in the email to verify that what he requested is what you understood his request to be. I would also do a blind cc to your email address for your records. This will get it in the email system so that you can have something to fall back on in the event of a finger pointing match.

I would not worry about it... The company e-mail system is for company use only and it is open to examination. I am certain you are ok since a CFO is usually an officer (not just by title) of the company.

You have not been asked to monitor the "contents" just the volume. Go to the management tool for you email server and make a note of the mailbox volume size and number of messages. Then note daily/weekly or wahtever the change in the volume and number of messages. You don't need added access or violate any privacy.

I do think that you are in "rock and a hard place" but not one that you can get out of with careful wording. If you have a company policy that all employess sign about the usgae and moniter of company equipment, email and software then you might want to remind the CFO of that, in a nice way of course. You might what to inform the CFO of what you can do to either move all incoming mail to the new CEO and somekind of filtering method that your email systems can handle. I donot think you should tell the old CEO of this but advise the CEO that he shuold start using another acount for his transactions soon. Why inform HR is this just to cover your put in all of this, but I would tell the CFO that you have or are going to inform HR of what is going on.

There are really 2 issues here. One is the use of the email and the other your need to CYA.
Let's deal with the CYA first. Try and get the direction in writing if you can. If not document the meeting with time and date as well as contect information. Do not leave this at work or on the company computer system. That is all you can do for this one.

Now on to the request of the CFO. First what is your company policy concerning using company resources for non-company work? I know rank has its priviledge but the other side of the coin is an out going CEO puts his slacks on one leg at a time just like the rest of us. Use your policy as further CYA. The company email system belongs to the company and is not subject to privacy concerns. As a result I would do what the CFO directed and go on about my job.

1) The following is predicated on the assumption that, regardless of your company size, you DO have a company computer use policy stating somewhere in the document that all computer files belong to the company and that monitoring is a distinct posibility. If you don't have a computer use policy -- get one. NOW! Then have it reviewed by an attorney or minimally by an IT HR professional before having each and every computer user sign a copy to be kept in their personnel file. This is a common Best Practice!

2) It sounds to me like your CFO didn't agree with the new CEO's decision to let the outgoing CEO use corporate email. Having lost the argument the CFO is now trying to establish his case (ie: You monitor quantity of useage. CFO takes usage quantity to CEO and says, "See? He's using too much of our company resources!" Or some such thing. Whatever the case you DON'T want to get tangled up between these two! You report to the CFO. He gets to tell you what to do.

3) Whatever the CFO's motivation you have been instructed to monitor. Just Do It! Only be sure you CYA with your own documention of who, what, when, where, and why. Leave the rest of the ethical and legal issues to the CFO and to the new CEO. No matter how you "feel" about the CFO's motivation you're not the company policy maker. In the event trouble brews, and you have CYA well enough, you can prove that you're just doing what you were told to do.

4) Number three is one excellent reason to have a computer use policy.

Good Luck!

A tough spot that you find yourself in. The CEO will no doubt be offended that he is being monitored, however, would understand the critical nature of the company information that could flow outside. Personally, being a CEO myself, I would suggest that the CFO approach the subject with the CEO and have the conversation that it is a requirement for legal purposes and for useage purposes, prior to placing you in this position.

If the CEO wishes to use the address for Other opportunities, why not have him setup a new account on a separate server in some other company and notify all the people that the account will be changing in 30 days. Direct all incoming mail to that account for a specified time frame that is agreed upon by both the CFO and CEO as a parting gift and that way the forwarded messages only go on for so long as well as the monitoring.

Best of Luck

In any way you can think of CYA!

Tough sistuation but if he is still an employee through November you will need to keep his email around and treat it according to company policy. Our policy gives us unlimited access to emails because the company owns the email box, system, etc. So if the new CFO wants to monitor for traffic or content you should be fine if it is covered under your acceptable use policy for email.

Basically you do what you're told whether it goes against your ethics, etc. The CFO has the right to give you that directive. If you feel it goes against your ethical thinking then you would simply tell your boss that although you don't like it, you will follow his directive, and monitor. Since you're between a rock and a hard place, yourself, I would also get, in writing, from him that this was a directive from him. By doing this, it will cover your rear end should anything come of this. I hope this helps, and I simply would do the same thing.

If management wants something monitored, monitor it. What's the ethical dilemma? You work for a company and they want you to manage a company asset.

The CFO's request is not out of the unusual. Since company e-mail systems belong to the company to aid in the carrying out of its business and therefore can be monitored, and in many places are on a routine basis. You may feel a bit uneasy about being put in the position of e-mail monitor, but it is a perfectly legitimate and defensible request. It could be that the higher-ups want to make sure the former CEO doesn't use that e-mail account to do harm to the company.

If I were in your position, I would do as requested, and while doing so, I would watch for abuse of the e-mail system by the former CEO, such as divulging "company secrets." Any such activity must be reported immediately to your boss and the new CEO, and the e-mail account should be terminated.

At the end of November, or on the first day following the former CEO's complete severence, his e-mail account should be terminated. There is then no legitimate business need for his continued use of the system and he has no right to expect e-mail access to continue beyond that date.

Not to worry, you're in the clear on this because you're not violating any laws -- you're protecting the company.

our company regularly monitors not only email but actually computer usage via real time monitoring. Our company also uses a termination check list. This allows for the return of asset keys, laptops, cell phones, Id cards, and termination of computer usage for the company. Continuing usage could lead to unauthorized access that the company has no legal remedy for. When an employee is terminated or teminates his employment all ties are done when he goes. Usually the employee is paid for the day even though he may only be there long enough to complete termination package.

If he was in a position ie CEO CFO ect.. his mail is forwarded to the new CEO or person incharge of that department. Much of his mail may be related to the company and should reach the new person in that position.

I think you CFO is being to soft. I would openly monitor all communications to ensure corporate information is not being lost. Looking at the size of a email is irrelevent since a database could be sent out in smaller packets.

Part of your job is to watch out for the companies interests. Try not to get into a political game. Documentation is everything. Keep good records. If the CFO requested it, give the information requested. If the CEO finds out and asks pass on what you were told.

Dan

Since you report to the CFO and the old CEO is on his way out, you should do what the CFO asks without notifying the old CEO.

It's possible that the monitoring is only to let the CFO know when the activity tapers off to nothing so he can tell you to terminate the account.

An outgoing CEO may still have ties to the company. He might have a couple of deals going that he's committed to wrapping up or he may be going to work as a consultant for your company.....these issues could also still be up in air.

I think since there is not actual reading of email going on, there is no problem. Monitoring volume is harmless and one might expect that you can and do monitor everyone's email volumne on a regular basis.

The legal aspects will vary from state to state, however, the general rule is that the company and its officers are legally responsible for all material on, in, and leaving the corporate systems and network. Past court cases have seen multi-million dollar pay outs.

The CFO has a responsibility to protect the company and a right to know what is happening, especially with a person who is no longer with the company and still using corporate assetts. However, if the CFO is being honest in saying that all he is interested in is the usage stats, this could then be due to oncharging agreements, then there are various technical solutions that will handle that. Another technical option may be to set up mail forwarding at the server if it only relates to contactability; then the old CEO could set up an account elsewhere for transmitting in preparation for the final cut.

A few years ago I did an assignment on this and related issues and will happily send you a copy if you wish, just email me with a request.

... getall the CxOs together, and have them sign off on an addendum to the policy.

I see nothing wrong with the request. However I would strongly advise that you ask the CFO to document the request in writing! An e-mail is probably easiest, but a letter would be acceptable. You will, of course, maintain a copy of this authorization OFF-SITE (eg at home!) for your records.

This is what was refered to in "Clear and Present Danger" as a "get out of jail free card". Monitoring of the e-mail at a basic volumen level is well within your abilities, and within the scope of your job. If you are concerned, document the request, and then follow up by keeping very detailed records of what you do, and how you do it.

If the crap hits the fan, then you should be OK.

Just my two cents worth.

The politics surrounding the request is all that has been an issue for me, not the request itself. I have requested, in writing from the CFO, the request and am documenting everything as I go. At this point, that's all I can do as it is a directive from my immediate manager. Thank you for the relevant responses, ideas and information. They are greatly appreciated.

I'm amazed that so many posters are so free with legal advice when they are completely ignorant.

Althought this guy is apparently not in the US, his title expresses the state of US law in ever state I checked, a few years ago.

If you have questions, best check a lawyer to see what the law is for the state that would be applicable. (for example, company headquarters in X, you are in Y, servers are in Z might be more difficult).

One of my friends who is a lawyer described a case in which an email system of message storage was likened to corporate file cabinets, rather than to corporate phones, and there was no issue related to wiretapping whatsoever.

One thing you might do is make sure that the CFO knows you are doing him a special favor and get brownie points out of this.

And on a sideline, you might note that Oliver North was brought down, in part, because he was such a jerk to his email administrators, requesting and requiring them to delete all his top-secret emails covering his extra-legal shenanigans. The admins got suspicious and made double sure to save copies, which were later given to Congress.

So , email admins can be VIP's too. Why don't you see if your CFO won't buy you a Coke or lunch or something? It might be worth it to him to keep you discreet.

While we can only guess why you're being asked to monitor, may I throw in an example from my past work experience?

I worked at a firm that had a large lay off of software engineers and managers. In a local office of 400 over 150 lost their jobs.

The individuals who had been at the firm for many years, over 10 years at least, were permitted to come to the workplace and access their email and use their office during their job hunt. Some were getting paid severance, some wheren't. It was part of an exit program. They were permitted to use these services for varying amounts of time. This included their remote access of email from home.

I am not sure why they did this, but it seemed to soften the blow of losing their jobs. It seems like an IT nightmare to me. I'm not in your field, so I can only wonder about all the pitfalls of allowing this practice.

As you've already been informed in professional and not so professional ways, it's legal to do this monitoring. The computers and the Internet access belong to the company and they are permitted to monitor in anyway. The only notification employees are due, are usually in the employee handbook or any security splash screen that comes up when they log onto the network.

You are most likely asked to do this because of your level in the company in consideration of the level of the former CEO in the company.

I'm glad you posted this question. There are no dumb questions. I learned a lot reading the various posts. Good luck to you!

I don't know how it is everywhere, but in my organization the computers, every file on them, and every transmission sent from or received by a computer owned by the company is the property of the company. That means that employees do NOT have the right to privacy when utilizing company resources.

I therefore don't see this as an invasion of anyone'sw privacy, and see nothing wrong with the request. I would comply without question. Anything that ANY individual is doing with company resources could potentially harm that company, so they have a right to defend themselves by monitoring that resource usage.

That's my two cents anyway...do with it what you will...

In my previous company, everyone have to sign a form, one of them said that you are allowing the company to monitor your emails or your documents store in your local drive or network. Do you have this kind of policy in place?

Some people just have a chip on their shoulder and find it impossible to be civil to others. That kind of posting in no way reflects the many who contribute to these discussions and should be treated as the exception rather than the normal.

Cheers

Col

I don't think I have anticipated you to defend your position, my comment was to merely remind you of your position.

"As the IT Director, I am responsible for security and integrity of the data on the network.

Fine, sounds good so far.

Now, let's get the summary of the rest:
a.) "The CFO has _told me_ to monitor CEO's mailbox"
//CFO cannot _tell you_ to do so, he might officially request (in writting) such activity to take a place.

b.) "I have _told him_ that _I thought this was NOT the right thing to do_, however (???)
I am being told to do it because of this "rock and hard place" the CFO is in (???)."
//Again, you have informed your CFO (verbally) that it is not right thing to do, but agreed to do this thing that is not right ANYWAY because CFO is in "rock and hard place" position.
The question is also what does the "rock and hard place postition your CFO is in has to do with you? Does it implies that you don't have to behave professionally?

c.) "I will be monitoring usage myself instead of asking one of my associates do it.(???)"
//Then you chosen to do the thing that is "not right to do" by yourself, although you were not asked to provide for content monitoring of the correspondence in question but merely the amount of correspondence (messages).

At the bottom you mention that you are not _pleased about the situation_. My professional opinion is that you got yourself into it, and no website forum will bail you out. Howgh.

If you believe one of the objectives of your job is to secure the data on the network, then this "Rock and Hard Place" feeling truly is part of your job. Every pieces of software tools or other devices which access data in your network is in your jurisdiction to be monitored for anything out of the ordinary; including that of the ex-CEO. Now the only reason that you may not be monitoring OTHERS is that, there is no possible threats from them (I would even question that in this day and age.). As a pre-emptive action from your employer this new task of your will be justified.

If you're ever called into a grandjury to testify about the contents, then seek a counsel before you answer. (that is a joke, with all that is going down in DC!!).

Relax. Stand for what is right. May God Bless.
Regards,
RK

He's looking for a way to "charge back" for the use of company assets.

I can relate to your dilemma. However, there are a couple of things all parties should be reminded of.
First, no email can be considered safe from prying eyes. It is the property of the organization which provides the connectivity, directory and storage service by default and I have no expectation of privacy from any corporate email service. For commercial ISP's I have some expectation because I pay money to get some privacy.
Second, no one from the FORMER CEO down should expect any organization to provide unremunerated email service for them if they no longer work there. The account should be terminated at departure.
Third, most email clients provide a delegation feature that allows other users to take optional roles for email maintenance. This is the cleanest method for your CFO to get what is needed. The IT guy does not need to act as a secret agent.
Fourth, because email does not enjoy the same benefit of law (or suffer postal charges) as USPS and delivery services, one should not assume it is physically secure. Don't email anything you wouldn't want to become public knowledge.
Conclusion: If your company grants email service to anyone free of charge and the company needs to see the content or metadata then official who needs the data should be delegated to look at the email himself. If the company charges for such service, then the contractual agreement of service should determine the legal limits of such monitoring.

(a) The CFO can generally request this and it's appropriate
(b) How squeamish you feel is a separate issue if your boss is making a legal request
(c) Make sure corporate legal counsel is onboard. You can ask for advice without letting the CFO know about it.

Get over your discomfort with "spying". "Monitoring" is a generally accepted IT practice.

You contact the outgoing CEO requesting an alternative e-mail address.

For the month of November the status quo on he e-mail remains as a normal employee. During this time you request him to notify all his cantacts. You may even offer to do it for him. I mean how difficult is it to send mail to everybody in his address book?

Then during December you inform him that all mail to his account will be opened by the new CEO's PA, who will determain if it is company related mail. This will be sent to the new CEO. ALL other mail will be forwarded to the new e-mail address given to youo. The account will be suspended [deleted] at the end of December. Then yoou do not have a problem anymore.

Lastly, once you had the talk with the outgoiing CEO you draft a note to the CFO stating what was discussed and what will be done. CC this to the ouotgoing CEO and maybe even the new CEO as well. During all of this it is important to keep the company policies and lacal laws in mind.

If you do not have a policy covering this NOW is the time to write it.

If you are not being asked to read the emails and just monitor usage, it's not even a problem. Network performance and usage are standard-issue administrator tasks, and if your boss wants usage stats just shut up and give it up.

The manner in which the vast majority of professionals respond and assist with issues on this board, is exactly why I came here in the first place, to get advice. I do not expect an apology from the individual that posted the unnecessary comments. I am pretty thick skinned given that I am a female IT executive :) and have had to handle much worse criticizm, albeit more "constructive", in the last 7 years as a manager. Professionals are supposed to be just that, professional.