IT Employment

Ask something
Discussion Locked

Search Employee Computers

0 helpful
306 replies

by tsert

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I am the network administrator for a small business. Most of our employees use laptops so I cannot monitor their activities, but I do updates and preventative maintenance. At the time when I am updating I take a look around the documents and settings folder and view there history just to make sure there is no undesirable data or websites visited. I know there is another way to check hidden files in DOS but I was wondering if there was some way to search and view websites and cached items (mainly pictures) all in one program instead of searching through docs and settings folders until I see a file name that flags my attention? can anyone help this would reduce my time dramatically.

Thank you in advance for your responses

306 replies

by bhunsinger

go to the :\Documents and Settings\USER\Local Settings\Temporary Internet Files and open the files in there, dirty pictures will jump out at you if you have Microsoft pictures on the machine, or any thumbnail picture program.

by jdclyde

We don't need no stinken ethics...

People like this make the rest of us look bad.

Are you sure your not just trying to find where all the good porn sites are?

Does YOUR boss know that you are behaving in such an unethical behaviour? Does his boss? How many people will come to you for support if they know you are trying to get them busted for something that you don't seem able to control?

by tomsal

This situation isn't one of being unethical, a little over the top for my tastes to just do these searches without anything to amount to probable cause, but its not unethical. It sounds like someone is doing their job to me.

In my other post I explain, but basically we also scan computers here for everything really.. Could be spam, viruses, undesirable emails/documents, "dirty" pictures, etc.

I consider myself a very ethical and moral person with good values and I believe in you treat people fairly and honestly. But I have done these searches myself. Granted I've had reason and it was targetted at a specific invidual after we had reason to suspect something was going on. Nonetheless, I've done them.

What's more is I'm completely honest with users. I flat out tell them what we do. That we monitor activities on the network and suspicous users will cause us to wad through their computer and the entire contents of the hard drive.

Unethical would be NOT doing a search because your "feelings are hurt" at the thought of "violating" someone's private space. Blah blah blah. Its work damn it - here take this violin and play it for yourself.

;)

Now what you do with YOUR computer on YOUR time -- I really couldn't care less.

by seanl

Ethics has nothing to do with it. It's a question of company liability and user productivity.
We know that there will be a certain amount of personal internet/e-mail usage, and fair use is acceptable as long as user stay within the guidelines - i.e no porn or undesirable content. We actively monitor everything. (all automated) if someone is spending too much time on the net, or accessing too many blocked sites, then we will investigate further. All our users know this, and it is a fair policy.
As regards the company liability part: if someone pastes naked woman all over their desktop, and someone walks into their office and is offended by it, then that person can hold the company liable (i.e civil action) if it can be proved that the company is not trying to stop such content.
These are company resources, and as such are wholly owned by the company. Our users have no expectation of privacy at all. This does not mean that the IT techs can just browse any users files, there must still be a reason to do this.
At the end of the day, the users that stay away from undesirable content are not investigated in any way. they all understand this, and accept it as fair policy.

by tonythetiger

Preventative maintenance. Example: I was scanning the network for duplicate files (pictures mostly. What happens is someone will take pictures of somethiing work related (flood damage for example) and put them in a common directory, then 50 people will copy some of these to their personal directory. And then when they're done with them, they end up leaving them there.)

Anyway, while scanning for these dupes, I came across several hundred wma files. It seems some people copied CDs to their personal drive (and many of them the same ones!). THey didn't know that their "My Documents" folder was on the network. Well, that got me to looking for audio/video files and I found a bunch of them, some "off color", but all against policy.

I've had two kinds of experiences related to this. If I just tell the person and get them to delete the files, then later someone gets in trouble for the same thing, I get accused of playing favorites. If on the other hand, I tell my supervisor of my findings, and the person ends up getting in trouble for it, the environment around here is such that I'll get accused of "trying to get" someone. or it will be said that "Tony turned you in!"

From now on, and I told my supervisor this, when I see something, I am just going to delete it myself and not say anything more than putting it in as a ticket in the helpdesk software.

The benefit: I found 77,000 duplicate files, 20,000 of them unnecessary, and managed to get rid of over 12 gig of junk off the network in less than four hours! That'll get the time for a full backup down to under 48 hours, which is what I was trying to do, because when it runs past that, it impacts network and server performance during working hours.

Most of us just want the network we are taking care of to work the best it possibly can. Anything that relates to that is "my job" (and maybe it's just me, but after you've seen hundreds and hundreds of "nekkid pictures", you kinda get immune to it, and they become just "another file" to be dealt with).

by info

If the laptops and computers belong to the company, the company has a right, and a responsibility to make sure that the content is in line with their policies. Dirty pictures and such on company computers put the organization at risk for law suits for hostile workplace, sexual harrassment and a whole raft of other complaints. It is too bad that people cannot see that it is the responsibility of IT Admins to keep the goals and policies of the the organization enforced.
If you can't police your users, everybody ends up looking bad

by mmcdonal

We tell all of our users that the equipment they are using is for official business purposes only, and that they have no reasonable expectation of privacy in the contents of the machine. Every time they log in they have to acknowledge this. We can therefore take any data we want on useage. The law is behind us on this.
And to those weenies who don't want to do business with the original poster, boo-freakin-hoo!

by havilandr

The company owns the computer, the software, the data, the liability of everything the employee does with this computer.

Use Boss Everyware.

by dr dij

internet usage? perhaps you think employees should be allowed to browse porn instead of doing their job. Perhaps they should be allowed to browse jobs at Monster.com on company time. Maybe download spyware, trojans and viruses at same time to make your job easier.

I don't think I'd ever hire YOU if you didn't proactively prevent employees from j**king off at work, which they love to do. This fellow can't use surfcontrol type software if laptops used at home.

We even had one episode where an employee sent a fax to a competitor from our fax machine detailing a confidential meeting shortly after it was over. I'm sure you can tell all your employees never do anything wrong or waste time.

by stubby

> This fellow can't use surfcontrol type software
> if laptops used at home.

Correct me if I'm wrong, but isn't this what teh new SurfControl Mobile Filter is all about in version 5?

We don't use that bit here, but we do use SurfControl the main product (and I love it ....).

by cfrankel

The jist of this is litigation. A company has to protect itself AND it's employees. But is that what you're after? Or are you tyrying to impose your morals and punish offenders. If doing your job and protecting your company is the objective then there is only one way to do this properly.
1) Start with a cleanly imaged laptop.
2) Provide VPN access through a firewall that only allows access to company catalog Busimess and information sites. And provide proper Virus and Spyware protection.

Any other way of doing this is nuts.And, if you spend your time scanning for photographs then you are nuts.

The government has Image Recognition software it uses to to flag Child Pornography etc.. You may purchase such an item. Or you can mimic this activity when certain no no sites are flaged with warning messages or a message asking the employee to justify their business need to access the site.Employees will quickly learn to use their own home computer for such tasks. If your employees are all using laptops, perhaps they all travel too. That would mean they give up a lot of personal time for their company. It's only fair to give a little when you take a lot, so leneincy and soft warning should be the credo. But your job is to protect your company AND it's employees from themselves, not to act as the MORAL Police. It's best to handle thee issues up front and prevent the access from the get go. So you should either lock down these laptops or issue company disclaimers that state the company is not responsible for the non-business activities of their employees. But scanning via eyeball manually is non-productive and rediculous. I would onl;y do such a thing if the employee was ratted-out or suspected of sexual mis-conduct while on company business.

by sgray0707

Maybe I am missing the big picture here. Is the internet the only way to waste company time? Most of these post you all seem to be concerned with wasting company time. I could sit around and read the news paper. The JOBS sections, as some of you mentioned Monster. I could look at a magazine that is not work related. Are you now going to "Police" these activities also? I think the larger picture is just that. That are plenty of things an employee can do that is not job related. IS a smoke break job related? My point is if you are going to "police" the internet usage you need to "police" everything else. I am not saying that in some cases it is not warranted, however to just go out there and look for trouble is crazy if you are not going to do it across the board. Why limit it to just the internet or computer usage?? A large part of building a successful team or company is trust! if you have ever read the 5 dysfunctions of a team the first and root dysfunction is trust. What kind of message does that send to your "team", your company? If you have a reason to distrust someone that is a different story but just to distrust everyone is a sure sign of failure. I think this is where the comment "I don't want to do business with your company" came from.

by t3chiesp3cie

Are you saying that if you had a company that you would have no Internet Usage policy? Or that you just would not enforce it? Or what? I think you are the one I would not want to do business with. If his company has a policy, he has to enforce it. I truly do not understand your response, it makes no sence.

by dave.schutz

The best way to trap information about website usage is through a proxy server. We use ISA server and require all users to connect to the internet through the proxy server. ISA server generates log files you can read or you can purchase software that will read the ISA logs for you and present it in a nice report. Also all users have to sign a release form consenting to monitoring of computer, email, and internet use. This protects the company and the users.

by mgluscevic

Proxy Server is right solution for monitoring traffic trough multiple protocols: HTTP, SMTP, FTP. With MS ISA Server you can define policy rules for accessing different Internet services. ISA has very nice reporting system. SysAdmin can obtain information about most popular web sites, the most active users, protocols etc. ISA is also firewall solution with access lists, forbiden sites, etc. In conjuction with Active Directory Service ISA is very powerfull tool for monitoring network.

by mgluscevic

ISA offer web caching which reduces in/out traffic. But be carefull choosing sites to cache. If the site has a lot of links, all of them will be cached. This can be overwhelming for your network.

Regards

by mgluscevic

First step is to define policy for using Internet Services. Second step is to deploy the policy. It can be only done with some software and hardware solutions - Active Directory Service, Proxy Server (ISA 2004), firewall (Cisco PIX...). After deployment you life be much easier then before. This is personal experience.

Regards

by tony hopkinson

Stop being so damn nosy.
What sort of thing catches your attention ?
Saucy pictures of their wives ? Do they know you are doing this ?

by roger99a

If those are company owned computers then nobody should have any illusions of privacy. The computer and everything on it belongs to the company. The company should have a policy that states that as well.
Surf porn on your own computer for Pete's sake. DUHH

by tony hopkinson

wives, unless they are completely sad and download someone else and pretending it's their missus.
Heard a Lot of shoulds, ifs and buts in your response, decided to catch the fellas attention and see how many of them were true ?
Okay ??
Beside I think the employees should be trusted until there is cause to do otherwise.
They aren't ever going to be trustworthy if they know they are not trusted, before they've even got their pencils out.

by damon

The equipment and software is owned by the business -then Sys Admins have ever right to view check if nothing else randomly.

I have been involved with two employee termination which where because of misuse of time and equipment.

Unfortunately - it is a necessary evil!!

The PC (Politically Correct) Police can get off there high horses and work in the real world.

Big Brother is already here - Live with it.

by dc_guy

I just think that people make too much out of it. We spend more of our life in the office than any other place. We should be able to reach a compromise of sub-KGB proportions on how we use the resources in our "second home."

As for viruses, you can get them anywhere. Porn sites tend to be pretty well administered and probably not among the highest risk areas. They have enough trouble with P.R. without customers saying they picked up a virus there. That would be just a bit too ironic.

by jbaker

If these machines are company property, then there is no expectation of privacy on them. All of the data and files stored on the machines are the property of the company, and therefore the Administrator has the right, and perhaps even the duty to be sure that they remain clean.

by techden

JBaker -

Please be aware that expectations of privacy, as with everything else, vary from site to site, country to country, and culture to culture. While it seems to be the situation that US companies - operating *within* the US - are draconian in their enforcing abrogation / denial of worker's rights, it is not the case everywhere. Many US companies, in their operations outside the US, have (or had to) tempered their zeal in this area, my own company included. This is as much due to local cultural differences, embodied in the local employment legislation, having jurisdiction, as for any other reason.

Leaving all this aside, the "expectation of privacy", or lack thereof, must be set by the company, usually through the mechanism of contract clauses and/or Acceptable Usage Policies. In any *sensible* operation, AUPs will determine both the sites / activities that are /are not acceptable, AND when acceptable. Examples are SurfControl-enforced blocking of recreational sites (sports, news, tourism, etc) during core business hours, and then being relaxed outside of these hours, including lunch hour.

Expectations of privacy must be set by the company - and any company which does not do this is asking for trouble. Employees are entitled to a reasonable expectation of privacy (again, varying...), especially if the company has NOT explicitly stated otherwise. If you don't define it, you can't defend it. You then have no-one to blame but yourself...

by saintgeorge

Do you have saucy pictures of your wife in your work PC? I wouldn't keep there any pic that I couldn't also have in an old fashioned frame on my desktop (talking about furniture, here, not Windows). Ah maybe you download your digital cam pics from home at the office, well that is risky..

by rkuhn040172

Got to agree.

This isn't a privacy issue or who owns what etc.

This is a security issue. Not one of you "professionals" raised that.

Like I want a porn surfing, adware, spyware infested, virus laden PC joining my domain...yeah right.

As a company, that's our equipment and our expense should something go wrong...not on my dime.

by tony hopkinson

then it's a trust issue. While someones browsing habits might give an indication of other more useful indicators, such as why the pc is crammed full of malware and viruses, scanning the pc for those will be much quicker.
Then look as to why. The fact that they frequent shemales'R'US.com out of working hours is of no relevance whatsoever.

by roger99a

Shemales can cause lawsuits. If somebody else runs across these shemales and files and harrassment lawsuit and the company has done nothing to prevent it, the company can be found liable. It's the admin's job to delete shemales.

by tony hopkinson

But if I was to send someone an unsolicted message they considered offensive (of any description), I would be liable not the company.
If you were searching about on a pc I used and found something you considered offensive then you've offended yourself.

I find various political concepts offensive, but I'm hardly likely to be successful prosecuting someone for having a transcript of a GWB speech.

Illegal, yes damaging to the company yes, damaging to company property yes. You could say that people might be put off by an employees taste in the bizarre, but you'd have a tough row to hoe trying to discipline them for it (unless that was their thing LOL) at least in the UK.

Any of this done on works time of course and you can nail them to the wall with impunity if you have the policy in place.

If it's outside working hours and it isn't damaging the laptop, I would consider it irrelevant. I worked with a guy who got the sack for being a pornoholic with his laptop, he didn't get the push as such because of the content of his cache, but because he was doing all his downloading at the office and then compounded the error with a pathetic attempt to hide what he was doing. Course being into ebony porn when you've a female of african descent in charge of HR, is probably a bad idea as well.

by craig herberg

First of all, I strongly suggest that you not snoop on employee computers unless you are specifically told by your management to do so. In the world of confidentiality, curiosity will lead to termination.

On the other hand, if you are directed to do so, you can use a product like Snitch http://www.hyperdynesoftware.com/index.html.
If you just want to clear out the cache and properly delete temporary internet files in an automated fashion, use a product like Webroot Window Washer. This will help you keep the computers from getting sluggish and not run the risk of getting yourself fired.

Craig Herberg

by tony hopkinson

LOL.
Porn password sites, warez sites , mp3 finders, ringtones and plastic hackers (ones who hack their audience)
are generally the worst.
But that's a combination of education and tools not spying.
Why is it some company's think you've abrogated all your civil rights as soon as you accept money for your services.

by roger99a

The company may be found liable if it makes no effort. If I have a spam blocker and your offensive email gets through then I have made a reasonable effort to stop it, but if I don't then, being in a highly litigeous society, I may be held liable for the offense. This could get worse if the laptops are redistributed or shared.

by angry_white_male

First - does your company have an internet use agreement that each employee signs upon employment? Do you live in an area where privacy laws may prohibit such activity?

As the security guy at my company - I don't go on fishing expeditions for something unless I have probable cause to do so (I also work part-time in law enforcement - so some of the same principles apply). One employee (a VP) was given full access to the internet because he was running into too many blocked sites in the course of his research. The weekly check of the web filter showed that as soon as we unrestricted his access, he was surfing porno websites all day long which gave me cause (with our COO's blessing) to make a forensic image of his hard drive after hours when it was discovered that some of the websites had nearly nude models that looked very young and warranted further investigation.

Now if he were just looking at Playboy's website - big f'ing deal. He would have gotten an admonishment and that would be the end of it. However in this case our legal counsel decided that he wasn't breaking any laws (the models weren't nude - but 8 yr olds wearing bikini's 2 sizes too small??).

It was ultimately handled by the executive staff and they didn't pursue it (probably because of the negative publicity that would have ensued - given we're a public/gov't sector company). However if it were up to me he would have been doing prison time. If he's bold enough to do this sorta thing at work - god knows what's on his hard drive at home. Needless-to-say he doesn't even make eye contact with me anymore.

But anyway... that's one example. Why don't you have an internet filter on your network that tracks/filters internet activity instead?

by tsert

Thank you for your serious reply.

Yes we have employee internet use agreement along with P2P, file storage and download agreements which are filled out and signed by every employee.

My employee's mostly work at our customers sites (with laptops)and they use our customers internet connections which they have mostly just tracking software because I've heard of people being released because of web sites and other data found on there machines. if they were blocked then none of this would happen.

But since i must do updates and new installs for all machines i have been told by my boss to scan each machine i get for anything that would breach our confidentiality agreements. (This would be bad because not only would we have to remove this employee from our customers site -We probably would not fire him depending on what it was- but we would look very bad to our customers and obviously lose some of our clout with them as well, meaning we would not get any new jobs from this customer)

So to answer some other ridiculous posts on this thread -

1. I do have permmission to scan for any material harmful to our business

2. No i do not go snooping around on anyones machine without them knowing. They have signed the agreements and sometimes they even watch me.

3. My Company name and my name is of no importance to you DC GUY - from your atitude i can tell you would not even be a candidate for an employee of mine or of my boss (the owner/president of my company). and if you would stop thinking that everyone is out to get you and think about a company that you own and operate and how would you cover your butt?

Again angry_white_male Thank you for your serious reply

by angry_white_male

What you probably want to find out there is some sort of internet filter/blocking/reporting software that gets installed on the client and has the ability to "phone home" with a report of their web activity. I can't think of anything off the top of my head - but there's stuff out there that's used by parents to monitor their kid's web usage, as well as suspicious spouses.

Of course, you don't want to install this and give your users local admin rights to the local machine - so configure your laptops accordingly if you decide to go this route.

The first place I'd check is with SurfControl - I think they make a home software package. I'm not endorsing their product, but we use their enterprise stuff here at work - works well.

Finally, make it very clear to your users that big brother IS watching. For the non-believers here at work, I usually generate a detailled report of their web usage for them and suddenly their non-business web use drops off dramatically. Gets to be embarrassing when websites such as www.herpes.org shows up in your usage report!

by jdclyde

Than what you painted before.

As pointed out by a few of the others, typically most employees are not investigated without a reason. If they are doing something like going to sites that are a violation of policy then your firewall would be giving you indications of this.

There are also content filters that restrict this behaviour or at least notify the net admin.

AFTER there is anything that pops up suspicious, THEN is the time to start going in and looking for abuse.

Do the employees KNOW that their systems can and will be inspected from time to time? It is a bigger matter of respect and trust than what is your legal rights. Many people won't work in a place where they are treated like a criminal, and the one's that do are going to not be as dedicated to the company.

These are the things you should take into concederation, and will better explain some of the replies that you go.

Based on your original post, you just looked like a snoopy little worm on a power trip. Dispite getting testy, you did do a better job of explaining the whats and whys for what you are doing in this last post.

by jbaker

You should have mentioned all of this information previously. This adds an entire new dimension. If the user is onsite, and uses the customer's internet connection to access questionable material, then that reflects badly on your company...as I am sure you know.

As Angry said, there are several pieces of software that will filter material on the machine, and prevent it form accessing anything that is questionable. He gives one, BeSafe is another, as is NetNanny. Simply search internet filters, and mitigate the issue without having to search the machines. It will prevent headaches for both you and your bosses.

by abolla

I think that you would only not be doing your job if you did not take proactive measures. This types of activity is alive and well in the tech community. I personally have never worked for a company that did not have an AUP or computer policy in effect. I really don't think that I would want to work for someone who was stupid enough not to have one, and not be proactive. We monitor every bit of traffic on our network, and record every phone call. The point is, that people come here to work, and if they do their jobs there are no problems. If they don't it is discovered very quickly!

by tony hopkinson

Only the person sending the offensive content. If it was the company doing it the OK. But if I sent a picture of myself naked to female colleague either internally or externally, unless I was doing it under instructions, only I would be liable. To say anything else is to come back to the net nazis who want to make isps and such like responsible for content. Course in this case if I did send it internally, you could probably get me even if the recipient wasn't offended, unlikely the latter, to be quite honest but within the realms of probability.

by tsert

Thanks again for your informative reply.

I now have a direction forward thank you.

by jdclyde

Is it that persons supervisors job to make sure they are doing there work or does the Sys admin have so much free time that they are also the IT NAZI and are going to MAKE SURE that you obey the rules.

I neither have time nor desire to become the network babysitter. My boss has not directed me to do so, which means it is not my job.

Even if I see something, I would have NO AUTHORITY to do anything about it except go tell their boss who is the one that IS responsable for making sure they follow rules.

Don't let people turn a personel problem into a computer problem. If they are too incompentent to know what their employees do, then the supervisors are the first that should be walked out the door.

by support#netropole.com

if i want to know where my users are spending their time on the company dime i look in the ISA logs. as for surfing porn at home on a company laptop, try enterprise anti spyware software. when they connect back into the network and are scanned by anti-virus and anti-spyware, you will have reason to inspect that system closer if infected. alot of users today know how to delete cookies and temp files.
your main job is to protect the companies network. do that first then work on protecting the users from them selves.

by tonythetiger

But that "cause to do otherwise" might just be the downfall of your company. Some proactivity is surely required. Most companies have acceptable use policies. Why have them if you're not going to check on whether or not they are being followed?

by tony hopkinson

(laptops only make a problem becuase outside work they are probably not going through the company firewall proxy is clear, in my personal opinion you should have some evidence of misuse and then verify it. If an employee is doing something iffy, scans for malware, viruses, unauthorized executables will exposes 99.99% of them you don't have to go riffling thru their personal mail and browser cache.
Aside from being quicker and more efficient, it makes you look like you trust your employees/colleagues as opposed to deeming them guilty and then proving on the last scan they were not.
Just a respect issue to me. I got an email at work today, saying email scans were being implemented and one of the no nos is jokes of a sexual nature, that is political correctness to the extreme. If somebody believes I've offended them they have every right to complain, but for an other to decide because they would be offended so would the recipient is plain flat out wrong. The idea that the company could be in some way censured because they'd 'allowed' me to use their facilities to offend some one is stupid.

by nashua403

If you don't police, the company is responsible. I, myself, don't really like to do it, but it can open up a whole bunch of law issues in this day of "everyone wants to sue". Someone walking into someone's office while they are looking at some "unappropriate" mail or website can bring a whole mess.

Our small company doesn't use any kind of softaware to watch (so far) but we do check computers when we think something is going on. All employees have signed an internet policy document which does state that they are there to work and not waste work time on the web. This was drawn up by a lawyer.

by ltr_mo

There is plenty wrong with sending inappropriate emails of that nature from an employer?s email domain. How many times does that joke of sexual nature get forwarded? How many times is it forwarded with all the previous recipients left in the message? Obviously you're not an owner and don't have to deal with the liability or mere embarrassment when somehow that 'joke email' becomes public record somewhere or ends up in the wrong place and the company's name is smeared all over because a user like you decided it was your right of freedom to abuse company resources.

We may live in a democratic society, but democracy stops when you walk in the door to work. Lawyers made sure of that when all of the lawsuits began. Most employers are scared to death (and rightfully so) of what is being transmitted from their business domain. Unfortunately most users view their work computer just as they do their home computer. They are careless and have no sense of responsibility of what they do or any repercussions. I believe that your comment that ?The idea that the company could be in some way censured because they'd 'allowed' me to use their facilities to offend some one is stupid.? demonstrates the unawareness of the typical user.

I believe the original post of this thread probably didn?t spell everything out that he?s facing. I would imagine that he?s dealing with what everyone else in our industry is battling. I agree that there should be a stated policy, education of users, and accountability. Often times it takes the hostile workplace lawsuit, angry phone call from an un-expecting recipient 4 times removed, or a complaint from another company who DOES monitor and enforce a policy to finally persuade those without a policy that those days are over. It?s a business and the owners have every right to protect itself and its good name. A good employee should have respect for that.

by mnchstr

"The idea that the company could be in some way censured because they'd 'allowed' me to use their facilities to offend some one is stupid."

Companies are sued for STUPID things everyday by STUPID employees. It is STUPID for a company not to have a policy like this or not enforce it. I agree that political correctness has run rampant and you can decline to participate but thats like standing in the rain and complaining about being wet. Get an umbrella or shut up.

by toddz

Unfortunately, here in the States, companies do have to worry about being sued for what employees do with company equipment, regardless if it was on company time or not. As responsible network admins, we have to perform due dilligence to protect the company. While we don't review each workstation, we do monitor what goes through the firewall and maintain anti-virus and anti-malware on the workstations.

Our policy states that work equipment (including portable computers) is to only be used for work purposes with limited personal use as allowed by your supervisor. As it is an asset of the company, and therefore the responsibility of the company, no user should have the expectation of privacy from the company on company equipment.

by tonythetiger

I understand the "offensive" part. I've often marveled at how a person can be offended, then take the offensive item around to all their colleaguse to show them just how offensive it was (who is doing the offending now?).

by tony hopkinson

One can only assume that at least some of the employees have been up to no good as it were, using the company laptop, presumably out of hours for non work related things. My problem with the idea of verifying this from a content point of view is someone is sat down imposing their idea of what is right and wrong. I daresay, using ebay, or booking a holday on line, and such is not considered a problem. If you say no porn at all I can live with that as well. But somebody saying you can look at hetero porn that features the missionary position, but not some more ah esoteric porn is most definitely not. The fact that an employee has a 1000s of pictures on orgies in their cache should not concern you at all compared to say a default install of kazaa with it's full spyware/adware package, or a cracked copy of a pc game.

by zlitocook

To remove traces of where you have been. But not many to do a full search on a computer. I have worked for a large hospital and a bank. With both there are security and compliance problems. We have all computer users read, understand and sign a document that states the computer is the property of said company and every thing used, is company property. The user is told that Email, programs installed and any thing else will be checked at regular set times. If anything not approved is found it could be grounds for dismisal.
That said there are a few freeware programs that search hard drives but the best way is the search for *.jpg, jpe, mov, mpg and just to look around. Laptops have one or two users so it would be easy to search them. I have found things on computers that I could not understand why a person would look at! And now just report what I find to the proper people at the company I work for.

by tomber

employee agreement forms to use the PC's for work use only, we were able to catch an inside saboteur. We were having major system crashes with data loss every other week and after looking at all avenues for this problem (software defect, upgrades, hardware defects, hacking etc...) we implemented on all office pc's a spyware program in order to see if a certain sequence of commands or keys could cause a backdoor effect on the defective software. By viewing the spyware logs we found out that one employee had in his/her posession the super user login and password of his/her supervisor and was happilly deleting data files which were causing the system crashes. Therefore, if we had had the spyware installed at the begining we would of seen earlier on this user's unauthorized access and it would of cost us less in time, energy and money spent. So "snooping" can help an admin.

by tony hopkinson

it could create an environment of distrust. Doing it from the start or leaving it on says you are defining all your employees as saboteurs you haven't caught yet. There's a substantial cost to that as well, just a bit harder to quantify, than x hours of your time.
Every silver lining has a cloud around it. How did this pratt get their bosses password, probably a good argument for at least censure on his/her part as well. Don't tell me post-it under the keyboard or a spouse's name ?

by inno4te

A simple thing (costs lots of money), is reinforce your firewalls and cetntralise everything.

by tomsal

We aren't the SS either.

First just a blanket reply to any and all folks in this thread who say its fine for folks to do whatever with company computers if its outside of company time...I couldn't possibly disagree more with you, its not if you are on the clock that makes a difference its who owns the equipment. If its company equipment its company equipment 24/7/365 -- not just during your work hours.

As a backup to that statement, folks who think otherwise than me -- you either were never system admins responsible for the technology in your company or if you were that is EXTREMELY surprising news to me.

We monitor activity on our network, we monitor web traffic to each node. Trust me we see plenty of non-work sites be accessed, we don't sound an alarm and stomp on everyone every time. However we do look for patterns -- does this person do excessive non-work related browsing? What types of sites do they visit? do they download a lot? MP3s? Graphics? .EXE files? Do they sign up with their work email address at various websites (can I please have some more SPAM?). Those folks we monitor, if you call it spying -- guess what call it spying, makes not a damn bit of difference to me or how I feel about it.

Our jobs as admins are to protect the companies technology assets, maximize their efficient use, keep them running and safe guarding the company and its reputation from any "cyber-related" threats.

So if you are un-happy that the guy in IT is raining on your parade because you have a nightly habit at home of watching porn on the company issued laptop...sorry to offend your "civil rights" or sense of "privacy"...

here...wait....wait for it....wait...

there you go.

;)

by pepperami_monster

When the IT stops working because of virus downloads or other such issues who's responsible to get everything back up and running? If I find users going places that pose a threat to our network then I stop them dead.
It's my arse on the line if all the systems go down and everyone's a critic when they aren;t working but no-one wants to take responsibility for causing the problem in the first place.
We have an Internet/E-mail policy in place and it is very fair (according to our employment law advisors).

by techierob

Umm my first question is... Do these lappy's use a static proxy to access the internet? Or are these more "take home" systems that connect to anywhere and everything?

If you run a static proxy, then something like GFIs webmonitor for proxy/ISA servers will give you a drill down of the most common sites... Other than that if they are rouge - then I would set a local machine policy to import a DNS blacklist onto the local machine when they synchronise with the server. Enforce that the setings cannot be overridden with GP and it should sort it self out.

by mdm

Same story, different time, date and location. In simple terms, it isn't IT's job or business to monitor employees. Employees are monitored by whomever they are accountable to. It is not up to IT guys to look around anywhere for the purpose 'making sure there is no undesirable data or websites visited." Do you also check to see what the bosses wife is doing while he is working or away. Who is checking the 'checker'. IT guys are there to make IT work.

by stubby

But a part of making "IT work" is in protecting the initial investment, surely?

I agree that we shouldn't do the checking but we should certainly be advising or assisting in how the checking is done (what software, etc). However, as a partial mitigation, if this is a small company with one IT knowlegeable person in it, then I can easily see why the "checking" falls on them.

by ro.y

If you just once do a check, you will be surprised as to what people do on office computers during office time! It is not only the security risk, but more and more also the company time, bandwith etc. that is misused.
Working for a small legal company I amazed at what I found on just spot checking.

by james

Relating to this area of discussion, I am wondering what action I can / should take having discovered illegal images on a computer i.e. paedophilic material. I run a small IT business and came across such material on a clients computer on which I was repairing the Windows installation.

by frr

Matters of this nature should be immediately reported to your local police force.

by robertmi

I encounter varying grades of objectionable material on many of the computers I examine. If my task is not porn related I usually inform the client and leave to them to determine the appropriate action. If the stuff is kiddie porn then I have a clear duty to report it to the Police and would do so while telling the client of my intention. On the general thread of the topic, the issue of liability for computer content can be quite complex, however the company must have a policy that monitors and controls content, unless it wants to be found negligent if some of the content emerges into the open workplace arena. The practical implementation of the policy (what software should be used) is really what the guy wants to know. Morals have nothing to do with the topic.

by veet voojygig

I am the Sys Admin for a +1000 user company. We have a detailed IUP in place and to support that we monitor and log all traffic using an opensource proxy server which (fortunately for us) includes laptops Internet Use activity. All users are reminded every time they open their browser that their Internet activity is monitored and logged and they all sign an agreement when they start with the company. The system logs activity against the machine IP address and as such is relatively anonymous (initially), but what it does mean is that persistent access of adult/illegal sites which are not permitted by our IUP are flagged and then a more detailed investigation to discover the user is performed. This is as fair a system as we could devise since we are obliged by law to perform some form of monitoring. The system also blocks keywords and blacklisted sites.

Without the aid of some automated system I would likely have to perform some form of manual intervention similar to the originator of this discussion. As long as the users are notified that monitoring is taking place then the company is likely acting in accorance with RIPA.

However, our company does not monitor phone calls or check every letter that goes out with our official stamp or letterhead on it. Why should IT be the only accountable resource?

by craig herberg

Your clients have a reasonable expectation of confidentiality, unless you explicitly tell them otherwise. How did you come to discover the images on the client's computer? While you may have the duty to check up on your minor children, you have an obligation not to snoop on your clients.

If you don't have a privacy policy, you should seriously consider creating one. Just to get an idea, take a look at mine at
http://info-safety.com/privacy.html
What approach you decide to take is your call.

Craig Herberg

by eric-marketing

Having been through this scenario at a previous job, you need to
immediately report it to the local police. quite often the FBI gets
involved, and they confiscate any machines that might have
come in contact with or shared files with the suspect machine.
(this can mean every server in your shop!)

Additionally, if you FAILED to report it, and it becomes evident
that you knew it was there and did not report it previously it can
get you in some pretty hot water. we had a tech who ignored it
and they came down pretty hard on him.

any and all moral obligations aside, if you see evidence of a
serious felony on a machine you're working on any professional
ethical code would dictate that you report it (either to
management, or police, whatever's applicable).

And as a last comment- eww. better to lose a customer like that
to prison than keep working on their equipment. yuck.

by manumit

www.webspy.com.
Although more of a realtime monitoring product it may still be helpful.
Here in the land of Oz this product gets used more and more often to avoid legal liability of company officers.

by kinrowan9

SeanL, I disagree, ethics has *everything* to do with it, and your post actually outlines my reasons for believing so.

You say:
"...if someone is spending too much time on the net, or accessing too many blocked sites..."
and
"...there must still be a reason to do this."

I think those kind of monitoring is just fine, and should be expected by employees, even if there's no stated policy to that effect. If there's a problem of some kind then it will be dealt with appropriately.

What tsert is saying has no indication of any kind of "probable cause" or reason for suspicion at all. He says:
"At the time when I am updating I take a look around the documents and settings folder and view there history just to make sure there is no undesirable data or websites visited."

There's no indication that there are any productivity issues or reasons to believe that anything untoward is going on. It's certainly legal for tsert's company to have this policy, but it's also certainly distasteful and unethical. And the argument that tsert is just doing his job doesn't wash with me either. There are plenty of ways that someone can "do his job" but still act in an ethical manner, and tsert's wording indicates that he agrees with his emplooyer's mandate (I mean, he's trying to do it better, right? If he didn't agree he could just do it poorly.) In fact, there's nothing in tsert's post that even indicates that it's an employer policy at all.

by sww

If you are at work, on a company-owned PC, laptop or desktop, they own everything on that physical asset. All the email, pictures, or logs of websites visited. Period. If you don't agree, test it in court. The courts have consistantly held with the above. There is almost no right to privacy at work. At HOME is a different matter. But at work, you are selling your time in exchange for money, and using company property to do your work. Surf the web all day and email inappropriate pictures at your peril.
I hate having to monitor fellow employees. And we don't do it unless there is a complaint lodged first. But I will do it if ordered to because it's part of my job.

by saintgeorge

You are splitting phylosophical hairs trying to make your point. You think it is ethical to go against the legal right of your employer. What will you do if your boss orders you to check what the users are doing? Resign? Cool, go ahead. It's your right. That won't make it an obligation for the rest of the world. Be as confrontational as you want to but shush, don't go around calling people unethical for the job you have not the guts to do. Makes me wonder, what would they find on your pc...

by nkc

I believe if employees are told nothing is private and monitoring may be done, then searches are ethical. I frankly think a company is being irresponsible if they don't protect themselves and those they serve/support by monitoring what's happening - whether that be financial audits or possible dangerous/inappropriate use of their equipment and employee time. That said, I'm not condoning a searching for the personal interest or satisfaction of IT folks. Appropriate guidelines make for appropriate monitoring.

And I have problems with this comment: "There are plenty of ways that someone can "do his job" but still act in an ethical manner, and tsert's wording indicates that he agrees with his emplooyer's mandate (I mean, he's trying to do it better, right? If he didn't agree he could just do it poorly.)"

Does that mean that it's ethical to take an employers money and trust, then intentionally do a bad job?

by freeozraelised

you as IT Administrator must protect yourself.

I would worry at all about what on the computers.
I will first introduce some policies:

1 - internet and email policy
2 - access to the users C drive policy.

I am an It adminstrator and at time I need to access the machines and I can see some staff that should not be there. What I do is I remove the program or images and using email I direct the user to the It policies and to the specifice policy. I mean we are It adminstrator and we can access what ever we need. That is why I strongly believe that not all people should be IT Administrators, I have no needs or I don't even think looking and someting that I should not.

On the other hand if one day I will see something that is against the law I have a policy that I have to follow.

So jsut relax. As long as the network is working fine and as long the computers/laptops are working fine all is ok.

you must remember that is your boss/es don't provide you with the polices and the tools to perfome what you need to do, you need to explain to them that they probablly don't want you to do it.

do your work and keep on learing ....

Cheers

by narendra

You cannot monitor any user activity with out their written consent as against their human civil rights. Normally you can put a clause in to the contract or employment. Only then can you monitor.

All you really have to monitor are email servers/web or proxy servers/Telephone calls and file/print shares. There's lots of tools out there or you could develop you own.

by dlandrum1

Read any of the current rulings, check with LAW ROOM Audit or any of the other advice sites, check with your own legal counsel.

No employee of any firm has the right to expect privacy as long has you have presented an acceptable use policy. That policy does not have to be a manuscript.

All that it needs to contain is the statement that this equipment is owned by the firm and it is to be used by the firm employees for the sole purpose of furthering the business of the firm and to ensure that such is the case, all equipment is subject to random monitoring at anytime without prior notice.

You can go further to iterate the sexual harassment policy of the firm, etc., but as for the privacy and the legality issue you need do no more.

You place that statement in the employee handbook and you have every employee - owners included - sign and date it.

That's it.

by redgranite

What law prevents an employer from viewing his own equipment at his own place of business?

The IT equipment is not in the empoyee's home and does not belong to the employee. If an employee was reading a porno magazine on company time, most would have no problem taking disciplinary action against him. However, if he's doing it on his employer's computer, he has first amendment privacy??? That's ludicrous.

What about the employer's right to expect productivity out of an employee he's PAYING!

by mmcdonal

This is not a civil rights issue. This is a search and seizure issue.

Most good IT shops have a warning about using equipment for business purposes only. Most courts uphold the claim that all business activities of the employee are the property of the employer, and that, in the case where the employee is forwarned, they have no reasonable expectation of privacy (RXP) in the contents of their computers. No RXP is an exception to search and seizure protections.

by fgarvin

When anyone logs onto a Department of Defense Computer, they get a Banner that reads as follows:

"This is a Department of Defense Computer System. This computer system, including all related equipment, networks, and network devices specifically including Internet access, are provided only for authorized U.S. Government use. DoD Computer Systems may be monitored for all lawful purposes, including to ensure that their use is authorized, for management of the system, to facilitate protection against unauthorized access, and to verify security procedures, survivability, and operational security. Monitoring includes active attacks by authorized DoD entities to test or verify the security of this system. During monitoring, information may be examined, recorded, copied, and used for authorized purposes. All information, including personal information, placed on or sent over this system may be monitored. Use of this DoD Computer system, authorized or unauthorized, constitutes consent to monitoring of this system. Unauthorized use may subject you to prosecution. Evidence of unauthorized use collected during monitoring may be used for administrative, criminal, or other adverse action. Use of this system constitutes consent to monitoring for these purposes. Do you understatnd?"

There are 2 boxes underneath this statement. One says yes, and the other no. If you click yes, you are allowed to continue the login and use the system. If you click no, you are logged off and returned the Ctrl+Alt+Del screen.

My point here is that everyone knows and understands the acceptable use policy and break it under threat of discovery by monitoring.

The computer is not yours to do with as you like. It is not your personal computer. It is a tool provided by the company you work for to complete assigned tasks while being paid by the company.

by mollenhourb9

Yes, there is. Don't snoop on their computers. Tell the managers that it is THEIR responsibility to police their employees, and tell HR that it is THEIR responsibility to re-iterate what is acceptable in the "office" and what is not. When IT becomes the behavior police, instead of the technology police, they jump into an area in which they are ill equipped to deal.

Think back to before there were computers. It was not IT's job to rumage through people's desks searching for copies of Playboy. If a person was stupid enough to keep it at work, they new the consequenses if caught (usually they got fired) and so did their manager (a reprimand for keeping a "bad" employee around).

Let IT do what IT does best. Let HR and your legal department do what they do best.

by cweb

I find these replies surprising in that some seem shocked or outraged that the Company IT department scans company computers for unauthorized material. I've been in the IT field for over a decade now and have never seen or been with a company that doesn't do this! Since companies can be and are held liable for any objectionable material on their computers why wouldn't they scan?
As for the original question, you can do a "view thumbnails" under the docs and setting in temporary internet files and any porn will jump out at you.

by mgates

I would think that most IT departments would have a much better use of their time than to snoop around in the files of someone's computer.

by jamesrl

It depends. At one company I was at, a considerable amount of bandwidth was chewed up by internet radio, stock tickers, P2P file sharing etc. This caused us to upgrade the bandwidth a number of times just to keep the business running. At a certain point you have to say enough is enough and cut off non-business uses that singnificantly impact the business. The IUP clearly stated that the net was for business use. In that case, monitoring usage was totally justifiable - even demanded by senior non-IT management.

As for snooping on personal computers, personally I would avoid doing this unless there was some reason. Unless its been requested by management, or HR, or unless its done in a well publicized manner, its open to being interpreted as arbitrary.

James

by wildhorses

I have to do these type of audits but only when requested by a department head.... We don't have time to go snooping around.

Some "Junk" is on everyones computer... Make sure you check your own too........ Oh, and the Company Presidents....

by jimmy z

Spectorsoft makes several products which can be used to not only limit the websites that employees can access but it also monitors email and instant chat messages like instant messenger and MSN messenger. Go to www.spectorsoft.com. I know about this software because the company I worked for used it on every employee including myself. I no longer work for them because they went to the extreme on this. I believe that if an employer has suspicions that an employee is doing something unethical or illegal that they have a right to load this software on an employee's computer and monitor the activity.

by tony hopkinson

Using 'company time' for personal use.

Using company equipment out of working hours for personal use which puts the company at risk.

Using company equipment out of working hours, for personal use which is no risk to the company.

Only if the policy states explicity that ALL personal use puts the company at risk, can you unite all three scenarios under one umbrella.

by mick11

cfrankel is correct in his post. You really don't want to be caught up in auditing PC's, unless you and your company are protected. For starters, do users even know they are subject to monitoring or auditing? If the answer is no, then STOP! If yes, then get written authorization from your supervisor before commencing these activities.

If it needs to be locked down, do it properly, otherwise don't snoop, esp. if you don't have the policies to support your actions. You can get yourself and employer into trouble!

by dgerlach

I'm the network administrator for a small hospital with 600 employees. We also have a group of people who use laptops. Nevertheless, if they want to access network resources, (including the Internet) they have to log on to our network...and that's where IM (Internet Manager) takes over. Its set up to monitor all activity on the web. Although it automatically blocks certain categories like sexually explicit, you can configure it to notify you by email when users access non-job related sites....such as dating/relationships, shoppping, job searches, online games, gambling, etc. It's a great program and VERY effective. You can choose to block certain categories or specific sites, but still have it send alerts to you telling you someone's trying to access something they shouldn't...or you can just have it pass the traffic without blocking, and send you alerts on where surfers are going. You can also run reports on specific workstations that will tell you all sites visited from that PC.

by scmgithd

add to that the number of users that just don't get why downloading "that cute screensaver" could cause problems or why installing games on a computer so her child could play while she worked was inappropriate or the user that was playing internet games...not just taking up time but bandwidth as well.

I work for a clinic and just implemented a number of policies because of HIPAA security. One of them was that IT could audit a computer at any time for inappropriate use, to be sure they have their windows updates current, that virus scans are being done on a regular basis, etc.

The hospital in our area is *huge* on security. We have a connection to their system to pull patient reports and I get audits on a regular basis that I have to investigate why one of our users was in Patient A on a particular date.

Personally, I think audits are a great idea and the policy needs to be in place more in case of a problem than for normal operations.

by mmcdonal

I have written a script that runs at start up and stores the last 25 typed URLs, and the website names extracted from cookie titles to a hidden access database on some of our computers. Then when the person logs in, the data is sent to a central database for analysis. User data is also attached to each record. This works fine.

by jeff

I'm not surprised by the amount of consternation from the IT folks on this forum. We geeks are the worst when comes to obeying the rules of conduct with our computers and networks.

That said, this IT pro has a responsibility to enforce the company's IT policies. The company has considerable liability if takes no steps to enforce it's policies and illigal data is discovered on it's systems.

I now own the computer networking company that I work for and I have had the opportunity to be a consultant for a couple of law suites (on both sides of the issue)that involved abuse of IT systems. This has changed my attitudes towards this sort thing.

Not only is this man not being unethical, he would be unethical if he made no effort to be aware of his users activities. Good Job!!

by tech_guy1

No one has considered to ask him why or reason for what he has asked.
At my company we run monitors on every pc. We are not trying to cause trouble. We are trying to be proactive on our systems. We monitor applications installed on the drives, web sites visited, etc. It is in our policy and everyone understands it. The reason we do this is to catch spyware, viruses, etc. from entering our network. When monitoring the pc's we can usually clean the infected system before it becomes a problem and block the web sight that it came from so it cannot happen again.

by tony hopkinson

I don't send jokes, my manager does though. From the contacts, they are people who he assumes won't be offended by them. Saying that he did send one (not sexual) that I did find offensive. I didn't start an immediate law suit against the company I work for, simply mentioned that I didn't find that sort of thing funny to him.

Don't forget I'm from the UK, and therefore not on first name terms with a lawyer just in case I get the chance to sue someone.

I believe that your comment that “The idea that the company could be in some way censured because they'd 'allowed' me to use their facilities to offend some one is stupid.” demonstrates the unawareness of the typical user.

Do tell me how an admin can stop this happening !

All you can do at best is detect when you've either got away with it up to now or someone hasn't got round to phoning their lawyer yet.

So don't present automatic snooping as a solution, you know it isn't and so do I.

by hardware guy

I don't know what you guys are talking about!
I came from a researchy/pseudo-academic environment.

If we are truly paid for our time and not our
productivity then I shouldn't even be allowed
to follow this thread. It is not directly related
to what I am paid to do. Technically pushing that idea to the extreme, no body should talk about current events, politics, family at work.

How many of you guy are do this under company time and using company computer (the original poster included although he may have a justification for seeking advise).

by nlatsha

I also find it shocking that some people here are bothered by the fact that they are being watched on their company network.

Granted there should be some rules of engagement (ROE) for doing searches. The bottom line is this:

The computer you use at work is company property, not personal property. If it?s a personal computer, it?s most likely not allowed on the network, with the exception being dial-up or VPN access. All bits stored on the local hard drive or traversing the local network belong to the company. Most places have policies to let the user know this, if they don?t, bad on them. I wrote a logon script that randomly dumps the directory listing from a hard drive to an admin protected server. It also dumps the local admin group and changes the local admin password quarterly just in case you figured it out. Then I randomly check those logs to see what?s installed. I?ve found l0pht and other hax0r/sys admin tools installed on more than one machine before. I give the user the benefit of doubt and just uninstall it, or have the small computers guys format the box. That is usually enough to scare the user into not installing bad stuff anymore, and there?s always those pesky logon groups and that paper trail?

Anything traversing the internet using company IP space is the responsibility of the company. This is regardless of whether it?s regular business hours or not. If you are part of a company with unlimited bandwidth, I don?t think it matters what you surf. But as soon as your surfing habits start to take away from my mission essential services, bad on you. Now I have to go and find out what the top sites visited are. Webspy does a good job of making nice reports for this. It may not even be porn they are surfing, could be streaming radio over the internet. Either case, there needs to be a reason I am seeking this information out, slow internet access, proxy server processing spikes, large log files to store, flux capacitor at 120%, etc.

Some say it shouldn?t matter what they surf, do your IT stuff, but you have to remember, as an IT net admin, we are responsible from the keyboard to the service delivery point, so no, this doesn?t include that playboy in your desk. I am responsible for the performance of the network and this is IT stuff. I also have to keep my costs down. If I have to buy another proxy server, more bandwidth or a larger storage unit to hold the logs, I need to give a reason. If I go up the chain and ask for another 20K, I need a reason, I don?t think this would fly to well, ?Well, the porn sites, streaming radio, espn.com and mission essential services are slow. We need more money for the mission systems to remain operational and allow the users to surf non-work related sites.? (Side note: Yes, I will block espn.com if its one of the top sites visited, I?ll block pokemon-trading-cards.com if I have to. Actually I?ve had to block both of those in the past. Read: keeping costs down.) My blocked site pages were written by myself and if users wanted to know why it was blocked, they could always ask. Usually they didn?t though; I don?t know why they were afraid to shoot me an email about their favorite site. I always responded very politely with the form email of, ?In the course of normal network administration, we sometimes run across sites that are frequently visited and countless hours are spent? blah blah blah.? I always cc?d their supervisor or division chief, along with my own of course. For some reason they stopped asking why they couldn?t spend hours on some sites anymore?

The true bottom line: The box you work on belongs to the president/CEO/Dude up top (DUT), he delegated the responsibility to me or my staff and this is one small portion of my job, Of course this all needs to be backed up by the DUT?

by dtaylor2

Now with SOX, security industry regulations, HIPPA and others - you may HAVE to snoop soon.

Liability, compliance, productivity - I don't think its a question of ethics - Its good business. We are VERY happy with: http://www.spectorcne.com/ it does all the heavy lifting. Make sure your employees know you have it and you may never need it.

Here are the facts according to Gartner and others (from Spectorsoft's site mind you).

> The ease with which sensitive documents can be attached to email communications (intentionally and accidentally) and sent with the press of a button creates potential for loss of proprietary information.

> Non-work related Internet surfing results in up to a 40% loss in productivity each year at American businesses.2

> 58% of industrial espionage is perpetrated by current or former employees.3

> 70% of all web traffic to Internet pornography sites occurs during the work hours of 9am-5pm.4

> Out of 800 workers surveyed, 21% - 31% admitted to sending company confidential information, like financial or product data, to recipients outside the company by email.5

> 48% of large companies blame their worst security breaches on employees.6

> 46% of the one thousand largest companies globally will be utilizing IM as a daily communications tool.7

by charleshagen

It is ethical for a company to protect interests of it's operations (and hence it's workers) by checking this from time to time.

Is drug testing unethical? No it is not. In cases of government contracts, it is sometimes required.

If you protect the company, you are ALSO protecting the JOBS of the employee.

We found an employee moonlighting with a corporate competitor. When this was discovered, corrective action was taken. Jobs (many who used to complain) were saved (even the pious whiners appreciated that).

If there is true teamwork within a company this ends up not being a major issue.

by tony hopkinson

LOL
Whether that's because we are too STUPID to exercise our rights, or because we weren't STUPID enough to let lawyers run our lives is of course open to question.

Tell me as employee, would you sue your employer if in the process of snooping on an another employee you found something that offended you ?

I'm sure you can find someone to take on such an open and shut case.