Workplace monitoring has many legal and personal implications for employees, and you should be aware of them. Today I'll tell you about the different types of monitoring.

Monitoring in the workplace is legal under certain circumstances, and while there are general rules about monitoring, there is also a lot of room for interpretation by the courts.

Today, there is a lot of debate about how widespread workplace monitoring actually is. Some surveys, such as those conducted by the American Management Association, found that 78 percent of US firms monitor employee communications in some form, with about 47 percent of them checking employees' email. However, another privacy group, the Privacy Foundation, estimates that 15 percent of businesses monitor employee email and 19 percent track Web usage.

Regardless of the actual number, what is probably true is that any particular patterns detected by one of these systems can tip off an employer to do a more detailed investigation. So while most businesses are not monitoring all of their employees all of the time, it is probably the case that it is more targeted based on certain reasons for them to monitor an employee in the first place. Therefore, simply calling attention to oneself is cause enough for further monitoring.

Today, there are three main ways of monitoring employees.

Electronic
Video
Telephone

Nand Mulchandani is CTO of Oblix.

Electronic Monitoring

This tends to be the most widespread and easiest to do, but there are different degrees and types of monitoring.

Almost every action on a computer connected to a network can be monitored. This can be done at multiple levels: at the network level, at the email level, or at the Internet request level. The other advantage of electronic monitoring is that different logs and pieces of data can be stored in a database for later use and can be correlated across multiple dates. Therefore, it is possible to run programs that can discern patterns of behavior that can lead to further investigation.

There are multiple places a user can be monitored with different types of information.

On the PC

Each PC has detailed information and logs about user activity. In some cases, an employer or someone else can place a keyboard logger, which as its name suggests, can record every keystroke a user makes on the keyboard. In many cases it is almost impossible for regular users to ever detect that it has been placed on their PCs. Therefore, it becomes especially important to make sure that your PC remains locked when you are away from it and also that it doesn't install software downloaded from unknown users or sites.

Invisible KeyLogger is an example of a piece of hardware that logs every keystroke in Windows. Raytown Anti-keylogger promises to disable keylogging software.

A Web browser records temporary files (log files with a history of visited sites) as well as cookie files that also record personal information about a user and the sites they have visited. This information is stored on the PC and can also be used to track where a user has been.

Email servers

There are a couple of important reasons for employers to monitor their employees' email. The first is to prevent the leakage of confidential and proprietary information, and the second is to monitor employee productivity (such as how much times employees spend emailing friends), and the third is to protect against illegal or inappropriate use of the email system to spread content like inappropriate jokes that may create legal hazards for a business.

Once you send email from your PC, it goes to a mail server. There are a number of products being sold today that can intercept all email coming into a mail server and scan for all kinds of information -- confidential information being sent out, keywords, lewd jokes, and any information that an enterprise wishes to track. These systems are almost completely transparent to the user, and the information can be directly traced back to a named user. Therefore, every email that you send can be read and monitored, and specific keywords can alert administrators to look further into your behavior.

Many of these systems can detect email with various keywords, such as "confidential" or "acquisition" or inappropriate keywords (as in jokes), and can scan attachments and examine every part of the email.

SuperScout Email Filter is one example of a product that scans email.

Web surfing

Just like email, all traffic from your Web browser going over a corporate network typically goes through a set of servers connected to the internet. It's very easy to track all Internet requests coming from your PC and administrators can easily set up systems that track and analyze such traffic. They can then be alerted based on specific patterns of activity (how long you visited specific sites, for example) or match sites you are visiting to a database of known site characteristics (porn, for one).

Some users think that using sites with encryption means that all their information is secure. While the content that you get back from the site may be encrypted, the actual URL you are visiting is not! Therefore, your pattern of use can still be tracked.

Here are some links to products that can track Web traffic:

Web mail

It's harder for organizations to monitor personal email accounts separate from the corporate system because servers are outside the enterprise. Like instant messaging, the traffic between the browser and email system is not encrypted (you'll see "http" instead of "https" in the URL). However, your organization can still monitor the traffic using a network packet sniffer.

Another option is for the organization to install a keylogger or other software that can detect and track everything a user types on his or her computer. There are some very sophisticated programs now available that can also track Web-based email and instant messenger traffic. These include WebMail Spy by ExploreAnywhere Software.

Instant messaging

Organizations are increasingly concerned about employees leaking confidential information and files over instant messengers. If you use a public instant messaging system such as AIM, Yahoo!, or MSN, the client running on your PC connects directly to an instant messenger server running outside of work. A network packet sniffer can still check the traffic between the instant messenger client and server because the connection is not encrypted.

This type of monitoring is harder to implement, but is often used when an organization wants to look deeper into the activity of a specific employee. Desktop keylogger systems such as iSpyNow log instant messenger activity as well as other PC activity.

A Wall Street firm was recently fined for not storing instant messaging traffic between traders. Many enterprises are implementing internal instant messaging systems for these types of regulatory reasons. Remember, just like corporate email systems, everything you type into your company's instant messenger system can be logged, archived, and viewed by the corporation.

Video Monitoring

Video monitoring is harder to do, as it requires the installation of a specific video camera and monitoring equipment, as well as a specific set of people to monitor a particular user or group of people. This is typically done in public places (elevators, locker rooms, and the like) but can also be done secretly in an office or cubicle.

Here's a link to a press report on a recent court case regarding video monitoring that might shed some light on why video monitoring in the workplace is a difficult issue to discuss without the specific context of the problem at hand.

Telephone Monitoring

Telephone monitoring tends to be more targeted in nature, because it is hard to set up electronic programs to automatically detect or record communication for all employees. It is the easiest type of monitoring for a manager or supervisor to do, as it can be done simply by picking up extension lines that are easily installed and accessible.

The most important thing to realize is that if an employer is tapping your phone, the listener is required to listen in only as long as it takes to determine if the call is of a specific business nature. The person is not allowed to listen in on private conversations. However, what constitutes a private conversation or not is subjective, and is often decided in court. What's important is to simply stay away from making private calls on business phones, especially where there may be specific monitoring going on for quality control or other purposes.

How to Protect Yourself

The most important thing to realize and always bear in mind is that business equipment and services such as telephony and computer equipment is to be used for business and not personal use. Keeping that overall principle in mind should help you a lot.

Second, you can always meet with your human resources representative at work to discuss company policy and the appropriate laws governing workplace monitoring and privacy. There is nothing to be ashamed about in having such a discussion, as you are rightly concerned about understanding the appropriate use of company equipment and resources. Note that each state has very different laws governing workplace monitoring, privacy laws, and employer disclosure. Therefore, having this discussion can allow you to ask specific questions tailored to your specific company in that particular geographical location.

Third, always be aware that every communication you make can be monitored, even if you think you are not being monitored. Phone calls always go through exchanges where they can be recorded, and email and Internet traffic go through a large number of servers where information about the traffic is recorded in logs and in many cases directly filtered. Most of the traffic on the Internet flows unencrypted, so at every stage monitoring equipment and logging can easily detect not only where a user is going but also what the person is typing or sending.

Fourth, suspicious traffic and patterns always attract attention. Therefore, making phone calls at odd hours, browsing specific sites during business hours or after hours can always flag attention. Note that many of these monitoring systems have information on millions of URLs and sites, so they can easily correlate and flag suspicious activity. Once alerted, a company can build a good case for further investigation into a specific employee's behavior.

The bottom line is that employers have a right to monitor employees (under specific circumstances), but the boundaries between personal privacy and a business' need to monitor its employees isn't always clear. Therefore, it's important to make sure that you always err on the side of keeping your personal communication separate from your work.

Note that current techniques and advances in technology have made it possible to monitor almost every aspect of an employee's behavior, and in many cases, to go beyond the workplace and into the home and external activities.