Installing spy software.....

[fenris]

What are the legal implications of installing software that monitors users activities at work? I have heard conflicting stories that it was OK, and not OK. I have just been put in that particular situation, particularly to monitor a fellow co-worker. My boss came to me and specifically asked me to install something to monitor the activites that they were doing during the day. My boss would not ask such a thing unless he was suspicious of something.

Our network was recently connected to the internet via cable. So it was a concern to monitor the network traffic and watch where every one went. I personally don't feel comfortable doing this, but it may protect the company from liability.

Any suggestions or comments would be appreciated...

BTW, I live and work in Canada so the laws and practices of other countries would be interesting to hear about.

 

[kjonnnnn]

I think it has been decided (at least here in the states) that whatever is done with company equipment belongs to the company. Therefore, employees could be monitored.

Now speaking as a former legal assistant, as a precaution, I would advise that ALL employees be advised that your management reserves the right to monitor any and all employees without notice (either by memo or in your employee handbook, etc.) That would include phone calls, emails, inspect hard drives. All depending on how far u wanna go. You could even say no personal work is to be done on company computers. That would prevent anyone from saying they didnt know there was a policy.

NOW of course people will still do the personal things at work, but it does provide you leeway if you want to monitor someone.

 

[Zelandakh]

Personal freedom means no big brother unless you know about it. If you use monitoring software that users do not know about and you use it to remove someone from the company it is illegal. Send out a memo to all staff (and put in handbook for new staff) that management reserves the right to monitor what you are doing, where you are going and so on. Include guidelines and put in a catch all of "if in doubt contact this person".

Then install loads of monitors and blackmail everyone!

Only kidding

 

[MasterRacker]

Everybody's pretty much covered it. Mainly you have no legal basis to dicipline anyone over something turned up through monitoring unless written policies are in place informing all employees that such monitoring may occur.

Generally this is done as part of the employment agreement or a computer usage policy that all employees are required to sign stating that they have read and understand it. It's done the same way the Internet usage policies are done, where the employee actually signs that they understand that the service is for business use, blah, blah, blah, no porn, blah, blah, blah, no actual work time spent on Tek-Tips, blah, blah, blah.....

;-)

 

[Zelandakh]

no actual work time spent on Tek-Tips?

Oops.

 

[fenris]

Thanks all, I appreciate the input.

I don't know what or how the info will be used. I am pretty sure that it will be used to discipline the employee. I would hate to be the cause of getting someone fired.

I believe that the company has a general etiquite (sp?) policy in place that governs the behavior of all employees using company equipment. It doesn't state specifically anything about computer and internet usage.

Thanks again...

 

[Zelandakh]

Troy,

I would hate to be the cause of getting someone fired.

THEY are the cause, not you. Unless you were using their account to do things that you knew were wrong.

But of course no one here would do that...

Remember that any porn on your servers is ultimately YOUR responsibility and that of your Directors.

 

[fenris]

>Remember that any porn on your servers is ultimately YOUR responsibility and that of your Directors.

I never thought of it this way.
Thanks Zel, I appreciate the response.

 

[Guest_imported]

As a systems administrator myself, I would have no problem installing and using monitoring software if I were told to do so by a respected boss, and if discussions with the boss indicated that the software was being used to check on general types of activity that are not specific to a particular individual.

However, if discussions with the boss indicated that he/she were suspicious of a specific individual, then I would make sure that the boss knew that it may not be possible to dismiss an employee based on their computer activity unless that employee is previously informed of the company's monitoring policy.

On the other hand, there seems to be a number of companies using an "at will" employment policy, which means an employee can be terminated at any time without cause. I have seen this happen, and I have not seen the policy challenged in court. I know of cases where the employer monitored computer acticvity, the employees did not know about it, and individuals were terminated "at will" without cause, because the employer did not like the types of computer activity they were engaging in. But the computer activity was never mentioned as a reason for dismissal. My understanding is that no reason for the dismissal was ever given.

So much for my ramblings...

 

[kjonnnnn]

Actually ALL employees are At-Will, unless u have a specific employment agreement.

 

[justina]

Or unless you live in a state or country, like most of the EU, where it isn't. Ask a Nordic admin if it's at-will there and I suspect you'll get a no. The best advice would probably be to get specific legal counsel. At any rate, I don't think you could be held personally liable for whatever the results are.

 

[MasterRacker]

In the U.S. I believe that At will employment is governed by state law and most states support it. I believe a few don't however. (I could be completely wrong - wouldn't be the first time.) Jeff

I haven't lost my mind - I know it's backed up on tape somewhere ....

 

[iza]

there is (at last !) a great thread on this issue in the "ethics & information technology" forum (you can find this forum under "trend & ethics&quot - i wrote "at least" coz more than half of the threads deals with this subject ;] !

 

[ManagerJay]

My company is preparing to implement monitoring as well. What we have prepared is an addition to the policy manual that states the computer equipment is the property of the company use of the computer equipment can be monitored.

To make sure each employee is aware of the policy, we have prepared an addition to the policy manual each employee will be presented with and asked to sign and date. Additionally, a witness will be asked to sign and date the addition to the policy manual. The employee will then be given a signed copy, and a signed copy will be placed in their personnel file.

This policy change came about after we installed a proxy server/firewall and could actually determine what sites were being visited.

Hope you find this helpful.



Jay