Across the U.S., technology monitoring by an employer remains unregulated and varies from state to state. As a general rule, unless there is a company policy that specifically states otherwise, employers may listen, watch, read and record all of your workplace technology use.

What Is Under Surveillance?

At the workplace, your email and voicemail are not private. If employees use an email system provided by their employer, that employer is allowed to review its content. Content includes both incoming and outgoing email as well as internally generated employee-to-employee dialogue.

If you plan to view personal web-based email accounts such as AOL, Yahoo, Hotmail and Google, as well as sites hosting instant messaging portals such as AOL, your employer has an open window to that activity if you view it using equipment and connections provided by your employer.

How about the use of a laptop, notebook or desktop during the workday? If you use these or similar pieces of equipment, they also act as your employer's window into your workspace.

By the Numbers

According to surveys by the American Management Association (AMA), approximately 75 percent of those questioned monitor their employees' website visits in order to prevent inappropriate surfing. In addition, 65 percent use software to block or filter connections to websites deemed off-limits to employees, while about 33 percent track keystrokes and time spent online. More than 50 percent review and retain electronic email messages sent to and from their employees.

Another recent AMA survey found that 24 percent of organizations have had employee email subpoenaed and 15 percent of companies have gone to court to battle lawsuits triggered by employee email. In addition, 26 percent of employers have terminated employees for email misuse. Another 2 percent have dismissed workers for inappropriate instant messenger chats, and nearly 2 percent have fired workers for offensive blog content, including posts on an employee's personal, home-based blog. How far can an employer legally go with technology monitoring? The answer: pretty far!

Legal Exposure

Email mismanagement tops the list of electronic risks facing employers today. As many recent court cases have indicated, costly lawsuits and actions by disgruntled employees and competitors can easily topple even the strongest business.

Employers are clearly concerned about litigation risks of employees' technology use and the role that such evidence plays in lawsuits and government agency investigations. Workplace privacy court cases have been decided in the employer's favor. Bourke v. Nissan; Smyth v. Pillsbury; and Shoars v. Epson demonstrate how employers can prevail when it comes to monitoring employee usage of company-owned technology.

Tiny Device Casts a Large Shadow

It is not uncommon for employers to "shadow" your productivity during the day. A tiny application is loaded on your equipment by the employer's information technology department before it is deployed for your use. This little application allows the employer to track your every move. Your employer has the ability to record your website visits, how much time you spent on those visits, what you did during those visits and every key hit during your stay — including user names and passwords to any sites requiring such authentication.

Loopholes?

You often hear that an email system allows you to mark email as private. Does that allow you to send email to friends and business associates and put an employer on notice that such content is private and should not be subject to oversight? Usually not. While many systems have this option, there is no guarantee that such messages are kept confidential. However, if the employer's written email policy states that messages that are marked private are kept confidential, then you are likely okay with that assumption.

Can deleted messages still be reviewed by the employer? Through the use of tape and other backup systems, very often employees' email content is permanently reviewable.

The Accounting Profession

Our profession has not gone untouched by these concerns. In the American Institute of CPAs 2008 Top Technologies Survey, topics such as Information Security Management, Privacy Management, and Identity and Access Management were voted most important by 26.5 percent of those surveyed. For more details on this survey, visit http://infotech.aicpa.org. There are a number of other groups that are actively involved in workplace monitoring issues:

National Work Rights Institute (www.workrights.org).
9to5 National Association of Working Women (www.9to5.org).
Workplace Fairness (www.workplacefairness.org).
American Civil Liberties Union (www.aclu.org).

A Word to the Wise: Employers

Employers need to develop a technology acceptable-use policy to be followed by the employees within their organizations. This includes monitoring and sporadically testing policy compliance to ensure it is being followed.

A Word to the Wise: Employees

Employees should become aware of acceptable and unacceptable use of employer's technology. Assume all activities are being monitored all the time. Remember, your employer provides you access to email, the Internet and other technologies to allow you to effectively do your job. Also, never assume anything is private or confidential when utilizing this technology. And, most of all, use common sense when using that technology — as if your employer was looking over your shoulder.
 
JAMES C. BOURKE, JR., CPA, CITP, is the partner-in-charge of internal technologies at WithumSmith+Brown. He is the Immediate Past President of the New Jersey Society of CPAs. Bourke is also a frequent speaker and author on various technology topics and serves on the American Institute of CPAs Certified Information Technology Committee and Top Technologies Initiatives Task Force. He can be reached at jbourke@withum.com or 732-842-3113.