For more than a decade, rapid increases in the use of computer technology, both at work and in the home, have changed the way Americans work and communicate. As of September 2001, 174 million people—66 percent of the U.S. population—were using computers in their homes, schools, libraries, and work. In the workplace, 65 million of the 115 million employed adults age 25 and over, almost 57 percent, used a computer at work. However, in recent years, while the increase in the percentage of employees using computers has been modest (52 percent in 1998 to 57 percent in 2001), the percentage using the Internet and/or e-mail at work grew from about 18 percent in 1998 to almost 42 percent in 2001. As the use of these electronic technologies has increased in the workplace, so have employers’ concerns about their employees’ use of company-owned computing systems—e-mail, the Internet, and computer files—for activities other than company business. Likewise, privacy advocates have raised concerns about the potential for employers to infringe upon employees’ right to privacy. In response to these concerns, many employers have developed policies to notify their employees that they monitor use of these systems and to provide guidance to employees about the appropriate uses of the computing technologies. Information on the number of private sector companies that monitor their employees, their monitoring practices, and their effects on employee productivity and morale is very limited. While some of these studies suffer from methodological limitations such as low response rates, taken together they seem to indicate a general trend towards employers’ increased monitoring of their employees. In addition, software developers have made it easier and inexpensive for businesses to monitor their employees by creating software that can, for example, scan e-mail messages for certain words or phrases and/or block inappropriate Internet sites. The Electronic Communications Privacy Act (ECPA) of 1986, which is intended to provide individuals with some privacy protection in their electronic communications, has several exceptions that limit its ability to provide protection in the workplace. For example, the act does not prevent access to electronic communications by system providers, which could include employers who provide the necessary electronic equipment or network to their employees. (See, e.g., U.S. v. McLaren, 957 F. Supp. 215 (M.D. Fla. 1997)). Because the ECPA provides only limited protection to private sector employees, some privacy advocates have called for a new law that would specifically address workplace computer privacy and limit the powers and means of employer monitoring. The most recent federal statute affecting privacy in the workplace is the USA PATRIOT Act, which was enacted in the wake of the September 11, 2001, terrorist attacks. This act expands the federal government’s authority to monitor electronic communications and Internet activities, including e-mail. However, no federal executive agency has general oversight responsibilities for private sector employee-monitoring programs. Many states have statutes that are similar to the ECPA, with greater protection in some cases. Additional protection may be provided through state common law, which is based on judicial precedent rather than legislative enactments. Such decisions, however, have generally given employers substantial leeway in monitoring computer use of their employees. While state common law may recognize the right of an individual to take legal action for an offense known generally as “invasion of privacy,” such actions historically have not provided employees with additional protections. Courts have found that employers’ monitoring of their employees’ electronic transmissions involving e-mail, the Internet, and computer file usage on company-owned equipment is not an invasion of privacy. Invasion of privacy claims against an employer generally require employees to demonstrate, among other things, that they had a “reasonable expectation of privacy” in their communications. Courts have consistently held, however, that privacy rights in such communications do not extend to employees using company-owned computer systems, even in situations where employees have password-protected accounts. All 14 companies we contacted routinely collected and stored employee e-mail messages, information on Internet sites visited, and computer file activity. Eight of these companies reported that they only read or reviewed information on employees’ electronic transmissions once the company determined that a further investigation of employee conduct was warranted. However, 6 of 14 companies told us that they routinely performed additional analyses on the stored information to determine if employees were misusing company computer resources. For example, these companies routinely searched the e-mail message titles, addresses, or contents for proprietary information or offensive language. In general, we found that the companies we studied initiated few investigations of employee computer conduct. Most of the companies that have reviewed information on employees’ electronic transmissions and determined that misuse occurred, reported that penalties ranged from counseling and warnings to termination. All 14 companies collected and retained electronic transmission data as part of their normal business operations, primarily as backup files and to manage their computer resources. Backup files can be quickly restored if a computer system failure occurs, and the company’s operations can continue with as little interruption as possible. However, according to company officials, the information on these backup files was also available as a source of data for reviews of individual employee e-mail messages, Internet use, or computer files. Company officials also said that stored data were used to manage their computer resources. For example, officials at one company told us that they collect e-mail and Internet data to track the systems’ capacity. Another company’s representatives said they use the collected information for troubleshooting and to correct network problems. The 14 companies collected different information for e-mail, Internet use, and computer files. For e-mail messages, officials from the 14 companies reported they generally collect and store all business and personal incoming and outgoing e-mail messages including attachments, addresses, and the date and time the e-mail was sent or received. For the Internet sites visited, generally the information collected included the web address and the date and time the website was used. For computer file activity, all the contents of the files on their network computer systems were backed-up daily. Officials from the 14 companies reported they retained these data for short periods of time. Nine of these companies said that they generally retained these files for 90 days or less, and one company kept its e-mail data for as little as 3 days. Eight of the companies reported that they would only review the employee electronic transmission data they collected if there was an indication of employee misuse of computer resources and the company initiated an investigation. Generally, investigations were initiated by either a complaint submitted to management by a company employee or a “request for information” by management concerning an employee’s conduct. These initiating requests were usually reviewed by a number of company officials, including representatives from Human Resources, General Counsel, or Computer Security prior to the actual retrieval of employee information. Company officials told us that unless they received a request for data, they would not review any of their employees’ electronic transmissions. They added that access to any data collected for an investigation is restricted to a limited number of company officials. Company officials cited several reasons for establishing this reactive approach for reviewing employee electronic transmissions. One company believed it was important to establish an atmosphere of trust and presumed employees would use the system primarily for business purposes. Another company’s officials said that they did not have enough resources to actively monitor their employees’ electronic transmissions. Six of the 14 companies we contacted, in addition to collecting and storing information on employee computer use, performed routine analyses on all employee e-mail or Internet data resulting in the review of selected electronic transmissions. These companies reviewed the electronic transmission information for several reasons. Company officials reported that they needed to protect proprietary information and prevent Internet visits to inappropriate sites. For example, 3 companies reviewed e-mail messages using commercial software that searched for keywords. These companies selected the words to be searched, and a computer file of e-mail messages that matched pre-selected key words would be generated. Company officials routinely reviewed this file to determine if e-mails contained inappropriate material. Other companies reported different strategies to identify employee misuse of computer resources. One company’s computer security office generated a weekly report of the 20 employees who logged on the Internet the most times and listed the sites visited. Officials reviewed this list to determine if inappropriate sites have been visited. A second company reviewed the Internet use of a random sample of 10 to 20 employees each month. This review was intended to identify employees who had visited offensive or inappropriate sites. Employees identified through this process were generally counseled against further misuse. Finally, one company, in 2001, monitored the inappropriate websites employees visited, such as hate, violence, and pornographic, and in 2002, it purchased new software to block these offensive sites. Generally, the companies we reviewed—regardless of whether they routinely reviewed employee computer use or examined individual employee records only to pursue particular complaints—reported that the total number of investigations was very small as a proportion of the number of employees with access to e-mail, the Internet, or computer files. The number of annual investigations ranged from 5 to 137 and represented less than 1 percent of the total domestic employees at these companies. For example, one company with more than 50,000 domestic employees reported 72 e-mail investigations and 48 Internet investigations in calendar year 2001. We found companies most often investigated the alleged misuse of employee e-mail followed by investigations of Internet use. Not surprisingly, the company that routinely reviewed employee Internet use initiated the most investigations on employee Internet conduct— 90 investigations. Investigations of the content of employees’ computer files were the smallest in number, and only one company told us that they had initiated investigations related to them. Only 2 of the 14 companies we interviewed were able to provide data on the types of disciplinary actions taken against employee misuse of computer resources. One company reported that of its 20,000 employees, it terminated 2 employees for inappropriate e-mail use, 2 for Internet misuse, and 1 for computer file violation in 2001. The other company reported that over a 5-year period it had terminated 14 employees for misuse of the Internet. Most of the 14 companies reported various types of actions that could be taken against employees for inappropriate use of computer resources. Four companies told us these actions ranged from informal discussions or formal counseling between the employee and company managers to terminations. Only the most flagrant and repeated violations would result in employee termination. The 14 companies we reviewed all have written policies that included most of the elements recommended in the literature and by experts as critical to a company computer-use policy. There is a general consensus that policies should at least affirm the employer’s right to review employee use of company computer assets, explain how these computer assets should and should not be used, and forewarn employees of penalties for misuse. We also found that all companies disseminated information about these policies through their company handbooks, and 8 discussed their computer-use policies with new employees at the time of hire. In addition, some companies provided annual training to employees on company policies, and others sent employees periodic reminders on appropriate computer conduct. The 14 companies we reviewed had written policies that explained employee responsibilities and company rights regarding the use of company-owned systems. Our discussions with company officials and review of written policies showed that all 14 contain most, if not all, of the policy elements recommended by experts. From our review of the literature and discussions with legal experts, privacy advocates, and business consultants, we identified common elements that should be included in company computer-use policies (see table 1). These experts generally believed that the most important part of a company’s computer- use policy is to inform employees that the tools and information created and accessed from a company’s computer system are the property of the company and that employees should have no “expectation of privacy” on their employers’ systems. Courts have consistently upheld companies’ monitoring practices where the company has a stated policy that employees have no expectation of privacy on company computer systems. The experts also agreed computer-use policies should achieve other company goals, such as stopping release of sensitive information, prohibiting copyright infringement, and making due effort to ensure that employees do not use company computers to create a hostile work environment for others. Finally, according to experts, employees should clearly understand the consequences for violating company computer policies. For example, one company’s computer-use policy states that “violators are subject to disciplinary action up to termination of employment and legal action.” While the experts we interviewed recommended that employers include the above elements so that employees can be informed and acknowledge that they have no expectation of privacy on company-owned systems, some experts recommended additional steps that would help to protect employee privacy. For example, one expert recommended that employee groups participate in the formulation and review of monitoring policies; and another expert recommended that employees have access to any information collected on their electronic transmissions. Furthermore, other experts recommended an alternate policy framework that would preclude employers’ review of employee electronic transmissions except when they have a reasonable independent indication of inappropriate use. From our review of company computer-use policies, including interviews with private sector officials and reviews of written policies, we determined that all 14 companies generally addressed most of the seven key elements of a computer-use policy (see table 2). While we determined that these 14 companies’ computer-use policies generally addressed the key elements, we found that there was variation in the specificity in policy statements. For example, one company’s policy statement regarding “Monitoring Use of Proprietary Assets” stated, “ reserves the right to access and monitor the contents of any system resource utilized at its facilities.” Another company’s policy stated, “the information and communications processed through your account are subject to review, monitoring, and recording at any time without notice or permission.” An official from another company, which only collected and stored employee computer use information and did not routinely review electronic transmissions, told us his company informed employees of its capacity to monitor its property with the more general statement that “data is collected and the company reserves the right to review this data.” Only one company reported that its policy did not include language specifically informing employees that their computer use was subject to review by other people in the company. Representatives from this company told us that their policy does, however, include a statement that employee messages could be accessed and that the company could not ensure their confidentiality. Under “Establishing No Expectation of Privacy” some companies directly inform employees that they should under no circumstances expect privacy. For example, one policy stated, “All users should understand that there is no right or reasonable expectation of privacy in any e-mail messages on the company’s system.” Somewhat less explicit, another policy stated, “Our personal privacy is not protected on these systems, and we shouldn’t expect it to be.” Some companies generally implied the principle of “no expectation of privacy” with statements like, “ reserves the right to audit, access, and inspect electronic communications and data stored or transmitted on its Computer Resources.” Finally, the employers we reviewed also addressed improper uses of computer resources. All company representatives had policies that notified employees about improper uses; and the eight written policies we reviewed contained specific prohibitions on the use of company resources to create or transmit offensive material. Moreover, seven of these policies included some form of the word “harass” under their discussion of prohibited or inappropriate uses of corporate systems, and some also included a form of the word “discriminate.” No two policies addressed this issue in exactly the same terms, but representative statements prohibited behaviors such as “viewing or communicating materials of an obscene, hateful, discriminatory or harassing nature”; “any messages or data that…defames, abuses, harasses or violates the legal rights of others”; and “Accessing, downloading, or posting material that is inappropriate, fraudulent, harassing, embarrassing, profane, obscene, intimidating, defamatory, unethical, abusive, indecent or otherwise unlawful.” Experts recommend that policies include such specific prohibitions in order to limit a company’s liability for workplace lawsuits, and they stress the importance of ensuring that employees understand the company’s definitions of inappropriate use. Both the literature we reviewed and experts we interviewed agreed that establishing company policies on employee computer use is incomplete without strategies to disseminate the information. Experts pointed out that informing employees about these policies not only established the limits of employee expectations about privacy but also allowed them the opportunity to conform their behavior to the circumstances of having limited privacy. Among the 14 companies we contacted, we found multiple and active ways to inform and remind employees about the policies concerning the use of computer systems. Officials at 8 of the companies we reviewed said that at the time of hire, new employees receive training on company policies for using the computer systems. Officials from 5 companies told us they required all employees to participate in an annual review of their computer-use policies, either through an Intranet-based training or over e-mail. Other training techniques company officials described to us included business conduct reviews every 2 years, weekly e-mail reminders of their policies, and a series of videotapes that explain policies to employees. In addition to training programs, 10 companies have daily messages referring to the corporate policies that employees must acknowledge before they are allowed to log in to the systems. None of the companies’ representatives we interviewed said that they had changed any of their computer-use polices or practices as a result of the terrorist attacks on September 11, 2001. Officials from four companies reported that after September 11th, they had been asked by law enforcement agencies to provide information about their employees’ and customers’ use of their e-mail systems and other sources and that they had complied with these requests. But none of the employers we interviewed had increased the amount or type of information they gathered on employees’ use of e-mail, the Internet, or computer files. However, representatives from 10 companies did report increased concern for the security of their computer systems from outside trespassers or viruses entering their systems through e-mail or from imported computer files. Seven company representatives mentioned the Code Red Worm—which appeared around July 2001—and the Nimda virus—entering computer networks on September 18, 2001—as particular examples of the most serious kind of threat they faced and said these events had motivated them to strengthen the virus protection of their systems. Ten of the companies we reviewed told us that they have procedures to screen incoming e-mail messages for viruses, for example, by deleting file attachments with an “exe” extension from all incoming e-mail messages. In early 2002, one company began and another was preparing to use software that searches title lines of incoming e-mail and deletes messages with sex-themed language, simply because the volume of unsolicited e-mail had begun to overwhelm their systems. Such actions reflect the widespread belief among the company officials we interviewed that the worst nuisance and most likely threat to company computer systems comes from outside trespassers with a capacity to paralyze a company’s Internet infrastructure or disrupt business, rather than the company’s own employees. We are sending copies of this report to the Secretary of Labor and other interested parties. We will also make copies available to others upon request. In addition, the report will be available at no charge on GAO’s Web site at http://www.gao.gov. Please contact me on (202) 512-7215 if you or your staff have any questions about this report. Key contributors to this report are listed in appendix I. In addition to the individuals named above, Nancy R. Purvine, Eric A. Wenner, Shana Wallace, and Julian P. Klazkin made key contributions to this report.

Summary: Over the past decade, there has been a technological revolution in the workplace as businesses have increasingly turned to computer technology the primary tool to communicate, conduct research, and store information. Also during this time, concern has grown among private sector employers that their computer resources may be abused by employees--either by accessing offensive material or jeopardizing the security of proprietary information--and may provide an easy entry point into a company's electronic systems by computer trespassers. As a result, companies have developed "computer conduct" policies and implement strategies to monitor their employees' use of e-mail, the Internet, and computer files. Federal and state laws and judicial decisions have generally given private sector companies wide discretion in their monitoring and review of employee computer transmissions. However, some legal experts believe that these laws should be more protective of employee privacy by limiting what aspects of employee computer use employers may monitor and how they may do so. Following the September 11, 2001, terrorist attacks on the United States, policymakers re-examined many privacy issues as they debated the USA PATRIOT Act, which expands the federal government's authority to monitor electronic communications and Internet activities. GAO reviewed 14 private sector companies' monitoring policies and found that all companies reviewed store their employees' electronic transactions: e-mail messages, information on Internet sites visited, and computer file activity. They collect this information to create duplicate or back-up files in case of system disruption; to manage computer resources such as system capacity to handle routine e-mail and Internet traffic; and to hold employees accountable for company policies. Representatives from all of the companies had policies that contained most of the elements experts agreed should be included in company computer-use polices. None of the companies GAO studied had changed any of their employee computer-use policies or monitoring practices after the September 11 attacks. Most companies did, however, report a growing concern about electronic intrusion into their computer systems from outside trespassers or viruses and had increased their vigilance by strengthening their surveillance of incoming electronic transmissions.