The Extent of Systematic Monitoring
of Employee E-mail and Internet Use

Table of Contents

 Introduction
     Table: Number of workers under continuous online surveillance
 Surveillance vs. Spot Checks
 Growing Business
     Table: Some major customers of employee-monitoring companies
 Monitoring Grows Despite Slowdown
 General Methodology
     Table: Employees monitored worldwide by individual software products
     Table: Internet vs. e-mail monitoring
 The Online Workforce
 Comparison with Previous Studies
 Vendor Response
 Conclusion
 Appendix A: Notes on Extrapolated Figures
 Appendix B: Internet Monitoring
 Appendix C: E-mail Monitoring
 

Introduction

Fourteen million employees -- just over one-third of the online workforce in the United States -- have their Internet or e-mail use under continuous surveillance at work. Worldwide, the number of employees under such surveillance is at 27 million, just over one-quarter of the global online workforce. The "online workforce" is those employees who have internet and/or e-mail access at work, and use it regularly.
 

Number of Workers under Continuous Online Surveillance

These measurements of the extent of workplace monitoring are derived from a study of self-reported user-base ("seats") and revenue figures of publicly-traded companies that sell e-mail and Internet monitoring software such as Websense and MIMEsweeper, and focuses on continuous, systematic surveillance.

Previous studies of the extent of workplace monitoring have been based on survey questions that were mailed to human resources managers, and have counted "spot checks" and other ad hoc examinations of employee activities to arrive at their figures for employee monitoring.

The FoundationÕs research suggests that low cost of the technology, more than any other factor, is driving the growth of e-mail and Internet surveillance in the workplace.
 

Surveillance vs. Spot Checks

Several previous studies have looked into the difference between continuous surveillance and spot checks:

• A poll of corporate chief information officers in the U.S., conducted by CIO magazine, found that only 17 percent conduct sporadic employee e-mail checks, 16 percent never monitor employee e-mail, 11 percent check only on "problem employees," and 38 percent check only after there's been a complaint or productivity issue.
• In the UK, KPMG conducted a small survey in late 2000, and found that around 50 percent of the surveyed companies monitor Internet use "infrequently," around 20 percent monitor on a monthly basis, and only 11 percent monitor on a daily basis.

Our study's emphasis on continuous monitoring does not deny the importance of non-continuous monitoring. Many cases of employees fired or suspended for "inappropriate" Internet or e-mail use (see the Job Loss Monitor maintained on the Privacy Foundation's website) have not involved systematic monitoring.

For example, the South Dakota state government fired twenty employees in June 2001 for Internet misuse, not as a result of any systematic filtering or monitoring system in place to keep tabs on its 13,000 employees, but rather, according to Wired News, on the contents of one Web log report of the 100 users with the most hits over a three-week period.

However, 40 Xerox workers fired in 1999 for surfing forbidden websites were nabbed by software that recorded every website they had visited and every minute they had spent at those sites, according to the New York Times. In fact, Xerox routinely monitors the Web use of every one of its 92,000. Mike Gerdes, manager of information security at Xerox, has been quoted several times on the subject of employee monitoring, but declines to specify the products used.

The City of Boston's use of Elron Internet Manager is another example of the role played by systematic employee monitoring: The city uses Elron's software to monitor Internet and e-mail use on 4,000 computers spread out over 52 agencies. According to one report, officials have disciplined and even fired a handful of employees who violated the city's strict Web and e-mail policies on inappropriate material.

Many companies employ ad hoc monitoring, in that they've turned on logging in their proxy servers; at a later time, the company can examine the log files if the need or desire arises. It is also likely that some employers are systematically monitoring their employees, but without a product such as WebSense or MIMEsweeper, using instead standard Unix or Linux facilities such as syslog, or even with NT event logging.
 

Growing Business

Even figuring in reseller discounts and hardware costs, a large organization may end up paying less than $10 per year per monitored employee. For example, the U.S. Army recently purchased a 200,000-seat installation from Websense; including hardware, the total cost was $1.8 million, or only about $9 per employee.

Over the past few years, employee monitoring has been increasing about twice as fast as the number of employees with Internet access. The online workforce in the U.S. as measured by Nielsen//NetRatings has grown by about 33 percent per year, to 40.7 million employees using the Internet in January 2001 from 30.6 million in January 2000.

In comparison, Websense reports that its software currently covers 8.25 million employees worldwide; two years ago, in July 1999, the figure was only 3.3 million. This represents a growth rate of about 60 percent per year. MIMEsweeper's currently reported 10 million users are up from 4 million as recently as November 1999; thus, sales of this e-mail-monitoring software have increased about 80 percent per year.

The purchasers of surveillance software include some of the top companies and government agencies in the country, according to the vendors' client lists:

Some major customers of employee-monitoring vendors*

More than any other factor (even employer concerns over lost productivity or potential vicarious liability for employee activities), low cost may be what is driving the growth of monitoring e-mail and Internet activity. By contrast, activities that potentially pose as large a concern to employers, such as telephone use, are not yet monitored to this extent (except in call centers).
 

Monitoring Continues to Grow Despite Slowdown

• Tumbleweed laid off 20% of its staff
• N2H2 faces NASDAQ delisting
• Baltimore is seeing cutbacks in spending, and laid off 250 employees
• Telemate.Net was acquired by Verso, and is cutting 60% of its workforce
• Less dramatically, Websense's 1Q01 quarterly revenues increased only 17% over 4Q00, compared to a 23% increase from 3Q00 to 4Q00, and a 30% increase from 2Q00 to 3Q00.

General Methodology

There are at least four dozen companies that make employee-monitoring software, but a handful account for the vast majority of the business. The big publicly-traded companies include Websense, Baltimore Technologies, SurfControl, Elron Software, Telemate.Net, Tumbleweed Communications, N2H2, Secure Computing, and Symantec.

Employees Monitored Worldwide by Individual Software Products

For some of these companies, employee monitoring is only one of several lines of business, and some of the products used for employee monitoring can also be used for other functions. For example, monitoring employees' outgoing e-mail can be done as part of a larger e-mail system that checks all incoming mail for viruses or spam, monitoring employees' web accesses can be done as part of a firewall, or employee visits to specified websites can simply be blocked, without actually recording the attempted visit. Recording, rather than blocking, constitutes monitoring.

Some privately-held companies, such as SRA, specialize in higher-priced products for the financial industry. SEC and NASD regulations, covering several hundred thousand employees, require monitoring of broker-dealer communications with the public, including e-mail. They were included in the study under Miscellaneous.

A variety of figures were used to determine the number of employees monitored by each product. Some vendors, such as Websense and Baltimore Technologies, maker of MIMEsweeper, publish their own estimates of how many people worldwide use their software. Revenue figures of other vendors, supplied in their annual and quarterly SEC filings, were divided by an estimate for the annual revenue generated per monitored employee. When a product could also be used for non-monitoring purposes, the number of monitored employees was correspondingly reduced. The industry's annual growth rate was used to bring older figures up to date. (See Note on Extrapolated Figures below.)

The increasing use of HTML as an e-mail format, and the popularity of web-based e-mail sites such as Yahoo! and Hotmail, make the distinction between Internet and e-mail monitoring a little fuzzy. However, the study found that monitoring of Internet use (primarily Web surfing, but also including other Internet protocols such as IRC chat, news, ftp, and telnet) is more prevalent than monitoring of e-mail. Websense is the most frequently used Internet-monitoring product, and MIMEsweeper is the most frequently used e-mail-monitoring product.

Internet vs. E-mail Monitoring*

The current study does not account for those employees whose Internet and e-mail are both monitored. This overlap could occur if, for example, the employer has installed both the I-Gear and Mail-Gear products from Symantec, or is using Websense together with MIMEsweeper. This would reduce the total number of monitored employees.

How much the number would be reduced is difficult to estimate. However, taking the Symantec example, in 1999 when user figures were last available, there were 4 million users of I-Gear, and 1 million users of Mail-Gear. The maximum possible overlap would be 1 out of 5 million, or 20 percent. Since then, e-mail monitoring has become more important, as indicated by MIMEsweeper's larger user base than that of Websense, so the maximum possible overlap could be 25 percent. If we arbitrarily decided that half of the possible overlap is actual overlap, then the number of online workers under constant online surveillance worldwide would be closer to 20.25 million and 10.5 million in the U.S., or 20 percent of the global online workforce and 26 percent of the U.S. online workforce.

However, our existing 27 million and 14 million estimates are in fact quite conservative underestimates, because we have had to skip over one possibly major product, Raytheon SilentRunner, and have omitted employee monitoring that is performed without using one of the commercially available products. The IT departments at some large companies could be taking a do-it-yourself approach to employee monitoring, as mentioned above.

In addition, this study does not take into account products that have employee monitoring as a secondary feature. For example, the Webtrends Firewall Suite includes the SurfWatch monitoring product. According to a WebTrends FAQ, their firewall "reports on all employee Internet activity as read by firewall or proxy servers and highlights any visited sites with content pertaining to sexually explicit, violence, hate speech, gambling, and drugs/alcohol. Optional productivity-related categories include sports, fashion, entertainment, games, and shopping." (WebTrends was recently bought by NetIQ, for about $1 billion in stock.)
 

The Online Workforce

This study uses a figure of 40 million for the U.S. online workforce, the number of employees who actually have Internet and/or e-mail access at work, and use it regularly. In May 2001, Nielsen//NetRatings reported the total at-work "Internet universe" in the U.S. at 42.2 million employees; the "active" population was 34.5 million employees, without accounting for e-mail.

The total U.S. workforce is currently around 140 million workers, according to the Bureau of Labor Statistics. Thus, about 30 percent of the U.S. workforce can be considered online.

Worldwide, Nielsen//NetRatings reported in June 2001 that 429 million people have Internet access. How many of these are at work? In the U.S., the ratio of the at-home to the at-work Internet population is 4 to 1. Using the 4-to-1 home-to-work ratio globally yields a worldwide online workforce of a 107 million. However, according to Nielsen's report, "in both Europe and Asia Pacific, home access is a more common source of Internet access than work based access.... Even for those who do have Internet access at work, home is more likely to be the location of use of the Internet." Therefore, this study assumes a global online workforce of 100 million out of the 3 billion workforce reported in the International Labour Organization's World Employment Report, 2001.

Most of the revenue figures used in this study include sales in Canada as well as the United States. Nielsen//NetRatings says the at-home Internet population in Canada is 14.5 million. In the US, the ratio of the at-home to the at-work internet population is 4:1. If the same ratio applies to Canada, this would yield a figure of 3.6 million. For this study, we will take 4 million as the size of the Canadian online workforce. This brings the total size of the North American online workforce to 44 million. Note that the U.S. online workforce represents 90 percent of the North American online workforce. The study relies on this when turning vendor North American revenue figures into U.S. revenue figures.
 

Comparison with Previous Studies

The Privacy Foundation's results are not necessarily inconsistent with the AMA figures themselves, but with the way the AMA figures are conventionally interpreted:

• A careful reading of the AMA results shows that "Most respondent firms carry on surveillance practices on an occasional basis in the manner of spot checks rather than constantly or on a regular routine." Spot checks can include anything from looking through log files on the company server to reviewing computer use as part of an ongoing investigation into a particular employee's problem behavior. In effect, the AMA asked HR managers, "Has your organization ever had occasion to monitor employees?" In contrast, the Privacy Foundation study focuses on "surveillance" as continuous and systematic monitoring.
• The AMA's 77.7 percent figure includes recording and reviewing telephone conversations and voice mail messages, storage and review of computer files, and video recording of employee job performance, as well as storage and review of e-mail messages and monitoring of Internet connections. The Privacy Foundation study looks exclusively at continuous monitoring of Internet use and e-mail. Other technologies such as keystroke logging and other forms of personal-computer monitoring, video surveillance, telephone or voice-mail monitoring, and location tracking, were not examined.
• The AMA figure for e-mail monitoring exclusively is 46.5 percent of major U.S. firms (up from 14.9 percent in 1997); its figure for monitoring Internet connections is 62.8 percent of major U.S. firms (up from 54.1 percent in 2000, the first year the AMA asked HR managers about this practice). In comparison, the Privacy Foundation found 15 percent of the U.S. online workforce under e-mail monitoring, and 19 percent under Internet monitoring. Both studies found that Internet monitoring is more prevalent than e-mail monitoring.
• The AMA notes that its sample "accurately mirrors AMA's corporate membership and client base, who together employ one-fourth of the U.S. workforce ... the sample does not accurately reflect policies in the U.S. economy as a whole, where smaller firms predominate." The Privacy Foundation is looking at the number of employees monitored; the AMA is counting the number of major firms that at some point have engaged in monitoring.
• Because it is based on worldwide revenue figures, the Privacy Foundation study also measured non-U.S. monitoring.
• Revenue figures also indicate how inexpensive monitoring is, and how dependent monitoring is on IT spending.
• Perhaps most importantly, the AMA survey asked HR managers to respond to a questionnaire. The Privacy Foundation's use of industry revenue figures provides a more objective measurement of the extent of monitoring.

This is clearly inconsistent with any notion that three-quarters of employers already engage in this type of employee surveillance. However, it does correlate with the Privacy Foundation results, the only caveats being that employee monitoring is affected by larger fluctuations in IT spending, and that EIM obviously cannot grow indefinitely -- at least not without merging with some other function, such as internal firewalls, or taking on additional responsibilities, such as monitoring of telephone conversations and voice mail.
 

Vendor Response

Conclusion

Monitoring an entire workplace in order to catch slackers, deter inappropriate Web surfing, or perhaps to ferret out criminal behavior, may strike some employers as judicious. But it may also inject an air of suspicion and hostility into the workplace. Furthermore, the monitoring of an entire workplace to protect the organization from liability for "hostile environment" lawsuits may be creating its own peril for employers. By tracking and storing a detailed audit trail of employee activities, organizations may by inadvertently stockpiling large amounts of potential evidence that could be used against them in future litigation. This is particularly significant in government offices, where logs and reports produced by employee monitoring may be considered public records and accessible under Freedom of Information Act requests.

A key question implied, but not addressed, by this research report is whether employers are giving employees sufficient notice of continuous Internet and e-mail monitoring. Because companies can use (or be seen as using) employee-monitoring logs as a kind of "wishing well" to justify actions against employees, including dismissals and layoffs, employers would be well advised to disclose to employees what is being monitored and why. Employees, meanwhile, should make it their business to learn which monitoring systems are in place, and what the capabilities are.

While employers may fear that putting such knowledge in the hands of employees may allow employees to circumvent these systems, the practice of keeping employees uninformed about the details of monitoring may be tantamount to entrapment. Telling employees exactly what monitoring system is in place, and letting them see what the system's capabilities are, is likely to have more of a deterrent effect than a vague reference by an employer who "may monitor your activities for enforcement purposes."

Notice of monitoring in the form of a boilerplate paragraph in the employee handbook is inadequate. A "splashscreen" warning each time an employee starts the computer is an absolute minimum for adequate notice of ongoing continuous monitoring of online activities.

Notice, however detailed, may not be enough. As with the debates regarding information kept on private citizens in commercial and government databanks, there should also be access. Employees should be able to see, review and append comments to the logs and reports that have been kept by employers on their e-mail and Internet activities.

One of the main lessons from this study is that today, more than any other factor, inexpensive technology is driving the growth of employee monitoring. It's cheap and easy to record and store more and more office activities that once were ephemeral. Shoshana Zuboff's fascinating early look at employee monitoring, In the Age of the Smart Machine: The Future of Work and Power (Basic Books, 1988) refers to this as the "textualization of work," which means that increasingly, employees' activities end up being recorded in files.

An important area for future study will be whether technological "convergence," such as Internet telephony and digital video, fosters the same type of widespread monitoring of phone conversations, voice mail and visible activities that is apparent today for Internet and e-mail use.
 
 

APPENDICES

Appendix A: Notes on Extrapolated Figures

• As noted earlier, some products used for employee monitoring also have non-monitoring uses such as virus checking and spam elimination. The major assumption in this study is that only 70 percent of such use should really be counted as employee monitoring. This figure was supplied by Websense, as an estimate of the percentage of their customers who turn on Websense's optional reporting feature.
• Some companies didn't break out U.S. or North American sales. When necessary, this study assumed that 60 percent of total sales come from North America. This is extrapolated from available figures. For example, Websense reports in its Q1 2001 report that "we derived 34 percent of revenues from international sales." SurfControl's statement for the 9 months ended Feb. 28, 2001 shows North American turnover as 78 percent of the total. On the other hand, Baltimore Technologies (based in Ireland) derives only 22 percent of revenues from sales in the Americas; however, Content Technologies, from which Baltimore acquired the MIMEsweeper product line, had at the time of the acquisition (Sept. 2000) 42 percent of its sales in North America. North American sales (U.S. and Canada) account for just under 60 percent of the revenues of the firms that produce these products.
• In some cases, we had older figures that we needed to bring up to the present. As noted earlier, IDC figures the industry's growth rate at 55 percent per year. While this is not sustainable, it does not exaggerate reflect industry trends until recently, and may even underestimate them. As noted earlier, the user base reported by Websense and MIMEsweeper has increased 60 percent and 80 percent per year, respectively.
• Over the years, some of the companies in this study have published both revenue figures and the number of "seats" or "users" of their software. Since these products are frequently sold on an annual subscription basis, dividing annual revenues by users provides a rough sense of how much an employee-monitoring company makes per monitored employee each year.
  For example, Websense announced Q1 2001 revenues of $6.7 million, representing more than 8.25 million worldwide customer seats, pre-sold on a subscription basis. If the Q1 figures are stretched out to an entire year, this means $26.8 million, or only about $3.25 per customer seat. Content Technologies, at the time of its acquisition by Baltimore, claimed 6 million users and annual revenues of about $25 million, or about $4.15 per employee.
  A small Australian company, EmuTech, before its acquisition by SurfControl, had annual revenues of $242,000 and covered 45,000 users; this comes out to $5.35 per user.
  These companies (with the exception of a few that are targeting the financial market, in which SEC and NASD regulations require e-mail monitoring) don't make much per user. About $4 a head seems to be the industry standard. However, as noted above, not all the "users" of these products can really be considered as under surveillance. By taking the 70 percent monitoring figure noted above, and using the Websense and old Content Technology figures, we came up with a rough figure of $5.25 per monitored employee:

• Some companies selling monitoring software to both the corporate/government and educational/home markets do not provide separate revenue figures. This study is concerned only with employee monitoring. SurfControl's financial statement for the 9 months ended Feb. 28, 2001 showed education/home sales accounting for 14 percent of revenues. Symantec reported that "almost half" its sales are corporate. A Frost & Sullivan study found that the "content filtering" business (which has a large overlap with employee monitoring) generated $119 million in revenue in 2000, of which corporate customers accounted for 77 percent and education 16 percent. Unfortunately, there is too wide a range here to derive a sensible average corporate/government-sales percentage. In addition, enterprise sales are likely more lucrative than educational sales (precisely why many "censorware" companies entered the enterprise market in the first place), so that $1 of educational revenues covers more students than $1 of enterprise revenues covers employees.
• It's sometimes useful to know roughly how many employees there are at the average customer site. Websense currently reports 8.25 million seats and 13,000 customers, or about 635 seats per customer. MIMEsweeper reports 10.5 million seats and various reports 8,000 and 10,000 customers, or between 1,050 and 1,300 seats per customer. SRA Assentor reports over 100,000 seats at over 75 firms, or about 1,300 seats per firm. It is reasonable to say that a typical customer has about 1,000 seats.

Appendix B: Internet Monitoring

Totals for Internet Monitoring, Worldwide

"Internet monitoring" refers primarily to examination and logging of an employee's Web surfing. Most of the products look at the URLs rather than the page contents. Some have the option to log only the domain name (e.g., "playboy.com") rather than the full URL (e.g., "http://www.playboy.com/2001/april/playmate.gif").

"Secure" web pages are a major hole in most products' monitoring. URLs that start with "https://" are frequently invisible to these products, or only the domain name is visible. Some of the smaller companies make products that install, not on a network server, but right on the PC used by the employee. These products, such as WinWhatWhere Investigator, can see all https:// requests. While such products make up a tiny fraction of the market (see below), there does appear to be a small trend toward locating a client "agent" on the employee's PC; this agent could be used to monitor https:// traffic.

Apart from web surfing, these Internet monitoring products can also frequently see traffic related to other Internet protocols, such as ftp, telnet, news, and IRC (chat). Some of these products don't watch AOL Instant Messenger (AIM), RealPlayer, Napster-like file-sharing services and so on, but they do block access to the sites from which an employee would download these tools.
 

Appendix C: E-mail Monitoring

Totals for E-Mail Monitoring, Worldwide

As noted above, the distinction between Internet and e-mail monitoring is somewhat artificial. As another example, we're considering Baltimore's MIMEsweeper product line to be entirely devoted to e-mail monitoring, yet one of its components is WEBsweeper. Similarly, Tumbleweed has a Web Filter product. However, it's possible that these products are used primarily for the increasingly common e-mails formatted as HTML pages, and for web-based e-mail such as Yahoo! and Hotmail.