Surf Patrol

How should you police employees goofing off on the Net? Very carefully

Wondering if your employees are as busy as they claim? Or if your pricey high-speed Net access is being used mostly to download MP3 files? About 21% of small companies have decided to stop wondering and start snooping: They've installed software that tracks what employees are doing on the Net, says researcher International Data Corp. An additional 35% of small companies plan to begin monitoring within two years.

Technically, it's pretty simple stuff. But as a management matter, this business of peeking over employees' shoulders is a lot more complicated, raising the issues of workers' privacy and morale and forcing entrepreneurs to address the larger question of just what kind of workplace they want to create. "Considering how hard it is to find and keep employees, this is something that has to be treated carefully," says Chris Christiansen, an analyst with IDC.

Still, there are good reasons to keep an eye on things. When it comes to Internet use, even staunch privacy advocates admit judicious monitoring can help maintain productivity and preserve bandwidth for business-related use. (Fear of sexual-harassment suits--a common motive for monitoring--is an overblown concern, legal experts say.) "Most employers who monitor Internet use do so for legitimate business reasons," says Lewis Maltby, president of the National Workrights Institute, a nonprofit research and advocacy organization. "I can see the point."

Not so with the creepier forms of snooping. It may be fine for brokerages to scan e-mail for words or phrases in pursuit of securities law violations, but Maltby argues such intrusion is unwarranted for most industries. And, he says, there's no place for software that keeps track of employees' individual keystrokes--allowing supervisors to read an e-mail, say, that was composed in anger but never sent.

Even if you're just monitoring Internet use, what's legitimate depends on your business and your employees. So figure out how much personal Internet use is appropriate at your company, then how you should enforce your policy. Do you need monitoring software or would you rather just lay out the policy and trust your employees to follow it?

Even if you don't trust them, be open. Cubellis Associates Inc., a 75-employee architectural firm based in Boston, has every employee sign an Internet-use-policy form, which makes clear that the firm tracks where they go online. Cubellis' policy on Web use is extremely simple--no personal surfing allowed. Technology Manager Michael Andrea says he hasn't detected any Web abuse and the restrictions have not been an issue.

For most companies, a more liberal policy works better, analysts and vendors say. "You may decide that having employees do some shopping online is more productive than taking long lunches to do it in person," says Chuck Egress, senior product manager for Symantec's I-Gear monitoring software. If your employees work killer hours, you'll want to be pretty lenient. (Cubellis employees work from 8:30 to 5:30.)

If you do use software, tread lightly. Simply determining the total amount of time your employees spend online will help you decide if you need to track Web use more closely. If you want additional detail, you can generate companywide reports showing the amount of time or bandwidth spent in categories like news or shopping. Or you can sort data by department or by individual employee. Much of this information is already in the traffic logs generated by your web server, but culling the logs by hand is tedious and time-consuming.

If you find reason for concern, start by blocking categories of sites, such as pornography, gambling, or even job-hunting ones. Or you can block certain file types, such as MP3s, at least during peak times.

You can also send warning messages to users who visit nonwork sites without blocking the site entirely. If you were to "soft filter" gambling sites, your employees could still visit them--say, to book a hotel for a convention in Las Vegas. But before the site comes up on the screen, employees would have to click on a message saying they understand that visiting the site is against the company policy. You'll get an e-mail the moment they agree.

While software makers trumpet the flexibility of their products, some entrepreneurs will still find the software a blunt instrument. For instance, you can allow access to certain sites only during certain hours, but you can't tell the software to allocate each employee a specific amount of nonwork surfing time each day. And you can't give a tech person the ability to look at top-level-employee information while reserving more detailed stats for yourself or a human-resources manager.

Whatever you decide to do, make sure to explain any monitoring, and the necessity for it, to your employees. While only Connecticut requires it, the disclosure offers some extra legal cover. And if you do find too much nonwork-related Internet use, don't crack down too severely. "If there's a little abuse, treat it the same way you would if people were taking too much time at lunch," says Bill Gassman, a Gartner Group Inc. analyst.

Making people think they're being watched is often as effective as actually watching them, and it's certainly cheaper. Hence, Gassman's favorite productivity enhancer: Make a nice pie chart. Label one slice "work-related Internet use" and the other "nonwork-related Internet use." Post the chart where employees are sure to see it. If you did have an Internet-usage problem, chances are that little pie will slice your lost productivity nicely.

Before it's here, it's on the Bloomberg Terminal.