Filtering software blocks employees' Web abuses

But users say policy is as important as technology in halting inappropriate surfing.

When Cellular One rolled out Windows NT to its 1,100 employees more than two years ago, the new PC operating system suddenly made access to the World Wide web much easier. Not surprisingly, employees increased their web surfing time. Most of the surfing was appropriate to their jobs. But the cell phone service provider eventually learned that a few of its employees were spending company time at pornographic web sites.

Like Cellular One, any company that gives employees access to the web will need to wrestle with the issue of inappropriate surfing. Internet filtering software, which lets the employer block access to certain sites, is a possible solution, but controlling web use on the job has less to do with technology than with policy, according to Jonathan Penn, an analyst in the Santa Clara, Calif., office of Giga Information Group.

"It's like so many other problems where a small percentage of users constitute the largest percentage of abuse," Penn says. "It's usually not widespread throughout a company; it's just that there are a few bad apples. A lot of companies are concerned about this."

Analysts and HR experts say companies should deal with such surfing before it creates a legal mess. Although no such litigation has surfaced yet, employees offended by coworkers' surfing habits could bring sexual harassment or civil rights suits against employers. To avoid lawsuits, experts say, companies need to establish and communicate an acceptable use policy, then enforce it by blocking or monitoring Internet content coming through the corporate firewall.

Even if no lawsuit materializes, the problem still can embarrass a company. Consider the now well-publicized example of Salomon Smith Barney, the Wall Street brokerage house that recently fired two executives for using company e-mail to exchange pornography plucked off the web.

Liability isn't the only reason companies are concerned about inappropriate web surfing. Lost productivity is another. Web surfing not directly related to employees' duties can drain their time.

Stars, Sex and Stocks

How serious is the problem? SurfWatch Software, a Los Gatos, Calif.-based division of Spyglass Inc., estimates that as much as one-third of employees' Internet surfing at work is not work-related. In the first quarters of 1998 and 1999, SurfWatch reviewed the computer logs of about 100 companies and analyzed which web sites visited were not work-related. It looked at categories such as astrology, entertainment, games, travel, sex, investments and job search sites. The two studies found that non-work-related Internet surfing by employees at the companies studied rose from 15 percent in 1998 to 30 percent in 1999.

The studies are not statistically significant, and SurfWatch has a vested interest because it sells Internet filtering software, of which Cellular One is a user. Still, the results offer a snapshot of a phenomenon that few others are tracking, says Theresa Marcroft, SurfWatch's director of marketing. She sees evidence of growing concern. She's swamped with calls from companies requesting to see an acceptable use policy that she wrote more than a year ago, and about 100 organizations download a free trial version of SurfWatch Professional Edition from the company's web site each week.

"Awareness of the problem is increasing rapidly," Marcroft says. She finds that inquiries usually come from either an HR professional or an IT professional. In many cases she gets calls from both kinds of professionals in the same company, indicating that CEOs have mandated that both HR and IT work to reduce the company's risk. Another indication of interest, Marcroft adds, is the fact that SurfWatch has more than 1,000 corporate customers and is adding customers at a rate of about 100 a month.

SurfWatch's biggest competitor is The Learning Company Inc., of Framingham, Mass. Susan Getgood, vice president of marketing, says she has about 1,200 corporate customers for the enterprise version of Cyber Patrol, which is best known as filtering software that parents install to keep children from surfing inappropriate sites.

In her experience, Getgood says, companies usually don't think about Internet filtering until they experience pain. "Maybe they get hit with a sexual harassment suit for some other reason and that prompts them to see where else they might be at risk," she says.

Marcroft and Getgood agree: The two main reasons potential customers seek them out are legal liability concerns and lost productivity. Preserving network bandwidth is another, but less pressing, worry for firms examining employees' Internet use, they add.

Tracking the Hits

Cellular One didn't discover the nature of its problem until the increased web surfing began to slow down its corporate network, and the information technology staff decided to look at web usage.

"The first thing we needed to do was figure out who was hitting the web and what they were hitting," recalls Thomas Yamashita, vice president of HR at Cellular One, a San Francisco-based division of CMT Partners. The IT staff determined who the 100 most frequent web visitors were, then began to collect addresses of the web sites they were visiting.

One finding was disturbing. A small number of workers was hitting between 400 and 500 sexually explicit web sites each month. "There was more of it than we would like," says Yamashita. "It didn't involve a lot of employees, but they were doing it a lot and during business hours."

Once Cellular One understood the problem and got backing from senior management, it established an acceptable use policy for employees' use of the Internet and the corporate intranet. It also acquired an Internet filter, software that blocks most of the content that the company deems inappropriate for employees to access at the workplace, mainly pornography and racial hatred sites.

Yamashita says Cellular One decided not to block workers from visiting shopping, sports or stock trading sites because management believes it is appropriate for employees to visit those sites on their normal work breaks. "We don't want to be Big Brother," he says. "We just wanted to take a proactive approach to make sure employees are doing the right thing." Because Cellular One now continuously monitors the sites employees access, it will be able to tell if workers are abusing their privileges with these non-work-related sites.

Yamashita says there has been no adverse reaction from employees. The company made a concerted effort to communicate why it was taking these steps. The handful of employees who were visiting inappropriate sites were counseled privately to stop. "But there are new pornographic sites coming up all the time, and we still see employees trying to hit certain sites," he says. Usually, he says, the embarrassment of being confronted by a supervisor is enough to make the culprits stop.

No Different from Phone Logs

Concerns over bandwidth initially prompted ITA Group Inc., of West Des Moines, Iowa, to look into employees' web use, according to Joan Shultz, former director of HR at ITA. The company, which designs, implements and administers performance marketing campaigns and incentive programs for corporate clients, has about 250 employees with Internet access. Shultz, who left her job recently, was involved in a series of decisions to spell out what was acceptable use of both the desktop computer and the Internet.

ITA's concern began in 1993, when the company put a PC on every desk. ITA did not want to keep adding server capacity just to handle the load of non-business personal files that might pile up in the employees' PCs. The problem increased with the advent of the web. "When they got access to the Internet, they were getting chain letters, junk mail and other stuff," Shultz explains.

The company issued its first acceptable use policy in February 1998 and

recently revised the policy to include guidance on using e-mail. Employees must read and sign the policy. New employees are informed of the policy by a computer trainer, usually during their second week of employment.

Shultz was concerned that the policy - and the web content filtering that accompanied it - would raise invasion of privacy complaints. "We took a great deal of time to think through what the negative reactions might be and where they might come from," she recalls. That forethought and the efforts to communicate the reasons for the policy seemed to work. "There has not been much grousing from the rank and file," she says.

She believes it helped that ITA has long requested that employees minimize personal use of their telephones during business hours. Others point out that companies have reviewed telephone logs for years in an effort to cut down on inappropriate phone calls; reviewing logs of web site visits is no different.

Jim Bates, IT manager for the company, believes it helps that ITA is employee-owned. Says Bates: "Employees understand they are working for themselves when they come to work. There's a greater sense of productivity."

An Imperfect Solution

From a technical perspective, Bates says Internet filtering software is fairly simple. SurfWatch and Cyber Patrol are popular products, but there are many others. ITA chose SurfWatch Professional Edition because it was integrated with the firewall the company was already using from Check Point Software Technologies Ltd. of Redwood City, Calif.

As network products go, Bates says, SurfWatch was relatively easy to install. "I was personally involved and I'm not highly technical with network software," he says. Bates and his team have installed the product twice, once on a Microsoft server and once on a Novell server. Bates says the documentation was good and the configuration was straightforward.

The product also is easy to update, he says. Behind the software at SurfWatch is a staff of web surfers who prowl for new addresses to add to their lists of sites to block. Each week, SurfWatch posts those updated lists on its web site and the SurfWatch software downloads the lists automatically. The software allows a company to block not only pornography and hate sites but also entertainment, shopping, stock trading and a host of other sites the company chooses. The user company can decide which types of sites to block.

Because new sites spring up constantly, no Internet filtering software will block everything, says Joel Yaffe, an analyst in the Cambridge, Mass., headquarters of Giga Information Group. "You can only put so much time into building these lists, and there will always be new sites," Yaffe says.

Yaffe is not enamored of filtering software and recommends to his corporate clients that they develop an acceptable use policy and tell employees that they are going to monitor usage, not block it. "By monitoring and tracking after the fact you can find out if there is a serious problem," Yaffe says.

But given that these products can be bought for as low as $1,000, depending on the number of users, it may be worthwhile to try them out if a company has any kind of problem. Some products have a monitoring-only option in case users want to try that before blocking specific sites.

Whether the concern is pornographic material or just the blizzard of non-work-related material that can find its way into your workplace, Internet filtering is probably a pretty good tactic. As ITA's Bates says, "The Internet is a good tool for your company, but it also brings a lot of junk to your door."

Bill Roberts, a freelance writer based in Los Altos, Calif., covers technology, business and management issues.

COPYRIGHT 1999 Society for Human Resource Management
COPYRIGHT 2004 Gale Group