Office Spies

That shouldn't come as a surprise. Employees have come to expect that their company keeps track of the web sites they visit and the emails they send. But does it stop there?

It's a question many are asking thanks to the recent scandal at Hewlett-Packard (HPQ), in which the company hired private investigators to spy on board members and reporters covering the company. The investigators were accused of using "pretexting," or illegally masquerading as their targets to obtain their phone records.

It's an extreme example of a company that went too far, says Jeffrey Stanton, a Syracuse University professor and author of "The Visible Employee," a book on workplace surveillance based on a four-year study of company practices. But illegal ways like pretexting aside, he adds, when it comes to most anything else — whether it's tracking employees' instant messages or the records of company telephones — employers have the green light.

A federal law known as the Electronic Communications Privacy Act (ECPA), for example, allows companies to track and record email, Internet browsing, instant messaging and blogging at work, or even at home if it concerns work-related issues, says Nancy Flynn, director of the ePolicy Institute. As a result, more than two-thirds (76%) of employers participating in a survey the ePolicy Institute conducted together with the American Management Association (AMA) said they monitor Internet activity; 55% said they store and review employee emails. More than a quarter (26%) reported they have actually fired people for inappropriate Internet or email use.

In short, don't be fooled by that office door or high cubicle walls. "The employee has no expectation of privacy," Lynn says.

Where it gets interesting is how much employers can actually do within their rights to monitor their workers. If you're still reading this story, for example, chances are your boss can find out exactly how long you spent slacking off. And if you emailed this reporter, your boss could find out what you wrote — even if you never sent the message.

Only two states — Delaware and Connecticut — require employers to tell their employees that their web activity is monitored, Lynn says. Even so, the majority of companies do tell their employees they're being watched: 89% say they've notified employees of tracking web usage; 86% alerted them to email monitoring; and 85% informed them of video surveillance.

The problem is how they did it, Stanton says. During the research for his book, "we did run across companies that were doing a very bad job of telling their employees about what kind of monitoring they were using," he says. "Someone had written it in a little policy manual that someone stuck on a shelf and we had to dust it off when we got there."

Here are some of the new ways your company can watch you.

Recording Every Click
Internet monitoring doesn't end with going through email and a list of visited web sites. Now, thanks to software programs like SpectorSoft, employers can record practically everything employees do on their computers and watch it as if on videotape, says Jay Mellon, vice president at AtNetPlus, a Cuyahoga Falls, Ohio-based IT security consultancy.

It's a fairly common practice. More than a third (36%) of the companies surveyed by AMA, for example, said they monitor web activity by using keystroke-tracking software, which can also monitor the time spent at the keyboard. These companies not only know what you wrote in an email, but also how long it took you to write it. They can access it even if you never sent it.

Following Employees
Got one of these electronic passes you need to swipe to get into your office? Don't be late for work. Your employer knows exactly when you came in and, if you use the card to access different parts of a building, where you went during the day. More sophisticated cards have chips that can be read from a distance of a few feet, Stanton says, which means the employer could wire up the building with sensors and locate your exact movements within. "This can be very helpful in a hospital, if the administrator needs to locate a surgeon, for example," he says. "But as with anything, you can go too far. How much do you really need to know when your employees used the restroom?"

Even without a key-card monitoring system, a creative employer could find a way to track down its employees during company time. Greg Suhajda, chief operations officer at corporate security and business intelligence firm Veritas Global, was hired to investigate a company's employees who weren't as productive as the company thought they should be. What Suhajda did: He suggested the client give its employees prepaid gas cards as a company perk, and then track when and where the cards were used. One employee was caught red-handed when she used the card at 3 p.m. on a work day, at a gas station 20 miles from the office. She had told her boss she was in a meeting downstairs.