It's already a workplace maxim that employees should be careful what they say in their emails from company computers. But fewer office workers know to apply caution to their use of instant-messaging services.
These immensely popular computer programs, which let users exchange short text messages with online buddies in real time, are no haven for private chatter. Companies and government agencies can monitor and log IM conversations conducted on company-network computers. And though it seems that IM conversations disappear into a cyber-vacuum when a session is over, that isn't always true.
Two scandals currently dominating the headlines highlight the risks. In the past week, instant messaging came back to haunt former Republican congressman Mark Foley of Florida. He resigned abruptly when he was confronted with his emails to a young Capitol Hill page, which showed a member of Congress taking an unusual -- and perhaps disturbingly close -- interest in a subordinate. But the most damning revelations came from his sexually explicit IM sessions with several pages.
Mr. Foley sent emails to pages from an AOL email account with the screen name "Maf54," and he used the same ID for chats on AOL's AIM instant-messaging service, says a person familiar with the matter. The pages were most likely AIM users as well, though it is possible on AIM to write to users of Apple Inc.'s iChat software. It's unclear how those IMs were saved. If they were using AIM, congressional pages could have saved sessions on their computers or copied and pasted them into separate files that could be printed or emailed.
And Hewlett-Packard Co.'s leak-investigation scandal, though it has centered on the use of "pretexting" to obtain phone records of journalists and board directors, also involves IMs. H-P tracked the instant-message communications between a company spokesman and a Wall Street Journal reporter.
Most companies are just beginning to wake up to the popularity of IM in the workplace. While more than a third of employees use instant-messaging services at work, only 31 percent of organizations have policies in place that specifically restrict the use of IM, according to a survey on workplace monitoring by the American Management Association and the ePolicy Institute. But the issue has caught the attention of leading industries. The National Association of Securities Dealers requires member firms to "supervise" the use of instant messaging the same way they do written and electronic communications and to retain electronic copies of instant messages for at least three years.
The survey found that only 13 percent of companies have started logging IM records, but the crackdown is starting to take effect: About 2 percent of employers have fired employees for something they said over IM. By comparison, the study said, 26 percent of companies have terminated employees for misuse of email.
There are several ways users can save IM sessions. Google Inc.'s Google Talk instant-messaging service automatically saves the chat sessions of users that have signed in with Gmail email accounts. Users of Google Talk can disable the setting or choose to go "off the record" during a particular session if they want to avoid having it saved. Other instant-messaging services, such as AOL's AIM, Yahoo Inc.'s Yahoo Messenger, and Microsoft Corp.'s Windows Live Messenger, don't store conversations on their servers automatically. But they do offer various tools for companies and individuals to log conversations. Users can save an IM session by using a built-in save feature or by copying it into another file.
Some of the instant-messaging services are trying to expand their current offerings to give businesses more tools for tracking their employees. AIM Pro, a new free version of AIM for businesses and individual at-work users, is, by default, set to archive conversations on a local hard drive for 14 days, although the feature can be extended and turned off. A more robust fee-based version, WebEx AIM Pro Business Edition, will store all of a company's IM conversations on servers hosted at WebEx and can block messages that contain certain keywords from being sent at all.
Microsoft's Live Communications server allows companies' information-technology departments to log and search employees' IM conversations, including those conducted on other easily available consumer instant-messaging services like Yahoo and AOL.
On top of that, some companies are also purchasing separate hardware that can trace and block IM conversations companywide or set rules for particular employees. One appliance, offered by San Diego-based Akonix Systems Inc., tracks the traffic that goes through a company's firewall, scans it and logs it for compliance and liability issues at a starting cost of around $5,000 plus $20 to $70 per employee. Companies also could read employees' IMs by using key-tracking software and programs that capture what appears on employees' screens at a given moment.
World-wide, the corporate-messaging-software market hit $2.5 billion in 2005 and will climb to $3.3 billion by 2009, according to the Radicati Group Inc., a Palo Alto technology market-research firm.
Gregg Lemley, a labor and employment attorney with Bryan Cave LLP, said instant-messaging sessions are joining email and other company records as an important element in cases dealing with everything from sexual and racial harassment to violations of noncompete agreements. "Most employers now have a firm-wide policy that says what you do on your computer and in your internal emails isn't subject to a privacy right," Mr. Lemley said.
Still, he said, employers would be smart to expand their internal communications policies to make specific reference to instant messaging, explaining what it can and can't be used for, to insulate them from privacy lawsuits.
As for whether the government can subpoena instant-messaging records, as it does with emails, Marc Rotenberg, executive director of the Electronic Privacy Information Center, said the law isn't so clear, because emails are often stored on the servers of Internet service providers, while instant-messaging sessions aren't. "It's a new issue from the legal perspective how privacy rules might apply," he said.
First Published: October 5, 2006, 4:00 a.m.
