As the use of these electronic technologies has increased in the workplace, so have employers’ concerns about their employees’ use of company-owned computing systems—e-mail, the Internet, and computer files—for activities other than company business. This act expands the federal government’s authority to monitor electronic communications and Internet activities, including e-mail. Such decisions, however, have generally given employers substantial leeway in monitoring computer use of their employees. Private Sector Companies Gathered Information on Employees’ Computer Use and Some Read and Reviewed Contents

All 14 companies we contacted routinely collected and stored employee e-mail messages, information on Internet sites visited, and computer file activity. In general, we found that the companies we studied initiated few investigations of employee computer conduct. Companies Developed Computer-Use Policies and Informed Their Employees

The 14 companies we reviewed all have written policies that included most of the elements recommended in the literature and by experts as critical to a company computer-use policy. For example, one company’s policy statement regarding “Monitoring Use of Proprietary Assets” stated, “ reserves the right to access and monitor the contents of any system resource utilized at its facilities.” Another company’s policy stated, “the information and communications processed through your account are subject to review, monitoring, and recording at any time without notice or permission.” An official from another company, which only collected and stored employee computer use information and did not routinely review electronic transmissions, told us his company informed employees of its capacity to monitor its property with the more general statement that “data is collected and the company reserves the right to review this data.” Only one company reported that its policy did not include language specifically informing employees that their computer use was subject to review by other people in the company. Companies Have Not Changed Their Computer-Use Policies or Monitoring Practices as a Result of the September 11 Terrorist Attacks

None of the companies’ representatives we interviewed said that they had changed any of their computer-use polices or practices as a result of the terrorist attacks on September 11, 2001. However, representatives from 10 companies did report increased concern for the security of their computer systems from outside trespassers or viruses entering their systems through e-mail or from imported computer files.
What GAO Found

Over the past decade, there has been a technological revolution in the workplace as businesses have increasingly turned to computer technology the primary tool to communicate, conduct research, and store information. Also during this time, concern has grown among private sector employers that their computer resources may be abused by employees--either by accessing offensive material or jeopardizing the security of proprietary information--and may provide an easy entry point into a company's electronic systems by computer trespassers. As a result, companies have developed "computer conduct" policies and implement strategies to monitor their employees' use of e-mail, the Internet, and computer files. Federal and state laws and judicial decisions have generally given private sector companies wide discretion in their monitoring and review of employee computer transmissions. However, some legal experts believe that these laws should be more protective of employee privacy by limiting what aspects of employee computer use employers may monitor and how they may do so. Following the September 11, 2001, terrorist attacks on the United States, policymakers re-examined many privacy issues as they debated the USA PATRIOT Act, which expands the federal government's authority to monitor electronic communications and Internet activities. GAO reviewed 14 private sector companies' monitoring policies and found that all companies reviewed store their employees' electronic transactions: e-mail messages, information on Internet sites visited, and computer file activity. They collect this information to create duplicate or back-up files in case of system disruption; to manage computer resources such as system capacity to handle routine e-mail and Internet traffic; and to hold employees accountable for company policies. Representatives from all of the companies had policies that contained most of the elements experts agreed should be included in company computer-use polices. None of the companies GAO studied had changed any of their employee computer-use policies or monitoring practices after the September 11 attacks. Most companies did, however, report a growing concern about electronic intrusion into their computer systems from outside trespassers or viruses and had increased their vigilance by strengthening their surveillance of incoming electronic transmissions.