Workplace e-mail is not your own

Employers have legal right to snoop online

SAN FRANCISCO, California (CNN) -- If you work on a personal computer, you'd better get used to it -- there's no such thing as private e-mail on a company system.

Analysts say this high-tech monitoring is a growing trend for employers, particularly as the technology makes it increasingly easy to implement on a large scale.

"Legally, they're not required to tell you if they're monitoring the e-mail," says Shari Steele of the Electronic Frontier Foundation. "Legally the equipment that you're using when at work belongs to your employer. And therefore the employer can do anything they want to with the equipment."

Businesses can customize the software to identify senders and scan for keywords that send up a red flag. They can also choose from a set of keywords associated with viruses or unsolicited e-mail, or "spam."

Once a policy is set, the company chooses what happens next, whether that's to quarantine the e-mail for review, divert it or send it to the trash.

"Well, it's not 1984 ... this is 2002 ... and yeah, this is Big Brother," says Jeff Smith, chief executive officer at Tumbleweed Communications, which makes e-mail monitoring software used by 100 of the Fortune 500 companies.

Companies like Tumbleweed tout their products as ways for businesses to track how employees may be wasting time recreationally surfing the Web and to filter out harmful e-mails that could launch a costly virus or worm.

Tightening the Net

So how common is e-mail monitoring?

According to an industry survey in 2001, nearly 47 percent of large corporations store and review e-mail messages -- three times more companies than in 1997. What can't be quantified, however, is the number of e-mails mistakenly screened-out.

CNN showed Smith an e-mail that got bounced back to the sender by his software, a memo arranging a meeting for a charity fund-raiser. It did have dollar signs and financial company names, but otherwise appeared to be completely innocuous.

"It could have been kicked-out for compliance violation," says Smith. "Or alternatively, the software could have concluded that it was spam."

Legitimate concerns and a hard line -- administered by software.