|
Computer keystroke logging: You can, but should
you?
By Pat Curry
Bankrate.com
 As
long as they get the work done, maybe you don't care if your workers
putz around on the computers you paid for.
But -- what if they're using it to look at pornography?
Or Web sites run by hate groups? Or writing nasty anonymous notes
to co-workers that violate your discrimination or sexual harassment
policies? What if they're trashing your corporate reputation in
chat rooms?
Maybe now you care.
Tracking programs easy to find
There is a long list of reasons that you might
want to keep track of how your employees are using company computers.
There is an equally long list of companies to help you do that,
and at surprisingly affordable prices.
Say hello to key loggers.
Offered both as downloadable software and as
external devices that attach to the computer, key loggers don't
just monitor Net surfing. They record everything typed on the keyboard,
from the moment the computer is turned on until it's turned off.
That includes passwords, attempts to hack the system, bidding on
Elvis memorabilia on eBay, and lots and lots of very normal business
activity. Pricing starts at $29.95 and tops out at about $150 per
computer.
But look before you leap into logging. While
it offers clear benefits to small-business owners, it can thrust
them into a murky legal tangle over privacy.
So if you're considering installing keystroke
loggers, be certain why you want the information and what you plan
to do with it.
A delicate balance
"We can do it; what do we do with it?" says John
Conlin, chief operating officer of Denver-based eSniff,
which manufactures a program that analyzes network content based
on what a company decides is inappropriate. "From an employee standpoint,
one of the complaints the employees have is, 'It records my keystrokes,
but it doesn't record whether I sent that or not.' If I'm mad at
you and wrote this flaming e-mail and I hit delete, my keystrokes
have been captured.
"It's also very one-sided. If you and I are
in a chat, it only captures what you say, not what I say. It's a
neat capability, but how do you balance a desire for privacy with
a company's duty to protect its shareholders?"
Finding the software or hardware is as simple
as doing a keyword search for keystroke logging. You'll find such
external plug-in devices as KeyKatch and KeyGhost,
and software programs such as the WinWhatWhere
Investigator, the Invisible Keylogger
and Stealth
Activity Monitor.
All of them are designed to make monitoring
virtually undetectable, which is the route some employers seem to
take, says Dr. Peter T. Schmidt, with IOPUS Software, the maker
of the Stealth Activity Monitor.
"It seems that some businesses are using the
software without telling the employees," he says. "This seems to
be mostly the case if they are already suspicious about a specific
employee."
Feds recommend a banner
If this is your plan for the software, the U.S.
Department of Justice may want to have a few words with you. The
department chimed in on the topic of keystroke monitoring as long
ago as 1993; a legal opinion on the topic recommends posting a banner
on every machine that's using the technology.
Jeff Johnson, a labor attorney and partner with
Holland & Hart in Denver, says there are important personnel
and legal reasons for telling employees about the installation of
keystroke monitoring. As long as the monitoring is for legitimate
business purposes, you should be able to defend the use.
"What you do is you promulgate appropriate policies
that say, 'Here are the expectations. These tools are used to be
for appropriate business-related uses. There are some things you
shouldn't be using them for at all. Here are our expectations. This
may be subject to monitoring,'" Johnson says. "To do it without
telling your employees defeats your purpose, which is prevention.
The other piece, strictly legally, is if you're monitoring without
telling your employees, I think you're setting yourself up for substantial
liability "
Best practice: Be upfront about monitoring
Beyond the legal implications, you'll find it
easier to accomplish your goal -- to keep people from using company
equipment for unapproved purposes -- if you tell employees upfront
that you may monitor computer use.
"The wondrous thing -- as soon as people know
you're planning to install it, they minimize the activity right
there," says Mike Shevelev, president of Trisys in Florham Park,
N.J., makers of Insight
computer-use monitoring software. "If they're not intelligent enough
to understand and still abuse it, they have to face the piper."
While some software tries to catch people doing
things they're not supposed to do, Shevelev says Insight gives companies
an accurate picture of computer usage -- without the snooping that's
implied in a keystroke logger.
"We don't cross the boundary to invade people's
privacy; we chose not to do it," he says. "From a technological
point of view, there's no limit to what you can do in this area.
We decided it was a little too personal. We believe it is sufficient
and detailed enough for managers to get a clear picture of what's
going on without reading someone's private thoughts."
Pat Curry is a freelance writer
based in Georgia
|
