Smart Computing Article - Whose Shoulder Are You Looking Over?

Subscribe Today | Contact Us | Register Now

Home | Tech Support | Q&A Board | Article Search | Subscribe & Shop

Whose Shoulder Are You Looking Over?

Email This

Print This
View My Personal Library

Featured Articles January 2002 • Vol.13 Issue 1 Page(s) 52-54 in print issue	Add To My Personal Library
Whose Shoulder Are You Looking Over? Monitor Computer & Internet Use

Let's pretend you're a dot-com genius. You've struck upon the one idea every other Internet startup has overlooked. You've built a company around this billion-dollar idea. One day, one of your overworked, underpaid employees decides he's had enough and sends the details of your idea to a powerful, deep-pocketed competitor. Congratulations. Your dot com has just bombed, and you don't know whom to thank. Now you're wondering if you might have known if you'd monitored your employee's computer usage.

Many employers have begun monitoring their employees. According to American Management Association (http://www.amanet.org/research/summ.htm), 77.7% of major U.S. companies monitor their employees' Internet, phone, computer, and work activities. The Privacy Foundation, an organization that studies workplace communications and privacy issues, released a study in July 2001 that found approximately 14 million employees who have access to e-mail and the Internet at work, or one-third of the United States online workforce, are monitored by their employers.

Andrew Schulman, chief researcher for the Privacy Foundation's Workplace Surveillance Project, says employers have three primary reasons for monitoring employees. Employers want to keep track of employee productivity. In other words, employers want to make sure employees aren't using ESPN.com to plan their Fantasy Football teams or Amazon.com to buy romance novels.

Employers also monitor e-mail and Web use to protect themselves from liability in sexual or racial harassment cases of employees by their co-workers. Employers also use monitoring products to protect the company's intellectual property. An employee could easily send trade secrets or vital information to a competitor. If that happens, an employer who monitors employee computer activity can determine what was sent by whom and act accordingly.

Products such as KEYKatcher record a user's keystrokes. The device plugs into the keyboard port on the back of the PC.

Schulman points out these justifications for monitoring employees address legitimate concerns, but Web and e-mail monitoring don't prevent the problems completely. Schulman says, "You don't need the Web or e-mail to goof off, to racially or sexually harass co-workers, or to spill company secrets." Yet monitoring is done extensively because it's cheap and easy to implement. According to the Privacy Foundation's July 2001 study, a large business or organization can implement a monitoring system for less than $10 per employee per year.

Parents, too, have legitimate reasons to monitor home PC use. Parents don't need to monitor their kids' computer use for fear they'll reveal family trade secrets, but many parents are concerned about the kind of content their children are exposed to online. Parents want to protect their children from offensive content and make sure they don't wander off into dark and nasty Web sites and chat rooms like a cyber Little Red Riding Hood. The Internet has a reputation for harboring wolves. Furthermore, kids tend to be curious (and sometimes mischievous) by nature and may try to check out online content they know they shouldn't just to see what all the fuss is about.

Parents and employers can track their children's and employees' computer activity using a variety of hardware or software products. Some options are rather expensive, but most monitoring products are relatively cheap and easy to use. They either record a user's keystrokes or keep a log of general PCactivity, including the Internet sites and chat rooms accessed or e-mail messages sent from the PC. We'll examine some of the monitoring products used by businesses and by parents, starting with a little device called a keystroke logger.

Keystroke Loggers

Keystroke loggers are software programs or hardware devices that record the keystrokes a user presses on a keyboard. Keystroke loggers don't block Internet sites, and they don't send warnings to administrators. Rather, a keystroke logger records keystrokes character by character until you disable the device when you enter a password. The password also lets you access the recorded keystrokes. That way, you can see what has been typed on the computer's keyboard. Some hardware devices simply plug in between the keyboard cable and the keyboard port. Other products are not as obvious. They're built into a normal-looking keyboard or are software programs that run unobtrusively in the background.

Allen Concepts KEYKatcher (http://www.keykatcher.com) is a keystroke logger about the size of your thumb (2 inches long and .5 inches in diameter) that you install in the keyboard port on the back of the PC. There are three KEYKatcher versions: one records 8KB of data, one records 32KB, and one records 64KB. The 8KB version, which costs $49.95, stores about four typed pages of data. The 64KB version stores about 32 typed pages and costs $149.95. To discourage tampering, each unit includes a heat-shrinking tube you can seal with a hairdryer; you'll know if someone tries to disable the device.

The KEYKatcher's main components are its microcontroller and flash memory chips. The microcontroller records the keystrokes as they are being typed; the flash memory stores the data. For example, if you type the letter K, a signal is sent through the keyboard cable to the computer. Along the way, the KEYKatcher intercepts the signal and stores the typed letter in its flash memory. The flash memory is nonvolatile, which means that you can unplug the KEYKatcher from the keyboard port without losing the data it stored. However, once KEYKatcher reaches its memory capacity, it stops recording. You need to erase the stored data before it can start recording again.

You decide the frequency with which Spector takes screenshots of your PC's Internet activity.

Amecisco Invisible Keylogger Stealth is a software keystroke logger (http://www.amecisco.com). The Invisible Keylogger Stealth records a wider range of keystrokes, including arrow keys and the CTRL and ALT keys. You can customize the software to include or exclude keystrokes. You can also check the keystroke log remotely. The Invisible Keylogger Stealth 1.25 for Win9x/Me is $79 for a single-user license, and the WinNT 4.0/2000 versions are $99.

Keystroke loggers are not widely used by businesses to monitor employees, according to Schulman. He says these products are frequently used by spouses to spy on each other (Schulman refers to these products as "adulteryware") or by parents to monitor kids. Both parents and businesses are more inclined to use monitoring software to track or set restrictions on computer use.

Monitoring Software

Monitoring software does more than record keystrokes. These products, which are predominantly software products, filter and block content, especially inappropriate or offensive Web sites. Some can record which applications are run on a PC and block or record instant messages. Parents can buy programs for about $40 with which they can restrict the kind of content available on their kids' computer, as well as track the online travels of the young ones through an activity log.

Monitoring programs designed for businesses are robust, feature-rich products and can be expensive, yet at the same time they're really cheap. It depends upon how you look at it. For example, in a July 2001 report, the Privacy Foundation mentions that the U.S. Army spent $1.8 million to implement a monitoring system, which is not small change to us. But it's a drop in the bucket for the Army, and the cost of installation breaks down to only $9 per monitored employee per year.

Parents have lots of choices when shopping for home monitoring software. SpectorSoft (http://www.SpectorSoft.com) has two products for spying on your loved ones: Spector and eBlaster. You can use these products to monitor employees in a small business. These programs record all activity, such as keystrokes, Web sites visited, e-mails, instant messages, and chat room conversations, on the computer in which they're installed. Spector takes screen shots of the image on the computer screen and stores them so you can view them later. You can adjust the interval between screen shots, which can be as frequent as once every second. Once you type the password, Spector is disabled so you can access the stored data.

For parents who want to see what their children are up to when they're home alone or administrators who want to monitor an employee but can't frequently access the employee's PC, eBlaster is a better option than Spector. eBlaster records keystrokes, chat room conversations, and Web sites. The program e-mails the information to you as often as every 30 minutes. Both eBlaster and Spector are available for $69.95.

CYBERsitter 2001 ($39.95; http://www.cybersitter.com) and Net Nanny 4.0 ($39.95; http://www.netnanny.com) are two more products that parents can use to monitor and control computer activity in the home. Neither program is foolproof in terms of filtering Internet content, but they are both customizable and have activity logs that monitor Internet activity. So even if the program doesn't keep Junior from checking out an Eminem fan site, you'll still know he's been there.

Small businesses can use products such as Net Nanny or CYBERsitter 2001 to monitor and restrict Internet activity, but larger companies need more powerful software to track large pools of employees. Schulman says three especially popular products for Web-monitoring are WebSense (http://www.websense.com), SuperScout from SurfControl (http://www.surfcontrol.com), and SmartFilter (http://www.smartfilter.com). Administrators use these programs to set restrictions on sites employees can access, record Internet activity, and generate "red flags" if there is a violation of the company's Internet usage policy.

The programs have extensive databases of Web sites that are grouped into several categories, such as adult content, gambling, MP3 sites, and so on. Administrators have a lot of flexibility regarding what sites are restricted. The programs are also capable of generating dozens of various reports so administrators can review them when they have time. The administrators can use the reports to address problems or adjust policies regarding Internet use. Schulman says that the main e-mail filtering software is MIMEsweeper (http://www.mimesweeper.com), which is a product made by Irish company Baltimore Technologies. Like Web-monitoring programs, this product monitors e-mail messages for inappropriate content.

Keep Your Eyes Open

Monitoring your kids' or your employees' computer use does make sense for several reasons. You want to protect your children, and if you're an employer, you want to protect your business and your intellectual property. Having said that, monitoring is a sore subject for kids and employees alike. They feel their privacy isn't being respected, which is true to some extent. You have to balance trust and prudence, which is a tricky high-wire act.

Parents and businesses do have a right to know what their kids and their employees are up to, but at the same time neither parents nor businesses want to alienate kids or employees. Parents should explain why they're monitoring their children, and employers should do the same with their employees. Informing them up front that they're being monitored will likely prevent most computer misuse in the first place, which is the whole point of monitoring computer activity.

Those who misuse their computers after they've been informed that they're being monitored have little excuse when they get caught. If you suspect your employees are surfing porn sites instead of working, you can use tracking devices to confirm your suspicions and take appropriate action. Similarly, if you're worried that your child is spending an inordinate amount of time in a chat room, a tracking device may alleviate your fears when you find out it's a math homework club. On the other hand, if the chat room is completely inappropriate, you can address the problem with your child. Either way, you get what you need: a safe, appropriate environment for your kids or your employees.

by Michael Sweet

Big Brother Or Big Trouble?

I t's one thing for parents to buy tracking devices to monitor what their children are seeing on the Internet. Because the intent is to protect your children, few people would argue that installing such a product on a home PC is an invasion of privacy. Parents are not obligated to tell their children they have installed a tracking device that will record word-for-word what is typed on that computer, although it's probably a good idea. But when it comes to a company-employee relationship, the issue can get a little more complicated.

A business is a public place. Employers can set company policies they expect their employees to follow. These policies can range from common courtesies, such as not stealing lunches from the company's break room, to professional rules, such as a dress code. If you use a computer at work, chances are the computer you're using is not yours. It belongs to the company, which means you play by the company's rules.

The rules for workplace monitoring favor employers. According to the Privacy Foundation's Andrew Schulman, there are no federal laws that regulate monitoring employees. He says only two states, Delaware and Connecticut, have laws that require employers to notify employees if the company monitors them.

Ruth Hill Bro, a partner in the Chicago office of Baker & McKenzie and chair of the American Bar Association's E-Privacy Law Committee, says employers should make and distribute a policy to employees that emphasizes that there shouldn't be an expectation of privacy and that the employers have the right to monitor the employees. The policy should also state the reasons the employer may monitor employees and provide guidelines for proper use of e-mail and the Internet.

Employers need to watch themselves, as well. Hill Bro says that "when monitoring, limit the scope and length of time as narrowly as possible. Employers have gotten in trouble for excessive monitoring." For example, employers can eavesdrop long enough to determine whether a phone call is personal or business related, but they can't record all of the details of the phone call.

by Catherine Geistkemper and Michael Sweet

Want more information about a topic you found of interest while reading this article? Type a word or phrase that identifies the topic and click "Search" to find relevant articles from within our editorial database.

Home Copyright & Legal Information Privacy Policy Site Map Contact Us