Companies Loosely Monitor Employee Email Correspondence

July 13, 2004 ( - More companies are seeing their employees' email conversation wind up in the courtroom, yet many employers remain largely unprepared to manage e-mail and instant messaging risks.

Twenty percent of US companies say they have had employee e-mail subpoenaed in the course of a lawsuit or regulatory investigation, up from 14% in 2003. Additionally, 13% have battled workplace lawsuits triggered by employee e-mail, according to the 2004 Workplace E-Mail and Instant Messaging Survey of 840 companies conducted by American Management Association (AMA) and The ePolicy Institute.

While the use of e-mail as courtroom evidence continues to grow, companies are doing little to retain e-mail and instant messages according to written retention and deletion policies, the study found. Only 6% of organizations retain and archive Instant Message business records, and only 35% have an e-mail retention policy in place, up a mere 1% from 2003.

Also, 60% of companies use software to monitor external (incoming and outgoing) e-mail, but only 27% monitor internal e-mail conversations. Even worse is the 11% of organizations that use IM gateway/management software to monitor, purge, retain and otherwise control IM risks and use. This comes at a time when 31% of employees use IM at the office, and 78% of those users downloading free IM software from the Internet.

Nancy Flynn, executive director of The ePolicy Institute points the finger of blame toward the employer. “The fact that 37% of respondents do not know or are unsure about the difference between an electronic business record that must be retained versus an insignificant message that may be deleted, suggests that employers are dropping the ball when it comes to effectively managing e-mail and IM use,” said Flynn.

While employers have been slow to put e-mail and IM retention and deletion policies into place, 79% of employers have implemented a written e-mail policy. On the other hand, only 20% have adopted a policy governing IM use and content.

Some companies are taking steps to correct previous oversights. More than half of this year’s respondents (54%) said their organizations conduct e-mail policy training, a 6% increase over the 48% reported in 2003. Further, employers are getting tougher about e-mail policy compliance, with 25% of 2004 respondents having terminated an employee for violating e-mail policy versus 22% in 2003 and 17% in 2001.