E-Mail Monitoring: Employee Stress, Privacy, and Morale

Introduction and Problem Statement

The impact of electronic mail monitoring on the productivity of workers globally — in addition to its effects on their levels of stress, sense of personal privacy, and morale — reflects a fundamental tension within modern organizations. The intent of this analysis is to evaluate, through empirical research, how e-mail monitoring is perceived by employees, how it affects their approach to getting work done, and how their perceptions of privacy and equitable treatment relate to their awareness of specific e-mail monitoring policies. A random sample of 30 respondents was chosen and given a questionnaire with 13 questions capturing gender, attitudes regarding time spent on e-mail each day, knowledge of whether any employee had been discharged for unauthorized use of e-mail, perceptions of their right to privacy, and attitudes pertaining to the organization's right to monitor e-mail.

E-mail monitoring is perceived by many employees as negative and intrusive, illustrating how far the erosion of trust between employers and employees has progressed (Adams, Scheuing, & Feeley, 2000). As a result, excessive e-mail monitoring is seen as intrusive, potentially illegal, and lacking in the level of trust that is critical for any organization seeking high performance from its employees (Baker, 2006). The paradox of e-mail monitoring, however, is that companies do have a legal obligation to monitor e-mail in order to minimize liability — particularly by stopping unauthorized use of e-mail systems for distributing inappropriate content (Grupe, Kuechler, & Sweeney, 2002). As much as many employees dislike the thought of their e-mails being monitored, it is essential for many companies to engage in this practice, as it can drastically reduce their legal exposure (Wakefield, 2004). Formal policies are becoming commonplace as a result (Welebir & Kleiner, 2005).

The paradox of e-mail and Internet monitoring within corporations is anchored on one hand by the many legal precedents holding corporations liable for their employees' illegal activity (Wakefield, 2004), yet on the other hand, excessive constraints on communication directly impair employee performance and morale (Adams, Scheuing, & Feeley, 2000). Mediating these two extremes is the role of education: providing the necessary insights into why specific safeguards are critical for ensuring that the corporation does not inadvertently expose itself to legal risk (Casarez, 1992), while also respecting employee privacy and autonomy sufficiently to preserve productivity and job ownership (Friedman & Reed, 2007).

In previous empirical research, the core problem has proven to be more educational than legal: in many studies, a majority of employees have not known the policies governing e-mail use, nor their resulting implications for their careers. Differences between levels of management have also revealed significant variation in how much is known about proper e-mail use policies and the permissibility of personal e-mail (Casarez, 1992). As a large percentage of U.S. companies monitor e-mail use to minimize legal liability (American Management Association, 2005), the lack of training on these policies is causing significant disruption to work processes and to collaboration with external trading partners, suppliers, and customers. Empirical studies of the implications of stringent e-mail policies and their correlational effect on productivity — particularly with respect to external constituencies — underscore the significance of this issue (Grupe, Kuechler, & Sweeney, 2002).

Literature Review and Acceptable Use Policies

There continues to be significant legal and legislative activity concerning employee rights when it comes to monitoring their Internet and e-mail activity while at work. This encompasses the use of company PCs, both company-based and public-domain e-mail accounts (including Yahoo, MSN, and others), and the use of the Internet for both work-related and personal browsing. The creation of e-policies by organizations to govern these forms of electronic communication is typically referred to as establishing an Acceptable Use Policy. These policies are specifically designed to protect organizations legally from unauthorized use of their computers and to set guidelines for the use of computers, e-mail, and the Internet by employees.

Creating Acceptable Use Guidelines

The primary impetus for companies implementing policies to govern the use of computers, e-mail, and the Internet begins with their need to protect both company assets and employees from offensive and inappropriate materials — including spam, pornographic or racially sensitive materials sent through the company e-mail system, or employees visiting inappropriate websites. Despite the widespread perception that Acceptable Use Policies are meant to control employee behavior, many researchers contend that these policies are actually intended as guidelines rather than restrictions, according to Kallman & Grillo (1996). Acceptable Use Policies must be structured enough to provide guidance and direction to employees on what constitutes acceptable use without stifling their ability to perform their jobs. This is a balancing act that many organizations have navigated through trial and error.

What further complicates the development of an Acceptable Use Policy is that many companies do not have a clear sense of their own values to begin with. What typically happens in these situations is that the company will first introduce a Values Statement in the context of a Vision and Mission Statement announcement, and then follow that with the distribution of an Acceptable Use Policy. The most common forms of abuse that companies encounter within their networking systems — as documented by Siau, Nah, & Teng (2002) — include unauthorized personal use of e-mail, inappropriate content distribution, and excessive non-work-related Internet browsing. The term "Non-ISPs" in this context refers to internal abuses within a company; an Internet Service Provider would face many additional external threats including hacking and theft of access time.

In creating an Acceptable Use Policy, the following steps should be considered:

1. Establish the company's values. Researchers and experts agree that the best first step is to clearly state the company's values, including the Mission Statement. For many companies this includes being the leader in time-to-market with new products, being the highest-performing company in their industry, and other high-level objectives. These values serve as the foundation for setting an Acceptable Use Policy.

2. Define codes of ethical computer use. Companies should define their own codes of ethical computer use and circulate these to a select group of senior managers for feedback and approval before distributing them to the entire organization.

3. Communicate the policy in advance. When launching the Acceptable Use Policy, companies should emphasize that — in order to remain free from unnecessary liability, competitive threats, and inefficient use of employee time — the policy will go into effect at a specific future date. This is a considerate approach, as it avoids imposing immediate restrictions and sets a new standard for acceptable use going forward. The policy statement should make clear that inappropriate content — including pornography, racially motivated humor, or any other offensive material in any form — will not be tolerated and will be grounds for disciplinary action up to and including dismissal. Many companies also require new employees to sign an agreement acknowledging that the company has full rights to the employee's hard drive and other media that may contain personal or company information. In many cases, companies include this statement within their Acceptable Use Policy as well (Welebir & Kleiner, 2005).

4. Implement monitoring and filtering tools. Companies should begin implementing monitoring and filtering software and network routers capable of tracking Internet use across e-mail, website visits, instant messaging, and blogs. Users should be informed that these activities are now being monitored and that consistent policy violations will result in disciplinary action.

5. Establish a user council. Companies should create a council of users drawn from each department to discuss how the Acceptable Use Policy is working, and what adjustments can be made to allow for greater flexibility or greater control as needed. Organizations frequently discover that filtering routers inadvertently block websites employees need in order to do their jobs.

Measure, Monitor, and Modify the Policy Over Time

What makes Acceptable Use Policies most useful to companies is their adaptability to unique business requirements. Organizations often find that when they first install filtering software or routers, critical communications with outside suppliers, buyers, customers, resellers, and service organizations are inadvertently blocked. A gradual, iterative approach is therefore needed to include the sites and communication types required for daily operations.

The use of monitoring is now prevalent across U.S. businesses. According to the American Management Association, fully 76% of companies surveyed in 2005 actively monitor the use of websites and filter them based on content (American Management Association, 2005). The momentum to measure, monitor, and modify Acceptable Use Policies is now in full swing, and the development of these policies must be governed by the broader strategic needs of the company on one hand and the need to maintain an acceptable working environment for employees on the other (Pauli, 2001).

Research Method and Design

The research objective of this study is to measure the level of awareness of e-mail monitoring programs in a typical services-sector company. The study aims to assess employees' levels of awareness of e-mail monitoring policies, their impressions and attitudes toward those policies, and the resulting influence on their behavior and productivity. The research objective, hypothesis, variables included in the analysis, and methodology are provided in this section. The questionnaire used in this analysis is included in Appendix A. Limitations of the study and threats to validity are also discussed.

Research Objectives

1. To statistically demonstrate that e-mail monitoring educational programs are not well understood and are not effectively communicated within companies.

2. To identify significant differences in the perceptions of e-mail monitoring programs between genders.

Hypothesis

Null Hypothesis: There is no significant statistical difference among employees with regard to their knowledge of e-mail policy specifics.

Alternative Hypothesis: There is a significant statistical difference among employees with respect to their knowledge of the specific e-mail policies in their companies.

Methodology and Research Design

A total of thirty respondents were interviewed in person using the questionnaire shown in Appendix A of this study. The questionnaire captured gender, percentage of time spent checking e-mail, whether the organization had terminated anyone for using e-mail outside its policies, and whether the organization had informed respondents via written policies and regulations regarding violations of e-mail usage. It also measured attitudes regarding the right to privacy, the legality of monitoring e-mail, general attitudes toward e-mail being monitored, and whether the respondent felt any sense of distrust toward the organization as a result of monitoring. All of these factors combined to create a complete empirical analysis of the effectiveness of training programs in teaching employees about e-mail usage policies.

Limitations and Threats to Validity

As with any empirical study, safeguards must be in place against both interviewer bias and respondent bias. To minimize these threats to validity, the interviewers identified themselves as being from a local university where results would be aggregated to ensure respondent anonymity. The researchers also clarified that they were completely independent from the company and that survey results would only appear in a summarized report. Given the statistical analysis performed using Microsoft Excel and the Statistical Package for the Social Sciences (SPSS), it would be impossible to isolate each specific response by individual respondent, further ensuring confidentiality.