E-mail is logged and monitored by most companies, but with instant messaging on the rise, who is taking responsibility?

Over the last few years, I have helped companies and school districts improve productivity, reduce liability, and preserve network resources with tools to manage and monitor Internet usage. This has been a dynamic and challenging environment, highlighted by constant technological change. The advent of instant messaging (IM) is the latest issue to cause some real concerns that require multiple solutions - and an understanding of employee attitudes.

It goes way beyond simple technology fixes. According to the "Messaging Technology Report," by The Radicati Group, a consulting and market research firm in Palo Alto, California, it's just the tip of the iceberg of what is to come: "With corporate instant messaging taking the business world by storm, it only makes sense that the concept of how to properly manage IM has become a market all on its own." A recent study by Radicati shows that 70% of corporate respondents indicated their organizations were using IM in the workplace. This percentage is expected to grow as the total worldwide IM revenue is expected to increase from $224 million in 2003 to $566 million in 2007.

While some companies provide a "corporate" version of IM for their employees, most corporate IM traffic comes from individual users who have downloaded one of the popular services (from AOL, MSN, Yahoo, or ICQ, to name a few) and have loaded it on their at-work computer to communicate with friends, family, and co-workers.

What does this mean for HR executives, IT managers, corporate legal counselors, the next generation of employees and employers, and others? Quite a bit.

IM is significantly harder to control than e-mail and remains a real nuisance in the corporate world. Most companies' internal IT administrations lack any kind of centralized tools to detect and control IM, which leads to a host of virus risks, legal exposure, and the lack of regulated compliance for capture and reporting. This is true despite the fact that IM has all of the productivity, liability, and virus issues that e-mail and Web surfing can have.

It also means that employees are being paid to talk about sports, last night's date, the co-worker in the corner office, office politics and gossip, and other personal business. While employees are certainly allowed a bit of personal chat time while at work or in occasional e-mails, IM conversations can be maintained with several different people at once and can literally "go on all day" while the employee appears to be working. So much for technological advancement.

IM As a Security Problem?
IT managers have to remember that when a user carries on an instant message conversation with the person in the cube right next to him, it doesn't go directly from one computer to the next. It bounces around the corporate network, and then out to the public Internet, across different networks, and then back to the other person's desk. Whatever is being transmitted is being transmitted in the open. Not good.

This is an important security problem that goes beyond e-mail, and it is often neglected because it is misunderstood as "another kind of e-mail" by employees. After all, it's just using the Internet, right? They aren't hurting anybody, are they?

Maybe yes, maybe no. Like a door or window left unlocked, it isn't a problem until someone comes through the unlocked door and causes problems. In that regard, IM in the workplace will continue to compromise security and pose competitive threats if it is not controlled properly. Jaikumar Vijayan, of Computer World, explains: "Security analysts for some time have been warning that unchecked use of such software could cause dangerous holes in enterprise firewalls, leading to sensitive corporate data being exposed on public networks and files being transferred in an unprotected fashion. At the same time, public IM products still dominate corporate networks. AOL Instant Messenger, for instance, is used in 64% of the companies surveyed."

It's not just a matter of wasted employee time and corporate dollars.

But, IM Is Efficient
Although many companies believe IM to be "efficient," it can also keep corporate legal counselors up at night - probably using IM to discuss the problem. Specifically, it poses serious legal threats to the company when conversations between people get carried away. This is easy to do with IM because it involves instant, multiple, and ongoing conversations throughout the day.

Employees are more willing to share personal information via IM because users do not realize their informal "conversations" are being stored similarly to the way in which e-mails are stored. They may feel there's less risk to transferring a racy photo or off-color joke through IM than they would through the corporate e-mail system.

Unlike e-mail - which can be ignored or put off "until later" - IM tends to be urgent; there's a live person at the other end! The result is a tendency to become obsessive and consume a much greater amount of time in front of the computer. Surprisingly, employees feel no remorse at all for wasting their time on IM. They feel they are not hurting their company. It's not costing the company money like an occasional personal long distance call might.

This is where Internet filtering and reporting vendors can intervene and provide a solution that can help secure, log, and manage multiple existing IM networks for companies that want to control activity.

But that's not enough. Companies need to craft and distribute a policy that educates employees about the security dangers and lost productivity posed by incessant IM usage.

The Next Generation of Employees
College students entering the workforce are being groomed in this technology, and, by the looks of the latest surveys, it is not going anywhere soon. IM is gaining real traction with college students, and the numbers add up to a future where the proverbial corporate office "watercooler" is simply replaced by IM. According to a recent study by Pew Internet and American Life, 62% of college students use e-mail as their primary Internet medium while 29% use an IM program. I have read studies that suggest college students spend between one and three hours online per week in social communication, and I don't need surveys to tell me my teenage daughter often has five IM conversations going at once on the home computer.

In fact if my kids are any indication, IM is their communication tool of choice with their friends. The only reason they have e-mail accounts at all is to communicate with teachers and professors.

Steve Jones, senior research fellow of Pew Internet and American Life, says that college Internet users are twice as likely to use IM on any given day compared to the average Internet user: on a typical day, 26% of college students use IM, while only 12% of other Internet users are. Clearly, it will be with us for a long time, and that's the point.

The solution needs to overcome current and future employee mentalities with technology and corporate policy. The behavior and attitudes of the next generation of corporate employees simply demand a more complex solution than technology alone - from management training to writing and distributing office policy.

Beyond Technology
The solution to the IM trend in the workplace is to use a combination of technology and internal HR policies to manage, rather than completely control, usage in the workplace. Acceptable usage policies should be written, distributed, and discussed. For example, does the company need IM at all? If so, a single IM service should be designated to be used by employees. Then the employer can shut off others and seek a solution that allows monitoring and control of the designated IM service. Also, if information security is a concern, an internal server version can be implemented such that internal communications stay internal.

There is not a single technological fix to the problem. It involves multiple departments, so relying on technology alone will not do the trick. Certainly not when one quarter of college students, the future of our corporate workforce, uses IM in the average day.

Sorry, but I must go now; my IM box just popped up. There goes another....