Cyberveillance

(2 of 3)

Just how sophisticated is the technology? Look at what Corporate Defense Strategies of Maywood, N.J., has on offer. Last year managers at a New York City import-export company suspected it was being robbed by two employees. CDS advised the firm to install Investigator, a software program that could furtively log every single stroke of the suspects' computer keys and send an encrypted e-mail report to CDS. Investigator revealed that the two were deleting orders from the corporate books after they were processed, pocketing the revenues and building their own company from within. The program picked up on their plan to return to the office late one night to swipe a large shipment of electronics.

Last February, as police hid in the rafters of the firm's warehouse, the suspects gained entry, only to get a big surprise. The pair are charged with embezzling $3 million over 2 1/2 years, a significant chunk of revenue for the $25 million-a-year firm. They could face 10 to 12 years in prison.

Investigator is the brainchild of WinWhatWhere Corp. in Kennewick, Wash. It monitors all PC activity, including programs running, and traces any files that are being copied and moved, deleted or renamed. Says creator Richard Eaton: "We're monitoring your off-line Solitaire game, things you've written in a chat room, documents you print on the company letterhead that you don't even save." Investigator retails for as little as $99 a copy and comes with an optional banner to notify anyone under surveillance of its presence. But the program will also do bizarre things to stay concealed, such as duplicate and reidentify itself. Since Investigator made its debut in 1998, it has been installed in 7,000 locations. Version 3 will be out in a month or two.

Programs like Investigator have the law on their side, explains Amelia Boss, chairwoman of the American Bar Association's business law section. Employers are free to monitor an employee's use of their networks so long as they don't violate labor and antidiscrimination laws--by targeting union organizers, for example, or minorities. Existing constitutional, statutory and common-law doctrines have not been interpreted to cover employee monitoring. Some union contracts limit an employer's ability to monitor during downtime like lunch hours, but they typically don't bar monitoring altogether. And while federal law prohibits wiretapping and the monitoring of private phone conversations, it does not preclude an employer from monitoring its own systems. Only Connecticut has so far passed a law mandating notification of e-surveillance.

That concerns the A.C.L.U. and others. Says Adam Clayton Powell III, vice president of the Freedom Forum, which defends the First Amendment: "The vast majority of employees are unaware of the extent to which monitoring goes on." Nonetheless, the A.C.L.U.'s Steinhardt says his offices are getting more frequent calls from spooked employees. "There's not much we can do," he says. "The technologies are developing at light speed, while the law that protects us from their misuse is developing at the speed of a tortoise." Still, the law may catch up. The California legislature is reintroducing a notification bill that was vetoed in October by Democratic Governor Gray Davis. Last month Senator Charles Schumer of New York introduced the federal Notice of Electronic Monitoring Act, which has a similar aim.