Email has made so profound an impact on business communications that it is accessible by pager, portable phone, or portable data terminal (PDT). Email has become an integral and necessary part of modern business. Email is typically conversational, giving senders and recipients a relaxed, comfortable disposition toward it. Often, humorous notes are spontaneously relayed by email with the intention of sharing light-hearted laughs with colleagues and friends. When people become less formal, however, they’re more likely to say something they’ll regret. We should appreciate the wisdom of the 17th-century philosopher Baruch Spinoza who wrote, “...the world would be much happier if men were as fully able to keep silent as they are to speak.” And when the message is patently distasteful, secret, misleading, or unsolicited, it can become evidence that weighs heavily in court.

Email Today, Evidence Tomorrow

It has been 15 years since email was used as evidence in the Iran-Contra arms case. Email was used as evidence in a significant part of the prosecution case against Oliver North. At that time, electronic evidence was a somewhat unsettled proposition to the courts. Several questions were raised: How should it be treated? Was it obtained legally? Can an email really be tied to its author in the absence of a signature? What were the rights of the sender and recipients?

Email and other electronic evidence now finds its way into the courtroom on a routine basis. Email was recently used heavily against Microsoft in its antitrust case. In addition to antitrust, email has been used as evidence in cases pertaining to trade secret theft, restraint of trade, sexual harassment, wrongful termination, copyright infringement, and insider trading. All relevant evidence, including email, is generally subject to pretrial discovery pursuant to subpoena in civil and criminal litigation.

Email is also used by employers for disciplinary purposes. For example, in 1999, the U.S. Navy disciplined over 500 employees for distributing sexually explicit email. A brokerage house fired 25 employees and suspended 48 others for distributing tainted jokes via email, and The New York Times fired 23 employees on similar grounds. You need not look hard to find countless similar stories.

User Misconceptions

Many users may believe that, as system users, they have password protection, which implies that their email messages are private. Because email is electronic, some users may think that messages are just a persistent buzz on a slackened wire that stretches between their device and that of the intended recipient. Many users believe that their email messages should enjoy the same privacy protections that telephone calls or conventional mail do.

In actuality, email is very different from other forms of communication. Users’ privacy rights vary based on where the email originates, where it is stored, how it is transmitted, and where it is received. Also, email and voice mail carried over private and public networks are subject to different privacy standards than telephone calls and letters, predominately because electronic mail can be stored for an indefinite period of time on equipment owned by or under the exclusive control of the employer.

In a recent poll conducted by the research firm NFO WorldGroup on the subject of email abuse, 60 percent of the respondents admitted to having sent or received adult- oriented material over the Internet. Some 55 percent admitted that they exchanged what some might consider to be racist or sexist material, and between 21 percent and 31 percent admitted to emailing confidential information to recipients outside the company. Most companies would construe these activities as unacceptable and damaging. A common misconception the sender may have is that only the sender and intended recipients have copies of the message. Email is more like a morning newspaper left on the seat of a commuter train; it can be read at many points on its journey between the sender and intended recipient. There are up to eight copies of the transmission in four different places: production and redundancy copies on the sender’s server, at the sender’s ISP site, at the recipient’s ISP site, and on the recipient’s server. Further, when backing up servers on either private or public networks, system administrators will create a backup copy of your email. Even though you may not have access to it anymore because you’ve deleted it, the message may reside on computers elsewhere, which is like placing a copy of every letter or note you have ever sent in a big box.

The tension between individual privacy and protecting the business doesn’t stop at internal issues. Illegal wiretapping is becoming increasingly prevalent. On February 7, 2001, the news wires broke one of many similar stories pertaining to email interception. A nearly undetectable JavaScript virus had been uncovered that, via Microsoft Outlook and Netscape Navigator 5.0, unknowlingly sent a copy of emails that were forwarded back to the originator. Laws have been enacted to deal with this kind of abuse, but they are often times difficult to enforce, as you’ll see later.

An Employer’s Liability

Many companies are finding email to be a vast, unbridled liability. For some, email misuse is just a perennial irritant. If a company is grappling with sexual harassment or discrimination claims, however, then there’s a tangible, material interest in ensuring that email controls are in place and enforced. In many cases, courts have found employers responsible for email messages sent by employees, even though the employer knew nothing of the offensive email at the time of its creation or distribution and did not approve of the message or its transmission.

Prior to the passage of the Employee Communications Privacy Act (ECPA) in 1986, there were few laws on the books that specifically addressed issues relating to the use and misuse of email. This federal law prohibits the interception of email transmissions by unauthorized individuals or individuals working for a government entity who are acting without a proper warrant. The ECPA is mostly concerned with the unauthorized access by employees or corporate competitors trying to find out valuable information. The ECPA does not prohibit an employer from monitoring employee email. There are three relevant

The Law

exceptions in the ECPA that pertain specifically to the workplace: when one party consents, when the provider of the communication service can monitor communications, and when the monitoring is done in the ordinary course of business. As you can see, these three conditions are not terribly restrictive. However, some privacy advocates criticize the ECPA for being too complicated, making it difficult to apply.

Further, while the Fourth Amendment to the Constitution establishes the right of the people to be secure in their persons, houses, papers, and effects against unreasonable searches and seizures, it does not prohibit an employer—a nongovernmental entity—from monitoring email. However, many mistakenly believe that these protections should apply in the employer/employee relationship.

State laws are often viewed as the primary sources of protection for privacy of electronic communications. The most common theory applied is the tort of invasion of privacy. This tort is typically defined to mean that “one who intentionally intrudes, physically or otherwise, upon the solitude of seclusion of another or his private affairs or concerns, is subject to liability to the other for invasion of his privacy, if the intrusion would be highly offensive to a reasonable person.”

Formal Email Policies

Many companies do not have a formal policy regarding the content and transmission of email. If no policies are in place, it is difficult to justify an employer’s unfettered access to employee email. In the absence of a formal email policy, the issue of implied consent may arise. Several courts have placed a high standard in implied consent, ruling that an employee’s mere knowledge of the employer’s ability to monitor cannot be considered implied consent.

If your company has a formal email monitoring policy in place, then the employees’ “right to privacy” and their expectations of privacy are quite limited. In this context, the extent of a person’s privacy turns on the notion of “reasonable expectations.” It can be argued that no one with knowledge that his or her employer is monitoring email can have a reasonable expectation of privacy in monitored email messages.

To ensure that employees are aware of company policies regarding their communications, a carefully worded email policy statement outlining “best email practices” should be drafted with the assistance of an attorney. The following issues are typically addressed in an email policy:

• The employee should understand why monitoring is necessary and how it protects employee and company interests.

• The policy should clearly state that the use of company computer systems, including email, is limited to business use.

• Email storage and backup issues should be addressed, including a statement that email, like other forms of data, will be duplicated on a regular basis for the purpose of system recovery in the event of a system failure or disaster. Email that is backed up is subject to audit.

• The policy should outline the potential disciplinary procedures for misuse of the email systems.

• The policy should explain the scope of employer monitoring and should be signed by the employee.

Audits

Email content audits should be conducted within reasonable guidelines. Any information that is gathered from an email content audit should be used appropriately to avoid seriously damaging employee morale. Employers should address auditing openly and clearly, so that there is no misunderstanding between corporate guidelines and what the employee perceives his rights to be under the law. Should an employee allege that she or he has been treated unfairly through the use of email monitoring, the court may make an effort to determine if monitoring or auditing was done for reasonable business purposes, on prior notice to employees and consistent with company policies concerning the use of the audited information.

A Key Business Tool

Many users are unclear regarding their rights and responsibilities when using company email systems. Many assume that their constitutional rights and right of privacy apply to these transmissions. Email policies will prevent an employee from construing an audit of his or her email as an invasion of privacy. To avoid any misunderstandings, employers should develop their email policies with the guidance of professional legal counsel.