Watching Web Surfers From the Shore

In the last ethics in IT column, I addressed the issue of allowing users to get to sites and services that provide access to legally protected material such as copyrighted music. In response to that column, one reader posed a related but broader question relating to Web surfing. Namely, what, if anything, should an IT manager do about users who spend gobs of time surfing sites unrelated to work?

Q. Weve had problems in the past with nonproductive Internet browsing. Whats a conscientious techie to do to ensure his companys IT resources arent being misused?

A. Some ITers speculate that as little as 25 percent of users browsing is work-related. But classifying surfing nowadays can get sticky. Case in point: In these post-Sept. 11 times, woe to the firewall administrator who blocks access to www.cnn.com since it isnt work-related. Anyway, Ive always thought that "nonproductive" browsing was primarily a problem for management, not IT. Why should IT managers be responsible for users abuse of IT resources?

But that doesnt mean you have to ignore the issue. Consider investing in a monitoring/reporting tool that can provide you with information you can then pass on to management. Perhaps if they saw how much time users spend on nonbusiness-related sites, they might choose to take action. Such data can even be useful for ROI purposes. For example, determining what percent of surfing is nonproductive can help you estimate what percentage of your ISP fees for bandwidth it is costing your company.

Another idea is to give each user a report of his or her own surfing, without any copy to management or any judgments from you. If users know their activity is being tracked, theyre likely to self-police online behavior.

Regardless of how you proceed, check with management first. Some companies have a free and open culture and avoid restricting surfing because it would appear too Big Brother-ish. Some management teams think that unfettered Web access is a small perk for the staff. And, of course, any plans for activity monitoring must include disclosure to the user community—after all, its not fair to release the sharks until youve told the surfers theyre on the way.

Brian D. Jaffe, an IT manager in New York, will address IT ethical dilemmas in future columns, so send paradoxes and conundrums his way at brian@red55.com.