Book Excerpt

E-POLICY:
How to Develop Computer, E-Mail,
and Internet Guidelines to Protect
Your Company and Its Assets
(Originally published in Messaging Magazine, January/February 1999)

By Michael R. Overly, Foley & Lardner
  

Chapter 1
 
E-Mail: The Prime Mover

Many of the problems, and most of the lawsuits, that result from employee use of computers in the workplace revolve around electronic mail (e-mail). Because of its importance, much of the discussion in this book relates to problems arising from use of e-mail. This chapter provides an overview of this important medium of communication.

E-mail is revolutionizing the way many businesses communicate with their employees, vendors, and customers. Because it is economical, fast, and easy to use, for thousands of businesses and ten of millions of individuals throughout the world e-mail is quickly becoming the preferred method of communicating.

Corporate networks, or intranets, have seen e-mail evolve from purely a method whereby technical personnel can exchange ideas to an essential means for disseminating information to employees, promoting intracompany communications, and tracking employee productivity and work quality.

The volume of e-mail, particularly over the Internet, is staggering. More than 1 million messages pass through the Internet every hour. An estimated 2.7 trillion e-mail messages were sent in 1997. Nearly 7 trillion messages annually are projected by the year 2000. Even within a single organization, the volume of e-mail can be substantial. One large American company estimates that its employees send more than a million messages across company networks every day.¹

E-mail has quietly become the "killer" application on the Internet. Although many businesses may not be able to spend thousands or tens of thousands of dollars developing and maintaining a site on the World Wide Web (the Web), even the smallest business can afford e-mail. In fact, if a business is willing to tolerate a few advertisements, several commercial online services provide employees with e-mail accounts at no charge.

The Advantages of E-Mail

E-mail can provide employees with an efficient and economical means of communicating among themselves and with customers and vendors-even when the intended recipient is in a remote office, working at home, or traveling.

Wide Use

According to most estimates, between 70 and 80 percent of businesses in the United States have access to e-mail. When you add to that several million home users, you have a method of communication that is both widespread and here to stay. Businesses that neglect this new medium or are slow to exploit it will quickly find themselves at a disadvantage in the marketplace. Today, a growing number of businesses and consumers expect that you will be able to communicate with them using this new medium.

Speed of Delivery

One of e-mail's strongest features is its speed of delivery. E-mail messages generally arrive at their destinations within minutes, or at the most a couple of hours, of transmission. With the possible exception of a fax, delivery time for e-mail is almost always faster than any other form of business communication. Even if it did not enjoy the clear advantage of speed, e-mail would still have a number of unique features that go far beyond what a fax can offer, as the following sections affirm.

Economics

Apart from face-to-face encounters, e-mail is one of the most cost-effective methods of communication ever invented. In general, the cost of Internet access does not vary with the volume of e-mail sent. This means the cost is the same whether a business sends ten e-mails a day or a thousand an hour. Moreover, there is no postage online. The cost of sending a 2-page e-mail across town is the same as sending an 800-page message to Japan.

Attachments

The ability to include attachments with
e-mail is one of its most important features. Attachments allow documents to be sent "in format" along with the e-mail. For example, a business uses Excel® to create a spreadsheet that it wants to send to its accountant for revision. The business can send sends the accountant an e-mail with the spreadsheet as an attachment. On receipt, the accountant uses his copy of Excel to edit the spreadsheet directly. Try that with a fax.

Accessibility

E-mail provides the means for today's mobile employees to send and receive messages and attachments while away from the office. Because e-mail is routed over commercial computer networks such as the Internet, employees can send and receive messages from any location where they have access to a computer and a telephone. This means that employees can communicate whenever and wherever they want. Instead of being tied to a particular telephone number or physical address,
e-mail provides employees with a "virtual" address that can be accessed, usually with a local call, almost anywhere in the world.

Ease of Forwarding

Ease of forwarding is another advantage of e-mail. Because e-mail is stored digitally, it can be forwarded any number of times with no degradation of quality. With a fax, you are lucky to be able to read the original, let alone one that has been faxed several times from one recipient to another. In most instances, if you want to forward a fax to someone, you generally have to send a hard copy to them by messenger or overnight delivery.

Forwarding e-mail is also far easier than using a fax. As with all e-mail, forwarding a message takes only a couple of key strokes. This makes communicating easy and economical (because there is no incremental cost in forwarding a message). The ability to quickly and easily share a message even with an attachment also makes collaboration with multiple parties straightforward.

However, ease of forwarding is also a substantial disadvantage of e-mail. We now look at the drawbacks of the medium.

The Disadvantages of E-Mail

Communication at a Cost

The growing use of e-mail in business has not come without costs. As online communications have become ever more ubiquitous, so has their role and importance in legal disputes. E-mail has already been the focus of dozens of lawsuits involving claims of sexual harassment, discrimination, breach of contract, fraud, defamation, and theft of trade secrets. Employee use of e-mail also raises concerns about security of sensitive business information and potential waste of corporate computer resources. This section outlines some of the inherent problems and concerns resulting from use of e-mail in the workplace.

Electronic "Postcards"

At present, e-mail is transmitted across the Internet using the Simple Mail Transfer Protocol (SMTP).² This protocol has virtually no security or privacy features built into it. In particular, messages are not encrypted or encoded in any way. Consequently, e-mail is like an electronic postcard; messages can be read by anyone who comes in contact with them. This is why many users have turned to commercially available encryption programs to shield their messages from prying eyes. If a message is not encoded with one of these programs, the sender should always assume that the message can and will be read by unintended parties.

Informal Treatment

One of the greatest distinctions, and dangers, of e-mail is that it is treated far more informally than other forms of business communications. People often use it to express thoughts, emotions, and opinions that they would never memorialize in a conventional written document. In large part, this may be because e-mail doesn't look like a normal letter or memorandum; ordinarily, there is no formal letterhead or signature line on e-mail.

Another reason e-mail is treated so informally is the problem of perceived impermanence. People wrongly believe that if they delete a piece of e-mail it is gone forever. In fact, using widely available software, deleted messages can be "undeleted" days, weeks, or even months after they were thought deleted.

Even if a message cannot be undeleted, backup copies of the e-mail may exist on the sender's or recipient's personal computer or on their employers' networks. If the e-mail was sent through a commercial service (e.g., Prodigy, America Online, or CompuServe) or the Internet, the e-mail may have passed through several computers before being delivered. Each computer in the chain between the sender and the recipient may, and normally does, retain a copy of the e-mail for archival purposes.

Thinking of e-mail as an informal, ephemeral means of communication has been the cause of many lawsuits and employment disputes. Employees who have circulated inappropriate jokes or cartoons or who have sent sexually explicit messages have found themselves and/or their employers defendants in lawsuits for discrimination, sexual harassment, and defamation, among other things.

Ease of Circulation and Copying

Although the ease with which e-mail may be copied and forwarded is a great advantage, it is also a significant drawback. When you send a message to someone, you have no control over whether that person keeps your message confidential or circulates it to any number of other people-or posts it on the Internet, where it may be viewed by thousands of people. This is a particular concern if your message contains sensitive or trade secret information, or if it is a communication with your attorney that may be protected by the attorney-client privilege. In these instances, disclosure to unintended parties may result in substantial harm to your business and potential waiver of the attorney-client privilege.

Sexual Harassment and Discrimination

Claims of sexual harassment and discrimination based on e-mail are particularly prevalent and have resulted in substantial settlements.

In one recent case, a woman filed a lawsuit against her former employer for age discrimination. Her suit appeared frivolous because her former employer had carefully handled her termination. The termination was referred to as "picture perfect by human resources standards." The company expected to quickly dispose of the litigation or, at most, settle for nuisance value.

But during the discovery phase of the lawsuit, the woman's attorney hired a computer consultant to examine the company's e-mail system. The consultant successfully recovered a previously deleted message from the company's president to the head of the personnel department. In the e-mail, the president used blatantly discriminatory language to order the woman's termination. Shortly after discovery of the message, the company settled the case for $250,000.

In another case, Chevron paid $2.2 million to settle a sexual harassment lawsuit brought by a large group of women who alleged, among other things, that a subsidiary of Chevron permitted its internal e-mail system to be used for transmitting sexually offensive messages. One such message listed "25 reasons beer is better than women."

Ease of Misaddressing

Because e-mail is typically addressed by selecting the recipient's name from an online directory, it is very easy to click on the wrong name and send the message to an unintended person. This is a particular problem when you are sending a message to multiple recipients, and it may not be obvious that you included an incorrect name in the "To:" field of the e-mail. Care should always be taken to ensure that e-mail is properly addressed.

Potential Seizure of Computer Systems

Improper use of e-mail can also lead to seizure of a business's entire computer system. If an employee or other individual who is authorized to use the system engages in illegal conduct (for example, sending fraudulent or threatening e-mail, conducting an illegal business), the government may seize the computer system to preserve evidence.

This is exactly what happened to a small computer game company that allowed its computer system to be used for the exchange of e-mail between game players and other interested individuals. During the course of an investigation concerning computer hackers, federal authorities discovered that one of the e-mail accounts on the company's computer contained stolen telephone company data. The Secret Service obtained a search warrant, raided the company, and seized its computer system, which seriously disrupted the company's business for months.³

The potential for seizure of a business's computer because of employee misuse of its e-mail system is a very real possibility. The U.S. Justice Department has issued Guidelines for Search and Seizure of Computer Systems, which provide that unless a business is prepared to cooperate with an investigation, seizure of computers is entirely appropriate and within the power of law enforcement investigators.

E-Mail Forgery

Another hazard of e-mail is that it can generally be changed or altered without leaving a trace. A recent case involving Lawrence Ellison, the CEO of Oracle Corp., illustrates the elusive nature of electronic documents. A former employee named Adelyn Lee brought suit against Ellison and Oracle, alleging she had been wrongfully terminated because she refused to have sex with Ellison. As proof of her claim, Adelyn introduced an incriminating e-mail from her supervisor to Ellison that read, "I have terminated Adelyn per your request."  It was later discovered the e-mail was a forgery. Cellular telephone records proved the supervisor was driving his car at the time the message was purportedly sent.

Creation of Jurisdiction

Employee misuse of e-mail may also subject employers to the jurisdiction of courts in other states—and even other countries—in which the employer has never even conducted business. Several courts have found that sending e-mail into their states is sufficient cause to exercise jurisdiction over the sender.⁴ This means that if an employee uses a business's e-mail system to send messages into another state and a lawsuit arises from those messages, the business may be forced to defend itself in that jurisdiction.

"Spam" Attacks

There is a growing trend for disgruntled employees and customers to intentionally use e-mail to provoke a "spam attack" against targeted businesses. (In this context, spam is unsolicited "junk" e-mail.) Suppose someone is judged to have violated the etiquette of the Internet. The offender might find, among other things, that the e-mail account is swamped by protest messages, fax machines are clogged with thousands of pages of random text, and the switchboard is shut down by hundreds of telephone calls automatically placed by computers. The purpose of the attack, clearly, is to disrupt the offender's business.

Samsung Electronics America was recently the subject of just such a spam attack. A disgruntled customer sent a large number of "cease and desist" messages to apparently random individuals accusing them of hacking and other crimes. The customer doctored the messages to appear as though they were official e-mail sent by Samsung's attorney. The recipient's responses ranged from minor annoyance to threatened legal action. Samsung received 6,000-10,000 angry e-mail messages a day about the fake letter. The bogus messages may have permanently damaged Samsung's reputation.⁵

E-Mail in the Larger Context of Business

Duty to Preserve E-Mail in Pending Litigation

Businesses should also understand their duty to preserve e-mail that relates to a pending lawsuit. Destruction of e-mail, whether intentional or unintentional, may result in a claim of spoliation of evidence. In a recent wrongful-termination lawsuit, a jury found that a major aerospace company had intentionally destroyed relevant e-mail. The jury awarded the plaintiff $20,000 for intentional spoliation of evidence and $60,000 in punitive damages.⁶

Unintentional destruction of evidence is particularly likely in large corporations. By the time a message from the corporation's attorney winds its way down to the information systems department, old e-mail on backup tapes may already have been overwritten as part of the normal backup process. Businesses must be sensitive to their duty to preserve evidence and act quickly when a dispute arises.

Growing Focus of Discovery in Lawsuits

As e-mail becomes ever more ubiquitous, so will its use in litigation. Given the informality of most e-mail messages, attorneys have found them to be fertile ground for telling admissions, which can often be very damaging. More than one recent case has turned on the discovery of an electronic "smoking gun."

In one well-known case, Siemens Solar Industries purchased the solar energy subsidiary of Atlantic Richfield Co. (ARCO). Following the sale, Siemens discovered e-mail in ARCO's computer system showing that at the time of the transaction ARCO knew the solar technology was not commercially viable. "We will attempt to finesse past Siemens the fact that we have had a great amount of trouble in successfully transitioning the [new] technology from the lab to the manufacturing floor," wrote an ARCO employee. "As it appears [the technology] is a pipe dream, let Siemens have the pipe." Siemens sued ARCO, alleging ARCO misrepresented the ability of its subsidiary to develop the new technology.

This case and others like it have prompted many attorneys to focus their discovery efforts on e-mail and other electronic documents. Responding to a discovery request that includes e-mail can be an expensive and laborious task for most businesses. Backup tapes, individual workstations, laptops, home computers, and the company's network may all have to be searched to locate responsive e-mail. Such searches are often complicated by the fact that employees do not have set directories into which they store their e-mail, thus requiring a time-consuming search of the entire computer system.

Although most businesses have implemented retention policies for written documents that require destruction of the documents after a certain period of time, few have adopted similar procedures for e-mail. As a result, the volume of e-mail that must be reviewed to respond to a discovery demand may be enormous. Every business should consider adopting a policy that requires e-mail to be deleted after a specified period of time. On many systems, deletion of old e-mail can be accomplished automatically.

In addition to adopting a retention policy, businesses should take steps to ensure that their employees use e-mail appropriately and professionally. One step is to create a formal e-mail policy that specifically defines the obligations and duties of every e-mail user. In particular, the policy should make clear that employees are expected to use the same care and discretion in drafting e-mail as they would for any other written business communication. If employees exercise that degree of care in drafting their e-mail, many lawsuits for defamation, discrimination, and harassment can easily be avoided.

Potential Waste of Business Computer Resources

Employee waste of computer resources is a growing concern for business. Computer networks have finite bandwidth (the ability to transmit information)and limited storage capacity. Employee misuse and abuse of these resources may result in increased network traffic, slower response time for legitimate business activity, and increased costs for data storage. For example, junk e-mail sent to employees cost one multinational corporation approximately one dollar per employee per day—a considerable sum given its 55,000 employees.

Summary

E-mail is a unique medium, quite unlike traditional written communications. Businesses must be aware of the potential pitfalls that go along with this new form of communication and protect against them by adopting appropriate corporate policies for use of e-mail.

Sample Clauses in E-Mail Policy

Forwarding e-mail. Users⁷ may not forward e-mail to any other person or entity without the express permission of the sender.

[E-mail frequently contains confidential, proprietary, or even trade secret information. What is meant for a single reader may not be meant for widespread distribution. Rather than rely on each employee's judgment as to whether a particular message may be forwarded, many companies are adopting a "bright-line" no-forwarding policy.]

Chain e-mail. Users may not initiate or forward chain e-mail. Chain e-mail is a message sent to a number of people asking each recipient to send copies with the same request to a specified number of others.

[Chain mail is growing ever more popular on corporate networks and is quickly becoming a substantial drain on computer resources. The circulation of a chain letter increases in geometrical progression as long as the instructions are followed by all recipients. This can seriously degrade network performance and consume substantial amounts of valuable disk space.]

Communicating information. Content of all communications should be accurate. Users should use the same care in drafting e-mail and other electronic documents as they would for any other written communication. Anything created on the computer may, and likely will, be reviewed by others.

[This clause reminds employees of their duty to be careful in authoring messages and of the fact that their messages may be reviewed by third persons.]

E-mail retention. Unless directed to the contrary by your supervisor, employees should discard inactive e-mail after sixty (60) days.

[Some businesses may be subject to federal and state laws and regulations governing mandatory retention of business records and electronic communication. These retention laws may require you to maintain files or documents for a specified period of time. Your business may also be under a duty to refrain from deleting files if they are relevant to a threatened or pending lawsuit. Destruction of the documents with knowledge of the lawsuit may lead to liability for spoliation of evidence. Consult with an attorney in each of these instances to determine your rights.]

Excerpted from E-Policy by Michael R. Overly. Copyright© 1999 SkiTech Publishing, Inc. Reprinted by permission of AMACOM, a division of American Management Association. All rights reserved. http://www.amanet.org

This book is available for purchase through the EMA Bookstore.

Footnotes

1 See Glassberg, "Electronic Communication: An Ounce of Policy is Worth a Pound of Cure," Business Horizons (July 1996), for discussion of Du Pont's use of e-mail.

2 SMTP is a server-to-server protocol; other protocols are used to access the messages. For more information on SMTP, see RFC 821, available at www.nsi.org. An "RFC" is an acronym for "Request for Comments." RFCs are created and posted online to describe new or proposed features for the Internet. Network Solutions Inc. has collected most of the RFCs and made them available on their Web site.

3 Steve Jackson Games Inc. v. U.S. Secret Service, 36 F.3d 457 (5th Cir. 1994).

4 See, for example Hall v. LaRonde, 66 Cal. Rptr. 2d 399 (1997), wherein telephone calls and e-mail may be deemed sufficient to exercise jurisdiction of a resident of New York.

5 You can read about the scam on Samsung's Web site: www.samsung.com.

6 Shaw v. Hughes Aircraft Co. (Los Angeles Sup. Ct.); see also "Somebody Destroyed the Evidence," Corporate Legal Times, vol. 7, no. 70 (Sept. 1997).

7 To ensure that the policy applies to the widest range of computer users, which can include individuals who are not employees, the term users is frequently substituted for employees. Users refers to all employees, independent contractors, consultants, temporary workers, and other persons or entities who use or have access to a business' computer resources.