There are increasing reports of email misuse, malicious use, mistaken use, and just plain bad implementations of email systems that allow the many threats out in the wild and woolly Internet, and the desperado insiders, to exploit vulnerabilities. It is most common for information assurance pros to be fairly diligent in trying to keep malware out of the enterprise network through scanning and filtering emails, and it is good to see that it is also becoming a growing trend to try and prevent sensitive data from leaving the enterprise by using scanning and encryption. However, there are many other mishaps and business damage that can occur through the use, or misuse, of email and email monitoring that can have legal implications.
One such use is the types of communications employees can make through the corporate email system.
The question of whether employees have the right to use their organization’s email system to communicate with each other about union matters and terms and conditions of employment ignited some pointedly different views from attorneys in a March 27 oral argument before the National Labor Relations Board (N.L.R.B., No. 36-CA-8743-1, oral argument 3/27/07)
In a nutshell, The Register-Guard, a daily newspaper in Eugene, Oregon, disciplined a copy editor/union officer for sending emails to her co-workers about union matters.
The NLRB attorney requested the employees’ interests to be considered under Section 7 of the National Labor Relations Act.
The NLRB argued that allowing employees to communicate with each other in the workplace via email was in the employers’ best business interests, and that a broad policy that prohibits all nonbusiness email use should be illegal, except in special circumstances.
The co-plaintiff, the Eugene Newspaper Guild, argued that when employees are allowed to use their employer’s email system to communicate about nonbusiness matters, they have the right to use the email system to communicate about union matters. He acknowledged that it was reasonable for employers to restrict these types of email communications to nonworking time.
The Guard Publishing Co. legal counsel argued that the email system is the company’s equipment and private property, that the company has the right to regulate and restrict its use, and that there is no Section 7 right to use it for nonbusiness purposes.
A little bit of history about the situation…
The newspaper issued a policy in 1996 stating all of its communications systems, including telephones, message machines, computers, fax machines, and photocopiers, “are not to be used to solicit or proselytize for commercial ventures, religious or political causes, outside organizations, or other non-job-related solicitations.”
The Register-Guard’s managing editor sent about 50 employees an email warning that the police had reported that anarchists might attend a May 1, 2000, union rally outside the building. A reporter and member of the union’s executive board replied to all the recipients and quoted a police statement that he believed showed that the newspaper had called the police about the rally. A few days after the rally, Suzi Prozanski, a copy editor and the newly elected union president, replied to all the recipients and explained that the newspaper had not called the police. Prozanski received a written warning for violating the communications policy by sending “a Union-related email.”
Because Prozanski thought she had violated the policy by using company equipment to write and send her email, she used union equipment to write and send two union-related emails in August 2000 to the approximately 150 newspaper employees represented by the union. The first message urged employees to wear green to support the union’s efforts to obtain a wage increase and a new bargaining contract, and the second asked employees to support the union’s entry in a local parade. A disciplinary notice from the human resources director stated that the two “Guild related emails to employees’ workstations” violated the communications policy.
In October 2000, the newspaper made a bargaining proposal for contract language prohibiting the use of the company’s electronic communications systems for union business, including all employee discussions of the union.
In February 2002 an NLRB administrative law judge ruled there was ample evidence of personal use of the newspaper’s email system and that the company discriminatorily enforced its communications policy against Prozanski for sending union-related emails. However, the judge also ruled that the policy itself was not overly broad. The judge also ruled that the company’s bargaining proposal was an unlawful attempt to codify a discriminatory policy and therefore was an illegal subject of bargaining.
This led up to the oral argument held on March 27, 2007.
The details of the oral argument are interesting and good for those of you to read who are responsible for email monitoring and creating the associated policies to review and consider.
Most organizations I speak with, with the few exceptions of perhaps some of the most restrictive government agencies and some military units, allow for “reasonable” personal use.
When I ask these organizations with the “reasonable” personal use allowance what this actually means, and what the threshholds are for what goes beyond reasonable, none I have spoken to have a specific answer. It is a very subjective determination. This subjectivity relates directly to an important part of the NLRB argument.
McKarrick, the judge, observed that employers need to monitor their email systems to prevent computer viruses and liability for illegal conduct and asked the counsel on both sides whether such employers could be charged with illegal surveillance of employees’ union activity. The Union legal counsel agreed that employers have the right to monitor email and said employees have no expectation of privacy in email on the employer’s system. The legal counsel also indicated employers may restrict personal email activity to nonwork times. When asked how employers could police such a rule, the legal counsel said employers have ways to measure productivity and said “the ship has sailed” because most employers already allow some personal email use.
This statement is critical for organizations to be aware of when allowing for personal use of email systems. If that amount of personal use allowed is not specifically described, but indicated as being “reasonable,” that creates a foundation for a very wide range of interpretation if an incident similar to this one goes to court.
Has your organization clearly defined what type of personal use is allowed or disallowed through your company’s email system? Do you describe it with specific examples? Do you put any metrics around what constitutes disallowed personal use, such as message size, time of use, types of communications, entities with whom the emails can and cannot be shared, and so on?
Has your organization’s personal use email policy ship already sailed?
Tags: awareness and training, email monitoring, email security, Information Security, IT compliance, NLRB, policies and procedures, privacy, risk management, surveillance