{1} Recent innovations in digital technology [1] have resulted in the proliferation of workplace surveillance devices, which allow bugging, telephone monitoring, visual surveillance during night or day, communications interceptions on computer networks and the creation of digitally controlled human recognition and tracking devices. Not surprisingly, the expanding presence of digital technology in the American workplace has guaranteed that complex issues of personal and workplace privacy have become far more pervasive than ever before.
{2} The modern workplace uses digital technology -- in the form of desktop computers, powerful database servers, facsimile transmissions, electronic mail, electronic networks, and interconnected information systems -- to routinely process, store, and transmit data for most important transactions. [2] As a result, employers have significant concerns regarding the best methods to protect their computer networks and the valuable information or data stored and transmitted on those computer networks from theft or damage. In this respect, employers are showing greater concern today for managing the conduct of employees when workers are accessing or using the employer's interconnected computer systems; namely, employers are managing employee conduct by monitoring workers' activities through the use of advanced technologies. [3] As the spread and use of digital technologies in the workplace have encompassed the surveillance [4] and monitoring activities [5] of employees, the failure of current privacy law doctrine [6] to protect the interests of workers has become more apparent. [7]
{3} The law of privacy, like other legal doctrines, developed in response to society's needs. In the past, the law of workplace privacy generally evolved in the context of societal notions about the degree of personal autonomy and informational confidentiality an individual should have when he or she is in the workplace using the technologies of the time. Not surprisingly, current privacy law doctrine evolved slowly and was largely developed for a time when telegraphs, typewriters, and mimeographs were the commonly used office technologies and when employers conducted business with paper documents transmitted by postal mail. Unlike a few other employment law doctrines that have recently created legal uncertainty after they were repealed or drastically revised, the legal protections that exist as a result of privacy law doctrine are being overpowered by technological force, not legislative or judicial intervention. In other words, the prevalence of digital technology in the workplace implicitly constructs a new objective reality regarding expectations of privacy. Paradoxically, privacy protections have been significantly weakened, notwithstanding the apparent vitality of current privacy law. In the digital age, however, workplace technologies are so advanced and sophisticated that societal notions about the degrees of intrusiveness that a particular technology may pose are often based on unfounded or mistaken assumptions about the possible uses of digital technologies. [8] The failure of courts, in particular, to grasp the fundamental nature of digital technologies is especially troublesome regarding workplace privacy issues since many employers use digital technologies to surreptitiously monitor employees' activities. [9] When workers do not know they are being monitored, the right of privacy is presumptively eroded. To thwart the de facto erosion of workplace privacy, privacy law must be expanded to encompass the present-day realities and future possibilities of high technology and its impact upon employer monitoring practices. In attempting to resolve the legal and moral questions that arise when employers engage in monitoring activities, a new balance must be struck between employees' right of privacy and an employer's need to manage its workforce.
{4} Surreptitious and sweeping surveillance of the workplace through the use of digital technologies should be presumptively unwarranted under the law of privacy. [10] As such, employers could only use such technology when particularized suspicion of harmful or unlawful conduct of an employee could be articulated or when the presumption could be rebutted by evidence of exigent circumstances. And, in no case, should an entire workplace be subject to widespread surreptitious surveillance. Surreptitious workplace surveillance, when such use is warranted, should be limited to the area of the workplace for which particularized suspicion has been articulated.
{5} At first glance, this proposed enhancement of privacy doctrine may seem extraordinarily disadvantageous to employers. Yet, it is not. Instead, this proposal tips the balance more evenly between employee and employer. Noteworthily, relevant case law has permitted the termination of employees by employers who have determined that an employee surreptitiously used surveillance technology against his employer. [11]
{6} In particular, employers are relying on technology to make their operations more efficient by using high-performance computers linked together as private networks, which are then connected to a vast collection of networks called the Internet. As part of their information infrastructure, employers utilize a combination of mainframes, desktop computers, routers, servers, database software, program applications, and connections to external computer systems. This information infrastructure is both expensive and highly valuable to the employer. [12] Not only are employees able to work more efficiently, but employers can reap significant competitive benefits by investing in and developing the right kind of information infrastructure. In this respect, an employer's interest in securing their information infrastructure from damage or sabotage is magnified by the vulnerability of the infrastructure when it is interconnected to other computer systems - - like the Internet - - and when access to the information infrastructure is granted to most employees. [13]
{7} Undoubtedly, one of the most difficult problems arising out of the everyday use of interconnected computer systems facing employers is whether, and if so, in what manner, to use modern surveillance technology [14] to monitor employees' use of the computer network. [15] In the workplace, this issue involves two competing values: security and privacy. Employers want secure computer networks. Employees want protection from impermissible intrusions into their personal privacy. [16] Although the protection and security of an employer's information systems is not a trivial matter, neither are the concerns of employee right of privacy. As the technological surveillance capabilities of employers increase, similarly, an employee's right of privacy protections must grow in response. Digital technology provides employers with an arsenal of extraordinarily intrusive methods of workplace surveillance. These technologies enable employers to record unsuspecting employees engaging in very personal and private behavior. [17]
{8} Although hackers have been exploiting security weaknesses of computer systems and have been viewed as external threats to networks connected to the Internet for years, the increasing number of employers who have connected to the Internet has brought to the forefront a more serious threat: employee sabotage from inside the organization. [18] The threat of employee sabotage coupled with the rapid growth and reliance on interconnected computers, have turned Cyberspace and some work spaces into a veritable electronic frontier. Undoubtedly, the need to secure information from those who might damage expensive computer systems or conduct economic espionage or perform some other havoc has never been greater. The concomitant risk that employers may implement digital surveillance and monitoring systems that require employees to surrender substantial privacy interests is also greater than ever before. In most cases, a prudent approach to this problem involves a simply stated, but notably difficult solution; namely, selecting an appropriate level of monitoring or protection of the employer's network, while ensuring that the security measures adopted do not breach the fundamental privacy interests' of employees.
{9} There are no laws prohibiting employers from using digital surveillance [19] to monitor employees in the modern American workplace. [20] In this respect, the Orwellian nightmare of the Thought Police and Big Brother appears to reflect reality and has several disturbing similarities to the current widespread use of surveillance technology in American workplaces. [21] Employers now have an unprecedented ability to monitor virtually every aspect of an employee's activities throughout the day using video surveillance, electronic eavesdropping, [22] and a wide variety of computer monitoring techniques. [23] The presence of surveillance technology [24] has become so ubiquitous that it appears as if the right of privacy for employees is facing inevitable extinction. [25]
{10} The growing presence of surveillance technology [26] may be directly related to the nature and prevalence of computer technology; particularly the expanding use of computer networks. As employers expand their reliance on automated and interconnected information systems, they face an increasing challenge to protect the integrity, confidentiality, and availability of the data they maintain. Along with this challenge comes the need to implement methods that enable employers to maintain a watchful eye on the use of their computer and information systems by their employees. Although employers have relied on computers for years, employers throughout the world are experiencing an explosion in the growth of electronic data and networked computer systems, [27] and in the way that organizations collect, process, store, and disseminate information. [28] The presence of digital technology [29] in the workplace has become widespread and far-reaching as a result of the use of desktop computers and the Internet. [30] The Internet, in particular, has revolutionized the information [31] of the nation's businesses and governments by linking a vast number of business and organizations to each other. This interlinkage enables the efficient electronic transfer of funds, the distribution of electrical power, and varying forms of digital communications. Harnessing the power of desktop computers wired together has already proven essential for many businesses to compete effectively in the information age.
{11} Yet, our dependence on the new information infrastructure has created new vulnerabilities for employers who are connected to the Internet. Employers are relying on an unprecedented use of digital surveillance technology, ostensibly, in order to protect the integrity of the employer's information systems connected to the Internet. On October 20, 1997, the President's Commission on Critical Infrastructure Protection [32] (the Commission) issued a report identifying the nation's dependence on computers and telecommunications as posing unprecedented risks that an organization's computer network connected to the Internet may be harmed by an insider or someone legitimately authorized access to a system or network. In addition, another report issued by the Federal government found that government agencies were severely lacking in implementing systems to safeguard information technology from malicious attack. [33] In other words, the vast number of employers who have connected their computer systems to the Internet have also rendered these systems vulnerable to malicious attack by disgruntled workers. The potential risks include the danger that sensitive and critical information could be inappropriately modified, disclosed, or destroyed, and possibly result in significant monetary losses for an employer or, if a government employee sabotages his employer's computer system, such could result in a loss of confidence in the government's ability to protect confidential data concerning individuals. [34]
{12} These potential risks are increasing because automated systems and records are fast replacing manual procedures and paper documents, which in many cases are no longer available as backup, if automated systems should fail. [35] As such, the vulnerabilities of an employer's information infrastructure are exacerbated because, when systems are interconnected to form networks - like the Internet -- they are not only much more vulnerable to anonymous intrusions from remote locations, but workers from inside the company can potentially sabotage an employer's computer system much more easily than before, and the effect of an attack one computer system interconnected to others could easily multiply the damage exponentially. [36] So grave does the Federal government view this problem that the Commission recommended several policy and legislative changes to thwart the threat of a so-called Cyberspace meltdown. [37]
{13} Interestingly, the Commission found that employees and other insiders provide the most frequent avenue of attack to an organization's information infrastructure. Quite remarkably, the Commission concluded that the Federal government, as an employer, has been better able than the private sector to protect against employee sabotage as a result of having the legal authority to conduct background investigations of employees and applicants. [38] To assist other employers, the Commission recommended changes in certain fair employment and privacy right restrictions that currently preclude private sector employers and others from lawfully adopting practices that could allegedly assure employers that the company's computer systems and information infrastructure were adequately protected from sabotage by disgruntled or rogue employees. [39]
{14} The Commission recommended, inter alia, that the Attorney General impanel a group of professionals from law, state and Federal governments, labor and management organizations, and the privacy community to explore existing laws and recommend measures to safeguard employer networks that do not fully compromise employee right of privacy. The Commission's report is notable because it directed the nation's employers to seriously consider whether the ubiquitous presence of interconnected computer systems sufficiently justified the need to consider how these computer systems and the information and data they maintain could be compromised by unhappy or malicious employees. Although the critical importance of an employer's information infrastructure warrants sufficient considerations of how to protect and safeguard information technology, the Commission's view of the American workplace is uncompromisingly cynical. [40]
{15} Indeed, another view of the impact of information technology on the workplace reveals that the unmistakably intrusive nature of digital technology and its many uses for workplace surveillance warrant an examination of whether an employee's privacy interests are sufficiently protected by current law. [41] Not surprisingly, the formulation of the question may have a pivotal impact on the nature of the answer. In this respect, questions concerning the right of privacy often entail ready-made assumptions about the importance of privacy; unfortunately, these assumptions limit or confine the privacy interest at the start of the analysis. [42] To thwart the reliance on false or improper assumptions about an individual's interest in privacy in this case - the employee, once a privacy right is detected, privacy analysis should begin by setting forth the countervailing interests, which will be weighed against the interests of privacy, to establish the real impact of the countervailing interests. In framing the analysis in this manner, the outcome will not be limited to the rather predictably interdependent conclusion that the privacy interest should or should not be further restricted, but, instead, could include the determination that the privacy interest should be expanded.
{16} Under this framework, the questions concerning whether or how the status quo-workplace should be altered in view of the ubiquitous presence of digital technology would be vastly different than the questions the Commission posed. What follows is an analysis of whether the presence of the Internet and other digital technologies in the workplace, which can be used for unprecedented workplace surveillance, warrant a reevaluation of whether current laws adequately protect employee right of privacy and, if so, what is the outcome of that evaluation?
{17} Today the Internet is composed of a global network of over 4 million host computers linking approximately 35 million people in 140 countries. [43] According to some online observers, the number of people who join the Internet community expands by nearly a half million per month. [44] During the 1980s, the National Science Foundation (NSF) built the high-speed, long-distance data lines that carry Internet traffic and that form the Internet's so-called backbone or basic network infrastructure. [45] Internet traffic moves over almost any physical channel - telephone lines, cable-TV setups, satellite links, wireless phones, or high-speed fiber-optic trunks. Through a collaborative effort among universities, national labs, large corporations, and national governments funding and technical support was provided for operating the global network. [46] In 1991, the NSF ended restrictions on commercial usage of the Internet, which ultimately opened the floodgates to the general public. [47] As its design suggests, decentralization is one of the Internet's salient features. In keeping with its goal to withstand the impact of a nuclear blast, there is no central authority that controls the content or functioning of the global network. Highlighting the absence of central control on the Internet is the reality that there isn't even a master switch or magic fuse that can shut the Internet down in case of emergency. [48] At its inception, therefore, the Internet embraces a concomitant degree of vulnerability and invincibility: presumably the entire network cannot be shut down by the acts of one individual or group, but the Internet also opens doors to the private networks interconnected to it that cannot be shut or entirely controlled once a TCP/IP connection is made. [49]
{18} The Internet is a network of computers that are linked together, allowing computer users to share information and data. [50] Each computer that is linked to the Internet contains a numeric address called an Internet protocol address, or IP address. [51] The numeric IP address has four parts, each separated by a decimal point. However, since it is easier to use, each computer is given an alphanumeric address, called a domain name, which corresponds to the IP address. [52] When an Internet user types in the domain name, the user's computer reads the name as the numeric IP address and contacts the appropriate computer. An example of such a domain name is "redlaw.com". Domain names are the alphanumeric monikers that ease the use of the Internet. Computers are linked on the Internet by "IP addresses," which are each composed of a long string of numbers. Each computer or user has a unique number, so that information can be directed to a specific destination, by using the IP address. [53]
{19} The domain name is a more accessible, more memorable, occasionally catchy, title that can be attached to an IP address. However, domain names must be unique, to avoid confusion in delivery. To send electronic mail ("e-mail"), the user addresses the message to the domain name of the recipient's e-mail provider. America Online, for instance, is an e-mail provider, whose domain name is "aol.com". Each user of the America Online service is given a user name to use with the domain name (e.g., "harrysmith"). Therefore, if a person wants to contact Harry Smith, an America Online subscriber, the user would send an e-mail message to "harrysmith@aol.com". The computer would read "aol.com", translate this into the corresponding numeric IP address, and deliver the message to the America Online computer, which would then deliver the message to Harry Smith.
{20} The domain name may also function as a "World Wide Web" address, if preceded by the letters www (e.g., www.redlaw.com). Web sites are pages of electronic information that a company, organization, or person wants to advertise to Internet users. Entities and people such as Sports Illustrated, Duke University, the National Basketball Association, and certain individual politicians have web sites that allow Internet users to look up information. [54] Once connected to the Internet, users are able to access and transmit data across Cyberspace in many different ways, including using electronic mail (e-mail) and downloading home pages from the World-Wide Web (the Web). [55] E-mail allows users to easily send primarily text-based messages between computers. The Web employs a point-and-click technology, which allows users to easily access information on other computers as well as establish Web sites that incorporate graphics and other multimedia features. [56] Much of the Web's usefulness is derived from its use of links. [57] A user interested in accessing the referenced document selects the link, causing the document to be displayed automatically, along with a new set of links that the user may follow.
{21} While the linked structure of the Web is well-suited to allow users to browse among many sites, following whatever links happen to draw their interest, it is poorly suited for users who want to find a single Web site directly. Users searching for a specific Web site have two options. First, if users know or can deduce the address of a Web site, they can type the address into a browser and connect directly to the Web site as if dialing a telephone number. [58] More often, users do not know the exact address and must rely on search engines available on the Web to search for key words and phrases associated with the desired Web site. Because of the quantity of information on the Web, searches often yield thousands of possible Web sites. Such a cumbersome process often leads to what is now commonly known as web surfing. Web surfing consists of a user going from one web page to another in a rather haphazard fashion in an attempt to locate a website of interest. Web surfing is particularly alarming for employers because it inevitably leads to a significant amount of inefficient computer use. More important, website surfing may lead to a user unexpectedly coming upon an obscene web page or encountering malicious programs. [59] The Web is filled with malicious code that either disable an employer's computers or, perhaps worse, enable theft of trade secrets or other important data stored on an employer's private network. [60]
{22} Undoubtedly, the Internet has revolutionized the information infrastructure [61] of many employers by linking many organizations to one another. This interlinkage enables the speed and efficient electronic transfer of funds, the distribution of vast amounts of information as well as varying dimensions of digital communications. [62] This form of networking has already proven essential for many businesses to compete effectively in the information age. Yet, dependence on the new information infrastructure has created new vulnerabilities for employers who are connected to the Internet.
Areas Where Employers Are Subject to Liability
{23} In this digital age, employees may be exposing their employers to unprecedented liability risk [63] now that many desktop computers in the workplace are interconnected to the Internet. [64] For instance, pornography may enter the workplace as a result of an employee downloading graphic images from the Internet. Once these images are downloaded, they may be viewed on a computer screen or transmitted to other employees via e-mail. Under these circumstances, an employer may be exposed to a sexual harassment lawsuit or the employee, himself, may be engaged in criminal conduct.
{24} In December 1997, a lawyer at the law firm Dickstein Shapiro Morin & Oshinsky was discovered using the Internet to access pornographic materials from his desktop computer. The lawyer was not dismissed. Instead, the firm suspended his Internet privileges for a few weeks and fined him an undisclosed sum for acting in contravention of firm policy. [65] Although this employer apparently escaped economic harm, the firm was exposed to embarrassing publicity from news accounts of the event.
{25} Despite the fact that Interconnected computer systems are now a fact-of-life for most modern office employers, some employers are just beginning to develop policies on the proper uses of technology in the workplace while others have still not done so. Indeed, a wide swath of employers are confronting this issue. The problem of stemming the tide of inappropriate e-mail messages and graphic digital pictures at work has come to the forefront lately because of the casual attitude many workers display when using their employer's computer equipment.
{26} One, largely unanticipated, problem with granting workers wide access to the Internet is the reality that when an employee visits a web site they leave a trail usually identifying the employer who owns the computer. [66] And, there's more than just personal embarrassment at stake. In February 1995, Chevron Corp. settled a suit brought by four female workers who were distressed by descriptive, sexual e-mail sent around the office. The settlement cost the company $2.2 million; to wit, employers have a significant basis to presume that monitoring employee Internet activity is justified to prevent an employer from being held liable for the website viewing habits of employees.
{27} Indeed, that's exactly what happened at Dickstein, Shapiro, the law firm mentioned supra. The unnamed lawyer's actions came to light only after he allegedly printed an indecent image from his computer screen. He sent the document to a printer, where a staffer saw it and later complained to management.
{28} Additionally, sexual harassment claims may have serious consequences for an employer. Statistics have shown that many employees spend a "disturbing" amount of time surfing pornographic Websites during working hours. Employees at I.B.M., Apple Computer, and NASA logged on to the Penthouse website thousands of times per month during 1996. [67] Of course, employers are not without remedial measures to significantly decrease unwanted Internet abuses, short of denying workers access to Interconnected systems like the Internet. Indeed, employers are using monitoring devices as technological solutions to this problem. One technological solution involves the use of a proxy server for access to web sites. A proxy server acts as a giant cache for the employer's network. Instead of requests for Web pages going directly out to the Internet, they're passed through a proxy server. If the proxy server already has the requested page stored locally, it delivers it to the employee's Web browser, or Internet software, without going out to the Internet.
{29} The advantage of using a proxy server from an employer's standpoint is that, because all Web requests pass through the proxy server, it can track all those requests. By checking the proxy server's records, an employer can find out every site visited by every employee on its network. [68] Employers also have access to software that can monitor Internet access and keep a log of all activity. For example, Cyber Snoop, is a software application that runs on an employer's network and provides Internet blocking and monitoring capability with features that could enable an employer to monitor employees' Internet use, including Web activity, FTP downloads, chat discussions, e-mail messages and Usenet news group posting activity. [69]
{30} In the digital age, it has become common practice for sexual harassment plaintiff's lawyers to seek copies of an employer's network e-mail logs during discovery. This practice could be critical to an explosive case even if only a few, out of several thousand, offensive e-mail messages are discovered. The consequences for technology-related harassment suits in the private sector have become an employee's grist in supporting a wide variety of employment discrimination cases against employers like Morgan Stanley, Citibank and R.R. Donnelly. [70]
{31} In a recent case involving Oracle Corporation chief executive Larry Ellison, Ellison's former girlfriend, Adelyn Lee, was convicted of sending him a falsified e-mail. [71] That very e-mail, in which Ellison was purported to have been told by Lee's supervisor that "I have terminated Adelyn per your request," was the key piece of evidence that originally led Oracle to settle with Lee for $100,000 in her wrongful termination suit. [72] But cellular phone records showed that Lee's boss, Oracle vice president Craig Ramsey, was in his car at the time of the e-mail transmission, and could not have been the sender. [73] What the Oracle case illustrates is that e-mail is as much a type of evidence in employment cases as traditional documents or oral evidence has been. [74]
{32} Generally, employers consistently articulate three considerations that drive the need for monitoring Internet usage by employees: [1] employee productivity; [2] cost of network bandwidth and technology resources; and, perhaps most importantly, [3] the potential negative publicity and legal liabilities resulting from inappropriate use of the Internet.
{33} Employers are typically concerned about the impact of non-business related Internet surfing on employee productivity. It is often assumed that excessive Internet usage results in measurable organizational costs -- e.g., upgrading network resources like leased lines, routers, disk storage, and printers to handle the increased load -- and wasted time caused by slow network response, the deployment of anti-virus programs, and an increase in unreliable connections. [75]
{34} Undoubtedly, as a result of the use of interconnected computer systems, employers can be held liable for the acts of their employees in a variety of ways, including defamation (from inflammatory e-mail messages or harmful electronic bulletin board postings), copyright infringement (from installing or downloading pirated copies of software onto employer owned computers), sexual harassment (from offensive or hostile e-mail messages), obscenity (from downloading or distributing obscene graphic images or use of offensive material that is distributed by means of the workplace e-mail system), and discrimination. [76] For example, in one case, still pending, two African-American employees sued their employer, Morgan Stanley, under Title VII claiming that a white employee authored and sent e-mail messages containing racist or offensive jokes and that Morgan Stanley tolerated a racially hostile environment to exist by permitting the jokes to be passed around through the corporate e-mail system. [77]
{35} In addition, employers may be subject to liability for the conduct of their employees in other ways. Employees who download unlicensed copies software programs from the Internet or install pirated copies of applications on their desktop computers leave their employers liable to legal challenges on copyright infringement. Software piracy is a common area of liability exposure on the Internet. If an employee uses company equipment to download software, and then wrongfully distributes the software or unlawfully makes changes to it, the company could be held liable for piracy -- which is, in effect, copyright infringement.
{36} Finally, e-mail can be a very dangerous means of intentionally leaking corporate trade secrets. Employers want to minimize the legal risks associated with the Internet since providing access to the Internet is akin to giving employees access to a ubiquitous, powerful, communications tool that allows instantaneous communication to others throughout the world. This is particularly true with regard to the protection of trade secrets. [78] Trade secrets are, obviously, one of the most confidential types of information owned by an employer to which an employee may have lawful access. Although courts decide on the individual circumstances of the case what is or is not a trade secret, the most important factors in making this determination are the nature of the information and to what extent the employer treated it as confidential within its organization. Examples of trade secrets include: special manufacturing processes, chemical formulae, designs, a board's corporate strategy, or highly sensitive financial information. [79] Loss associated with stolen trade secrets can be substantial. In some cases, the loss associated with the public revelation of a trade secret is more a matter of reputation than pecuniary interests. While Borland Corporation was surreptitiously using electronic surveillance to monitor its employees' e-mail messages, it discovered that one of its high level software executives, who had announced an imminent departure from the company, was sending e-mail messages that contained corporate trade secrets to his future boss, Gordon Banks, the president of Symantec Corporation. Borland reported its discovery to law enforcement officials who charged the employee, Eugene Wang, and Banks with theft of trade secrets under California state law. [80]
Areas Where Employers Are Subject to Employee Sabotage
{37} In the Federal employment sector and in accordance with the Paperwork Reduction Act of 1980 (Public Law 96-511), OMB is responsible for developing information security policies and overseeing Federal agency practices. In this regard, OMB published its guidelines on Federal sector information security in what is commonly referred to as OMB Circular A-130. [81] In addition, responsibility for developing Federal agency technical standards and providing related guidance for sensitive data belongs primarily to the National Institute of Standards and Technology (NIST), [82] in accordance with the Computer Security Act. [83] In the Federal government, primarily, information security risks are most troublesome when unauthorized persons gain access to highly sensitive information in the Defense Department's (the Pentagon) computer systems. Surprisingly, the Pentagon's computer systems are compromised frequently and more than a few of the attacks are considered malicious insider attacks. [84] Although the exact number of attacks [85] cannot be determined precisely, the Pentagon believes that it may have experienced as many as 250,000 attacks in 1995. These attacks are often successful! The number of attacks have doubled each year during the 1990s as Internet use as also increased. At a minimum, these attacks amount to a multimillion dollar nuisance to the Pentagon. At worst, they frequently pose a serious threat to national security.
{38} In one well publicized information security breach, in 1990, the computer network at the Air Force's Rome Laboratory in Rome, New York (Rome Laboratory) was sabotaged. Rome Laboratory is considered the Air Force's premier command and control research facility -- it works on very sensitive research projects such as artificial intelligence and radar guidance. In March and April 1994, Rome Laboratory's computer systems were attacked by hackers and other unknown individuals over 150 times. The attack, which is thought to have involved insiders as well as hackers, ultimately succeeded in shutting down thirty three government network systems for several days. [86] During the attacks, the intruders stole sensitive air tasking order research data. [87] Air Force Information Warfare Center staff estimated that the attacks on Rome Laboratory cost the government over half a million dollars. [88] If the research project had been damaged beyond repair, it would have cost about $4 million and 3 years to reconstruct it. [89]
{39} Additionally, an employer's vulnerability to insider or employee infrastructure sabotage is not limited to the public sector. Private sector computer systems have been attacked and damaged by disgruntled workers with increasing frequency. In a case that is believed to be one of the most expensive computer sabotages in history, Timothy Lloyd, 30, of Wilmington, Delaware, was charged with intentionally damaging Omega Engineering Corporation's (Omega) computer system by activating a software-bomb that permanently deleted all of the company's software and system files. Lloyd's former employer manufactured high-tech measurement and control instruments used by NASA and the Navy. As a result of the damages caused by the software-bomb, [90] the company had to forego millions of dollars in sales and contracts with the Federal government. Lloyd, who was a chief computer network program designer at Omega, allegedly became exceptionally frustrated after Omega decided to dismiss him for poor performance. Lloyd is now facing possible conviction and a prison sentence of 15 years. [91]
Electronic Surveillance Techniques Used By Employers
{40} Employers may use electronic surveillance techniques to monitor employee performance. In the name of assessing productivity, telephone company supervisors eavesdrop on their operators and used software to count and record the number of keystrokes per minute entered by the data entry workers. White-collar-knowledge-workers are also becoming just as vulnerable to electronic surveillance. [92] In the settlement of a class action lawsuit brought by the Communications Workers of America (CWA), Northern Telecommunication Corporation (Northern Telecom) agreed to compensate workers whom the union alleged were subjected to secret electronic surveillance over a 13-year period at the company's Nashville, Tennessee location. In addition, as part of the settlement, the company announced a new policy banning all forms of undisclosed employee monitoring. The new policy affects more than 22,000 workers at Northern Telecom. Apparently, Northern Telecom used hidden bugging devices and telephone wiretaps at several locations in the Nashville plant between 1976 and 1989 to identify and weed out CWA supporters and thus thwart unionization drives. [93] Although an employer has many reasons to conduct surveillance on its employees: to detect theft or tardiness, to monitor quality control or poor job performance, to examine the workplace for the presence of drugs and alcohol, [94] oftentimes, what an employer would like to do, and what an employer is legally allowed to do are two very different things.
{41} Some Federal agencies often use the same monitoring techniques they use to monitor employee Internet use as they use to monitor the public's computer users are visiting their websites. For example, the Department of Labor uses sniffer [95] programs to record the IP [96] addresses of users who visit the agency's web pages. [97] These same programs are installed on the agency's network computers to monitor the websites visited by the agency's employees. [98]
{42} Undoubtedly, the digital age has brought about both unprecedented resources that employees may rely on to increase productivity and efficiency and unprecedented possibilities for employees to use the resources provided to them to the intentional or unintentional detriment of the employer. Consequently, it would be obnoxious to common sense and plain logic to deny that employers, whose information infrastructure includes the use of technologies like the Internet, have legitimate interests in protecting and securing their computer networks through some use of monitoring technologies. The issue remains, however, to what extent should surveillance technology be put to use?
The Scope of an Employee's Right of Privacy
{43} Generally, and under the right circumstances, employers can use private security guards, supervisors or managers or technological devices, such as video cameras, to monitor employee activities without running afoul of an employee's right of privacy. [99] Under the law of communication privacy, whether the circumstances of a communication justify a belief that it is not subject to interception is analyzed in the same manner as the question of whether an investigative activity amounts to a search: that is, whether there is a justifiable expectation of privacy at the time and place of the communication. [100] Privacy law [101] is confusing because its sources stem from tort law, constitutional law, criminal procedure, civil procedure, family law, and contracts. [102] Nonetheless, in the context of the workplace, the fundamental concern raised under the tutelage of the right of privacy actually may boil down to the complex task of defining the proper contours of when it is appropriate for countervailing interests - - be they the interests of the government or the employer - - to justify an employee's loss of individual power and personal autonomy. [103] The Federal Constitution protects an individual's privacy in many spheres of privacy [104] including the interest in preventing the disclosure of certain types of personal information [105] without consent. [106] Of course, the Constitution's protections are not absolute. [107]
{44} In Griswold v. Connecticut, [108] the United States Supreme Court enhanced the jurisprudence of privacy by declaring that a Connecticut law forbidding the distribution of contraceptives violated the right of "marital privacy." The Court defined the right of privacy as being imputed from the "zones of privacy" [109] or "penumbras" emanating from general constitutional protections of liberty. [110] Interestingly enough, the Griswold case is a provocative precursor to contemporary privacy issues brought about by the present-day increasing use of digital technology in the workplace. The expansive right of privacy protected by Griswold resulted, in part, from technological advancements in birth control. [111]
{45} Another fundamental privacy case is Roe v. Wade. [112] This case established that the constitutional right of privacy [113] protects a woman's decision to have an abortion. [114] Although Roe appears to have been altered by Planned Parenthood of Southeastern Pennsylvania v. Casey, [115] the case remains good law, but it too may be eventually affected by technological advancements. [116]
{46} In the workplace setting, common law, statutory, and constitutional tests used to determine whether a reasonable expectation of privacy exists, in turn, require an initial determination whether there is an actual (or subjective) expectation of privacy. [117] The latter, objective determination [118] is tested against the customs, values, and common understandings that confer a sense of privacy upon many of our basic activities. [119] Thus, whether there is a legitimate expectation of privacy in a particular case depends necessarily on the facts and circumstances, with the actual expectation manifested by a party being a question for the fact-finder and the objective reasonableness [120] of the expectation being determined for the particular circumstances as a matter of law. [121]
{47} It is generally accepted that there is a legitimate expectation of freedom from visual electronic surveillance by police [122] in private rest rooms or private areas of public rest rooms. [123] This expectation of privacy is objectively reasonable both because of the setting, [124] compare People v. Triggs, supra (reasonable expectation of privacy in restroom) with United States v. Hitchcock, [125] and because individuals can shield themselves from view. Notably, it is legitimate to expect that a particular conversation will not be electronically intercepted by the police. [126] Moreover, there can be a legitimate expectation of freedom from clandestine electronic interception of a conversation by police despite the fact that the police or others might hear a conversation unaided. And, simply because a person allows one conversation to be overheard by nearby individuals does not mean that the expectation of freedom from electronic reception by police is objectively unreasonable. [127] This is because the legitimacy of an expectation of privacy depends, in part, on the ability of persons to control their circumstances. [128] And, without a warrant, police may not negate an otherwise reasonable expectation of privacy by surreptitiously eliminating such control. [129] Thus, while a listening device may be properly used to reveal information otherwise available by personal observation were a police agent actually present, [130] it may not be used without a warrant when its value is in hearing what a visible observer could not overhear. [131]
{48} Although conflicts over workplace privacy are increasing, legal analysis of the issue remains fragmented. A number of federal and state statutes regulate aspects of employee privacy, but each addresses only a particular, narrowly defined invasion. For example, separate federal statutes regulate the use of polygraph testing, credit reports, and medical examinations by employers. Similarly, over half the states have statutes regulating the use of polygraphs in employment; at least fourteen limit employer drug testing plans; and nearly two dozen forbid adverse employment actions based on off-duty tobacco use. No statute, however, deals with the issue of employee privacy in any comprehensive way. [132]
{49} The federal wiretapping law, Title III of the Omnibus Crime Control and Safe Street Act of 1968, 18 U.S.C. 2510-2525, as amended by the Electronic Communications Privacy Act of 1986, 18 U.S.C. 2510-3126, prohibits any person from intentionally intercepting, using, or disclosing any wire, oral, or electronic communication. [133] In the employment context, this frequently arises in the context of an employer taping telephone calls made to and from the business phone. There are two exceptions to Title III's coverage relevant to employers: [1] the prior consent exception, [134] and [2] the business extension exception. [135] Generally, an employer may be able to monitor sales or marketing calls for training or other legitimate purposes. The exception, however, will not extend to the monitoring of personal calls made by the employees on the same telephone lines. [136] The type of surveillance used seems to be a key factor affecting whether the employer's use of such equipment will be upheld in court. [137] For example, video cameras that also record sound are covered by the federal Wiretap Act as described above. However, video cameras that merely record activity, particularly when visibly placed in public work areas, have not been found to be a violation of employee privacy under the Act. [138]
{50} Five current or former workers at a Sheraton hotel in Boston are suing the company for secretly videotaping them and other workers in the male employees' locker room over a seven-week period in 1991. The workers say they were humiliated after discovering that some of them were captured on videotape in their underwear. Such videotaping may be viewed as an attempt by employers to control every aspect of workers' lives while they're on the job, and that includes when they're changing their clothes or taking breaks. [139]
{51} ITT Sheraton Corporation defended its actions by arguing that the videotaping was intended to investigate suspicions of drug dealing. A previous survey, a poll of 301 businesses by Mac-world magazine in 1993, found that 22% had engaged in searches of voice or electronic mail or computer files. [140] Electronic surveillance is most prevalent in larger organizations where employees perform routine jobs at a computer or on the telephone. [141] Apparently, the majority of employees being electronically monitored are women in low paying clerical positions. [142]
{52} In Watkins v. L.M. Berry & Co., [143] the employer intercepted a personal phone call. The court found that the employee did not give consent to this action and therefore the employer violated the Wiretap Act. [144] The interception of a personal call was also the alleged harm in Epps v. St. Mary's Hospital of Athens, Inc. [145] In that case, the employer was found to be in compliance with the Wiretap Act because its actions fell within the business-extension exception. [146] As noted, in one of the most extensive cases of covert monitoring to date, Northern Telecom agreed to settle a suit filed by the Communications Workers of America. [147]
{53} Of course, not every violation of privacy norms warrants legal intervention. Some intrusions are so trivial that they will be experienced by most people as mere annoyances or rudeness. The intensity of social life inevitably results in frequent minor personal offenses. These breaches of social norms are easily repaired through ritual interchanges--a simple apology is the most obvious example--which are designed to affirm the norm violated and to vindicate the victim's claim to basic forms of respect.
{54} The law, however, should be concerned with serious violations of personal autonomy and human dignity, those which threaten an individual's self-regard and honor. From its first articulation by Warren and Brandeis, the right of privacy has been linked to the principle of an inviolate personality. [148] As such, the values underlying the right of privacy rests on a conception of privacy that is concerned with maintaining basic forms of respect for the individual. [149] Since the observance of fundamental social norms by others is a crucial constituent of individual personality, violation of these norms is itself harmful, independent of other considerations because privacy can be understood as redressing human dignitary harm. [150]
{55} In addition to an intrusion, a violation of privacy involves an element of loss of control over one's personal human dignity. [151] The degree of this loss of control affects the significance of a given intrusion. For example, the passerby who lingers by a bedroom window in order to overhear private conversations can be easily shut out by closing the window, while the surreptitious use of a listening device to acquire the same information leaves the victim feeling a sense of loss when the intrusion is discovered and the victim recognizes that he could do nothing to prevent the intrusion since the invasion of privacy was furtive and secret. [152] Indeed, the worst since of loss of human dignity may occur when an individual is systematically deprived of privacy through the exercise of power by another - such as in the employment context. In such cases, power is used to intrude directly, or to force another to expose aspects of himself to the boss. [153] Even in these contexts, however, there may be a kind of quid-pro-quo relationship wherein the employee knowingly relinquishes a degree of personal autonomy in exchange for the opportunity to earn a living. [154] Nonetheless, covert surveillance would still exceed the bounds of this relationship. The employee cannot be assumed to have consented to or agreed upon the presence of surveillance simply because of its possibility. With little doubt, a fair agreement would require the employee to be put on notice that surveillance is taking place. In this respect, the sense of loss of human dignity or personal autonomy may not be as injurious since the knowledge and awareness of surveillance empowers the employee with the ability to control the degree to which he exposes aspects of self to the employer. [155]
{56} At first blush, this may not appear to serve the employer's needs well. But, even under the current doctrine of privacy law, the employer is never justified in insisting on unlimited access to employees. [156] This is particularly true of certain forms of invasive electronic monitoring. As noted, supra, in the case of e-mail: an interesting condition of e-mail is that e-mail seems to promote a certain type of candor in its users. In this respect, e-mail messages tend to be more revealing of a person's inner feelings than a traditional paper document. As such, an employer's monitoring of e-mail messages surreptitiously obtains unauthorized access to an employee's personal self. [157]
{57} In this digital age, employers must be permitted to undertake reasonable precautions to protect and secure their information infrastructure. It can hardly be doubted that employers face unprecedented vulnerabilities to their computer systems and private networks when those technologies are interconnected to the Internet. In this regard, employers have legitimate interests in surveillance technologies and other devices that assist employers in securing their vital information infrastructure. Yet, the employers' interests are not without their limits.
{58} Contemporary interpretations of privacy law doctrine has left employers with an arsenal of powerful technologies to use in the workplace to surreptitiously monitor the activities of employees. This framework may have been sufficient when the critical issues of workplace privacy involved considerations of whether a manager could open a sealed envelope delivered to the employer, but addressed to an employee. [158] Although a great deal of the mail still is delivered in an envelope, billions of messages travel across employer networks in the form of electronic mail. Employers have the technological capability not only to read each message addressed to an employee, but to so undetected and unknown. In this respect, privacy law doctrine could impose clear limits on an employer's ability to lawfully undertake secret surveillance activities. Employment is not an all-encompassing relationship. Employers and employees enter into the employment relationship for a specific, limited purpose. The law of privacy is fundamentally concerned with serious violations of personal autonomy and human dignity; namely, those which threaten an individual's self-regard and deep sense of honor. When those core areas of privacy are threatened by an employer's interests in protecting and securing its information infrastructure, such intrusions should not be permitted. [159]
{59} As employers expand their use of information technology, they face an increasing challenge to protect the integrity, confidentiality, and availability of information that is vital to their business. The conclusion that employees do not lose all ordinary expectations of privacy merely because they enter into an employment relationship has been confirmed in a number of legal contexts. [160] Courts have often held that an employee does not somehow abandon his right to privacy at the doorstep of the employer's premises. [161] Merely by signing on to an employment relationship, an individual does not automatically open his entire private life to the scrutiny of the employer. Digital technology provides employers with an arsenal of extraordinarily intrusive methods of workplace surveillance. [162] These technologies enable employers to record an unsuspecting employee engaging in very personal and private behavior. [163] The increasing number of employers who have connected to the Internet has brought to the forefront a serious threat that employers could have their entire information infrastructure significantly damaged through employee sabotage. Moreover, employers face an unprecedented degree of risk of liability for the acts of their employees when those employees have access to the Internet.
{60} Undoubtedly, the need to secure information from those who might damage expensive computer systems or conduct economic espionage or perform some other such havoc has never been greater. The concomitant risk that employers may implement digital surveillance and monitoring systems that require employees to surrender substantial privacy interests is also greater than ever before. In most cases, a prudent approach to this problem involves a simply stated, but notably difficult solution; namely, selecting an appropriate level of monitoring or protection of the employer's network and also ensuring that the security measures that are adopted do not breach the fundamental privacy interests of employees. Unfortunately, most employers that engage in digital surveillance monitoring, do so surreptitiously. When workers do not know they are being monitored, the right of privacy is presumptively eroded. [164] To thwart the de facto erosion of workplace privacy, privacy law must be enhanced to encompass the present-day realities and future possibilities of technology and its potential impact upon employer monitoring practices. Surreptitious and sweeping surveillance of the workplace through the use of digital technologies should be presumptively unwarranted under the law of privacy. [165] As such, employers could only use such technology when particularized suspicion could be articulated or when the presumption could be rebutted by evidence of exigent circumstances. And, in no case, should an entire workplace be subject to widespread surreptitious surveillance. Surreptitious workplace surveillance, when such use is warranted, should be limited to the area of the workplace for which particularized suspicion has been articulated. All surveillance technologies, operations and practices should be subject to procedures to ensure accountability. Explicit criteria should be agreed for deciding who should be targeted for surveillance and who should not, how such data is stored, processed and shared. In this manner, the values underlying the right of privacy, which rest on a conception of privacy that is concerned with maintaining basic forms of respect for the individual, will be legitimately supported by the legal doctrine.