Chapter 6: Hardware, Software, and Spyware

Computers have revolutionized our workplaces in ways that earlier generations could not have imagined. Among the most significant changes is the remarkable extent to which an employee's activities can now be measured and monitored. The electronic signals that flow from one part of a computer to another, and from one networked computer to another, can all be measured, tracked, and recorded. In a remarkably short time, your employer can develop a highly detailed profile of exactly how you have been spending your day.

Feeling the Electronic Lash

Roughly 2,500 years ago, Greek shipbuilders perfected one of the most fearsome vessels for ship-to-ship fighting that the world has ever seen—the trireme, a narrow-hulled vessel with outriggers for stability and a massive ram on the prow for slamming into enemy ships. The trireme had one large square sail and a few smaller sails, but for power, it relied primarily on the strength of 170 rowers. The dearth of sails was hardly an impediment: Maritime scholars estimate that a trireme could go from zero to its top speed of about twelve knots (approximately fourteen and a half miles per hour) in just over thirty seconds.

The modern day office is slowly becoming the equivalent of the Greek galley. While there's no whip-wielding taskmaster at the front of the room (at least in the more well-known companies), the pace of work is enforced by a far more relentless observer—software that monitors the number of keystrokes each employee makes during the course of the day, and/or records the keystrokes themselves.

Keystroke counting, surprisingly, is not an invention of the computer age. Long before computers appeared on office desktops, a management theorist named Frederick Taylor developed the concept of "scientific management," in which he argued that a company's economic success depended on the regular and objective measurement of each employee's performance. Taylor's concepts proved enormously popular with business owners, leading to the invention and implementation of a wide variety of employee-monitoring devices, including keystroke monitors for typewriters.

The only thing that early keystroke monitors had to measure was how fast a typist could type—the paper in the typewriter produced a record of which keys were struck. Today, some employers are still concerned with how quickly their employees type—the industry standard today for a good typist or data entry person is approximately 12,000 keystrokes per hour, or 200 keystrokes per minute. However, the majority of employers today are concerned not merely with productivity but also with the possibility of stolen secrets and hostile work environment lawsuits. As a result, companies are far more interested in software that can record the actual keystrokes made during the course of the day by each employee, along with a record of websites visited, programs used, and in some cases, the actions and movements of each employee's mouse.

The 800-pound gorilla in the keystroke-monitoring jungle is WinWhat-Where, a Kenniwick, Washington, software company that produces Investigator, a multifeatured computer monitoring program. First released in 1997, Investigator was developed by Richard Eaton, a programmer who came up with the idea when he wrote a program to help himself track down bugs in his software. Since then, he has sold more than 200,000 copies of Investigator to suspicious spouses, concerned parents, businesses, and even the FBI. ^[1]

Investigator not only records every keystroke made on the computer, it also maintains a record of dialogue boxes and takes periodic screen shots of what's being displayed on the computer. The software can even be configured to take secret photos of the computer user if the PC is equipped with a Web cam. By recording each keystroke made by a computer user, Investigator can effectively record every e-mail (sent or unsent), Internet relay chat, or instant messenger session that takes place on the computer.

Investigator could be monitoring activity on your office computer right now, but chances are, you'd never know if it's running or not. Eaton designed the program to be hidden in plain sight: An icon may appear in the system tray, but the various modules that make the program operate periodically change their name to make them more difficult to find. Similarly, the files that are used to hold the data that Investigator collects are given arbitrary names and dates so that they can't be easily located.

Even if you know that Investigator is running on your office computer system, you may not realize the extent to which it is actively reporting on your activities. Investigator can be configured to surreptitiously send its collected data by e-mail to your boss on a regular basis or wait until it discovers certain preset keywords ("boss," "pornography," "kill," or the name of an unreleased product).

Although it is perhaps the best-known keystroke monitoring program, Investigator is just one of the dozens of monitoring applications on the market. For instance, Scalable Software, a Houston, Texas, software company, produces The Survey Suite, which takes a slightly different approach to this issue. According to company literature, instead of monitoring keystrokes, The Survey Suite:

"[d]etails the time the employee spends using Windows applications, e-mail, and the Internet, and provides the employee with easy-to-understand reports so that he/she can better manage their time."

The focus of The Survey Suite is on the amount of time you spend actually interacting with the programs on your computer rather than on what you are actually typing. It can be particularly useful for keeping an eye on telecommuting employees, because the software is designed to run locally on an employee's PC and then transmit the results of its observations to a central database. The Survey Suite gathers its information during the course of a day and then transmits it to the central server whenever a network or Internet connection is opened.

A company that installs a keystroke or software monitoring program may have to deal with employee morale issues, but there are no legal barriers to the use of such programs. The information gathered by such programs is not "in transit" within the meaning of the Electronic Communications Privacy Act, so its collection does not constitute an "interception." More importantly, whatever expectation of privacy employees might have with respect to their actual keystrokes or the time they spend in each program is generally outweighed by the legitimate concerns of business, or rendered nonexistent by company policy.

In addition to the privacy issues, an employer's use of these types of programs (particularly those that focus on counting keystrokes) can raise serious health concerns. Various studies have linked keystroke monitoring to a variety of physical ailments, including carpal tunnel syndrome. There's also growing concern that a high level of electronic surveillance is contributing to a growth in employee psychological problems.

There are no specific figures regarding how many companies use software to count or record keystrokes. These types of surveillance programs are either not being studied or the usage statistics are reflected in the three-quarters of American companies that do at least one type of electronic surveillance. It can be safely assumed, however, that as the cost of installing this type of program falls (right now, it's in the ballpark of ten to fifteen dollars per employee) and the data mining capabilities of business computers increases, the percentage of employees whose every keystroke is recorded will continue to grow.

Perhaps the only serious disincentive to increased keystroke monitoring is that the same keystroke evidence that companies gather to analyze potential misconduct by their employees can be used against them in litigation. As many companies have learned to their dismay with e-mail, archives of electronic data can be a mixed blessing.

^[1]"'Sneaky' software may be watching you," CNN.com (February 19, 2002).