Do acceptable Internet use policies pose unacceptable risks? In the government workplace, the acknowledged right to make personal telephone calls looks like a close analogy to e-mail and Web surfing. But in terms of security risk, there is no comparison: When it comes to accidentally revealing secret information, sending embarrassing information to thousands of people or crashing entire networks, there is no substitute for a personal computer connected to the Internet.
In the early days of workplace desktop computing, it was common for IT instructors to tell employees to "have some fun" with this new and intimidating technology, by sending and receiving electronic mail, playing games or looking up information. The goal was to have employees accept computers and quickly integrate them into their working days. Now, of course, most employees know exactly how to use personal computers and - certainly for personal use - e-mail, either through their government accounts or through Web-based applications like Hotmail. They can also exchange vacation photographs and humorous videos; play games (which they download and install on their machines); stay current with the latest news from the world of sports, and indulge in other, less wholesome amusements.
The damage that can result from unrestricted Internet use will not necessarily make front page news in stories about virus-damaged networks or pornography arrests. For example, senior managers should be aware that search engine companies keep careful track of queries. They know exactly what people are looking for - and perhaps who those people are; failing that, they can usually identify the IP address where a search originated. They can watch a lengthy search from a single user or location as it twists and turns before reaching a destination.
Through some combination of cookies, search engine registration information, data mining and simple tracking technologies, then, the most intimate concerns of a government agency can be turned into hard information. Of course, search engine operators pledge not to divulge personal data that might identify an individual, But information requests coming from a specific government department don't need to be linked with a specific person to yield valuable intelligence. Want snapshots of what a certain department was worried about over the course of an hour, or a day, or a year?
They're probably available.
There are technological fixes for that problem, but the true challenge of acceptable use is up close and personal - your people, their right to be treated as adults, and their potential to behave like children and get your organization into trouble. Canada's public libraries have been an interesting test bed for acceptable use policies, as publicly funded institutions serving distinct communities with free and open access to information. They have already debated acceptable Internet use in the glare of media publicity and the chill of vote-minded city councils. The typical outcome is, as the mission statement of the Ottawa Public Library says, public Internet access that is "consistent with the library's mission" and "endorses intellectual freedom."
In principle, that means providing a safe environment for all. In practice, it means filtering at least some content in some contexts.
As president of the Canadian Library Association, Wendy Newman watched the discussion that led to the CLA's leadership document: A Matter of Trust. On the one hand, she said, you can trust a library to provide a "safe" environment. But "you can't have a b busy-body' system."
In the end, most libraries have opted for blocking technology to filter content as appropriate: Tight restrictions in the children's area and the ability to choose for adults. Still, Newman said, "Filters both overblock and underblock. No filter is a substitute for human judgment."
Unfortunately, human judgment is exactly what public sector managers want to avoid. After all, who wants to sneak around looking at computer screens to see whether an employee is playing a harmless pre-installed card game or is betting the next paycheque in Texas Hold'em? Who wants to decide that five personal e-mails are all right, but half a dozen is wrong? These days, there are no electronic Bob Cratchits out there. In a disciplinary situation, the employer would almost certainly have to prove that an acceptable use policy was being uniformly applied across the department. If not, harassment would simply be the first item on a page of grievances as long as the imagination.
It is not enough to hope and trust that people will behave reasonably. Some won't, and the risks are too great to run. It may be time to act now, and forcefully, to confine Internet use to work only, with all exceptions carefully delineated. Otherwise, the ability to damage the organization becomes permanently entrenched as a right, not a privilege, and as a negotiating point rather than a tool for doing the work taxpayers are funding.
Richard Bray (rbray@itworldcanada.com) is an Ottawa-based freelance journalist specializing in technology issues.
Related link:
Security and the Internet
Yes, staff is network security's biggest threat
icon.
