The unblinking eye of the boss sees more than you realize

Warning: reading this story at work could be hazardous to your career.

Your boss could be watching your keystrokes, logging websites you visit and keeping track of how long you spend there, and looking for keywords in your emails. As if that weren't scary enough, some employers are going even further by demanding prospective employees submit to deep background checks as a condition of employment.

Technology is making it much easier for employers to quickly find out things about the people who work for them — or want to work for them.

And it's all perfectly legal.

'I think one day everyone will be fingerprinted by their employer.' —Paul Guindon, Canadian Corps of Commissionaires

Some employers, for example, are going far beyond a simple check of employment references and are drilling deep into a prospective employee's background. They're checking for a criminal record against the national police database by requiring a fingerprint.

It's a trend that Paul Guindon, chairman of national business management committee at the Canadian Corps of Commissionaires, sees growing exponentially. Besides providing security guards, the Commissionaires' services include doing police clearances and digital fingerprint checks of staff for companies.

"I think one day everyone will be fingerprinted by their employer," he says, "especially those in sensitive positions like teachers."

To capitalize on the trend, his organization purchased 40 digital fingerprint machines with training and software at a cost of $1.5 million. At some 20,000 checks a year and growing, Guindon expects the investment will pay for itself in three years.

"We already do about 25,000 traditional ink-and-roll fingerprints, but there's a 200,000 backlog at the RCMP because it's manual," he says. "Digital is instant."

He says many private and public employers demand criminal record checks, including the Department of National Defence and defence contractors, Public Works Canada and many educational and health institutions.

Because of the privacy issues involved, those being checked must consent to the $75 process. The encrypted fingerprint data is sent directly to the RCMP, and the results returned to the employer noting a summary of any conviction including the offence, location and date if there is a match on the database.

"We have no idea of the result, and the data is wiped off our computers when it is sent," says Guindon, noting the Commissionaires also offer a pardon service for those with criminal records who qualify to have them expunged.

Potential employees, of course, can refuse the check and take a pass on the potential job. They usually get into difficulties if they haven't disclosed a criminal record when asked directly about it during their application process.

Companies have some responsibilities to protect privacy, though. They must store the information securely and restrict access to it if they hire the prospect, or destroy it securely if the applicant is not hired.

Desktop surveillance

Technology is also offering employers ways to quietly keep tabs on what their staffers are doing on company time.

That time is money, says SpectorSoft Corp.'s marketing director Doug Taylor, and the Florida-based company sells software packages to monitor the online activities of a company's employees. Underlining how much time at work some spend on personal pursuits, Taylor points to a report from consultants Challenger, Gray & Christmas that suggests during the National Football League regular season some 37 million people spend an average of 50 minutes a week at work managing their fantasy teams.

Add in eBay, Facebook, MySpace, YouTube, stupid email jokes and the lists of top web destinations, and number of lost hours grows exponentially.

During the National Football League regular season some 37 million people spend an average of 50 minutes a week at work managing their fantasy teams.

Looking to claw back that company time, IMV Projects, a Calgary project management firm, installed SpectorSoft's 360 software three years ago on the PCs of the 650 people it employed at the time.

IT manager Ross Benov conservatively figures the firm recouped 10 hours per year per employee at $30 to $40 an hour, equaling between $195,000 and $260,000 in salaried work time. Setting a more liberal estimate of time wasting at 40 hours a year per employee, it adds up to more than $1 million, he says.

"We use it in different ways — to run a report on an employee if their supervisor feels they're spending too much time online, to see what websites they're going to," says Benov.

He notes that employees are told about the software and the company's internet guidelines. "We've had no problems since and I haven't heard any complaints. We allow full internet access at lunchtime because we want to keep people happy and maintain a balance."

SpectorSoft started making its surveillance software for the consumer market about a decade ago, allowing parents to control what their kids did online and monitor which sites they went to. It has since expanded to the corporate world and is finding an eager audience. Today it is one of the fastest growing companies in the U.S., with sales to more than 50,000 companies and 400,000 consumers.

"You have to own the computer and the network," says Taylor noting some European jurisdictions do prohibit some types of monitoring. "And you should tell your employees up front that they may be monitored."

He says there are two ways to use the system. The first is to monitor all employees for prohibited online behaviour. The second is to only watch employees who are not meeting performance standards. The software is not intended to crack down on any personal use of the web or email, Taylor says, but to single out the worst abusers.

"The system knows how long you had an eBay window open and how long you were active in that window," he says. "So it's not going to report that you were on eBay for seven hours [if the window was open that long], just that the window was open and that your mouse was active inside that window for 20 minutes."

Legal considerations

But do the measures companies are taking to check and monitor employees equal an invasion of privacy?

A recent Ontario Securities Commission case, for example, uncovered a scheme by an IT worker who had default access to all company emails and who used his inside knowledge of merger talks to profit on the stock market before the talks were made public.

Companies are within their rights to ask prospective employees to submit to a background check, including fingerprinting, says the federal privacy commissioner's office, though there are rules around how that information is stored and who has access to it.

When it comes to on-the-job surveillance, there's no easy answer, says lawyer Michael P. Fitzgibbon, a labour and employment law specialist at Borden Ladner Gervais in Toronto.

"The lines are not clearly drawn, so it's a question of degree," says Fitzgibbon.

He notes that there are legal requirements around compliance and dissemination of information for publicly traded companies that may make surveillance necessary. A recent Ontario Securities Commission case, for example, uncovered a scheme by an IT worker who had default access to all company emails and who used his inside knowledge of merger talks to profit on the stock market before the talks were made public.

Fitzgibbon adds that there are areas where the employer has an interest in ensuring confidential data is not distributed by employees, and that sexual harassment and human rights rules aren't violated by material a worker puts on their screen or uses a company email system to distribute to others.

Still, says Fitzgibbon, monitoring all employees by default can also create a climate of distrust. That can have an unintended, negative impact on the productivity or retention of valued staff.

The federal privacy commissioner's office says surveillance of employee activities is a case-by-case matter. It says that as long as there are legitimate reasons for capturing the data and it's stored securely under privacy legislation rules, there's no hard and fast policy on the practice.

Not every company is comfortable with such stringent measures.

"We do get prospective clients who investigate our software and then decide it's just not for them," says SpectorSoft's Taylor.

The key is consent, Fitzgibbon says. Companies should tell employees if they are being monitored and be clear about what the guidelines are for personal internet use.

Still, to be on the safe side, you might want to stop reading this story and get back to work.