________________________________________________________________________________ Wired News We Know What You Did Last Fall by Chris Oakes 3:00 a.m. 21.Sep.99.PDT A software utility that secretly records computer activity in alarming detail counts some high-profile corporations and government agencies among its clients. But not a one wants to talk about how they're using Investigator to monitor workers. The software produced by WinWhatWhere performs some impressive monitoring of any and all user actions. "It records the time, the date it started, how long it was active, the name of the program, the title of the window, and every keystroke that was entered," said Richard Eaton, president and founder of the Kennewick, Washington, company. Better still, all of its activities are conducted in stealth mode. "It's as quiet as can be on a computer. You won't see it on the task list," Eaton said. Originally designed to help system administrators track down software and network problems, Investigator has found an eager audience among corporate and government clients, Eaton said. Its users include Delta Airlines, Exxon, Ernst & Young, the US State Department, the US Mint in Denver, the US Department of Veteran Affairs, and Lockheed Martin. Corporations account for roughly 70 percent of Investigator's sales, Eaton said. "They're using it in a corporation when they suspect somebody is doing something they shouldn't be doing." Corporate networks are not the only snoopers, however. "The [most surprising] use that I've seen that I didn't even envision is disgruntled spouses watching [what] their spouses [are typing] in chat rooms," Eaton said. Investigator was released in August 1998 and was recently updated to version 2.0, which added a finer-tooth comb to the software's tracking capabilities. the keystroke-monitoring feature was the No. 1 most-requested new feature, according to Eaton. The software has competitors, such as Kansmen's LittleBrother. But few have Investigator's reach, and most work simply to block Internet access rather than recording all activity. Jodi Beebe, hotline coordinator for Privacy Rights Clearinghouse said it's one of the most intense monitoring applications her organization has seen. "Whatever happened to the good old days of an employee background check?" Beebe wondered. "It's just incredible how the workplace is changing." Determining how employers are applying the software is an inexact science for WinWhatWhere. Eaton said he can only go by his impressions since administrators are reluctant to discuss how they use the software. Seeking testimonials for the product, Eaton sent individual emails to 450 Investigator users, but didn't get a single response. "The people I talk to think it's a fine idea, and then they go talk to their boss and they say 'No way.'" Eaton said he believes that 90 percent of the time the software is used to track suspicious behavior. He doesn't think it's deployed to keep tabs on entire networks. Then again, multi-user versions of Investigator could be used for constant, company-wide monitoring. How it's used is up to network administrators. Eaton is among the first to admit the software is open to misuse and that it belongs to a category of products ripe for some form of regulation. "We're torn by the whole issue, because we didn't set out to write a program that would be used like this," he said. "But you know, we cashed the check -- and there are legitimate uses." A California bill, now sitting on the governor's desk, aims to put restraints on corporate e-spying. Senator Debra Bowen (D-Redondo Beach) introduced an amendment to the state Labor Code (SB 1016) in the final week of the legislative session that would have made it a misdemeanor for employers to snoop through an employee's email without warning him or her in advance. Governor Gray Davis is expected to sign the bill into law before 10 October. A 1998 American Management Association survey found that 63 percent of employers electronically monitor their workers by reading email, browsing computer files, and/or monitoring Internet use. The survey also found that 23 percent of those employers don't notify employees that they're being monitored. Eaton and others -- including Beebe of the Privacy Rights Clearinghouse -- think notification is a minimum requirement for the use of software like Investigator. "At a minimum, privacy principles dictate that employees be notified when this is going on," said Barry Steinhardt, associate director of the American Civil Liberties Union. For the moment, the software itself is clearly legal. But Steinhardt said privacy laws would prohibit employers from reading at least some of the information Investigator gathers without employee notification. "Ultimately, we think that employers make a mistake to engage in this kind of surreptitious surveillance of their employees," Steinhardt said. It breeds mistrust and could have the unintended effect of making employees take more time off from work. "Employees are not simply machines that need temperature and pressure monitors to ensure they're working properly, and many of them will see keystroke monitoring as Gestapo-like tactics," added PC user Greg Hansen, a graduate student at Indiana University. "Morale and productivity can suffer." Beebe agreed that, laws aside, the software polarizes the employer-employee relationship. "It's a matter of being forthright with one another -- OK, we are or are not going to be monitoring your email." No matter whether or how laws end up regulating the use of software like Investigator, employees in the modern workplace should educate themselves, she said. And they should use common sense. "You shouldn't be using workplace email for personal use.... Do it at home and don't do it at work," Beebe said. http://www.wired.com/news/news/politics/story/21847.html ________________________________________________________________________________ no copyright 1999 rolux.org - no commercial use without permission. is a moderated mailing list for the advancement of minor criticism. more information: mail to: majordomo@rolux.org, subject line: , message body: info. further questions: mail to: rolux-owner@rolux.org. archive: http://www.rolux.org