need suggestions for monitoring internet activity at company

[joelen]

ive got a customer (small biz- 12 computers) that wants to keep track of where all users are going on the internet. they have server 2000 with active directory, but the internet is being handled with a netgear router. is there a good way (cheap or free software) to keep track of each workstation and where they are going on the internet? - the boss wants to be able to see where each employe is visiting- doesnt need to do screen captures on each system or anything that extensive.

[3fingersalute]

There are many different options. If you have an older computer laying around not in use and feel comfrotable with following some setup guidlines, throw fedora linux on it and put dansguardian on it. Its totally free, and can run either in a stealth mode that simply logs internet activity, or can be used to filter traffic as well. The hardware requirements are super low and there are a lot of nice step by step guides for setting it up on their site. Once its configured, you can throw it in the closet, under a desk etc. with no keyboard, mouse or anything and just access it via a web interfacet to make changes, run reports, etc.

If you have any questions give me a yell.

[Gabriel]

As a side note - the Employer need to notify his workers that their internet activity is being watched (Privacy issues).

Cheers,
Gabriel

[3fingersalute]

As a side note - the Employer need to notify his workers that their internet activity is being watched (Privacy issues).

Cheers,
Gabriel

really? Is this a law?

[Auric]

I don't think there is any law about that?

The computers, and data are technically company property.

[3fingersalute]

I don't think there is any law about that?

The computers, and data are technically company property.

That's what I was thinking too. Morally you should probably inform them, but I can't imagine legally they could do anything about you monitoring their internet usage if you own the equipment and the internet connection.

[BOB IROC]

That's what I was thinking too. Morally you should probably inform them, but I can't imagine legally they could do anything about you monitoring their internet usage if you own the equipment and the internet connection.

I do believe that the employer has to provide some sort of statement regarding the use of business property including technology such as computers, internet, and email. State that anything that is done is company property and may be monitored. Where I work they call this the Acceptable Use Policy (AUP) and we make all our staff and students read and sign it every year. I had to acknowledge and sign similar documents in past jobs. And that includes bringing a personal device such as a laptop and connecting to the company internet/network.

[geoscomp]

you might want to read this:

Human Resources Solutions
Voice Mail, E-Mail, Internet Access, and Computer Files Guidelines
Monitoring voice mail, e-mail and Internet use is generally legal so long as the employer establishes an appropriate policy and effectively communicates such policy to its workers. The policy must be non-discriminatory and it should prohibit all forms of non-business related communications. The policy must be uniformly enforced through employee education, ongoing monitoring and appropriate discipline. Obtaining prior consent also serves to diminish an employee’s expectation of privacy and will generally protect employers from liability.
The key goal for an employer’s policy is to eliminate any employee expectations that these communications are confidential. As with any sample form, it must be adapted to the specific needs and situation of the employer. The policy should not be implemented without advice of your legal counsel or other qualified HR professional.

Checklist in developing a policy on employees’ use of the employer’s electronic communications and computer information systems:

Define what systems are covered by the policy, e.g., voice mail, e-mail, Internet, and computer systems and files.
Make clear that use of employer’s computer systems is to be used for business purposes only, and all files and messages are company property.
If personal use is permitted, prohibit personal use that interferes with employee’s work or that of others (e.g., prohibiting non-work related websites such as chat rooms, games, travel, shopping, stock trading, hate/discrimination, pornography, etc.).
Prohibit inappropriate use including transmitting or downloading of material that is discriminatory, defamatory, harassing, insulting, offensive, pornographic or obscene.
Prohibit copying and sending any confidential or proprietary information, or software that is protected by copyright and other laws protecting intellectual property.
Prohibit unauthorized access by employees of other employees’ electronic communications.
Notify employees that any misuse will be subject to discipline, up to and including termination.
Inform employees that employer may access, search and monitor voice mail, e-mail or company files of any employee that are created, stored or deleted from company computer systems.
Advise employees they should not expect their communications or use of employer’s computer information systems to be confidential or private.
Have employees sign company policy or notice on acceptable usage of employer’s computer information systems.
Consider installing an on-screen warning on the employer’s electronic communications policy that appears every time employees log onto their computers.

[Auric]

A good example where this comes up a lot,

Programmer A has a great idea so in his free time at work he develops an application and decides he wants to sell it.

Technically because he used a business PC and business compiler, the work is property of the company. Good ole Intellectual Property.

We are pretty easy going with our users about internet usage, no chat, no porn and no streaming music. Other than that you want to surf on facebook or myspace... don't let it effect your job.

[slgrieb]

Anytime you monitor employee activity, you have to able to demonstrate that the policy is applied uniformly and that all employees are aware of the policy and precisely what the requirements of that policy are. Otherwise, the first time you use it to terminate someone, you are likely to wind up on the losing end of a lawsuit. You can even wind up with the employee back on the payroll, where they are likely to remain until Doomsday.

This is the big pitfall of monitoring software. Is somebody going to examine all of these logs daily for all employee activity, or is this only going to happen to the black sheep? Answer B will get you hung out to dry.

You are better off with software that restricts access to objectionable sites. Most commercial proxy servers for instance will do this in a very flexible way. Years ago I used WinProxy a lot, but I'm sure everyone has a favorite. Generally, I tell clients to focus on employee productivity and meeting job standards. All the monitoring, maintaining whitelists, etc. is a pretty large drain on resources and productivity itself.