Home » Data Protection » Network Security

How To

Video Surveillance and Data Monitoring: The Basics

Here are pointers on creating and communicating your policy, determining return on investment, and other video surveillance basics.

CSO — It's getting easier to keep an eye on employees and customers, both in terms of video surveillance, with ever smaller and cheaper digital cameras, and data monitoring, with powerful tools for examining emails, web activity, and network packets. Done correctly, these surveillance activities can help deter or catch theft and fraud. Done poorly, however, surveillance can be expensive and ineffective, and can create legal risks and morale problems. Here are pointers on creating and communicating your policy, determining return on investment, and other video surveillance basics.

Questions and issues covered in this document include:

Why is the policy so important, and what should my corporate policy include?

Policy is important because mismanaged security surveillance is expensive and wasteful and can create legal and employee morale problems.

Four simple rules to follow:

1. Create a written policy that's fair and clear. This is the smartest step toward intelligent workplace surveillance, so it's a little surprising that so many organizations fail to do it. A video surveillance policy might state where cameras can be placed, as well as the fact that employees have no right to privacy in the general working areas of a facility. An electronic monitoring policy might state what forms of communication the company monitors; a very broad policy might include use a phrase such as "all electronic communication media including, but not limited to, e-mail, instant messaging, and web browsing". Some companies choose not to monitor so extensively. In any case, policies should also make clear the disciplinary consequences that can result from unprofessional employee actions caught on video or over the network.

2. Put the policy in your employee handbook and require an employee signature.

3. Periodically remind people being monitored of what the policy says. This helps with legal liability (so that, for example, an employee fired for breaking the policy can't file an effective 'wrongful termination' lawsuit using the "I wasn't notified of the policy" excuse). Also, simply communicating the fact that a company has a policy can act as a deterrent to potential wrongdoers.

4. Enforce the policy consistently and fairly. Otherwise, you send a confusing message to your employees and risk creating the appearance of favoritism. (This also means the policy needs genuine buy-in from upper management.)

I am concerned about employee morale if we institute a strict policy.

A key strategy is to communicate not only your policies and practices, but also the reasoning behind them. Here's a great example. In 1993, software company SAS built what's known as Building R on its Cary, N.C., campus. A security control center was located in the subbasement to monitor the new CCTV cameras that were being installed around the campus in lobbies, entry points and the campus day care. (Before 1993, SAS use of CCTV was minor.) However, SAS failed to anticipate the displeasure that spread its way through the employee ranks. Soon rumors started floating around that there were covert cameras. Questions arose: Why are they putting in cameras? What are they watching? Why do we need so much surveillance? "I had done my best to develop a relationship with the employees," says Miles Bielec, head of security at SAS. When the cameras came on the scene, he worried that he was about to take a giant step backwards.

Then Bielec had an inspiration. Because two sides of the control center were glass, he decided to turn the monitor banks around, so that the monitor screens faced outward. With this change, any SAS employee walking by the control center can see exactly what the cameras are being used to observe. "I told employees, come on down, you can see what we're looking at. We can show you how [the system] works; we'll let you play with the joysticks," he says. "That alone allayed the monitoring fears."

What Bielec came up against was a very open, creative corporate environment, not unlike that found on a college campus. To many employees, the installation of cameras screamed of Big Brother syndrome. Bielec assured employees that the system was more about customer service (such as letting employees back in the building if they accidentally got locked out during a smoking break), to give employees peace of mind and to keep an eye on more places than was otherwise humanly possible (data centers, for example).

If your policy is strict, but the reasoning and motivation is clearly explained, and if you also demonstrate a certain level of reasonableness in the way you handle surveillance and monitoring matters, it's likely that employees will understand.

I have a union workforce. Any special wrinkles I should consider as I write my policy?

Yes. Any introduction of surveillance into the workplace could be cause for a union grievance, according to the Labor Research Association. A report titled "Employer Snooping: What Rights Do Workers Really Have?" advises us "When a company seeks to introduce video surveillance, monitor e-mail, conduct random searches or other workplace surveillance policies, it is attempting to change working conditions, according to the NLRB. As a result, the terms of these policies are considered a 'mandatory subject' of collective bargaining and must be negotiated with the workers' union." It goes on to cite some examples of what a employer and union might negotiate, including allowing workers to defend themselves against accusations and agreeing that non-work areas remain camera-free.