Thursday, June 15, 2006

Personal Internet use at work

Internet usage in the corporate world is a touchy subject to being with but with recent compromise of taxpayer records at the Oregon Department of Revenue (an employee downloaded a Trojan from a porn site) this topic will blitz its way through management and the hysterical committees. But just how much Internet usage at work is acceptable and what type of usage is acceptable? In my opinion it breaks down into to two categories: time and content


Personally, I don't care how much personal time you spend on the Internet as long as you are putting in your allocated work time. If you are supposed to be working forty hours a week then work forty ore more hours a week. Personal usage can usually be allotted to lunch; simply eat lunch at your desk while catching up on news or whatever. I will take time in the morning to read news, catch up on hockey and soccer, do a sudoku puzzle and participate in some message forums. If I spend a little too much time I will always add time to the end of the day to keep a simple eight hour day. If I know there will be rain for the drive home one afternoon I will put in time there to avoid the idiots on the roads; which leaves time for personal Internet or extra time in the gym

Some people will complain that they have down-time or slow-periods where they are either bored doing nothing or can surf the web. I have a mixed reaction to that. If you are part-time or on a job that has busy and slow periods then maybe some personal Internet time is warranted unless the office works to help each other out during peaks. If you are slow while another area is getting slammed then maybe you should help them out (and they should reciprocate). If you are a programmer like me you should be bettering yourself through education during off-time


Obviously there are some places you shouldn't go when using the office Internet. Pornography is almost universally unacceptable but there are gray areas. Some "humor" or "not safe for work" content sites might have pictures of women flashing their racks along with pictures of mother ducks walking her chicks into a storm drain and animations of dogs eating their own barf. Obviously the naked breasts are wrong but that mother duck was funny and cute. A little humor works wonders when you are dealing with idiots all day long

The extreme point of view is "no personal use under any circumstances" – which is a harsh policy but really the only one that almost guarantees so workstations get compromised. Such organizations will usually have content filtered through a proxy, will log EVERYTHING you do, and will actively monitor your workstation with about eight scanning programs. In such environments it is best just to not use the corporate workstations to go to the Internet for anything. Don't even request access. As a consultant I had to be extremely careful what I did because the slightest infraction could be used against me to negate a contract or worse. A friend of mine got sent off a contact for having Yahoo! Sports in his bookmarks. If a client had any Internet policy or made me sign anything that weighed more than a can of pop I would simply say "no thanks" and worked without the Internet. If I needed something I would make the client do it. Sometimes they got the point

The other extreme is totally free and unrestricted access. While awesome as this might be it leads to compromised computers and plenty of content problems. Sites that start this way usually end up implementing this next type of policy

The most common policy I see in place in business entities is what I call the "gray area" policy. It is a policy drafted by some legal team somewhere that basically says "do what you want but don't do anything is wrong or will offend anybody, else we retain the right to punish you (for doing something wrong that might be wrong or might not be wrong or we might have no idea if it is wrong or we simply don't give a rat's hiney just as long as we cannot be held liable for anything)." It is policies like this one that scare me because I simply don't know what to do right and an employer can always use something I did in the past to justify an action towards you in the future. If the policy is gray then the button leading to the Internet should probably be gray as well.

Or if you want to have a little fun, mail the list of web sites you are going to access then have your supervisor sign-off on them. If your management is as gray as the policy they will eventually get tired of you annoying them all the time and either yank everything or give you full access.