2004 Workplace E-Mail and Instant Messaging Survey Summary

Background

American Management Association and The ePolicy Institute conducted their first survey of e-policies and practices in 2001. A total of 435 respondents participated in the 2001 Electronic Policies and Practices Survey sponsored by AMA, ePolicy Institute, and US News & World Report. In 2003, more than 1,100 participated in the 2003 E-Mail Rules, Policies and Practices Survey conducted by AMA, ePolicy Institute, and Clearswift. This year, 840 U.S. businesses participated in the 2004 Workplace E-Mail and Instant Messaging Survey sponsored by AMA and The ePolicy Institute. While many questions in the 2001 and 2003 surveys were repeated in 2004, there also were new questions added, reflecting the growth of instant messaging use in the workplace.

Executive Summary

Over one in five employers (21%) has had employee e-mail and instant messages (IM) subpoenaed in the course of a lawsuit or regulatory investigation. That's more than double the 9% reported in 2001, and a 7% increase over the 14% reported last year. Another 13% have battled workplace lawsuits triggered by employee e-mail. Yet, in spite of the fact that e-mail and instant messages are a primary source of evidence-the electronic equivalent of DNA evidence-employers remain largely ill-prepared to manage e-mail and instant messaging risks.

Most alarming is the business community's failure to retain e-mail and IM according to written retention and deletion policies. Merely 6% of organizations retain and archive business record IM, and only 35% have an e-mail retention policy in place-a mere 1% increase over the 34% reported in 2003.

The failure to properly retain e-mail and IM reflects employers' failure to educate employees about e-mail and IM risks, rules, and policies. The fact that 37% of respondents do not know or are unsure about the difference between an electronic business record that must be retained, versus an insignificant message that may be deleted, suggests that employers are dropping the ball when it comes to effectively managing e-mail and IM use. This year, 54% of respondents say their organizations conduct e-mail policy training, a 6% increase over the 48% reported in 2003.

While over a third of survey respondents are in the dark about business record retention, 42% perform a job function that is governed by government or industry regulations. Fully 43% of those regulated employees either do not adhere to regulatory requirements governing e-mail retention, or are unsure if they are in compliance.

While employers have been slow to put e-mail and IM retention policies into place, fully 79% of employers have implemented a written e-mail policy. Unfortunately, only 20% have adopted a policy governing IM use and content.

The failure to impose written instant messaging rules and policies is particularly disturbing considering that only 11% of organizations employ IM gateway/management software to monitor, purge, retain, and otherwise control IM risks and use. With 31% of employees using IM at the office, and 78% of those users downloading free IM software from the Internet, 89% of organizations are vulnerable to a growing array of IM-related legal, compliance, productivity, and security threats-on top of a myriad of e-mail challenges they have yet to master.

Employers do a somewhat better job of monitoring employee e-mail than IM. Fully 60% use software to monitor external (incoming and outgoing) e-mail. But only 27% take advantage of technology tools to monitor internal e-mail conversations that take place between employees.

When it comes to fast and loose content, nothing tops instant messaging. The majority (58%) of workplace users engage in personal IM chat. Survey respondents report sending and receiving the following types of inappropriate and potentially damaging IM content: attachments (19%); jokes, gossip, rumors, or disparaging remarks (16%); confidential information about the company, a coworker, or client (9%); sexual, romantic, or pornographic content (6%). From the standpoint of content and retention, employers should view IM as a form of turbocharged e-mail, creating a written business record that must be monitored and managed. Employers are advised to take control of instant messaging risks today, or face potentially costly consequences tomorrow.

For employers concerned about employee productivity, the survey reveals that 90% of respondents spend up to 90 minutes per workday on IM. Another 10% of employees spend more than half the workday (4-plus hours) on e-mail, with 86% engaged in personal correspondence. Spam continues to plague organizations, with 12% reporting that more than half the e-mail they receive at work is spam.

Employers are getting tougher about e-mail policy compliance, with 25% of 2004 respondents terminating an employee for violating e-mail policy, versus 22% in 2003 and 17% in 2001.

Findings

Litigation & Regulation

Over one in five respondents (21%) has had employee e-mail and instant messages (IM) subpoenaed in the course of a lawsuit or regulatory investigation. That's more than double the 9% reported in 2001, and a 7% increase over the 14% reported last year. Another 13% have battled workplace lawsuits triggered by employee e-mail. Yet, in spite of the fact that e-mail and instant messages are a primary source of evidence-the electronic equivalent of DNA evidence-employers remain largely ill-prepared to manage e-mail and instant messaging risks.

Q. Has your organization ever been ordered by a court or regulatory body to produce employee e-mail? In other words, has employee e-mail ever been subpoenaed?

• Yes - 20.1%
• No - 59.9%
• Unsure - 20%

Q. Has your organization ever battled a workplace lawsuit based on employee e-mail (sexual harassment/discrimination; racial harassment/discrimination; hostile work environment claim)?

• Yes - 13.2%
• No - 61.6%
• Unsure - 25.2%

Q. Has your organization ever been ordered by a court or regulatory body to produce employee instant messages? In other words, has employee IM ever been subpoenaed?

• Yes - 0.5%
• No - 75.6%
• Unsure - 23.9%

Q. If the organization were sued, your old IM could be subpoenaed and used as evidence.

• True - 61.2%
• False - 9.3%
• Unsure - 29.5%

Retention & Deletion

The business community's failure to retain e-mail and IM according to written retention and deletion policies is alarming. Merely 6% of organizations retain and archive business record IM, and only 35% have an e-mail retention policy in place-a mere 1% increase over the 34% reported in 2003.

The failure to properly retain e-mail and IM reflects employers' failure to educate employees about e-mail and IM risks, rules, and policies. The fact that 37% of respondents either do not know or are unsure about the difference between an electronic business record that must be retained, versus an insignificant message that may be deleted, suggests that employers are dropping the ball when it comes to effectively managing e-mail and IM use. This year, 54% of respondents say their organizations conduct e-mail policy training, a 6% increase from the 48% reported in 2003.

While over a third of survey respondents are in the dark about business record retention, 42% perform a job function that is governed by government or industry regulations. Fully 43% of those regulated employees either do not adhere to regulatory requirements governing e-mail retention, or are unsure if they are in compliance.

Q. Does your organization have a written e-mail retention and deletion policy?

• Yes - 35.1%
• No - 54.7%
• Unsure - 10.2%

Q. Does your organization retain and archive business record IM?

• Yes - 6%
• No - 64.9%
• Unsure - 29%

Q. Do you know the difference between an electronic business record (e-mail or instant message) that must be retained, versus an insignificant message that may be deleted?

• Yes - 63.1%
• No - 23.6%
• Unsure - 13.3%

Q. Do you perform a job function that is governed by government or industry regulators?

• Yes - 41.6%
• No - 54.1%
• Unsure - 4.3%

Q. If yes, do you adhere to regulatory requirements governing the retention of e-mail?

• Yes - 57%
• No - 8.6%
• Unsure - 34.4%

Q. Once your onscreen IM window closes, and your chat disappears, it is gone for good and can never be retrieved.

• True - 8.7%
• False - 68.3%
• Unsure - 23.1%

Employee Education

54% of organizations conduct e-mail policy training, vs. 48% in 2003 and 24% in 2001.

Q. Does your organizations train employees about e-mail risks, rules, and policy?

• Yes - 53.8%
• No - 40.8%
• Unsure - 5.4%

Q. IM content is not a concern. Consequently, my IM tend to be more casual and conversational than the e-mail I send/receive.

• True - 22%
• False - 57.2%
• Unsure - 20.7%

E-mail & IM Policy

Fully 79% of employers have implemented a written e-mail policy, versus 75% in 2003 and 81% in 2001. Unfortunately, only 20% have adopted a policy governing IM use and content.

Q. Does your organization have a written policy governing e-mail use and content?

• Yes - 78.8%
• No - 17.7%
• Unsure - 3.5%

Q. Does your organization have a written policy governing IM use and content?

• Yes - 20.2%
• No - 63.4%
• Unsure - 16.4%

Policy Enforcement & Monitoring

The failure to impose written instant messaging rules and policies is particularly disturbing considering that only 11% of organizations employ IM gateway/management software to monitor, purge, retain, and otherwise control IM risks and use. With 31% of employees using IM at the office, and 78% of those users downloading free IM software from the Internet, 89% of organizations are vulnerable to a growing array of IM-related legal, compliance, productivity, and security threats-on top of a myriad of e-mail challenges they have yet to master.

Employers do a somewhat better job of monitoring employee e-mail than IM. Fully 60% use software to monitor external (incoming and outgoing) e-mail, versus 90% in 2003 and 47% in 2001. But only 27% take advantage of technology tools to monitor internal e-mail conversations that take place between employees, versus 19% in 2003.

Q. What type of e-mail monitoring does your organization engage in?

• Software to monitor external (outgoing and incoming) e-mail - 60%
• Software to monitor internal e-mail between employees - 27%

Q. Does your organization monitor employee IM?

• Yes - 10.2%
• No - 64.1%
• Unsure - 25.7%

Q. Does your organization use IM gateway/management software technology to monitor, purge, retain, archive, and otherwise manage/control IM risks and use?

• Yes - 11.1%
• No - 60.6%
• Unsure - 28.4%

Policy Violations

When it comes to fast and loose content, nothing tops instant messaging. The majority (58%) of workplace users engage in personal IM chat. Survey respondents report sending and receiving the following types of inappropriate and potentially damaging IM content: attachments (19%); jokes, gossip, rumors, or disparaging remarks (16%); confidential information about the company, a coworker, or client (9%); sexual, romantic, or pornographic content (6%). From the standpoint of content and retention, employers should view IM as a form of turbocharged e-mail, creating a written business record that must be monitored and managed. Employers are advised to take control of instant messaging risks today, or face potentially costly consequences tomorrow.

Q. Have you ever sent or received an IM at work that contained any of the following content?

• Attachment of any kind - 19%
• Sexual, romantic or pornographic content - 6%
• Jokes, gossip, rumors, or disparaging remarks - 16%
• Confidential information about the company, a coworker, client, or yourself - 9%

Compliance & Employee Discipline

Employers are getting tougher about e-mail policy compliance, with 25% of 2004 respondents terminating an employee for violating e-mail policy, versus 22% in 2003 and 17% in 2001.

Q. Has your organization ever terminated an employee for violating e-mail policy?

• Yes - 25%
• No - 51.5%
• Unsure - 23.5%

E-mail & Productivity

10% spend more than half the workday (4-plus hours) on e-mail, versus 8% in 2003. 86% are engaged in personal e-mail correspondence. Spam continues to plague organizations, with 12% reporting that more than half the e-mail they receive at work is spam.

Q. On a typical workday, how much time do you spend on e-mail?

• 0 - 59 minutes - 18.5%
• 60 - 89 minutes - 24.9%
• 90 min - 2 hours - 22.4%
• 2-3 hours - 14.1%
• 3-4 hours - 10.3%
• More than 4 hours - 9.9%

Q. What percentage of the e-mail you send/receive is personal, not business related?

• 0% - 14%
• 1-10% - 74.4%
• 11-25% - 8.8%
• 26-50% - 2.0%
• 50%+ - 0.7%

Q. What percentage of the e-mail you receive at work is spam (unsolicited electronic junk mail)?

• 0% - 10.1%
• 1-10% - 45.4%
• 11-25% - 19.8%
• 26-50% - 12.6%
• 50%+ - 12%

IM & Productivity

For employers concerned about employee productivity, the survey reveals that 90% of respondents spend up to 90 minutes per workday on IM.

Q. Do you use instant messaging at the office?

• Yes - 31%
• No - 69%

Q. On a given workday, how much time do employees spend IMing?

• 0 - 59 minutes - 77.9%
• 60 - 89 minutes - 12.9%
• 90 min - 2 hours - 4.8%
• 2-3 hours - 2%
• 3-4 hours - 0.8%
• More than 4 hours - 1.6%

Q. How do you use IM at the office?

• For Business Purposes - 94%
• For Personal Use - 58%

IM Compliance

Q. Is your employer aware that you are using IM at the office?

• Yes - 87.9%
• No - 4.5%
• Unsure - 7.7%

Q. What type of IM software do you use at the office?

• Free IM software downloaded from the Internet (AOL Instant Messenger, Yahoo! Messenger, MSN Messenger) - 78%
• Employer-provided IM system (Enterprise IM) - 52%

Respondent Profile

# of Employees in Company - 840 (# of respondents)

• 100 or fewer - 26.4%
• 101-500 - 24.8%
• 501-1000 - 11.8%
• 1001-2500 - 10.2%
• 2501-5000 - 7.7%
• More than 5000 - 19.1%

Industry That Best Describes Your Organization

• Business/Professional Services - 18.1%
• Financial Services - 10.8%
• General Services-For Profit - 3.6%
• General Services-Nonprofit - 6.5%
• Manufacturing - 22.8%
• Public Administration - 5.8%
• Wholesale/Retail - 4.7%
• Other - 27.6%

The 2004 Workplace E-Mail and Instant Messaging Survey questionnaire was designed by American Management Association and The ePolicy Institute's Nancy Flynn, author of Instant Messaging Rules (Amacom 2004). Comparative numbers drawn from 2003 E-Mail Rules, Policies, and Practices Survey from American Management Association, The ePolicy Institute, and Clearswift, as well as the 2001 Electronic Policies and Practices Survey from American Management Association, The ePolicy Institute, and US News & World Report.

Media wishing to receive a review copy of Instant Messaging Rules: A Business Guide to Managing Policies, Security, and Legal Issues for Safe IM Communication (Nancy Flynn, AMACOM Books, 2004), should contact Amacom's Irene Majuk (212/903-8087 or imajuk@amanet.org). Contact AMA's Roger Kelleher (212/903-7976 or rkelleher@amanet.org) for survey process. The ePolicy Institute's Nancy Flynn (614/451-3200 or nancy@epolicyinstitute.com) for e-mail and IM policy and workplace best practices.