|
You need to advise users of the rules of the road because, despite the development of intranets as "the Internet inside your company," you wouldn't want your intranet to be as wild and woolly a place as the Internet. Nobody is in charge of the Internet. Nobody owns it. You can't turn it off. Hundreds of thousands of interconnected servers make up the Internet. The people who populate this archaic, chaotic community have established a sense of what is right and wrong, called netiquette, which varies from subcommunity to subcommunity.
There are, however, no rules for the Internet. An individual Internet Service Provider can dictate behavior and can enforce it by bouncing you off the system if you violate a rule. But the Internet itself cannot make you go away or make you do anything differently. The U.S. government's attempt to legislate decency on the Internet is laughable because such legislation cannot restrict content posted from other countries. Any attempt to institute rules on the Internet is met with active resistance and a flood of material that deliberately violates the spirit of the proposed rule, just to demonstrate how easy it is to break the rule and, thus, how ridiculous it is to try to impose the rule in the first place.
To achieve the advantages of an intranet, your company cannot afford such anarchy: Someone must be in charge of your intranet. There is an owner: the organization that built it. Because your employees need the intranet to work, you can't turn it off. But, unlike any of the traditional closed or restricted networks that preceded the intranet, there are no inherent, built-in mechanisms to restrict what people can put on an intranet server. If your intranet expands to accommodate more content and more functions, the exponential growth in the number of servers will make it increasingly difficult to monitor who is putting content on the internal Web. And that's to say nothing about articles posted to internal newsgroups and messages shooting around the e-mail system!
As a result, as often as possible, do not establish rules. Based on the nature of the Internet, rules beg to be broken. More importantly, the organization will find itself in a position of monitoring all intranet activity in order to apprehend violators. It is much better to establish policies and guidelines, and trust employees to follow them. The communicator responsible for building Aetna's intranet was faced with the question of rules. Ultimately, he says, the decision was made to treat employees like adults. "When you treat employees like children," he says, "you get childish behavior." Conversely, when employees are treated like adults, they tend to behave that way.
Current company policy documents may already include controls such as rules, policies, and guidelines that can be applied to intranet interactions. At the Barnes Group, a manufacturer in Bristol, Connecticut, every employee is required to read and sign a document each year that outlines expected behaviors and the consequences of violating these rules, up to termination. The rules include statements of how employees should comport themselves in dealings with external audiences and other circumstances that employees could encounter when using the Internet and intranet. The director of communications for the Barnes Group refused to duplicate these policies in a new document aimed specifically at online computer networks. Her philosophy: "The intranet and the Internet are just tools. We don't have separate guidelines for using the telephone, talking in the hallway, or sending mail. The rules cover all interactions."
There are four categories of policies you can establish for your intranet:
The following guidelines can apply to all employee use of online tools, from the various components of the intranet to those Internet services to which the organization has provided access. These guidelines have broad application, used by everyone from individuals developing home pages to systems professionals and/or others responsible for maintenance of the overall intranet system. Therefore, these guidelines should be published broadly, so all employees are aware of them and understand that they apply to everyone. Publication of this information also should appear in multiple formats, including a print version consistent with the organization's traditional means of offering information and a version on the intranet where it can be accessed quickly and easily when an employee needs to refer to it.
One of the great obstacles to installing an intranet or providing access to the Internet is management's belief that, given such access, productivity will suffer while employees forsake their jobs for the lure of Web surfing. I find this a cynical attitude toward employees. As the Aetna Webmaster pointed out, when employees are treated like responsible adults, they tend to behave accordingly. Most employees have embarked on their careers based on a certain level of interest-even passion-in their chosen fields. Their careers provide them with the opportunity to pursue those interests and passions. At work, employees at all levels-even the lowest-ranking of laborers-seek recognition, advancement, and pay raises. Not many are likely to ignore their professional interests or the possibility of betterment for themselves and their families in order to surf the Web.
Of course, some employees will use online services as an excuse to goof off. Before there was a Web, these same employees were most likely playing Doom or Tetris instead of doing their work. And before they had computers, they may have been reading Popular Mechanics or Cosmopolitan. Some employees are inclined to take advantage of their employers. But they are in the minority, and the others should not be treated like children in order to address the transgressions of these few.
A couple of realities about surfing need to be taken into consideration before adopting guidelines and policies for employees. First, a major advantage of the browser as a client interface is that formal classes are not necessary to learn to use it. Unlike other applications, browsers do not require formal training that costs the organization both money (the fee for the class) and productivity (the time employees are away from their desks). The trade-off is the time employees spend learning by playing.
Any psychologist will tell you that we learn fastest and best
by playing. For example, Windows Solitaire incorporates
all of the features of any Windows program: Learn to play Solitaire
and you can operate any Windows application. Indeed, employees
might spend time playing with their browsers, and productivity
will suffer a temporary dip. After employees have taught themselves
to use the browser, productivity is likely to increase as employees
use their new tool.
NOTE |
The other thing to keep in mind about Web surfing is that it is nothing like channel surfing with a television remote control. |
The other thing to keep in mind about Web surfing is that it is nothing like channel surfing with a television remote control. With the television remote, each click takes the viewer to something completely different, generally unknown and unrelated to the last program. There is no logic or pattern to the sequence: the news, an old movie, or possibly an infomercial. Surfing the Web is a context-based activity.
At one of the jobs I held, I was asked to help an ergonomics expert find some information he needed on the Internet. I found it quickly as he watched; he had not used the Web before and was fascinated. I showed him how clicking on links connected him to related sites. He spent a good three hours surfing. After this short introduction-despite the fact that he must have clicked on 50 links-he never went to a page that didn't contain information related to ergonomics. What he learned about the vast array of resources available on the Web no doubt made him exponentially more productive when the need for more research arose.
There are a lot of news services available on the Internet, and it is very easy-even advisable-to link intranets to some of these services. These services provide employees with an additional place to spend time on the intranet that, at first blush, may seem like another way to be unproductive. However, it is more likely that employees will support company decisions when they understand the context in which those decisions are made-specifically, when they understand the marketplace in which the organization operates and how changes in the marketplace are driving management decisions. Thus, it is ultimately a productivity- and morale-enhancing activity to allow employees to check the news. In order to make the employee's time on a news site more productive and related to the business, you may even want to consider adding links to the sections of news sites (such as CNN and MSNBC) that relate directly to the business and the marketplace.
The security policies you adopt for your company's systems will depend almost entirely on the computing operation environment. For example, a system based on firewall technology will have different security policies than one in which a firewall has not yet been installed. One company initiated a pre-firewall policy that stated, "No dial connection to the Internet is permitted from a PC or workstation that is connected to the company's network. When required and approved, such dial connections must be established from PCs that are not connected to the network."
Whatever the unique situation of your organization's network configuration, it is best to rely on managers and supervisors to understand the policies and ensure that employees adhere to them. At CIGNA, managers are advised of five security responsibilities:
Part of using communication to establish security policies-and trusting employees to take responsibility based on the information they receive-involves being explicit about the rationale for the security policies. Employees must be informed that risks include viruses, unauthorized intrusions, theft or destruction of vital company data, and network crashes resulting in serious costs to the company.
Security involves more than protecting the company's system from unauthorized entry. The inadvertent transmission of sensitive material is another type of security risk. Guidelines can be established to prevent the communication of closely held information over USENET newsgroups or Internet-based mailing lists. A sample policy might read like this:
Security means whether or not the company authorizes sending sensitive documents via e-mail. Depending on the level of security built into the system, the company may permit sending semisensitive documents. However, under no circumstances should employees transmit confidential documents over external lines (and especially the Internet), or send extremely sensitive material over any e-mail system.
If you already have policies articulating employee use of other systems to communicate confidential information-such as unencrypted telephone lines, fax machines, and U.S. mail-these policies can easily be expanded to include e-mail without developing a whole new set of guidelines. This approach is consistent with that discussed earlier, in which the Barnes Group noted that policies pertaining to good taste and professionalism extended to the intranet, eliminating the need to develop new policies that were directed solely at online communications.
Ultimately, the degree to which your organization permits such transmissions will depend on a variety of factors, including:
Bear in mind that threats are out there, and there are risks inherent in sending information over digital lines. However, there also are risks associated with sending information over the phone, through the U.S. mail, or by courier. Consider a few facts before making a decision that could hamper your ability to take advantage of the system:
The Internet and its related systems represent the most secure method of transmitting data in existence. My ultimate advice: Take precautions, but don't let paranoia or the media's overdramatizing of online security issues prevent you from taking advantage of the potential these systems offer.
One final policy that makes sense to develop addresses the issue of downloading files from outside resources. Even an organization that keeps all of its workstations inoculated against viruses, using updated monthly definitions, are at risk from viruses. Since files are available that can benefit the organization, it is important not to prevent downloading completely. Some companies require that files be downloaded to a particular computer, where they can be checked before being released to the individual who downloaded them. Find a solution that protects your organization from viruses without denying employees access to useful data that may exist in file format on the Net.
A general guideline to offer employees reminds them that every time they send e-mail or post to a newsgroup, internally or externally, they are representing not only themselves but their organization. Their e-mail addresses within the company can nearly always be associated with the company, as in yourname@company.com.
Many employees try to get around this problem by including a disclaimer in their e-mail signatures that reads something like "These opinions are mine alone, and do not represent those of my company." These do not help. Because of your business-use policy, employees should already know that their posts to newsgroups and mailing lists are restricted to work-related issues or the company's business. It wouldn't hurt to offer an additional reminder that employees always represent the company and should use good taste and good judgment. Any posts or messages they want to send that contradict the policy should be sent using a personal account from a computer at home.
Valley Metro, an Arizona regional public transportation agency, issued a simple four-paragraph policy about online usage that manages to embrace all of the concepts discussed so far in a simple, easy-to-understand statement:
In order to assist staff in their daily responsibilities, enable employees to perform additional research, and become more task proficient, the Internet and other online services will be incorporated into the RPTA management information system. Typically these services are worldwide communication networks that can put users in touch with unlimited amounts of information which may prove to be valuable. The cost of some online services, the nature of the information contained on some, and security are some concerns which make it advisable to provide access in a structured manner.
While employees are encouraged to develop their own proficiency in using the Internet and similar services to search for information, they are reminded that they are not to provide entertainment. As with all other RPTA resources, authorized access is for business purposes only.
Agency software management policies will apply. Specifically, software is not to be downloaded unless ownership and licensing requirements can be determined, and it is scanned for viruses. This standard applies to all users. An employee who does not comply with this policy may face disciplinary action, up to and including termination.
Common sense plays an important role in the adherence to this policy. If you think utilization of a particular program/file is questionable, then do not access that program or file without the prior approval of your supervisor.
Different organizations will have different policies regarding the levels of employee privacy (for example, who will read employees' e-mail and under what circumstances?). In some organizations, these policies are governed by legal considerations; other organizations may look more toward ethical or cultural issues. Whatever approach your organization takes, employees should have a complete understanding of the degree to which their communications are privileged, the circumstances under which their communications might be read, and what the possible consequences might be.
A variety of activities and applications of the intranet are unique-they do not have counterparts on the Internet or other external online communication vehicles. On an intranet, for example, employees can (and will) establish home pages of their own. In discussion groups, they will raise sensitive topics; many may wish to remain anonymous if the culture of the organization does not yet support candid discussion (or if the perception among employees is that they will face recrimination for speaking their minds). The following guidelines are suggested for intranet use.
One of the most common questions asked by people developing intranets-and by people who already have them-is, "How do we keep employees from establishing personal home pages?" To which I answer, "Why would you want to?"
Employee home pages, like any other information that resides on the intranet, can be of tremendous value to employees in need of information. Part of the value of the intranet is that employees are able to pull the information they need; the organization can never know what information might be of use to any employee at any given time. Here are only two instances that exemplify the potential value of employee home pages:
Of course, the same principles of good taste that are instituted for all online communiqués should apply equally to an employee's home page. While content should not be specifically limited, it should also not include anything that will be offensive to other employees. Based on your organization's space limitations, you may also set limits on the size of the employee's home page files and prohibit the use of audio and video files if your system cannot easily accommodate these resources.
At Silicon Graphics, employees are encouraged to develop home pages. Not every employee has the time or the inclination to do so, however, so employee profiles are required for the intranet. Employees needing information on any other employee can visit either the home page (if the employee has developed one) or the brief all-text profile, which contains basic information.
Should employees be permitted to start their own newsgroups on the intranet? In some organizations, such as the Oregon-based Tektronix, employees can begin any newsgroup they like. Elsewhere, employees can suggest the creation of a newsgroup, but somebody in a position of authority is the final arbiter of whether or not to actually introduce the group.
In deciding which approach to take, consider the environment at the company. Will the inability to create a newsgroup be viewed as censorship? Will employees feel management does not trust them, and that needing special approval to speak about issues important to them is tantamount to being treated like children? Other considerations include the following:
NOTE |
To deny employees the ability to initiate discussions on topics that require attention and dialogue could ultimately be detrimental to the organization. |
Usually, I advise that employees be permitted to start newsgroups as needed. As I discussed in an earlier chapter, an intranet is an open environment that evolves into a community, and communities tend to become self-governing. Inappropriate newsgroups simply will not be used, or will be used by the bulk of the population to denounce the few who speak inappropriately. But to deny employees the ability to initiate discussions on topics that require attention and dialogue could ultimately be detrimental to the organization.
Can employees post messages and information to the intranet and its systems without identifying themselves? It depends on the organization. In most circumstances, there should be no need for anonymity; employees who speak their minds should know that they do so without fear of recrimination from the organization. The free and open exchange of ideas and opinions is the centerpiece of any intranet.
However, some organizations implementing intranets are exploring for the first time the notion of nonhierarchical structures; they are new to an environment free of a command-and-control structure. Particularly among industrial-era organizations, employees have traditionally kept their mouths shut for fear of the consequences of saying what they think. In these organizations, granting anonymity-particularly in newsgroups-will allow employees to grow accustomed to engaging in exchanges without fear of the reprisals that have been common in the past.
Of course, management must make a conscious decision to permit such an open forum for ideas and issues. The first time a manager says, "Find out who wrote that; I want his name and I want his hide," will be the last time the system is used for the kind of exchange that provides true advantages to the organization.
Some intranets contain material that has been cleared by a higher authority before it is posted on a server. This practice presumes that some material will be rejected. Such rejection suggests that somebody is deciding which material might ultimately be useful to employees. And it is that notion that contradicts the nature of the intranet.
Book publishers will not publish a book unless it has a good chance
of selling enough copies to be profitable. If only three or four
individuals would buy a book, the publisher will not make the
investment in producing it, regardless of how invaluable the book
might be to those three or four people. An intranet resolves this
problem, because the investment in providing the space is so negligible
that your organization can easily afford to place information
that perhaps only three or four employees might find valuable.
That only a small number of employees will ever use the information
is irrelevant. What if one employee uses it to find information
that helps the company win a lawsuit? Avoid costly new government
regulations? Identify a new market? Solve a technical problem?
NOTE |
An intranet allows your organization to provide information that perhaps only three or four employees might find valuable. |
By leaving the content that is developed and posted in the hands of the departments that have the information, companies can avoid being placed in the position of having to censor material. And since the volume of information that can ultimately find its way to the intranet can be overwhelming, most organizations should be reluctant to commit resources to censorship when those resources could be focused on helping the organization achieve its core business objectives.
Each department that will provide content to the intranet should designate an individual or a department as the key point of access to the intranet. Through that individual or department, all material for archiving on the intranet should be funneled. In this way, the intranet's caretakers can exercise some control over consistent navigation tools and icons, use of corporate graphics, and other elements.
Organizations with solid guidelines for their intranets produce intranet manuals-usually several pages of information contained in a three-ring binder for each updating. Information to be included in the document covers the following categories:
When employees go online outside the company, they are representing the organization, even when they may think they are not; after all, their names are followed by the company name in an e-mail address. A variety of other issues face organizations that allow employees access to the global, unmoderated Internet. The following policies pertain to the use of the Internet when it is accessible as an integral part of the intranet.
The discussion of intranet policies already covered how employee home pages can be made available to other employees on the intranet. Some companies also provide space on their servers for employees to create individual home pages that are accessible to those on the external Internet. The first inclination of many organizations is to scoff at this idea. Did they pay for servers and staffs to maintain them so employees could post vanity pages in cyberspace?
The creation of employee home pages for Internet access can prove useful to the business and its objectives. An employee in the research and development department, for instance, can establish a home page that contains papers he has published and nonproprietary information about the processes and programs on which he is working. This visibility can increase the communication and cooperation between the employee and his peers in the industry.
Whether you permit individual pages will depend on more issues than just the information employees may publish. Can your server handle the additional hits it will take from people accessing these extra pages? Generally, if your site is being hit pretty hard and your server can deal with it, individual home pages won't add an undue amount of strain. If your server isn't generating a big load, though, it could be a consideration. As for the size of the sites developed by individuals, you can establish policies and guidelines that limit the use of graphics and multimedia in order to ensure you don't lose too much hard disk space to this activity, or slow the server down as people access those pages.
A policy of permitting employee home pages that are accessible through the Internet, then, should require employees to portray the organization in a way that is consistent with the organization's official communications. The pages should comply with other policies, including those related to good taste and judgment noted earlier.
Your company will need to determine whether or not to police or monitor employee home pages. One reason to adopt a policy of reviewing employee home pages is to ensure that no confidential information or offensive material is published, and that the organization is able to portray certain information in an appropriate manner. You wouldn't want a major announcement planned by a marketing communications group to be rendered useless by an untimely post to a personal Web page, after all. On the downside, however, monitoring employee pages will require a commitment of time-it needs to become someone's responsibility-and that will mean a reallocation of resources currently committed elsewhere. Further, employees may find the monitoring process intrusive. That could have an impact on morale, and some employees (in fact, more and more as it becomes more common) may choose to take the information to their private Web sites over which the organization has no control.
Alternatively, you can elect not to monitor personal pages, but rather to ensure that employees have adequate information about policies and guidelines that will keep them from violating any rules or spilling any inappropriate information. (As the Aetna intranet manager noted, if you treat employees like children, they will behave that way; treat them like adults, and you will get adult behavior.) There is risk in this approach, to be sure, but the advantages may ultimately outweigh that risk. Employee home pages should not be linked to the corporate home page. As a result, personal home pages accessible through the Internet remain independent from the primary company site.
If employees can send e-mail from the intranet to the outside world, the system may also allow them to receive e-mail from the outside world. As more and more organizations insist that their vendors, partners, and customers conduct business via e-mail, such access to the outside world can be highly beneficial. But it also can be dangerous if employees are not careful about what they write and to whom they send it.
Employees should always know who sent them e-mail before replying. There is something about e-mail that encourages people to respond quickly in an effort to move the mail off their system. The inquiry, though, could be from a newspaper reporter; a response from the company's e-mail system can become an official response that is quoted in the press, and the employee will find that she has violated a company policy that requires her to forward all media requests for information to the media relations department. Or the e-mail might have come from a competitor.
Employees also should be cautious about the information they provide via e-mail. Closely held, confidential, proprietary information should not be transmitted via e-mail outside the company's own internal systems.
One of the most popular services for employees to subscribe to is PointCast Network, a screen saver that allows users to establish a profile of their interests. It then prowls the Internet in search of relevant information and brings it back to the screen saver to flash across the users' monitors when their computers are not in use. PointCast Network is also the curse of many systems departments because of its drain on resources. A company in which many employees' computers are simultaneously scanning the Internet and pumping information back down can find its systems routinely on the verge of crashing.
The systems department should identify services of value to employees that do not threaten the integrity of the system and make them available through a resources page on the intranet. A list of unacceptable resources should be distributed in a clear communication and included in a policy document, along with a clear explanation of why access to the resource is being denied (for example, "Our company does not yet have the bandwidth in its system to handle simultaneous multiple streaming of real-time video").
The best way to ensure the intranet-and any external access to the Internet that is provided through the intranet-does not cause problems is to ensure that employees understand what is expected of them. Their behavior online, the information they access, the information they provide, and the manner in which they obtain information all should be clearly understood in order for employees to use the intranet to its greatest advantage and to preclude the potential for the difficulties many people routinely fear will arise from providing employees with such an open source of information.
Make sure employees have access to all of these policies on the intranet itself, but also work with your communications and human resources departments to see to it that these policies are incorporated into other regular communication vehicles, such as employee handbooks and policy manuals. Also, the more you can make sure that employees understand existing policies apply to the intranet and Internet as well, the more comfortable you can feel about the system.
In the next chapter, we'll look at the process of preparing to launch the intranet.