FW: FW: FW: FW: RE: Check this out! LOL

April 20, 2009 9:27 AM

Should I try to take back our Exchange server from the inappropriate uses?

I'm an IT worker in a small local government IT shop. We have roughly 250 - 300 users. Recently I've been taking a more active roll in the management of our spam firewall and Exchange server, and have made some interesting observations.

I am not shocked, but I am thoroughly appalled at the amount of personal email that travels through our server. It turns out that the top users of email resources aren't the important decision-makers and managers, but the lowest level employees with very little legitimate work use for email. For example, the #1 email user in our entire organization is a receptionist that answers phones for the tax department. What are these emails? Albino moose pictures, prayer forwards, angel pictures, chain forward, inspirational videos, and the like.

This is just one person, but there are a hundred more out there that either through ignorance of apathy are misusing the government email server as their own personal email provider.

Part of the problem, I think, is that most of these people are not computer & internet savvy. Their email address here is the first one they've ever had, and they have zero concept of what is and isn't appropriate email. To them, there is just EMAIL. Dancing baby forwards are just as legitimate as a message from their boss, or a member of the public seeking help.

As I see it I have a few options.

1) Do nothing. Accept that people are using county resources for their personal business and try to minimize the impact on legitimate users. This is the easy way out, and the way we got into this situation to begin with.

2) Bring the hammer down. Get aggressive with what comes and goes. Block all images by default. Train spam filters to block inappropriate emails. Tighten disk quotas to noose-like levels on "regular" users. Tell users to get hotmail/gmail/yahoo accounts for personal use. Expect resistance.

3) Something in between.

I'm especially interested in hearing from anyone who may have come into a poorly managed IT department and had to affect changes to both the technology and the culture side of problems similar to this.

posted by Liver to computers & internet (38 comments total)

Think of it this way: are they really "using" more resources? They need to have email to do their job function. Using it additionally for crap doesn't really use much space in the long run.

And the most miserable (workwise) people I know are those whose email is spied upon, or severely restricted. Bringing the hammer down would do *nothing* but make their lives more miserable. Don't be a dick.
posted by notsnot at 9:37 AM on April 20 [1 favorite has favorites]

Option #2 seems mostly appropriate. I would recommend against trying to re-train a spam filter to avoid filtering out legitimate mail. Per-message quotas may be more effective than quotas on the whole mailbox.
posted by mkb at 9:40 AM on April 20

Do you have an acceptable use policy? You should. Albino moose pics are wasteful of server space, but not really a problem, unless publicized. It's more important to worry about somebody using email for a side business, or stalking, or being insecure. Many government workers have learned the hard way that their email can be divulged to the press. Do some research, implement policies and publicize them well. Also, government resources(email server, bandwidth) can't be used for politicking. You can remind your brother-in-law to vote, but you can't remind your brother-in-law to vote for a specific candidate.
posted by theora55 at 9:41 AM on April 20

Do you have an acceptable use policy (AUP)? Every Government department I have worked for or with has had an AUP that defined what was and was not acceptable use of the network. Breaches of this policy were met with stern warnings and repeated infractions would result in dismissal.

Before you start blocking email and filtering out forwards, you need to have a conversation with your boss. Explain the business reasons why this is inappropriate (how much is that receptionist costing the county in bandwidth and CPU?). How much will it cost to mitigate the loss?

You need to be armed with real metrics, and then you need the support of your boss before you implement anything. There are excellent legal and financial reasons to restrict how email is used. Talk to your boss about them, get management buy-in and then start implementing technical solutions.

As you say - some of the problem is just user ignorance, so some user eduction about hoax emails and why forwarding is bad might help.

But I can't stress enough: get management buy-in to a well defined AUP that every employee signs.
posted by BOfH at 9:43 AM on April 20

at most, limit the size of attachments, as hard drive space is a real concern, otherwise, notsnot is right: don't be a dick.
posted by jrishel at 9:43 AM on April 20 [1 favorite has favorites]

I've gone for a mix of 2 and 3 by creating policies that make inappropriate e-mail use harder, but not necessarily impossible. These include:

1. Drastically reduce the allowed recipients per e-mail. How often do you want people sending the same message to more than 75 people? The actual number depends on your organization and how e-mail is normally used, of course.

2. Reduce the attachment capabilities by setting tight quotas and instructing people how to use our FTP server. In our case, FTP is much more annoying to deal with and requires a specific client username/password for the recipient. This makes it only useful for legitimate client-employee transactions.

3. Disallow HTML e-mail. I'm just now testing this out, but it seems to reduce the "fun" aspect of e-mail for those who like to craft jokes and FWDs. I haven't determined if it impacts business significantly enough to avoid doing this across the company, though.

4. Carefully control how groups are used. Messages over 2K in size aren't allowed to be sent to some of the larger groups in our organization. This essentially limits people to very short text announcements. Messages from outside the organization are not allowed to be sent to group addresses.

5. Consider restricting some of the lower-level employees to internal-only e-mail delivery. Don't let them send mail outside the organization at all. This is probably not going to go over very well, but it really should be evaluated as it solves a lot of the problems. Couple this with a "we recommend X for personal e-mail" tutorial and it might work.
posted by odinsdream at 9:43 AM on April 20

Before you get in too deep, make sure you have the proper authority to be reading other people's e-mails. I've know some execs who do not approve. Particularly, in terms of clamping down, you don't want to all of a sudden catch the boss off guard and have their favorites niece's e-mails blocked. Without proper management support, this will be hell.
posted by jmd82 at 9:45 AM on April 20 [2 favorites has favorites]

Using it additionally for crap doesn't really use much space in the long run.


Not true, especially if he has a limited upgrade budget. MS Exchange runs much faster when its db smaller.

Option 3 is your best bet. As a network admin, you probably have very little actual policy control over anything. Talk to someone in management who understands IT and with their support you can get usage policies passed or properly enforced.

You can also mention to users to use webmail accounts for personal email to minimize spam. You mentioned tightening down the spam filter, which is something that you can do without much oversight and are fairly safe from any blowback, usually, unless it blocks actual work correspondence.

What's important is that you don't go around telling users that you're looking at their email, even though you have full access to the domain. Try to do as much as possible under the umbrella of management or with clandestine tweaks.

Another option is to look into an offsite failover system like Dell Message One that provides email archiving so you don't have to worry about space constraints anymore. Barracuda also makes an archive appliance that takes the load off your Exchange server. Those can be pricey, so going that route means selling a bigger budget.
posted by Burhanistan at 9:47 AM on April 20

Does it cost anything? You're possibly saving bandwidth costs by storing them except when the messages are forwarded back out again. But does it matter?

Can you write a little script to crawl the outboxes looking for outgoing mages? Send those people a memo saying it's not so professional if people outside the office get the forwards from government email addresses. Ask them to switch to gmail *if* they are sending silly stuff to friends who are not immediate family members.

You'll get much more positive reactions if you talk about professionalism and specifically exempt immediate family.
posted by jeffburdges at 9:48 AM on April 20

I am thoroughly appalled at the amount of personal email that travels through our server. It turns out that the top users of email resources aren't the important decision-makers and managers, but the lowest level employees with very little legitimate work use for email.

When you say 'top users' do you mean that they do things that meaningfully increase the cost of IT, or just 'they send more email, but it doesn't mean anything in terms of IT?'

Depending on where the answer lies between these two points, you can make a cost-benefit analysis of whether it is worth your time to try to change the habits of your organizations' employees.
posted by zippy at 9:50 AM on April 20

Speak to the supervisor of the most prolific resource waster, and mention that they should inform/remind the employee that personal non-work-related emails should be restrained, especially when attachments are concerned. Repeat for the 9 next-highest resource wasters. Then see what the impact is.

The idea is that personally discussing it with these people will likely have more of an effect than policy reminders. Also, since word gets around, targeting 10 people will disseminate throughout the department news that people are concerned about resource wastage. You will probably see a reduction in traffic from more than only the 10 people that received the reminders.
posted by Simon Barclay at 9:54 AM on April 20

Oh, yes, if the limiting factor is MS Exchange's bad database design, then you can simply explain that fact, explain how to use gmail, and ask they use gmail for personal mail if they forward many images.

Just don't be a dick & give a good reason. People will understand. But disk space & bandwidth are not good reasons.
posted by jeffburdges at 9:55 AM on April 20

Oh, and one other observation. It is possible that emails you are seeing actually do serve an important role for your organization, in maintaining links between the people at your organization and people at other organizations.

If you listened in to phone calls made by salespeople, for instance, you'd find that a lot of calls sound personal. That is because, in a sense, many business relationships are built on top or reinforced by personal ones.

So that secretary in the tax department? She very well could have a network of other secretaries in other gov. departments that she can draw on for favors when your org needs something.

Not saying the albino moose forwards are necessarily good, just pointing out that the social component of email is not necessarily a bad thing for your org.
posted by zippy at 9:56 AM on April 20 [5 favorites has favorites]

I think the first question is what do you actually want to accomplish by doing this? If solution (1) is costing you lots of money, solution (2) turns you into the No-Fun Police and wastes lots of time and effort making sure people aren't breaking the rules (possibly saving you no money as a result, or unintentionally making it difficult for people to do actual work).

Solution 3 would seem to be the best option, but you're not going to be able to fix it all at once, nor will everyone get on board completely. Communication will be very important. The least successful attempts to change work culture around IT come from IT acting like the voice of God, so you need to make sure you present everything as you trying to help them to get things done, because the IT department is there to serve the users. Accept that some amount of personal use will happen. Tackling things like chain letters first will make a big difference. If you have archiving requirements, inform the users -- who wants their schmoopy email to be a matter of public record for the next 25 years? Centrally spam filter. Expect it to take a while.
posted by nckd at 9:57 AM on April 20 [2 favorites has favorites]

Tip: when presenting these ideas to management, turn it into a conversation about dollars. It completely makes me insane to know that users are using my email system to send forwards of beliefnet emails, but that's my peeve and management doesn't care about that. If I turn it into a conversation about storage quotas, downtime for running eseutil or isinteg on databases, to database size and increasing disk costs and the downtime associated with that, management will then pay attention. Management doesn't like to spend money, and they don't like their email to be unavailable. Play to those triggers.
posted by 8dot3 at 10:04 AM on April 20

Former municipal IT Manager here . . . this is something you're not going to want to hear, but this is probably not your call. The resources don't dictate the job, but vice-versa.

First of all, most of the resources (aside from disk-quota) you're managing are ephemeral. You don't get "roll over" bandwidth. If you don't use it, it's gone, which is to say that if you're already paying for an X Mbs connection, the only time this kind of usage really impacts you is when you're reaching that cap. Put another way: the resource you're already paying for is being underutilized, so these people aren't so much "wasting" as they are making use of something that was already being wasted.

You're throwing bandwidth in the trash, they're doing some electronic dumpster-diving. This is why you shouldn't have a theoretical problem with this sort of usage. Now, when they start impacting your budget, not only will you have a reason to care, but you'll have something to take to the decision makers and get them in your corner.

Second of all, and most importantly, if this isn't a violation of employment policy, it's your job to support it, not squelch it. It's not your job to greedily hoard resources. If it is a violation of policy, and you get into a situation where it's actually impacting something other than you curmudgeonly sense of "appropriate" usage, go ahead and do something about it.

Bottom line: being a dick about resource usage just for the sake of it is not popular OR good business.
posted by toomuchpete at 10:11 AM on April 20 [7 favorites has favorites]

Seconding toomuchpete, and it sounds like you're a little power-mad with your new responsibilities. However, you're a netadmin...why are you trying to get involved in policy? From your description of the "problem," what is "appalling" is not the resources being used (since you don't mention that at all), but in the content of the emails that you've been inexplicably snooping.

If there is AUP for email at your office, have a superior send out a reminder email about personal junk and be done with it. There's no need to "bring the hammer down," assuming you have a hammer at all.
posted by rhizome at 10:25 AM on April 20

I managed an IT department for a company in much the same situation as you: Lots of people for whom work email was their first email, and they loved using it personally for jokes and running conversations and whatnot.

You should establish system-wide limits just to keep people acquainted with the idea that email is not some magical realm where size doesn't matter. Work with management to create and publicize an AUP. Set disk quotas so that people run into them and need to actively prune their mailbox. Set attachment size limits so that they bump up against them occasionally.

The point of all that is to get people used to the idea that email is, like everything else, a finite resource. That way, when personal email becomes a disk or bandwidth problem, and you need to take action like auto-archiving everything older than 90 days, people understand that this is normal management of a resource, not Nick the IT guy capriciously slapping them down.

That said, don't be a dick. Surveys consistently show that employees who can incorporate personal time into their work day perform better and are happier. Allowing a certain level of jokes and bullshitting makes the day easier for everyone and actually improves productivity.

Where excessive email usage becomes a problem is for employees who do nothing but, and that problem is their manager's, not yours. The link you play there is to let their manager know how much email usage is per employee. We had a couple employees who were basically having cybersex in slow motion; when we showed their bosses a traffic report from Exchange showing a constant stream of messages back and forth, it was obvious to everyone involved what was happening without actually reading their email and embarassing them. Their managers told them to cut it out, and they did. If the manager doesn't care (like the receptionist's boss, who probably doesn't), then it's not your problem unless it's consuming IT resources needed for other things.

Shorter version: protect the integrity and capacity of the IT systems, and don't screw people. Your job is infinitely easier when users see you as a helpful person, not as a peeping tom out to get them in trouble.
posted by fatbird at 10:32 AM on April 20 [1 favorite has favorites]

I would spend less time looking at their email "Albino moose pictures, prayer forwards, angel pictures, chain forward, inspirational videos, and the like" and more time looking at ways of protecting your network from spyware, viruses, malware, etc. Those are things things that will really give you down time.

Do you have a policy in place with employees? Have they signed anything that allows you to look at their email without their knowledge?
posted by askmatrix at 10:41 AM on April 20

If you dig deeper, you will discover that the vast majority of phone calls made at work are conversations with children, romantic interests and other non-official duties. Most faxes are probably crap, most photocopies are cute jokes and so on and so on. If Susie in reception is wasting too much time on stupid emails and failing to perform her job, the remedy is for her supervisor to take action. The ability to measure things like this (web site usage, email volume) leads earnest new admins to want to control them, but it is usually a bad idea. If Programmer A can be my best and most efficient coder and still spend hours trolling slashdot/cooltools/gizmodo/whatever, I don't care. If Programmer B spends half as much time on personal web cruising and gets half as much done, he will be on my chopping block first. I don't really want to see detailed lists from the proxy server, thank you very much.

If we have a legitimate problem with storage or performance or bandwidth, then we need to address that. You want to address it in the manner least obtrusive to legitimate use and most effective at solving your problem. This usually means storage quotas in most Exchange shops. However, your problem users will still send the most emails and they will continue to be stupid in nature. This is no more of email administrator problem than the person who spends hours on the telephone with their beloved is a phone administrator problem.

Taking punitive action against volume email users is a bad idea. If you work in a shop with clever managers, they will see that. You might find a manager who thinks the idea of cracking down on this "problem" is a good idea, but then you probably work in a bad shop. Making email less useful and convenient for legitimate users in order to prevent "abuse" is getting the entire service aspect of your job completely backwards in my view.
posted by Lame_username at 10:43 AM on April 20 [1 favorite has favorites]

Do stop people from sending large (or preferably, any) attachments to large lists. I recall a time that someone sent a 10M attachment to roughly 2500 people. Exchange reacts poorly when you do that.
posted by oaf at 11:02 AM on April 20

I played the good cop in my IT organization, and sent out reminders every quarter or so with the use policy and tips and "best practices" under the guise of keeping users from inconveniences like getting stuck on mailing lists they didn't want to be on (an occupational hazard in our line of business), with a few reminders in there about personal email belonging at your personal email address. My bad cop counterpart would occasionally put the hammer down a little harder about mailbox size, and also had a sort of agreement with the users that he wouldn't block webmail sites if they would use them instead of work mail for personal use.

(If bad cop had just let me take IE away from the three users who just loved sending/receiving e-cards and were completely baffled when their workstations vomited up 700 photos of penises and died, we would have saved approximately the same amount of grief.)
posted by Lyn Never at 11:31 AM on April 20

You think you're talking about a technological policy change, but what you're trying to do is change the work culture of your office. Not just change it, but change for the worse (in terms of a feeling of control/freedom) for the least-paid people in your organization.

I'm sure you have the skills to pull this off, but I bet there are bigger cultural problems that are probably worth taking on if you're really that short on things to do.

Think of it this way: Thus far, your organization has chosen to offer the people at the bottom of the org chart benefits in terms of flexible communications and disk storage, in exchange for their having very constrained paths for advancement and jobs that lead IT folks (which I used to be myself) to judge them as not being "important decision-makers and managers". A few pennies' worth of disk space and an extra hour or two of your time doing maintenance on an Exchange box is more than worth it, vs. making these already low-level employees feel small about the fact that they use email for a different social purpose than you do.
posted by anildash at 11:45 AM on April 20

Thanks for the responses, everyone! You have raised a number of good points that I had failed to see on my own, and I'll take this all into consideration. If you have more suggestions or insights, keep 'em coming.
posted by Liver at 11:45 AM on April 20

jeffburdges writes "Can you write a little script to crawl the outboxes looking for outgoing mages? Send those people a memo saying it's not so professional if people outside the office get the forwards from government email addresses."

Don't target these reminders, just send them to everyone. You want to avoid looking like you're reading users mail.
posted by Mitheral at 11:54 AM on April 20

Fighting battles you can't win makes you look weak. No place I've ever worked has successfully controlled the flow of dorky forwarded emails. Half of them are probably from my mom. Sorry, everyone.

Also, what TooMuchPete and others said -- professionally, it's not your business unless they're actually having some measurable negative impact. Otherwise, how much slack people bring to their jobs is between them and their managers (and plenty of times, I'll bet, their managers are on some of those cute baby pictures/dumb joke threads. You don't really have a reason to assume their managers will feel the same as you, and you'll be stepping on their toes.

Boundaries help make for a mutually respectful environment -- you want that, not a tyranny.

Right?
posted by A Terrible Llama at 12:01 PM on April 20

The email of Govt workers have been successfully obtained via freedom of information act requests.

If the time comes to remind people about the acceptable use policy, it might help to remind them what's in it for them. Do they want the contents of their email to be available for public inspection?
posted by Good Brain at 12:11 PM on April 20

Call me cynical, but the best way to protect your job and make yourself a invaluable employee is to secretly encourage tons of mindless email traffic - then you get to upgrade servers, fix broken stuff, do reviews of strategy, spend money on cool networky-things, etc, etc.
posted by Xhris at 1:52 PM on April 20

Call me cynical, but the best way to protect your job and make yourself a invaluable employee is to secretly encourage tons of mindless email traffic - then you get to upgrade servers, fix broken stuff, do reviews of strategy, spend money on cool networky-things, etc, etc.

And waste even more taxpayer resources than these people already are pissing away. What a great suggestion!
posted by cellphone at 2:12 PM on April 20

If spam isn't already causing 100 times the server load of your top 20 email users, it certainly will before too long. Ask any network manager - most of us would have a party to celebrate if we found that users forwarding jokes to each other was the biggest load on our servers.

Focus on that and let the people forward their moose pictures. This serves a purpose that isn't always obvious to us IT geeks:

1. It maintains (shallow) social connections.
2. It lets people casually "ping" each other and let them know they're OK.
3. It helps IT-phobic people become more comfortable using email and computers in general. In the future more and more of the low-level employees will need to efficiently use email to do their jobs, and forwarding moose pictures now helps them lose their fear so they can do useful things with email later.
posted by mmoncur at 2:15 PM on April 20

Also, stop reading people's email unless it's explicitly your job. It's bound to get you in trouble.
posted by mmoncur at 2:17 PM on April 20 [3 favorites has favorites]

It's largely tangential to your issue, but zippy nails a very important point that is well worth remembering.

I used to work in a place that was micro-managed by remote computerised means to the point where social interactions during working hours were almost abolished. On paper, the efficiency stats looked amazing - a 10~20% increase in jobs completed per worker across the board. But informal information flow between employees ground to a halt, the transfer of 'local knowledge' stopped, and every worker became an expert on their tiny little bit of the organisation, with no idea of who might hold the key to problems on the boundaries of their own domain.

Off the top of my head, I can think of a half-dozen occasions where this lack of informal communications cost the company $10,000 or more per incident just through wasted time, poor solutions, or unnecessary rework - and that was in a low/mid level, but skilled, technical field.

Never underestimate the value of keeping informal social contact flowing, especially when it allows everybody to know what's going on where, know who knows what, who might know what else, and being able to skirt the 'official' lines of communication/control to ask informally 'hey, you know about X & Y - what can you tell me about X+Y+Z?"
posted by Pinback at 3:16 PM on April 20

(Having said that, yes, 95% of what flows through these side-channels is crap. Problem is, you don't know which 95% is crap, which 5% is gold, and how to tell the difference. Often, the gold is intimately associated with the dross and there's no practical way of separating it.)
posted by Pinback at 3:18 PM on April 20

That receptionist in the tax department... he knows a lot of people and some of them like him. He may not be very high up in the formal hierarchy but he's got a large social network. If you're a government worker, then you're probably planning on sticking around for a while. If that's the case, you want to cultivate good relationships with people who know everybody.
posted by rdr at 4:03 PM on April 20

If the decision is made to limit the use of work email, offer to help people set up Gmail or other accounts. Being friendly and pro-active will help offset any negative impact from tightening control on their work email, even if it's legitimate. Just be sure you recommend one that you are comfortable supporting.
posted by GJSchaller at 4:05 PM on April 20

I would be careful about this. How many net savvy people are willing to go eight hours without checking personal email? Doing so need not be a major drain on productivity, and many people are likely to strongly resent IT staff looking at their messages.

If your server infrastructure can handle the load, I would suggest letting it be.
posted by sindark at 5:43 PM on April 20

Incidentally, my workplace bans GMail using WebSense (a piece of web blocking software), so I end up accessing it using Outlook and IMAP.
posted by sindark at 5:44 PM on April 20

Thanks again for the great replies, everyone. You gave me a lot of perspective that I was missing with my hammer-&-nail mentality. I will go forth trying to take a broader look at the impact my seemingly-simple admin actions can have.
posted by Liver at 1:45 PM on April 21 [1 favorite has favorites]