Psssst. A word of warning: Your company is being invaded by a seemingly innocuous consumer technology that could compromise your deepest corporate secrets, render you vulnerable to lawsuits, and adversely affect employee productivity.

The name of this Trojan horse? Instant messaging. And it’s your employees who are bringing it inside the firewall. These text-based, consumer chat programs, a longtime fetish of teenagers and computer geeks, have gone mainstream and invaded corporate America in recent months. IM’s spread to the business scene poses a variety of problems, but also underscores its potential as a communications tool no less powerful than e-mail or the old-fashioned phone call.

The free, consumer programs — including market leaders AOL Instant Messenger (AIM), AOL-owned ICQ, Yahoo Messenger, and Microsoft’s MSN Messenger — are simple Internet tools intended for keeping friends and family in touch with each other. Each instant-messaging program features some form of “buddy list,” a window showing which of your friends and colleagues are currently online. Click on a buddy’s name and you can “talk” with that person by typing on your keyboard. After you type each line and click Send, the message immediately appears on your correspondent’s screen (for more on how instant messaging works, see “Getting the (Instant) Message“). It is, without a doubt, a very effective way to stay in touch, ask quick questions, or gossip.

Chances are, your employees already use instant messaging of some form. According to research firm IDC, 5.5 million people now send instant messages at work. Further, Jupiter Media Metrix’s February study of 60,000 U.S. Internet users found that workers with AOL Instant Messenger spent an average of 6 hours and 20 minutes per month actively messaging while on the job. That’s significantly more than the four hours per month AIM users spent chatting at home. The Jupiter report does not indicate how much of that office time on AIM is used for business as opposed to personal matters, but it’s reasonable to guess that most folks at work use it to exchange some notes with friends and family. Typically, employees download and install the free tools from the Web without any supervision from their employers. While there are commercial IM programs designed for corporations, such as Lotus SameTime and Microsoft Exchange 2000 (more on those later), they have far fewer users, according to Jupiter.

So what’s the problem with free IM programs? Productivity, for starters. Why are your employees spending six hours a month on instant messaging at work? Are they goofing off and gossiping with their friends? Or are they using IM as a new means of business communication? It’s probably a bit of both, and ironically, it’s the latter of these possibilities that’s especially worrisome.

If your employees are conducting business via instant messages, they should know that the conversations are vulnerable to interception. That’s because the most popular chat tools lack any encryption technology to encode communications. Worse yet, IM programs can record your chats (ICQ saves messages on your PC by default; other programs don’t keep continuous logs, but do allow users to save conversations). If those recorded chats fall into the wrong hands, you could find your company secrets posted all over the Internet. In other words, consumer instant messaging can easily undercut all that money your company spends to ensure that corporate e-mail is secure. Sam Jain, CEO of Internet startup eFront, based in Costa Mesa, Calif., learned that lesson the hard way. In March, Jain’s ICQ logs, including sensitive contract negotiations, were stolen and published on the Web, embarrassing Jain and the company. eFront is still investigating the incident but suspects it was an inside job.

Litigators are also wise to the potential of IM logs. Just like e-mail, the logs can be subpoenaed in the event of litigation. “Attorneys are getting more savvy about instant messaging,” says Michael R. Overly, a partner at law firm Foley & Lardner. “If a deal blows up, or if an employee gets terminated, attorneys will ask for IM records, along with e-mail records, faxes, and other communications.” The bottom line: Anything you say in an IM chat may be used against you.

Perhaps less crucial, but still important to anyone interested in using consumer IM for business communication: It’s not reliable. Most IM tools depend on a central server to act as a switchboard, routing messages and keeping track of who’s online. As with any other Internet application, if that server goes off-line, so does your instant-messaging capability. Outages are a frequent occurrence. In March, for instance, AOL Instant Messenger went out twice for several hours. If the idea of relying on AOL, MSN, or Yahoo for a critical piece of your company’s communications infrastructure doesn’t make you nervous, I don’t know what will.

Still, using IM at the office does have significant advantages, so long as it is a planned part of your infrastructure. For brief, immediate communications, it beats a phone call or e-mail. At IBM, the company’s more than 300,000 employees have used SameTime, a corporate IM program from IBM’s Lotus subsidiary, for several years to conduct virtual meetings, augment telephone conversations, and communicate quickly with remote employees. “If we were to shut down instant messaging at IBM, I think we would have mutiny,” says John Patrick, VP for Internet technology at IBM. “I don’t know how to put a dollars-and-cents figure on it, but the impact on productivity has been profound.”

At application service provider Vobix, based in Louisville, Ky., MSN Messenger has turned into a critical communications tool for the company’s entire 75-person staff — in many cases supplanting phone conversations. Managers often use IM to ask their employees for additional information while in the middle of executive meetings, for instance. Think of it as a high-tech version of passing notes under the table. “We use IM religiously,” says Vobix spokesman Jon Reischel. “It plays a pretty big role in having us all keep in touch with each other.”

There is little question that IM will be a major part of corporate communications in the years ahead. But if you’re going to use it, heed the Defogger’s advice and steer clear of the kinds of free programs that your employees are probably already using. In addition to their lack of security and manageability, these tools generally cannot communicate with one another across platforms, thanks to protracted “IM wars” between AOL, Microsoft, and Yahoo. Efforts to come up with a single IM standard, such as IMUnified and Jabber.org, have not made much headway so far.

Furthermore, AOL, MSN, and Yahoo are not pursuing the enterprise market for IM, and have no plans to support corporate users (though, in my opinion, this is a huge mistake). Microsoft, through its Hailstorm initiative, is working on building IM capabilities into future business products, but those applications are at least a year away.

So where should you turn? Your best bets are corporate tools like Lotus SameTime and Microsoft Exchange 2000. Both programs run on a company’s own servers and are relatively inexpensive to support; Exchange isn’t compatible with consumer IM programs, but SameTime works with AIM and also adds encryption capabilities. The software runs $27 and up per user and requires server setup and maintenance comparable to that of an e-mail system. For example, the 400 lawyers at Shaw Pittman, a law firm based in Washington, D.C., use SameTime at a total cost to the company of a few thousand dollars annually, says CIO Nicole Picciotta. (By the way, if chat is to be used strictly for customer support, check out the Web-based solutions offered by Kana, eGain, and others. See “Who Needs Online Customer Service? You Do,” July 2000.)

Whatever program you choose, the key to reaping gains like those of Shaw Pittman, IBM, and Vobix is to set guidelines for usage and train your troops well. This may take some time, says Picciotta, but the results are “absolutely worth the effort. There’s no question.”

Sign up for e-mail delivery of Dylan Tweney’s weekly column at www.ecompany.com.

Want to learn more about IM solutions for businesses? Check out our Web File.

Link: Your Employees Love IM. Should You Worry?

Link broken? Try the Wayback Machine.