Inadequate Attention to Privacy Concerns May Lead to Underutilization of Instant Messaging in the Workplace
by Alfred Kobsa and Sameer Patil

Instant Messaging (IM) is not only popular for personal usage, but its utilization in the corporate setting has grown exponentially. As noted in the Danziger and Garrett article, IM first entered the scene in the late 1990s and is now used by nearly one-third (30%) of all computer-using workers. Companies such as Intel and IBM are developing an IM friendly internal organizational culture, with the goal of raising productivity and saving costs. IM has become the medium of choice for quick informal business communication in many companies. While the use of IM is mostly limited to within the organization, its potential for collaborating and communicating with external business partners and clients is also increasingly being explored.

Nature of IM

Instant Messaging is a form of real-time communication between two or more people based on typed text, and typically boosts communication and allows easy collaboration. The text is conveyed via computers connected over a network, and differs from e-mail in that conversations occur in real time, and the parties know whether the peer is available. People are not forced to reply immediately to incoming messages, and in this manner communication via instant messaging may be less intrusive than phone communications.

Business Value

Numerous features of IM translate into promising business value for organizations through productivity gains and cost savings. IM can increase productivity by improving the effectiveness of collaborative work practices, leading to faster answers and decisions. It can improve trust and morale by facilitating greater informal communication. And last but not least, it can reduce telecommunication and travel costs. For instance, Intel estimates that by promoting an IM-friendly culture, it can save up to $25 million over 3 years. These advantages are all the more salient when collaborating colleagues are geographically distributed. As a result, the use of Instant Messaging is very much encouraged in quite a few companies such as IBM, and its day-to-day usage is abundant.

Security Concerns and Underutilization

While this potential business value makes the deployment of IM very attractive to organizations, its introduction and adoption has to address and overcome existing concerns regarding the privacy, security and surveillance of IM usage. Inadequate attention to privacy issues could lead to underutilization, and in the worst case, complete abandonment of IM, thereby reducing its promised potential. Moreover, it can also cause a loss of trust in the respective organization.

CRITO Researchers Alfred Kobsa and Sameer Patil conducted interviews with frequent users of IM (both for business use and for personal use), and found that despite the diversity of work contexts of the interviewees, they shared privacy concerns regarding both the availability and the communication aspects of IM. Interviewees felt uneasy about the fact that their IM conversations could be saved (and possibly forwarded to others) without their knowledge. They were concerned that conversation logs accessed at a future time could be misinterpreted due to lack of accompanying context in which they were captured. Interviewees also complained about the distraction and interruptions caused by broadcasting their availability to others. Moreover, they worried that their availability, as projected by IM, could be monitored by others, and conclusions about their work productivity be drawn. As a matter of fact, one interviewee reported having been electronically stalked by a colleague who eventually reported her alleged idleness to management.

Tactics Used to Preserve Privacy

Companies have an interest in the transparency of employee activity and availability, and in the preservation of conversations for knowledge management purposes and reasons of accountability. The employees that were interviewed seem to partly disagree, but did not openly fight the company policy. Instead, they engaged in several tactics aimed at preserving privacy. The most prominent of these include:

• Avoiding the use of IM in certain cases (e.g. for potentially sensitive topics), by switching to another medium of communication
• Active self-censorship of what is said via IM
• Using IM pro forma to give the appearance of compliance without active use
• Strategic changes in IM status messages to avoid interruptions
• Blocking of contacts to withhold information and selectively avoid communication
• Using multiple IM accounts to separate different spheres of activity
• Disabling local saving of IM conversations to prevent unauthorized/accidental access
• Social negotiation of appropriate etiquette regarding the sharing of conversations with third parties

Factors Affecting Privacy-related Attitudes and Behaviors

The initial analysis by Kobsa and Patil suggests that several factors contribute to the attitudes expressed by IM users regarding privacy, and corresponding behavior. These include:

• Sensitivity of the content of the IM conversation in question
• Inherent personal attitude towards privacy
• How well the user understands technological details (both about technology in general, and IM in particular)
• Perceived potential for IM conversations to persist in the future via archiving or logging
• Location where IM is being used
• The nature of the relationship with parties with whom users are conversing via IM

Conflict between Organizational Expectations and Employee Privacy Concerns

These privacy-preserving tactics suggest that a conflict exists between current organizational expectations regarding the IM usage (and current design of IM systems that seem to largely follow these expectations), and employee privacy concerns with regard to these expectations and system design. While this conflict has not led to a boycott of IM, there are subtle indications of “underutilization.”

Balancing Organizational Benefits and Individual Privacy

From a managerial standpoint the research team suggests that organizations ought to explicitly formulate easily understood policies regarding IM, and ensure that these policies are communicated well to the employees. Making it clear to users what is and is not expected as acceptable IM usages in the organization can facilitate better decision making regarding privacy while using IM. Specifically, given the concerns expressed by users regarding persistence of conversations beyond the moment, policies related to logging, and archiving are particularly important.

From a design standpoint, IM software ought to be designed such that the manner in which the underlying technology is made more transparent to the users. Moreover, privacy-affecting actions ought to be made more visible in the interface such that they are appropriately noticed by the users. And the burden of configuring privacy preferences needs to be lessened by providing defaults that work as widely as possible, and by allowing specifying preferences differently for different “groups” of IM contacts.