The dubious effects of monitoring surfing habits

In a previous incarnation, I ran the web traffic monitoring software for a major company.  It was my job to make sure that the employees of the company couldn't get to sites they weren't supposed to and occasionally run reports for the Human Resources department.  The company's policy was relatively simple: no pornography, no hate sites, no gambling at work.  They didn't monitor time online or have any automated reports to tell  who was spending too much time online, they only asked for details if there was a problem.  Having had that experience I'm more than a little dubious of any claim by a vendor that their product is going to "make companies more efficient and effective".

It's pretty well documented that taking a break from time to time to let your brain digest what you've been working on is a good thing.   Does it matter if an employee does this by taking a few minutes to read personal email or goes out to take a smoke break?  After all, most people have worked with someone who seems to take a 15 minute smoke break every hour, so spending the same time at your desk catching up on your web comics can't be any worse. 

The real issue has nothing to do with an employees surfing habits.  It's an employee's work habits that are the real issue, and overly controlling what sites they can visit and how much time they can spend online is just treating a symptom of the problem, not curing it. An employee who's going to shirk their work is going to do so one way or another, web surfing is just one option.  Employers need to realize this and treat the problem at it's source, making the employee realize that a certain level of productivity has to be met, not blame time spent on the Internet as the cause. 

Restrictive surfing policies impact businesses in less direct ways that may not always be obvious.  Employee morale can suffer when seemingly arbitrary restrictions are placed on employees.  If you have these types of restrictions, make sure your employees know about them, why they're in place and the consequences for violating the policies.  Another problem, especially for IT and security professionals, comes into play when we're trying to do research.  There are few things as annoying as not being able to get to the site that has the answer to your technical question because it's been labeled as a hacking site by your monitoring software. 

Web monitoring is essential in today's networks, but it has to be a delicate balance between enforcing corporate policy and being overly restrictive.  But more than anything, this monitoring should be a function of the HR department, not the IT department.  Yes, IT may be the one's running the systems and configuring the monitoring, but it has to be HR that decides what is and isn't blocked based on corporate policy.  Even more important, HR needs to be the ones running and controlling the reporting mechanisms, because any time you run a web traffic report, it's an HR issue.  Giving these reports to managers without involving HR from the start can not only result in an inability to take any effective action against the employee, it could mean a possible lawsuit if handled badly.