IM Spread Causing Management Headaches

Computerworld - The spread of instant messaging in the financial services industry is causing compliance and technology challenges for IT managers who must not only monitor and archive electronic communications but also root out and shut down unauthorized IM services.

Many IT units are having difficulty managing a plethora of IM systems installed without their knowledge that are used for both personal and important business communications. And user objections to IT's efforts to rein them in are another factor to consider.

For example, Thomas Weisel Partners LLC in San Francisco tried to shut down the use of America Online Inc.'s Instant Messenger, Microsoft Corp.'s MSN Messenger and Yahoo Inc.'s Yahoo Messenger after the Sept. 11, 2001, terrorist attacks. However, user pushback forced the company to adopt monitoring software instead.

"It comes down to some of our institutional customers who required IM as the method to communicate with them," said Beth Cannon, former chief technology officer and now chief security officer at the institutional brokerage.

Thomas Weisel installed IM Auditor from FaceTime Communications Inc. in Foster City, Calif. The program runs on an internal server and monitors IM traffic, flagging any banned words or phrases while archiving all messages.

More vendors of all sizes, such as Stellar Technologies Inc., which last week unveiled the GEM content-blocking tool, are scrambling to build robust tools to monitor IM for financial firms, which must meet new government regulations requiring that electronic conversations be monitored and recorded.

Two years ago, IM monitoring was almost nonexistent in financial firms. Now it's a key IT function of most banks and brokerage houses on Wall Street, according to research firm TowerGroup in Needham, Mass.
"If they've got IM, they're logging. I can't think of a situation when I've gone into a bank and they're not logging," said Jeremy Condie, senior vice president in charge of business strategy at Thomson Financial LLC in New York.
Thomson, a provider of financial information to banks and money management firms, offers IM management services to clients based on a monitoring tool from IMlogic Inc. in Waltham, Mass.

Most IM monitoring products are gateway devices that sit on the network and monitor all incoming and outgoing messages. Some contain policy engines that search for keywords and alert managers to unacceptable conversations.

Establishing Policies

Marcelo Sciurano, MIS director at brokerage firm Libra Securities LLC in Caledonia, N.Y., said his firm chose an IM monitoring and archiving service from Stellar based on cost and maintenance features. Each quarter, Stellar sends CDs to Libra containing all IM traffic data for that period. Libra's security officer then performs keyword and phrase searches of the traffic.