RU OK w IM?

The free, Internet-based types of instant message software, such as AIM, don't have the robust features found in typical e-mail packages, such as the ability to store, forward, sort or retrieve messages. But commercial software has advanced features such as shared whiteboarding, the ability to link to a videoconference, store and search capabilities, broadcast messaging, file sharing, encryption and unified messaging. Some applications extend to mobile users, and most integrate with portals and existing directories behind firewalls.

Instant-messaging systems also complement existing applications. For example, attorneys at Shaw Pittman, with offices in Washington, D.C., Virginia, New York, Los Angeles and London, use Lotus Sametime within their Lotus Notes application.

If a lawyer has a question or wants clarification on a document written by a colleague, the Sametime user can click on an icon and chat with the author. This speeds the process of preparing IPOs and contracts.

Cindy Thurston, application development manager for the firm, adds that Sametime lets lawyers host online meetings. Cutting back on traditional videoconferencing costs and travel budgets makes sense, Thurston says. Sametime costs $33,220 for a 1,000-user license. She adds that attorneys are using the messaging software to speak confidentially with clients during contract negotiations.

Many remain skeptical

But many companies are resisting the lure of instant messaging. "I would never put it on my computer," says Rob Ramrath, CIO for Bose, an audio manufacturer in Framingham, Mass. "With the phone, voice mail and e-mail, I don't need another application popping up."

"It's hard to get your arms around it as a business case," he says. While there's no formal instant-messaging program at Bose, it is making inroads through the back door. One call-center service group uses it as an additional communication channel.

Ramrath says instant messaging hasn't become a problem yet; the burden on the network is minimal. But, "if there's a virus threat, we'd be forced to take action," he says.

Similarly, Jeff Sanford, Health Insurance Portability and Accountability Act (HIPAA) project manager in IT for Eastern Maine Healthcare in Bangor, says his company has no formal real-time messaging program. He says upper management hasn't asked about it but IT people are concerned about managing its use, especially with regard to patient information.

Sanford says he would need to install filters or use encryption to implement instant messaging, and his infrastructure isn't ready to support widespread use of encryption.

He adds that the five-hospital network already has phone, voice mail and e-mail. "I ask myself, what value will this add?"

One possible value is pairing instant messaging with meeting software to let physically separated workgroups collaborate, Sanford says. "It's starting to churn in our heads," he adds.

There's no shortage of things to be concerned about when it comes to instant messaging in the enterprise:

• Spam is starting to surface, at least with the free services.
• Error checking and retransmission capabilities don't exist.
• Usage policies and security are potential problems.
• There's a lack of standards for integration between message platforms.

It's a young market, says Robert Mahowald, senior research analyst with IDC. "Vendors are waiting to see what the big business play will be, in portals, for collaboration, or as a business application."

A 2001 IDC report indicated that as of 2002, nearly 40% of U.S. businesses would use enterprise-messaging software for corporate messaging, customer relationship management and contextual collaboration.

In the report, IDC predicted that the percentage of corporate instant messages sent annually using enterprise-messaging software, as opposed to free messaging services, will increase from 66% in 2000 to 91% in 2005.

Dana Gardner, research director at Aberdeen Group, says, "Enterprises are recognizing the value of integrating with directories behind the firewall." He cautions, however, that the infrastructure needs to be in place for encryption, and properly set up for user authentication.

Gartner analyst Robert Batchelder says most companies build a closed network for instant messaging because they want employees to use it for business and because they want it secure. One option, Batchelder says, is forbidding and blocking free messaging services.

Another security concern pops up when a company ties instant messaging to its Web portal, Gardner says. "The only way to secure a portal right now is to use the same technology on both ends. That means working off the same directory, integrating by mirroring directories using [Lightweight Directory Access Protocol], and using encryption to secure across the two different systems."

And companies need to address etiquette and usage policies. "Usage policy is a big issue that corporations are blind to right now," he says.

He says an employee using a free service to complete a transaction may find that the recipient logs off and doesn't get the last message. "And, it could cost someone a job."

He recommends that companies develop policies that lock down desktops, filter traffic and close down ports.

Hayes and Associates Disability Insurance uses WiredRed e/pop to establish a sense of community among remote workers and to save on telecom costs.

Nick Reich, director of IT for the Maryland disability insurance outsourcer, says Hayes likes the ability to encrypt real-time message streams, which may become a requirement under the upcoming HIPAA regulations.

Reich says e/pop's Citrix technology provides basic encryption and authentication. Non-Citrix users can log on to a company server, and with a desktop client, authenticate through passwords.

He says if encryption is needed, they'll be ready with e/pop, but they'll have to tighten their usage policies, especially for allowing nonsupported instant-messaging clients.

At Johns Hopkins University, IT staff noticed an increased use of AOL and MSN instant-messaging services in late 2000, and decided not to deal with a hodgepodge of platforms, says Ross McKenzie, director of IS.

The university has 500 full-time faculty and 3,500 staff and students who rely on a network of desktops, Microsoft Office licenses and other products. IT chose Bantu Messaging, which was layered into the university's Citrix XPS Web portal technology.

He says the free commercial services such as AOL's and MSN's haven't been banned. "We'd hear people screaming about their academic freedom," he says.

But McKenzie says file sharing via instant messaging is not allowed because antivirus technology from security vendors such as Symantec and McAfee isn't yet capable of protecting it at the server level.

With the heightened security awareness, McKenzie says Johns Hopkins plans to reevaluate its need to use encryption for passing sensitive information over a real-time messaging platform.

Bantu offers encryption, but Johns Hopkins uses the Secure Sockets Layer protocol instead. McKenzie says the use of encryption and digital signatures may become a requirement for new users, such as the Centers for Disease Control and U.S. Surgeon General's bioterrorism staff, which will eventually get added to the portal for collaborating with the university's epidemiology researchers.

Despite concerns on the part of network executives, AOL, MSN and Yahoo instant-messaging screens are popping up on desktops in workplaces everywhere, with or without the support of IT.

However, for use in corporations, the naming convention is a big hang-up, say users such as Pacific's Searcy, because AOL doesn't allow for private names. "If I wanted to find Mary, Joe or Sue with AOL, I'd have to know a word like babyface1."

Not being able to use a private network was also a drawback for Searcy. Lack of encryption and directory integration also concerns him.

David Beckman, a lawyer at Beckman and Hirsch in Burlington, Iowa, says Sametime was a better option than AOL or MSN real-time messaging services because encryption was an important security feature.

Beckman says a few select staff use AIM services too, but those messages don't get encrypted. "There's always risk. If someone wants to get the corporate jewels out, there's e-mail, the phone, or making a copy of it, and these issues need to be addressed by education and policy."

The Sametime Web client option is especially useful when traveling. "I can hit our server, download the Java client and have access to files, real-time messaging and audio/videoconferencing for instant meetings," he says. However, he would like to be able to archive messages with Sametime rather than have to cut and paste, because when you close the application the messages are gone.

Beckman admits he was against real-time messaging when he first saw his teenagers use it - it seemed they got little else done. "The reality of unproductivity is, if you've got a bad employee, you've got a bad employee, the policy is the same as e-mail. I was amazed at how it increased productivity, and how quick it took off at the office."