Under IT’s Radar, Instant Messaging Invades Corporate Desktops

Chances are, instant messaging has already infiltrated your firm’s computers.

It was sometime last year when Lee Blackmore, director of information technology at stock broker Stifel Nicolaus, in St. Louis, Miss, began to realize that his firm’s desktops were being invaded.

The invader was not some virus or malicious software program. It was instant messaging clients, which users were downloading off the Web from vendors like AOL, Yahoo! and Microsoft. But it was an invasion none the less: when Blackmore conducted a survey, he found that well over half of the firm’s 1,300 employees had the software on their computers.

“A lot of our institutional traders were using it extensively,” Blackmore says. “They would be on the phone with one person, and IM’ing someone else. And some of our larger branches were using it for our brokers to communicate with their assistants, who might not be sitting right outside their offices.”

Communication between employees was one thing, but brokers chatting with clients over IM posed a potential problem for Stifel Nicolaus, which, with 83 branches scattered across the Mid-West, is one of the nation’s biggest regional brokerage houses. The SEC has recently tightened the rules for financial institutions around recording communications with clients, and Stifel Nicolaus had no way of logging messages sent over IM.

What’s more, says Blackmore, the brokerage’s compliance officers, who are responsible for making sure the firm stays within the requirements laid out by the SEC and other agencies, weren’t even aware that IM was being used in the company.

According to industry observers, that’s not much different from the situation at lots of other corporations.

“If you asked CIOs if IM is being used in their environment right now,” says Michael Gartenberg, Research Director at analyst firm Jupiter Research, “nine out of ten would say no — and eight out of nine would be wrong.”

That’s because instant messaging has come up from the grassroots, according to Ken Hickman, senior director of product strategy for Yahoo! Enterprise Solutions, with individual workers or departments discovering its utility, and adopting it as a business productivity tool.

That’s easy to do, because IM clients are small and simple to use, and can be downloaded for free off the Web, without any involvement by the IT department.

But now, “IM has bubbled up to a level where IT is saying ‘we have to get control of it’,” says Hickman.

A voyage of discovery

Not surprisingly, many businesses have been on what IDC analyst Robert Mahowald calls a sort of “voyage of discovery,” to find out just how widely IM is in use in their environment.

A number of vendors, including Akonix, FaceTime and IMLogic, provide tools that let you test your network, Mahowald says, to find out what consumer IM clients are being used, what screen names employees are using, and whether they are using IM to transfer files, and if so, what files.

Stifel Nicolaus used software from IMLogic to look at IM use in-house, and then followed that up with a company-wide email to find out if employees were using IM as a business tool or for personal use.

Once companies have a sense of how widespread IM use is among their employees, they have three options, says Yahoo!’s Hickman. They can shut down IM use altogether, or they can replace the users’ free IM software with an enterprise-grade solution such as IBM’s Lotus Sametime — the current market-share leader — or more recent offerings from Yahoo!, AOL, Microsoft or Sun. Or they can install an overlay or gateway product, which funnels all IM traffic through one point, allowing companies to gain some control over IM traffic without making any changes to users’ IM clients.

When CIOs discover just how widely IM has permeated their organization’s computing environment, their first instinct is often to want to shut down all IM use, says Jupiter Research’s Gartenberg. “It’s a knee jerk reaction,” he says, “but users are not going to stand for it. They’ve already seen the benefits, they’ve installed the software, and here comes IT trying to take it away. The last thing IT wants to do is be seen as taking away a service that people see as valuable.”

Indeed, Blackmore’s email to all Stifel Nicolaus employees, which mentioned that the company was considering shutting down all IM, evoked a “strong response” from users who didn’t want to give up IM, Blackmore recalls.

So Stifel Nicolaus, determined to stay in compliance with financial regulations governing employee contacts with customers — and worried about the amount of messaging traffic it had to archive — adopted a compromise approach. The company limited IM use to 125 key employees, mostly high-level brokers who were “actually using it as a business tool,” says Blackmore. And it installed gateway software from IMLogic to log all IM traffic, and to make sure that employees were not using it to talk to anyone outside the company firewall.

Other financial services firms are adopting gateways for similar reasons. IMLogic, for example, recently announced large sales to financial services giants Merrill Lynch and Bear Sterns. Instant messaging is becoming “a more mainstream business tool,” says Andrew Brown, CTO of Global Infrastructure Services for Merrill Lynch.

Price was also a consideration for Stifel Nicolaus. Its IMLogic installation cost less than $10,000, says Blackmore. He estimates that going with an enterprise-grade solution would have set the company back more than three times that.

One of the attractions of gateway products is that companies don’t have to force their users to adopt a particular IM client. IMLogic, for example, supports AOL Instant Messenger, MSN Messenger, Yahoo! Instant Messenger, IBM Lotus Sametime, and Microsoft Exchange 2000 Instant Messenger, among others.

That flexibility is attractive to CIOs who are unwilling to commit to an enterprise product until the vendors work out their interoperability issues, says IDC’s Mahowald. Today, users of the “big three” IM vendors — AOL, Yahoo! and MSN — can only communicate with others using the same system. So even though AOL has some 59 million active IM users each month, according to Media Metrix, and Yahoo! and MSN smaller but still substantial user communities, a lot of CIOs are “still waiting on the fence,” says Mahowald.

But Yahoo!’s Hickman believes that, in the long run, the separate user communities will not keep companies from adopting enterprise IM products.

“As interoperability gets figured out — and it will get figured out — companies are going to want to standardize on one product,” he says. “Standardization is going to reduce costs, both in companies’ help desks, because they’re supporting fewer products, and down the road, when they go to integrate IM into their business processes.

And that’s where the real promise of IM lies, according to many industry observers. In the future, instant messaging is likely to be integrated with backend systems, so an inventory control system, for example, might appear on a user’s “buddy list.” A sales representative out on a customer call could then query the system and find out, in real time, if an item is in stock.

Some companies are already beginning to look in that direction. CKE Restaurants, for example, the Santa Barbara, Calif.-based operator of Hardee’s, Carl’s Jr., Timber Lodge Steakhouse, and other chains, recently signed an enterprise-wide license for AOL Instant Messenger. The company, which operates more than 4,300 restaurants, plans on using instant messaging to place orders in its restaurants.