Nontechnical Deterrence Effects of Mild and Severe Internet Use Policy Reminders in Reducing Employee Internet Abuse

This two-stage longitudinal study examines how employee Internet abuse may be reduced by nontechnical deterrence methods, specifically via organizational acceptable use policies (AUPs). This study used actual employee usage and audit logs (not self-reporting survey measures) to monitor the web activity of employees. In stage 1, a mild AUP reminder sent to company employees resulted in a 12% decrease in employee Internet abuse. In stage 2, a more severe AUP reminder resulted in a 33% decrease in employee Internet abuse. For both stages, the AUP warning (regardless of severity level) resulted in an immediate and significant decrease in employee nonwork Internet use. Results indicate that the severe AUP treatment was more effective in reducing and maintaining lower levels of employee nonwork Internet use than the mild AUP treatment. Under the mild AUP treatment, employee nonwork Internet use levels returned to their pretreatment levels after only one week. However, under the severe AUP treatment, employee nonwork Internet use levels were lower than the mild AUP treatment and remained consistently lower than their pretreatment levels even after three weeks. These results suggest that nontechnical deterrence methods in the form of organizational IT use policies may constitute an effective approach to reducing employee Internet abuse, particularly if AUP policies are clear with regard to related sanctions and penalties for employee noncompliance.