Unfortunately, in the real world, the issue is more complicated. As Wal-Mart recently discovered after monitoring employees to prevent communication with the media, it can be unsettling for employees to find out they are being watched by company officials.
So what do you do? Basically decide organizationally (and this is done by the CEO and general counsel, not the security manager) how detailed the traffic-inspection policy will be and what will happen if data is leaked. These policies must be documented, communicated to employees and enforced.
With the increasing maturity of leak-prevention products, many organizations are inspecting all outbound traffic for sensitive data. As a matter of course, that doesn't mean you should look at employees' personal email (if you allow that kind of thing), but you should scan email to make sure customer lists and other sensitive information stays put. In many cases, the enemy is actually an insider and you need to be able to confirm that.
Again, most importantly, even if you document and communicate the policies, you must enforce the policies equally. That means no one is above the law, not even the CEO. If you selectively administer guidelines, they won't be enforced..
For more information:
This was first published in May 2007