If your company owns the contract, then you have the right to read the hosted e-mail.

If individuals sign up for their own accounts (e.g. free Yahoo accounts) then, no, you don’t have the right to read the e-mail.

Best practice is to have a boilerplate acceptable use policy stating that the company has the right to monitor all communications, and that company business is required to be performed on company-approved e-mail systems.

If you have a contract, e.g. with G-Mail, this serves for both e-mail archiving (FRCP rules for e-mail retention) as well as provides the company with the ability to monitor that traffic.

If you are using a free service, even if the company set up the account, the terms not as clear cut.

That said, these actions are appropriate and would probably have yielded the same findings:
- Monitor incoming / outgoing e-mail from the CORPORATE mail system
- Monitor web activity using a proxy server
- Make a forensic image of the employee’s hard drive, and look for cached e-mails and other items such as sensitive documents that the employee would not normally need to store locally.

Most people, through ignorance or ego, will take the easiest path until they know they are being monitored. Once they suspect they are under scrutiny, they take more devious approaches to hide their activity, but this can be prevented by taking a “business as usual” approach, and working with IT to build the case against them.

Jon