WorkAuditor Blog

Employee monitoring for law firms is a confidentiality exercise first and a productivity exercise second, and the order is not negotiable. I serve as administrator and IT lead for a twelve-attorney firm practicing employment defense and corporate litigation, and the question we get asked most — by managing partners, by bar association committees, and by our own associates — is how you track billable time and firm activity without ever touching the attorney-client communications that define the profession. The answer we landed on is a monitoring model built around access and activity, with hard boundaries around content.

Why confidentiality comes before visibility

In a law firm, the data your employees handle is not your data. Client communications, draft agreements, opposing counsel emails, and work product are protected by privilege that belongs to the client, and a monitoring system that screenshots, records, or content-scans those materials creates a problem that does not exist in other industries: every captured document becomes discoverable, and every logging decision becomes a privilege-waiver question. Our malpractice carrier made this point bluntly during a review: one careless screen capture of a privileged document stored in a monitoring vendor's cloud is a claim waiting to happen.

So our first rule is a negative one. We do not use screen recording, keystroke logging, or content-level capture of email and documents, anywhere, under any circumstance. Those features are off the table for every user in the firm, including the partners. The monitoring we run is structural: what files were accessed, when, from where, and by which licensed user account.

What we monitor: access and activity, not content

Concretely, our monitoring stack covers four layers:

• File access logs. Our document management system records which matters a user opened, when, and whether the file was modified, printed, or downloaded.
• Application and website activity. We can see that an employee spent an afternoon in a client's data room portal or on a legal research platform, and we can see personal browsing during work hours.
• Time tracking. Billable hour capture with matter and activity codes, which doubles as the productivity signal for the firm.
• Endpoint activity. Login times, remote sessions, and device usage patterns that flag anomalies like an employee accessing the system at 2 a.m. from an unrecognized location.

None of these layers read the substance of anything. Access logs tell us a file was touched, not what the file says. That distinction is the entire foundation of our policy, and it is what we explain in the written disclosure every employee signs.

Scenario: a paralegal who worked from a coffee shop

A concrete case illustrates the value of this model. One of our senior paralegals — I will call her the only person on the employment defense team who handles our largest litigation client — began working Friday afternoons from a café two blocks from the office. The firm allowed occasional remote work, so nobody thought twice. Then the access logs showed her document management sessions originating from a public Wi-Fi network, which triggered our security policy automatically because the client's security questionnaire specifically requires that our firm's data handling not cross unsecured networks.

We handled it as a data security issue, not a discipline issue. A conversation established that the Friday café sessions were how she caught up on administrative filings, and she preferred a firm-issued hotspot. We provided the hotspot, added a rule that client matter access outside the office requires the VPN, and the situation resolved in a day. The monitoring did its job: it caught a confidentiality risk that would have been invisible to a time-tracking system and did so without ever revealing the substance of the documents involved.

Billing hours and productivity tracking that stands up to bar review

The second scenario is about the other half of the equation: using time and activity data as a productivity tool in a profession where billing is the business. Our associates target 1,900 billable hours a year, and historically, the tracking was honor-system timesheets reconciled at month end — with the predictable result that nobody knew about a slow month until it was over and unrecoverable.

We moved to weekly monitoring of billable activity against practice-area benchmarks. When one associate in our litigation group came in at 72 percent of expected billable time six weeks into a quarter, the time entry data showed the cause clearly: 11 hours a week in internal team meetings that had no matter code attached. The remedy was structural — we moved those meetings to biweekly, cut the internal review distribution list, and reassigned two administrative tasks to a shared resource. The associate's billable production recovered to target within the quarter. That is monitoring as a scheduling diagnostic, and it works because the data is matter-based and verifiable, the way any fee petition must be.

Insider risk: the leak you cannot afford

The last thing a law firm's monitoring design must address is insider risk, because the harm from a single disgruntled employee in a firm handling high-value corporate litigation is not measured in lost productivity. Our controls: access logs feed a weekly review of unusual patterns — mass downloads, bulk printing, file downloads shortly before a departure, access to matters outside an attorney's assignment. We also restrict what monitoring dashboards show: each attorney's matter list is visible to them alone, with matters grouped by client reference number rather than case name even in internal reporting, so that lateral visibility inside the firm stays low.

This is the model we now present to any administrator setting up monitoring for a firm like ours: access-based, content-free, matter-level, and fully disclosed in writing before the first log line is recorded.

Building the policy with your lawyers, not around them

If you are implementing employee monitoring at a law firm, involve your attorneys in defining the boundary before you buy anything. Have the managing partner write down what could never be captured, and let the technology fit around that list. On the product side, we use WorkAuditor, a cloud-based employee monitoring software for Windows and Mac, because its activity and application-level tracking matches our access-based model without content capture features that would create privilege problems. The software runs on the endpoints; the boundary is ours.

Has your firm stress-tested what your monitoring system would do with a privileged document — or worse, what a court would do with a screenshot your vendor stored?