Workforce monitoring. Surveillance. Big Brother. Terms that might generally describe how companies try to prevent cyber threats tend to make employees fear the invasion of their privacy.

Amid growing threats to trade secrets and infrastructure, companies are adopting more advanced protective programs. At the same time, employers are looking to strike a balance that takes into account privacy, communications and employment laws.

“The programs you choose need to be socialized so that the employees feel their privacy will be protected and they have the opportunity to see and understand the application of the program,” Erika Brown Lee, assistant general counsel at MasterCard for privacy and data protection, said on a panel in Washington on Wednesday. “When the employee is monitored, there should be a clear and articulated policy that is available to all employees.”

Speaking to a room of general counsels, private practitioners and government officials, panelists at the Global Privacy Summit addressed the complex framework companies must wrangle to protect their business and the privacy of employees.

Cybersecurity programs should take into account the evolving threat of internal leaks, Lee said.

“OK, we can be [politically correct] about it, but we also do need to take that sliver into account,” Lee said. “The type of employee under certain circumstances who has access and motivation to take information in an unauthorized fashion is a small but real threat. That effect could be great.”

Lee continued, “You need to think through that balance of privacy, making sure their information is not going to be monitored for any kind of purpose that isn't cybersecurity, but nonetheless, a breach of that kind affects us all.”

➤➤ Get employment law news and commentary straight to your in-box with Labor of Law, a new Law.com briefing. Learn more and sign up here.

The actions of employees, whether malicious or inadvertent, can contribute to a cyberattack. Companies should consider the legal risks when adopting a cyber defense program, said James Denvil, a regulatory senior associate at Hogan Lovells in Washington who spoke on Wednesday's panel.

Denvil, who advises companies on cyber defense programs, said there are many myths surrounding these issues, including that no monitoring is legal and also that the company can do whatever it wants.

“The protection from liability is quite broad,” Denvil said. “The protections will apply. If you are protecting systems or information in systems, that's a cybersecurity issue. If you want to find out if Joe is more efficient than Jack, it's hard to say that's a cybersecurity issue.”

To make decisions about whether a workplace monitoring system is reasonable, companies should ask: “Are we protecting crown jewels or innocuous data? Does the impact protect critical infrastructure or something with no trade secrets?” Denvil also said a company should consider if the tool works to protect those critical systems and is it the least intrusive version of the tool.

“Don't bring a nuclear weapon when you just need a hammer,” he said. “How does impact compare to the risk? Maybe you don't want to scrape social media. But there could be arguments in some reasonably scraping of public profiles to look for signs they will do something bad in terms of data or terms of kinetic impact of the real world.”

He added, “You aren't looking for people doing the wrong thing—a 'get the bad guys' attitude. If that's where you're starting, that's going to be expansive. Instead, think of preventing people from doing the bad thing.”

Lee, formerly chief privacy and civil liberties officer at the U.S. Justice Department during the Obama administration, said the department issued an order that developed parameters for access to information and because of the sensitivity to that information, there was a list of activities that could be monitored.

“You need to make sure there is that balance,” she said. “You really want to create an environment that has the trust of your employees and secures the parameter.”

John Holmes, general counsel of Forcepoint, which produces “human-centric” cybersecurity solutions for companies, said all stakeholders need to be involved, not just IT, and the businesses will need buy in from around the company. He said companies need to consider a holistic approach to the programs they adopt.

“Monitoring is a pejorative word that I don't like at all,” Holmes said. “The paradigm in cyber is employees are part of the solution. It's not about productivity. Rallying your employees to be part of the solution is critical.”