Prison sentences could await business bosses who do not do enough to stop the most serious abuse of computer networks by employees.
By Mark Ward
BBC News Online technology correspondent
The warning comes from legal experts who say firms are open to prosecution because they are so ignorant about what employees are doing with company computers.
Illegal use of networks is rife
In the most serious cases some firms are unknowingly harbouring illegal images on work PCs and servers.
Firms are being urged to take the problem of network abuse as seriously as they do fire prevention.
Staff misuse of the net is much greater than abuse of any other work system, according to statistics gathered for the 2004 Information Security Breaches survey.
For 8% of companies questioned in the survey, web abuse was responsible for a firm's worst security incident of the year.
Net law expert Dr Brian Bandey said companies were legally obliged to stop the most serious incidents which involve the making and storing of child pornography using work systems.
"This is not an issue of acceptable use policies or employment law," he said. "The law fixes criminal responsibility on the corporation itself and the decision-makers within it who have both the power and responsibility to decide corporate policy and strategy."
Criminal responsibility for illegal images on work networks could be pinned on directors if it could be shown that they had not done enough to stop such things, he said.
"It is like fire doors and smoke detectors," he said. "The liability on these people is put in place to stop those things happening that society wants stopped."
Proving someone had been neglectful in this area would involve showing that they had not done what they should have, said Dr Bandey.
"The easier it is to stop something happening the easier it is to prosecute someone for this type of neglect," he said.
"A case is inevitable," said Dr Bandey, "the availability of software tools that prevent the entry of illegal images into the corporation has made the threshold of neglect significantly lower."
The consequences of neglectfully allowing the storing or making of illegal images would be a jail term of up to 10 years, said Dr Bandey.
George Godar, a technology partner at law firm DLA, said the problem of net abuse was only just being confronted by many companies, though few had worked out just how to tackle it yet.
"They do not know about it or prefer not to know about it," he said. "If they did think about it, it would require pro-active work on their part.
But, he said, the legal consequences of net abuse by employees were real.
"If the offence of storing illicit material occurred with the consent or connivance of, or was attributable to any neglect of the senior officer, then the company is guilty of an offence and senior director and senior employees will be as well," he said.
Police forces may call on negligent firms
Mr Godar added that "consent" and "connivance" implied something active on the part of a manager, it was not simply a matter of them doing nothing.
He added that "neglect" was another matter and was a failure to take steps which ought reasonably to have been taken.
Firms that discover illegal images on their network typically dismiss the offender, said Jonathan Exten-Wright, human resources partner at DLA.
"A very firm line is being taken no matter how senior the person," he said, "there is no room for manoeuvre on child pornography."
He added that firms do not have to tell the police that someone has been dismissed for such serious abuse so it is a matter for their judgement. Only when money laundering is discovered do they have a duty to inform the police.
Key to good management of such incidents was a policy on net use that was regularly communicated to employees and which made clear the consequences for anyone transgressing it.
Firms should also ensure that appropriately mature staff were put in charge of viewing suspect material and acting on what they found.
Mr Exten-Wright said that firms also had to comply with obligations safeguarding employee' rights to privacy.