Microsoft apologises for feature criticised as workplace surveillance
theguardian.com
theguardian.com
> But that information could also be seen on a user-by-user basis, potentially allowing managers to identify individual employees who weren’t contributing enough
A good manager should identify employees who aren't contributing enough and work with them to understand how to empower them to contribute more. But the way to gauge this is by actually looking at the work they produce; snooping on their computer usage is a poor substitute used by poor managers.
They definitely stay hard in the platform category.
Ha ha seriously though, I was on a video call and people heard my laptop fans kick on and thought I was compiling.
In reality, I opened Jira.
Needless to say, I quit after 2 weeks.
https://techcrunch.com/2017/01/20/security-researchers-call-...
It's fully participated in the UK media race to the bottom.
https://theintercept.com/2019/01/02/five-weeks-after-the-gua...
How about
"Microsoft regrets the bad PR raised by workplace surveillance feature"
Or even
"Microsoft delighted at PR raised by workplace surveillance feature and wants to continue the publicity"
Is it "workplace surveillance" when you can view the calendar appointments of your coworkers? Or see stats about the changelists submitted, bugs resolved, etc. of each person? Or see their dot when they are viewing a document?
Maybe these Microsoft features crossed a threshold of creepiness past which the world should not go. But to act like it's a settled conversation, where right and wrong are so obvious that the issue was agreed upon long ago, does not match with reality in my opinion.
It's "insights" include utter garbage like "workers who share files on onedrive cause time savings vs. those who share files via email"
https://docs.microsoft.com/en-us/microsoft-365/admin/product...
This doesn't have to be so black and white. I can "view" the calendar of my coworkers. That means - I see if the time slots are taken or not. I don't have to see what the actual meetings are.
I feel like this is fine as long as it's opt-in. I cannot imagine having to go back and fourth about calendar slots every time I have to schedule a meeting, and this feature saves so much time.
> Or see stats about the changelists submitted, bugs resolved, etc. of each person?
I'm a bit ambivalent about these metrics. At least they are somewhat related to work results, rather than "how busy are you" metrics like those rolled back by MS. It's also just a visualization of data which is already publicly available in the git history.
> Or see their dot when they are viewing a document?
This one I think is a bit different. In a world with remote collaborative editing, I think this gives you more visibility about who might be looking over your shoulder while you are working rather than being a form of surveillance.
> This one I think is a bit different. In a world with remote collaborative editing, I think this gives you more visibility about who might be looking over your shoulder while you are working rather than being a form of surveillance.
It's two sides of the same coin isn't it? Depending on the feature is used makes it creepy, but the feature itself isn't necessary creepy.
The MS Office features which are relevant to the article let my manager see what I am doing without my knowledge. The fact that someone can watch you without your knowledge is what makes it creepy.
But I think that pedantic point hints at something that creates this problem: most jobs have a degree of performance to them (i.e. act out the part). Which is perhaps why improv gets recommended for workgroup development every second Sunday.
How do you define that? I ask because I am guessing people who are angered by this have no idea what data employers can already access. Have you seen the data that most MDM or network monitoring software can provide about employees? That is much more sensitive data than what Microsoft is reporting and I haven't seen anyone really object to it in large numbers. The Microsoft stuff seemed intrusive and wrong headed, but odds are if your employer wanted to use that they are also using some much worse stuff too. I might even consider the Microsoft tools helpful as a canary in a coalmine for other bad practices that are much harder to see.
>I haven't seen anyone really object to it in large numbers.
Again, whether or not people have complained about the other, existing workplace surveillance tools has absolutely no bearing the accurate description of Microsoft's new "feature" as a workplace surveillance tool.
>The Microsoft stuff seemed intrusive and wrong headed, but odds are if your employer wanted to use that they are also using some much worse stuff too.
Your employer's access to other, potentially more intrusive, surveillance tools also has no bearing on Microsoft's indisputable status as a surveillance tool.
>I might even consider the Microsoft tools helpful as a canary in a coalmine for other bad practices that are much harder to see.
This canary would already be dead if your previous statement about your employer's propensity to use other, more intrusive, surveillance tools is accurate. But in any event, even if Microsoft's new surveillance tool somehow benefited you by better informing you of your employer's devious intent, it still remains a surveillance tool, and should be accurately described as such.
No. I have not, not really. I would like to understand more about this, however.
I've asked about this but the "stock answer" is always along the lines of "The company owns the equipment, therefore they can do anything they want."
That stock answer leaves out a WHOLE LOT OF DETAIL about exactly what info is collected, how it's processed and some guidance about what's "normal" vs "extraordinary". Presumably it's possible for them to do "a lot", but no one who really knows is willing to explain this in a way that's useful. This would make a very interesting essay or in-depth investigative journalism article, I just don't understand why no one has done that, all writing about this just seems to boil down to the very boring "the computer equipment belongs to your employer" analysis.
I suspect that the vast majority of organizations do very little with this kind of surveillance power, but then, there's no way I can really know because either people stay silent about it or they have no idea.
I have also had to install MDM software in the past at companies with BYOD policies in order to get access to company email or corporate networks so the "they own the device" answer isn't always valid.
Pretty crummy for employees who can have their data wiped at any time by a petty employer.
I think it’s more that that battle is already lost, so it seems a bit silly to go on fighting it.
The fact that there is already something worse is a very poor reason for adding more.
Simply because companies have other tools for which to spy on their employees does not justify Microsoft adding one more
The same logic applies in the US for differrent topics, so it should follow it applies within one company on different topics.
It’s just a case of ‘please ignore this problem because there is a bigger problem’
>Whataboutism, also known as whataboutery, is a variant of the tu quoque logical fallacy that attempts to discredit an opponent's position by charging them with hypocrisy without directly refuting or disproving their argument.
[1] - https://en.wikipedia.org/wiki/Whataboutism
I am not trying to counter an argument by pointing out hypocrisy. I am simply stating there are bigger fish to fry. Maybe you object to that argument, but it wasn't whataboutism.
Nothing against the parent post; I see it all the time. You just were an handy target. :)
Whether or not it is workplace surveillance is an opinion, not an objective fact. So they report the fact that someone had that opinion, not that it is fact.
It's a good thing - it's good journalism to do this.
For example the BBC will report a headline like <Man "walks on moon">, and some people react to that like 'why is it in quotes are they saying they don't believe it?' What they're doing is reporting that they have been told by a source that a man walked on the moon. The source may be the President of the United States, but they're still reporting what the source told them, because they weren't there they don't know they didn't see it with their own eyes. They just know what they were told and so they quote that.
It's a principle, and sometimes principles look funny but the point is you always do it... on principle.
My comment was directed more towards news where they would report, following your example, <Group a says "man walked on the moon", group b says "nobody was ever in the moon">.
When it is reported in this way it feels a bit lazy, under the pretense of reporting on the "facts" ("Somebody said something" is a fact too, but were we on the moon or not?)
I guess all I am saying is sometimes reporting from the perspective of "there are two sides" (for every issue) is not neutral. It is an instance of False dichotomy, and removes all nuance on the debate (only options pro or against)
Are you sure that your employer hasn't installed any custom software/antivirus in your work device? Likely they have.
It’s baffling that Microsoft thought this was a good idea in the first place.
"we are just honest business man - just look at the extremely creepy shit Microsoft get up to"
I would think the bigger issue is that there isn't any basis to say that the metrics collected are a realistic capture of productivity. Measuring stuff and understanding measurements is hard, and you don't want to make big and consequential decisions on a bullshit number.
Or are you perhaps saying that the The Guardian have some kind of indirect interest in massaging Microsoft's rollback into an admission of guilt?
I'm curious why you suggest it might be corporate propaganda.
I don't see the word "sorry" or "apologize" anywhere in there.
They made changes.
https://www.microsoft.com/en-us/microsoft-365/blog/2020/12/0...
I actually wonder how this product would have passed GDPR at all.
As long as you’ve told your user in Sudan that country of origin is something you collect for marketing decisions, it’s fine.
It might be a great response and an outcome that everyone wanted, but in no way can the Microsoft statement be accurately construed as an apology.
Good. Apologies have become so watered down as to be meaningless. Just fix the problem, tell us how the problem was fixed, and move on. Looks like that's what they did. Good on them.
A corporation isn't a person. Decisions are made by 100's or 1,000's of individual managers, each of whom join and leave over the years. CEO's enter and leave. Board membership changes.
Accountability comes from people not buying a product. Or from a government fining them $$$$.
I'd ask you, why do you think a voluntary statement of "contrition" from one of a corporation's single employees means anything at all?
(I'm playing a little bit devil's advocate here, but I think it's worth remembering that corporations aren't people and shouldn't be treated as such.)
Failures shouldn’t lead to people falling on their swords to please the public. When you make that the response, people don’t learn to not make mistakes, they learn to hide them, deny them, and shift blame.
The failure we’re talking about is an organizational failure. For whatever reason, whole teams of people at Microsoft proactively decided to build a workplace surveillance tool. Microsoft can’t fix that by making small changes to what they’ve already built to appease the public. They have to change the organization so that it doesn’t happen again.
As much as I despise Microsoft, this is more of an industry and even a societal failure.
Taking a look at the exploitative, surveillance society we've built, it's clear that ethics are just not very important in tech, nor in business as a whole.
Many of HN's readers who are now wagging their fingers at MS are probably working at companies that also spy on their users, and they either look the other way as long as they get a nice fat paycheck, don't think about it at all, or excuse it in some way.
Privacy-violating sites and software don't build themselves, and there's no shortage of them in today's internet.
Maybe the reason was nostalgia https://en.wikipedia.org/wiki/Domain_Awareness_System
Microsoft knows social media and readers of the Guardian are not going to be a buyer of Office surveillance and metrics software. So it doesn’t matter if they do or don’t apologize - ie, it doesn’t matter if they delegate out customer service for non paying end users to social media. This is different than say Facebook and Google, where they need more people who click on ads and convert, which is a form of payer, so they’re going to be more sensitive to user perceptions despite the absence of a national privacy policy. It’s the #1 misconception, that there is a regulatory failure around social media privacy, when really it’s everything else where there’s no meaningful market mechanism to “opt out” of eg your employer’s privacy violating surveillance.
So to be really precise, the best way to get a remedy for non-paying poor people from a giant company is consistently, always, the law. It’s not a fucking post mortem scrum.
I find this to be quite a stretch. A company with an atrocious record on privacy got caught violating user's privacy in an atrocious way, and they backed off amid widespread controversy. MS calculated that the cost of the bad product image outweighed the benefit of selling your data to your employer. I have no reason to believe this is going to improve their handling of data privacy in the future.
If anything, the clickbaity title is a reflection of The Guardian's editorial liberty.
That’s the difference between moving a feature to some other random place and let people assume it disappeared, and removing a feature completely on ethical grounds.
A corporation can't do something, people do things. Nobody at Microsoft cares they put out surveillance software, they just estimated their was enough outrage that pulling it was more profitable than leaving it out.
E.g. Ralph Nader:
> Unsafe at Any Speed: The Designed-In Dangers of the American Automobile is a landmark non-fiction book by consumer advocate Ralph Nader, first published in 1965. Its central theme charged car manufacturers of resistance to the introduction of safety features (such as seat belts), and their general reluctance to spend money on improving safety.
https://en.wikipedia.org/wiki/Unsafe_at_Any_Speed
Check out what GM did:
> In response to Nader's criticisms, GM attempted to sabotage Nader's reputation. It "(1) conducted a series of interviews with acquaintances of the plaintiff, 'questioning them about, and casting aspersions upon [his] political, social, racial and religious views; his integrity; his sexual proclivities and inclinations; and his personal habits'; (2) kept him under surveillance in public places for an unreasonable length of time; (3) caused him to be accosted by girls for the purpose of entrapping him into illicit relationships; (4) made threatening, harassing and obnoxious telephone calls to him; (5) tapped his telephone and eavesdropped, by means of mechanical and electronic equipment, on his private conversations with others; and (6) conducted a 'continuing' and harassing investigation of him."[12]
> On March 22, 1966, GM President James Roche was forced to appear before a United States Senate subcommittee and apologized to Nader for the company's campaign of harassment and intimidation. Nader sued GM in November 1966 for invasion of privacy.[12][10] He won the case on appeal in January 1970 and was awarded $425,000, which he used to establish the Center for Auto Safety, a non-profit advocacy group. He went on to lobby for consumer rights, helping drive the creation of the U.S. Environmental Protection Agency and the passage of the Clean Air Act, among others.[13]
You can't make this stuff up!
I would be highly surprised if there weren't. However, it'd far worse if Microsoft provided such features, because that would mean there'd be much less friction for an enterprise to adopt them (since pretty much all of then already license Office). At least with those other suppliers, a company would have to have decided it wanted worker surveillance and seek it out, rather than getting it out-of-the-box by default.
Especially with remote work on the rise.
This is one thing I hope all of us continue opposing vehemently.
It's a huge privacy concern and companies have too much incentive to want to monitor this kind of data.
In Sales, this means meetings, calls, deals, etc. In Service, this means satisfaction scores, handle times, etc.
All of those are well understood employee productivity scores.
I think this scares people because no one is sure how it’ll be measured and used. At first blush, it just looks like a proxy for identifying luddites and/or people who hate chat — regardless of their actual job performance.
And given the nearly 100% penetration of office its much more serious.
That is absolutely laughable.
What a joke
At this point, we might all be better off adopting the attitude: I don't have to outrun the bear, I just have outrun the other guy. I don't like it either, but I don't see much of an alternative.
This has been possible for a long time, the only boundary which was being tested here was the idea of selling this data to your employer.
Edit: found it https://www.youtube.com/watch?v=15HTd4Um1m4
Microsoft didn't say sorry and then do nothing. They did the inverse: they did not apologize, but they did respond to criticism and fix the issue.
"Adoption of key features" does not sound like it corresponds to productivity to me. (Maybe in very extreme cases?)
I could imagine using this metric to see if I'm getting my money's worth out of the software or whether some department is slow in adopting it.
setInterval(() => {angular.element(document.body).injector().get('presenceService').setMyStatus(1, null, false); }, 15000)
This snippet is my own, made by looking at the source code, maybe the 15 second interval is overkill so feel free to adjust as you need.
I actually did that at a previous job where I had to use windows 10 and (I think) the sys admin policy was to 'lock screen' after 20 min of inactivity, so I eventually got fed up of having to login all the time.
Just to clarify you can definitely also do mouse moves with python and ctypes.
Is it just ignoring mouse movement, or actually monitoring interaction with the app it recognizes?
This mouse jiggler is programmable, and lets you insert keypresses and stuff into the script: https://www.amazon.com/WiebeTech-Programmable-Mouse-Jiggler-...
So one day, the guy brings in a vibrating baby bouncer, puts the mouse in the baby bouncer, and kicks back for the rest of the day.
Even plugging in a charging cable at my company will get you a visit from the IT Security department.
Seems like the number of jobs where your effectiveness can be measured by how much time you spend in Microsoft 365 is fairly small. The number where there isn't a better metric available is likely even smaller. If you are a transcriptionist, output is nicely metered—many get paid by the word. Even most admin assistants have so much phone work and other jobs where time in O365 is only a fraction of their job.
I think this is mostly a big todo about nothing. Any manager who uses something as basic as this as a metric is almost certainly worthless regardless.
Ultimately, if you have a bad boss, they are going to find some shitty way to screw you over. If you have a good boss, this is irrelevant.
I do think it's good that Microsoft pulled this, I'm just cynical it will make a difference.
If it makes money (directly or indirectly) or can be used to power a (feature/data/etc) moat of some kind you can absolutely bet it will return: it's been implemented now, and capitalism means that profit-motives ensure there's always pressure to bring it back, and if it's just some PR manoeuvring and the flick of a switch to re-enable it, it just becomes a case of "when" and not "if".
The privacy ramifications are intense. As the youth is apt to say, "like woah".
That said, I would love to see a tool that gives work-day insight where the user entirely owns and controls the data.
I've found it helpful to have a summarized report on how much of my work day is spent in meetings and emails verses writing code. It helps me to have data, rather than a vague feeling as to how much time I'm spending on things and how I could optimize my time.
I have no desire for HR or my management to see that information and I fully see where others having that data is ripe for abuse, but for my own sake if I totally control the data, it's useful.
How cute :) Organization don't get it. Microsoft get it all for itself :> More data for the ads ! And not only that.
All that experience or even code done by MS for China scoring system must be enforced on the rest of Earth population !
Not to mention typical metrics stupidity: lines of code, keypresses, count of videocalls ?
Such thing is just proof to not use that online-desktop apps. Or straight outlaw them.
But managers will love it ! Just today news: Google spies on emploeyes before firing them - no more "spying" necessary, everything will be in the "data" ! :>
> The company is also changing its branding around the feature to make clear that the “productivity” that is being scored is that of organisations, not individuals
OK, I was wrong when I wrote my prediction that the only thing they are going to do is to change the name of the feature (made in the previous comment in my comment history).
I'm impressed with their response to this. The promptness and decisiveness suggests the issue was something which fell through the gaps rather than an intentional strategy.
Ummmm... who do I send my list to?
Also Microsoft: Oopsie! Our bad.
Windows 10 is an annoyance.
Examples:
- periodic, mandatory paid leave
- "no emails after 6pm" policies
- anonymous surveys to identify managers who create burnout
- hiring the right number of people
- effective planning
Every “anonymous” workplace survey I’ve ever done has always had a unique URL with a GUID embedded and a warning not to forward the email to anyone.