I assume that my keystrokes are always being monitored on a company device. Obviously I'd prefer to not be monitored, but I don't really have an expectation of privacy at work on a work device.
We give full admin rights to laptop owners and don’t install spyware. I would be sad if a coworker acted as if their keystrokes were being recorded; thinking that would surely slow them down and make them more careful about pursuing all promising research paths. So I think it’s important for companies that don’t spy to signal that they don’t; the opportunity cost outweighs the marginal security benefit.
In a lot of places, in case of severe signal, like computer reaching out to know malware C&C servers, the computer is taken by IT and investigated - does it really have malware? How did it get on PC? Did it propagate?
This sometimes involves digging through browser cache and history.
So even if you not recorded all the time, you should be prepared that your computer will be taken away from you at any moment and browser history examined. Such is the life in a big company.
We are much smaller and still larger than the median company size in the US: https://www.naics.com/business-lists/counts-by-company-size/
Huh? I've worked at multiple companies that all do very broad device monitoring (it's fairly standard at all large companies) and I don't think I've ever heard anyone express any concern like this. I've certainly never felt this way myself. What "promising research paths" are you talking about? Do your google searches at work frequently involve porn or something?
I get big scary corporate “You’re not allowed to go there!” and get the feeling that there’s now somehow some black marks on my invisible permanent record, because I wanted to read something about Zig or something.
I know I’m not going to be fired for something like that. What I don’t know is if some higher up just looks at some roll-up without digging or understanding, the kind of scenario that could come up in something like, for example, layoffs.
Definitely has a chilling effect for me personally.
If I want to look up example of string operations in C I might Google "c strings" or "c strings examples". Incidentally, in similar fashion to G-strings, a C-string is a type of lingerie.
If I'm doing quick graphics adjustments I don't want to bother the art department with I might use the fantastic GNU Image Manipulation Program and do a search for "gimp tricks" or "gimp tutorials". Incidentally, as anyone who's seen "Pulp Fiction" might know, a gimp is a type of BDSM gear. Definitely not savory for work.
This is why, much as I'm concerned about personalized searches, it's kind of non-negotiable for me that to function as a professional software engineer I should be logged-in to my Google account. It's the only way I can be sure not to get results from, say, Victoria's Secret.
Over here, when a company would do that and use it against me, I would sue them for privacy breach. Employee rights are very well protected in western Europe.
Use a VPN, that way if you good off on your phone during the day at least they can only see how many bytes you're using and when
Queries to sensitive DB endpoints are what you want to keep an eye on.
In practice, companies only have humans look at IT use if there's a security problem or a performance problem.