Get your staff's consent before you monitor them, tech inquiry warns
theregister.com
theregister.com
To go even further - the physical hardware we provide to our employees is no longer enrolled into IT policies. If someone uses the actual work machine to play counterstrike, we literally don't care about this anymore. It wouldn't show up on any report.
We seriously don't give a shit if someone is listening to music, having Netflix playing, etc. The only thing that matters is the work product at the end of the day. Some people are incredibly productive while listening to death metal at reference volume. Others are not. Who are we to judge?
Even though we have access to deep digital forensics on our employee's virtual desktops, we would only ever use them if there were some criminal or civil proceedings brought forth.
If you feel like you have to use the digital panopticon to micromanage your tech/knowledge employees, you are potentially a really shitty manager.
Incidentally, I feel the same way about kids bringing laptops home from school.
Clearly GP's firm doesn't run a webcam and microphone capture on the thin client. They could potentially monitor audio/video I/O from the cloud workstation that the thin client logs into.
While I'm sure there are exceptions, thinking about the IT departments I've worked with in the past and how cost-conscious they were, the last thing any of them would want to do is waste the time and money to record non-work related employee conversations at their home.
My HP laptop needs to have the back panel removed. If I do that, it'll trip the intrusion sensor and wipe the TPM. IT can know about this and ask you why you're taking apart the laptop. If it's windows, and you don't have the BitLocker key, you won't even be able to turn it back on.
>Put it in a drawer. This isn’t rocket science. Yup
And who says that it would be the IT department that would want this capability, instead of, say the employee's manager?
There is thankfully a physical cutoff switch for the microphone whenever the laptop lid is closed in case I need to have a private conversation and ensure that there's no employee-provided microphones nearby.
Due to browser security standards, every time you access your work desktop via web, a warning pops up asking if you want to provide camera/audio/location services.
You can decline to consent and there won't be any problems, other than Teams won't be able to use your webcam/audio for a meeting.
How to treat a hostile device in your home network is the same as home automation - isolate it.
- Separate vlaned network that can’t see anything on your home network. Separate SSID.
Don’t like the microphone? Find an adapter that mutes it.
- Create a separate vlan and SSID that can’t see anything on your network. The ideal way to do this is configure a travel router behind your regular router. Then extra nat hop is worth it.
- Bonus points for a vpn at home that your travel router can connect to, making your work setup a little more mobile.
Employers have bigger things to worry about than some minor employee’s bickering with their family. I think you can safely worry about bigger things.
However, these examples don’t seem to have anything to do with spying on your private life, i.e. outside typical work hours.
I still surf HN and listen to questionable and obscure genres of metal while I code. If they ever complain I'll explain that is what I need to get my work done.
I have two jobs currently - one is regular 40h/wk salaried day job, another is part-time, nights and weekends, hourly pay. I only need to work 15-18 hours a week at the part-time one to exceed my full-time pay, but the part-time one is:
- Windows
- internet routed through a hardware appliance that I'm sure logs every bit and packet
- forced to run an invasive full-system virus/malware scan on start-up and at 5AM every morning (takes 4-4.5 hours) forcing me to leave the thing runnings for days or weeks at a time and preventing any early morning work
- random things that were fine for years suddenly blocked, e.g. spotify/youtube
- I will occasionally get emails from IT asking why I have a random application installed, what it does, and why it's "operationally necessary"
- Once had trouble working during an active malware scan so did non-sensitive but time critical work on a personal machine and got an email the next day why I was clocked in when the computer was off
- Not windows
- VPN is off by default and IT makes a conscious effort to move things *off* of VPN instead of the opposite
- No tracking of any sort
- We literally play Steam games for work events sometimes so it has Steam installed
> - I will occasionally get emails from IT asking why I have a random application installed, what it does, and why it's "operationally necessary"
The issue is that policies have to be fairly general and can't just count on all employees actually knowing what they're doing. And sometimes people actually do shady things, even if it's not intentional. And if IT is understanding, then I think it's OK.
The other day, there was a story on the HN front page [0] about some innocuous looking app that got bought and converted to some kind of shady proxy. If I was responsible for my company's staff machines, I sure as hell wouldn't want that kind of crap running on them.
What's to say that your random app won't be siphoning up ~\Documents\top_secret.doc?
They don't actually. This is why roles exist.
In my company's case, they do have roles. The "accountant" role has like 60 people. They're all doing mostly the same thing, so it wouldn't make sense to have 60 accountant1..60 roles.
It can also work as a deterrent. If you know you're going to have to fill out a form, maybe you won't download random stuff unless you actually need it.
I don't appreciate the deterrent culture because it's hard to get to point A to point B without some exploration if the company isn't used to trying to improve how work is done, or improve its thinking. The opportunity cost of preventing bright people from exploring is enormous. I understand, though, that compliance and uniformity are high priorities in some industries. (My experience with this kind of IT comes from aerospace and finance.)
The issue being that, of course, this exploration may end up badly. See all the supply chain issues which have made it to the HN front page. So some guardrails should absolutely be in place.
I don't know how practical that would be, but I keep thinking we (IT people and adjacent) should possibly have two computers. An "untrusted" one, on which we'd be free to tinker, test new things, etc. No issue with nuking it if anything goes wrong. No access to "important" data or networks. And another, "trusted" one, from which you'd do your admin work, deploy to prod, etc.
No one gets the benefit of the doubt, and certainly not programmers. You get more leeway with what we'll allow, but not free reign. Most programmers aren't HN level.
Oh boy, the self importance here is hilarious
There’s also a reading of that response where they mean “HN level” like “as confident as the replied-to comment author”. Could even be a bit sarcastic.
Someone with the attitude of “it’s my job [to not mess up]” will mess up subtly, try to fix the problem, and not mention it to IT.
As annoying as IT can be, one of those options is a lot better for operational security.
Generally “programmer” type folks are only power users in the context of software, possibly even only the software they wrote or tooling they chose.
Nope.
Engineers and programmers are the most-likely source of "I know what I'm doing so I can run it this way" and you end up with things like NFS running on systems that haven't been bounced in over 300 days and can't be updated because someone used sudo to break yum.
No one gets admin unless they explicitly need it. Period. Because while you may actually know what you're doing, most programmers haven't the slightest inkling about safe computing practices, based on experience.
Every instance I've encountered with an engineer having root/admin permissions has been a shitshow.
I just now encountered an instance of engineers bypassing policy by modifying sudoers to give a lower priv'd generic/shared account passwordless sudo to shit like /usr/bin/make.
The other project I was on, I had to fight with engineers about why having a firewall on your appliance doesn't negate the need to address code execution exploits behind the firewall. These aren't security-savy individuals and they shouldn't ever be given administrative access to anything.
I'm glad you don't work for me, too; I can't stand leadership positions. I work in security and all I see are engineers fucking up daily, so I'm pretty jaded/biased at this point.
Maybe its just me, but hasn't Microsoft antrivirus thingy gotten really _really_ heavy recently?
Back in the days you would barely notice it, but nowadays it will take over 1-2 cores and make sure the damn fan is always spinning.
To me, the important thing to protect on a computer are the user's files. Instead of regularly scanning everything and comparing to known bad signatures and grinding the machine to a halt, why not limit what the apps can do?
If it's hard to prevent users from downloading totally_not_shady_app.exe, just make sure that it can't access anything anyway. That may still allow it to mine bitcoin, but at least it won't leak sensitive data. Or better yet: most users aren't devs. Just don't execute anything from the users' home folder. This probably won't help with all the attacks on Office by macros and whatnot, but it'd be a start.
I wish it was more popular, but as soon as it was announced blogs like verge and Engadget started a crusade against it and more or less killed it off
I know not everyone is in position to pick and choose between jobs, but frequently you can improve your "it situation" a lot if you raise it during recruitment.
I recently started working for a (large) company that gave me a Linux laptop(I wfh 100%), 99% of their staff uses windows. It uses cisco vpn and a simple script to block all traffic if the vpn is off (once vpn is on, local traffic is allowed). The machine runs a rhel based distro, all public repos are disabled and "the it" maintains only approved packages. Interestingly, I can use sudo, but I have to write justification for every use. There is full disk encryption, but I'm no aware of any "activity monitoring" other than outgoing internet traffic.
Prior to this, the company I worked for gave me a windows laptop. I had Admin rights on it too.
During my recent search for new work I spoke with a company that seemed a great fit. Until they told me they log hours worked by tracking keyboard/mouse/recording screen use. "for client accounting reasons". To my objection that if a client agrees certain job is worth 4h to them, who cares if I do it in 1h they said they have to use this model. I declined to work with them and I got a different offer. I'd hate to have a job where I'm incentivised to work slower not faster.
* GSD: get shit done (because I literally can't be arsed if you watch Netflix, play TOTK, or whatever so long as clients are happy and you are satisfied with your work)
Check out Windows 365 Enterprise. We have it configured for multiple regions in order to minimize latency. One AD security group per US state. Then, we set up an intune provisioning profile per region to map them through.
You can push custom images or take the default 10/11 builds. It seems to be working out really well for us. I run a heavy VS2022 workload all day and have no issues (4vCPU, 16gb, 128gb). Build times are definitely slower than my 32 core battleship, but that's to be expected.
I just checked my RTT stats in MS endpoint management and I am seeing ~18ms between my desktop and the actual desktop. The worst case we have right now is S Florida to N Virginia (US East) @ ~60ms, but they are adding a new region soon so hopefully we will have every employee well under 50ms over time.
"Not only are you fired, the 400gb of futa hentai you downloaded is our property"
Yeah you say that and I believe you just like I believed Sergey, Larry and don't be evil.
Don't collect it at all. Collecting anything private is like having to handle toxic waste. Just don't. You can't control it, you can't guarantee security and you don't know what could happen if you're bought out etc etc. You just can't possibly trust all possible future managers about which you know nothing.
Just say no.
Having rigid boundaries encourages this separation, and I don't mean overly strict IT policies. I think you can easily allow people to listen to their music apps and watch netflix, without opening the floodgates for games that require kernel level anticheat.
IT policies should be as simple as possible, even an app whitelist coupled with preconfigured browser is plenty. You wouldn't even need to monitor them at all this way.
The higher up the management chain you go, the lower your visibility into developer productivity. It is natural that executives and owners should want that visibility, it's just that it's too fuzzy -- it can't be had with the kind of resolution that they want. Hence we have all these faddish metrics that get gamed and never end up being useful.
We should have empathy for management's need to know even if we don't think they can really get a clear picture.
What to do? Two things:
- Manage better. Companies need managers who can get a good sense for their direct reports' abilities, skills, and productivity. And those managers need to have good BS detectors too. And managers need these skills up and down the management chain.
- Look for outcomes. Teams and employees that never deliver enough value should be looked at with some care -- maybe they are, but the value they deliver is not very visible, or maybe they're expert bullshitters.
Regarding outcomes, long delivery delays need to be investigated because one of the many problems we have as an industry is in estimating time and effort needed to deliver. This happens for reasons, but mainly that software development is harder than we tend to think.
(Also, investigate your software development lifecycles. Maybe your change management schemes are wasteful and delay-inducing.)
I say software development is hard, but I think management is probably much harder. The business school metrics fads that lead managers astray don't help.
I'd like to think it's not controversial but I'm surprised at how often it seems to be overlooked for workplace romances as well.
I'm trying to follow the thread, are you saying that people who don't want to have every mouse click tracked or their private home network, outside the work VPN searched, are behaving in an entitled manor?
It’s not about entitlement, justice or any of that. This is capitalism.
It is about raw power and pragmatism and what one can get away with. When the employee has the upper hand as in a hot market, they have some wiggle room. When the employer has the upper hand, the landscape shifts accordingly.
Unions are unpopular in our industry, but are typically how employees in most sectors have increased their power.
Employer cartels and the state are how employers increase theirs.
Adam Smith covered it all about 250 years ago in the Wealth of Nations, a fantastic read if you can stomach the archaic writing style.
I would be much more likely to agree with you if the employer came out and said "here's the new policy, it's being implemented in 6 months. On this date 6 months in the future, you need to sign this form or you're out." That gives you time to make other arrangements, get independent review of the policy, whatever you want.
Like how an employee accounts for 1/n of an employer's work capacity (where n can often be large), but an employer typically accounts for 100% of an employee's income.
Or how an employer can often delay completing whatever task a particular employee was doing with minimal consequences, but if an employee skips paying rent or other bills then they can get stuck with late fees that are a non-trivial fraction of the actual bills, which they already have trouble paying. And you can't skip buying food for a month and make it up next month.
Or how the need to pay for food and rent means that even employers that are widely known to be terrible can often find new employees to take up the slack from somewhere no matter what their turnover rate, but employees who have any kind of negative reputation, or are seen to move jobs "too quickly", can find it hard to find employment again.
I find "Work is a bilateral voluntary arrangement" where "No one is under duress" to be an overly-reductive-to-the-point-of-naiveté position.
> Like how an employee accounts for 1/n of an employer's work capacity (where n can often be large), but an employer typically accounts for 100% of an employee's income.
The employer needs 100% of that employee's work, or they wouldn't pay for it. Conversely to your point, the employer may very much struggle to replace an employee, and an employee may have various other employers to choose from.
Of course there are jobs where this is less the case, and there are jobs where this is more the case. I'm not assuming that all jobs are like this, but I don't think we should be assuming zero (or vanishingly few) jobs are like this.
If that were the case, employers would go bankrupt, or at least descend into chaos, whenever anyone took a sick day.
> the employer may very much struggle to replace an employee, and an employee may have various other employers to choose from. [...] but I don't think we should be assuming zero (or vanishingly few) jobs are like this.
OK, then; if not vanishingly few, how many? Out of the roughly 130 million full-time jobs in America, do you want to give a ballpark figure for what percentage of those jobs you think an employer will struggle to cover or get by without in the immediate term, and replace within (say) four-to-six weeks, and would suffer significant effects on their business if that employee disappeared tomorrow?
You can't offer a salary below minimum wage even if both parties agree. You can't have people work hours above a certain limit even if both parties agree. And (at least in EU) in the exact same manner you can't have take-it-or-leave monitoring of all employees even if both parties agree.
Such monitoring may be permissible with genuine 'freely given consent' if it was given without any expectation of terminating the relation or any other adverse consequences or differential treatment. If you say "I'll give you $100 if you consent", the employee can agree, but that doesn't count as valid consent or binding contract and doesn't permit you to do the thing with that employee's data, privacy rights aren't for sale even if people would want to sell them. And you might get consent from some of the employees, but IMHO there isn't (and shouldn't) be any EU-legal way to ensure that you get consent from everyone, because if you do, that's a good sign that's not "valid consent" as defined by EU law, that it wasn't freely given but conditional or coerced.
A good analogy for how consent and privacy is handled in Europe (not in USA though) IMHO is like consent to sexual acts; if in an otherwise identical situation consent given in that manner wouldn't be appropriate to violate someones asshole, chances are that consent wouldn't be valid also for violating their privacy; If part of employment contract or company policies says "I consent to my manager arbitrarily monitoring me" it is about as legally binding as it saying "I consent to my manager arbitrarily fucking me", i.e. just empty words.
Yes - illegal things are illegal, of course. I can pay someone $1 to kill someone as a freely arrived at agreement, but that's illegal. What I was saying is orthoganal to legality. It's about whether or not the employer-employee relationship is 100% coercive.
E.g. PriceWaterhouseCoopers was fined for unlawful handling employee data despite having having the employees "agree" to it (https://www.lexology.com/library/detail.aspx?g=9a315cca-bc71...), and the "consent" being in the employee handbook effectively was an additional violation "PwC had processed the personal data in an unfair and transparent manner, by giving the false impression that it was relying on consent".
For resolving such issues, quoting that article, "the EDPB/ICO guidelines stipulate that in an employment context, consent cannot be given freely as there is most likely an imbalance of power between the employer and the employee".
It could be that in some particular scenario the relationship wasn't coercive at all and the consent is valid, but it would be up to the employer to demonstrate that, and if somehow 100% of employees consented to monitoring, it could be very, very difficult for the employer to demonstrate that no "motivation" (positive or negative) was involved and everyone really just loves being monitored as a pure coincidence.
True equality in any relationship between different humans is almost impossible. There are always differences where one person has more privilege or advantages than the other, and that includes hierarchy, but it also may be caste, religion, race, gender, sexual orientation, etc. It cannot be avoided that sometimes two people need to engage in a consent agreement and both of them are not considered "equals". Yet it's still important, perhaps more so, to seek that consent, and respect the denial of it. We shouldn't discount that consent agreement just because the two have an uneven power dynamic, because that will always be there.
If on the other hand, an employee has a specific case and evidence for why they are being intimidated, a judge and jury could decide if the extenuating circumstances warrant nullifying a consent agreement. That's basically how things like sexual assault cases are handled. The same logic would apply to business consent agreements.
The real difficulty is evidence. Always keep evidence of your treatment at work. Tell other people, send emails, confirm details after calls that you can't legally record.
It may be different if it's gathered during the hiring process. The earlier, the more likely it is to make a difference.
But just to point it out: on many countries employers do not need consent, often they just need acknowledgement. That one they can get, by doing exactly the things that are on the article.
A quick search also yielded this:
https://commission.europa.eu/law/law-topic/data-protection/r...
The next day, he was fired and I was brought into a room and basically interrogated. They asked me if I intentionally crashed their monitoring software (which I didn't, I just was curious about what was running on his computer).
Come to find out, they were monitoring all of us all the time. I suspected this was the case a few months earlier because one of my managers started randomly bringing up topics I had in a private AIM (aol instant messenger) conversation.
That day, they told our entire team we were being monitored and we had to sign a consent form or be fired. I signed it and promptly started looking for work during my lunch hour the next day (I would drive a few miles away and use my laptop in my car).
I left two months later. This was all about 6 months before the 2008 downturn and the company I left was in the loan business. I would have most likely gotten laid off in the cuts.
Although I guess it's because they're talking about companies, not the government itself.
And British people will accept it like they accept every kick to the balls by government or big business.
Employer: Employee, you must consent to monitoring.
Employee: What if I don't?
Employer: We will fire you.'You come back or we find someone else to do the job.'
What is interesting is that those same people no longer add 'your job will be outsourced'.
Employee: But what about my health insurance?
Employer: Better not make us fire youPutting it in your employee handbook means acknowledging (in writing) that you have an illegal, prohibited policy, and getting employees to agree to it doesn't make it permitted.
Here's my signature.
The Data Protection Act does allow for monitoring without consent, but only where that monitoring is specific and limited to an absolutely necessary purpose that overrides the rights of the data subject: for example, the detection and prevention of crime, the protection of life or limb, or the fulfilment of a legal obligation. For any other purpose, consent must be given; for that consent to be valid, it must be fully informed, freely given and freely revocable. Where consent is relied upon as the basis for data processing, the burden of proof is upon the data processor to demonstrate that the consent was legitimately given.
That's assuming the employee is even aware that they're being monitored in the first place.
It will become a standard cause in employment contracts that people will be "free" to negotiate, just like everyone "negotiates" their employment contracts now.
It’s like expecting the phone company not to log every key press on the pay telephone boxes they have set up.
I assume everything my work computer can monitor is being monitored. If I want privacy, I use a personal device.
The outrage seems to mostly be about computer system monitoring but it’s bizarre to me as I’ve also always assumed all my computer activity at an employer device is 100% monitored. Why would it not be? especially this has always been done for security reasons.
There have been numerous tests and offices and computers have been noted to not have an expectation of privacy, even keyloggers.
Id like to see a case where people take their work laptop into the toilet and employers record business and see how the courts decide that.
And mainly, as an employer I need all the info on your computer, it’s valuable. And there’s not a way to filter out what’s weard_beard’s family messaging them vs work stuff. So I just keep it all.
Of course I don’t do that because I don’t employ people, but that seems rational if I did.
So what I do, individually, is I have a phone. It belongs to me. If I want to check my bank balance, I use my phone. If I want to receive messages about my family’s health, I get them on my phone.
Even if my employer promised never to monitor my work computer, and they kept their promise, I wouldn’t want my kids’ school messaging me on my work email or my work phone.
No one needs to check their bank balance on their work computer to be happy and productive. Nor do they need to get texts from friends and family on their work phone.
But everyone needs money. And everyone needs bathroom breaks.
For me, it’s about reasonable vs unreasonable.
I think it would be odd if an employer actually banned bank web sites. But it would also be odd if an employee didn’t want their computer logged in the off chance they checked their bank balance. Or wanted the employer to buy some method of not storing personal data while storing business data.
I mean, my employer is regulated and must store all documents, email, and web traffic I send or receive. I wouldn’t expect them to try to distinguish what’s personal and not store it. Is that even possible?
Laws are reflections of attitudes. People in the US believe that they have limited right to privacy at work and so laws are written to reflect that belief. People in the UK don’t buy into that theory and so laws are written that are more nuanced. The first step to gain rights is to believe in them.
No one tell this guy about the shit home owners have to deal with. Once you decide to give other people access to anything you own you are held to a completely different set of standards than for things you keep locked in your closet at home.
in countries that have strong protection for renters, the owner does not even have the right to enter the property without express permission from the persons living there and any kind of surveillance is out of the question.
People who rent a home are legally entitled to privacy and the home owner can’t put cameras up and monitor them unless the resident permits it.
But if I own a home and live there I can put cameras up wherever I want. And if you come into my home, you don’t have a reasonable expectation of privacy standing on my front porch. But if it’s different if you’re in the bathroom of my home because you expect privacy there.
Of course “reasonable” varies and states vary. But, in the US, the courts have ruled that at work you should pretty much zero expectation of privacy except in a few exceptions like bathrooms and lactation rooms and clinics and stuff.
[0] https://www.findlaw.com/injury/torts-and-personal-injuries/w...
Device ownership can change what's considered a legitimate interest. For example if you set up a pay telephone box you can implement monitoring of keypresses to prevent fraud. But you can't just record whatever you want without justification, and you can only store the data as long as your justification requires and use it only for that purpose. Everything above that requires consent.
I have no responsibility outside my job duties. The company goes folds? Goes into massive debt? I do not lose sleep or stress in the slightest.
There is no power imbalance in my mind. There is no whip or debt to the company to pay off.
Acquiring this mindset took one bad boss when they altered our agreement and I quit that moment without looking back. I had no job lined up yet knew my skills were valuable.
I mean, that's great for you. But for millions of people, their health and wellness is directly tied into making money this very month (and possibly getting health insurance for them and/or their family), and losing their employer because they fuck up directly interfere with that, and will make their life a living hell until they can find a new job, which isn't always easy with the various constraints people have in their life.
Life is wide, really really wide, and it's a shitty experience for large swaths of the population.
So if the existence of an imbalance implies non-consent/coercion, can there ever be consent?
A lot of companies have some really nutty stuff in their employee handbooks. One of my previous employers had a "professional appearance in public at all times" provision. Even when you weren't on the clock, you were expected to dress in a suit, not drink alcohol (even in restaurants), and several other things I don't remember, because "a client could see you".
Places like that are likely chomping at the bit to get tracking software installed on your personal computer.
However, in the EU, where the GDPR was written, consent must be freely given (which means that it must also be possible not to consent without negative consequences). Especially for employees, the prevailing opinion is that employees cannot give consent freely in most circumstances (https://commission.europa.eu/law/law-topic/data-protection/r...)
I'm surprised to see a recommendation to gather consent in this context.
(BTW: the report itself is hidden behind a link fairly far down in the article: https://committees.parliament.uk/publications/41099/document...)
As always, it really leans heavily on why people are recorded and how that data is used.
That you can't use GDPR to e.g. delete random company data just because you are somehow associated to it is only logical, but I would not really count that as "GDPR not applying in full". That was understandably never the intent of the law, and it is detailed enough to avoid silly scenarios.
Can you point me to any? IMHO it does not have any explicit clauses mentioning more lax conditions for consent in case of employment relationships, and there have been multiple cases of GDPR enforcement re-asserting that anything that you require from all employees doesn't count as consent. An employer might assert a "legitimate need" basis for processing (in which case you need to only inform the employee, not their consent), but that is inherently limited and there have been large fines assessed for employees trying to push constant monitoring with this justification; the employer has a duty to minimize the invasiveness of achieving that legitimate need (e.g. surveillance for theft prevention can monitor only places relevant for that, and doesn't permit using the same videos for any other purpose e.g. measuring employee activity).
The software we found, the "features" are abhorrent in my opinion - the screen recording was what we purchased for, and we disabled everything else.
Thing is, we've discussed this with the specific employee involved and shown them exactly what we can see, and exactly what we can't see. Informed them that only I can see the data and will only use it when that specific problem is reported.
Watching seems to have reduced the incidence of the error, it was happening once or twice every 3 weeks, but it's not happened within the past 7 weeks at all.
It's "saved" us about 5k so far, so I can see why it's attractive.
I'm really curious about what they were doing now, and why they would blame it on system error.
The employee works at a branch office that used to have a really good connection but now has an awful 50/12 adsl link.
They connect to our remote desktop server to our accounting software - create a proof of delivery that is printed via the triplicator to their local mfp machine which can take a moment to actually print.
When we moved from the 100mbps mpls link to the crap adsl there were some issues with printing the delivery notes, which we had to work around, but this is now recorded in people's memories as an ongoing issue - which it's not.
So, the issue is they believe they've processed the delivery notes and printed them, but they never appear. We can prove they've not been processed or printed due to database entries and logs, but the employee is adamant she's done them, and she's a great employee bar this one thing so hr and her manager don't push back.
Aside from normal union activities, they have a very active interest in employee surveillance and are looking at how to fight it. Go and join, before you end up wishing you had done it sooner.
I had a collegue recently tell me how he was monitoring employees and 1 of the staff was working from home, but in reality watching porn all day.
Despite an HR derpartment, for some reason they required him to be the one who fired the person. Bizarre... infosec people should never be firing people. They did it because he ought to have known what he was doing was illegal.
So long as you make your meetings during “regular business hours” and produce agreed upon outputs then who cares if the contributor is fishing half the day. Their ambitious peers will take on more work if they being underutilized and when it comes time to distribute merit increases and promotions it is obvious who earned it.
Manage outputs and distribution of labor and build your metrics around this instead of trying to determine if someone looks busy.
This seems different than watching day to day work. I understand that if the company is suspicious an employee is doing something that’s an fireable offense then they need tools to take action.
The concept of probable cause as a requisite for more-invasive monitoring is foreign to most people.
Nobody cares about your personal business. Just don't do dumb stuff like watching porn at work, email company data to your personal account. Or sit watching Netflix all day.
Meh. I know a bunch of people who like having the TV or the radio on in the background. They're not actually listening to it, but they say they like the feeling of not being alone.
My mom does that when working around the kitchen. She'll have some news channel or similar on. She'll hear the same bulletins 10 times a day. And when in the evening something comes up at the dinner table, she'll have no recollection of ever having heard about it.
Your work antivirus probably keeps records of every file opened and saved for example, every URL visited, every password entered, etc. Thats pretty invasive monitoring.
Yet that information is only used to determine if you have accidentally fallen for a phishing attack or accidentally installed malware on your machine. It isn't the employee who is the target of the monitoring, but the possible evildo-er they might be letting into the corporate network acting under the employees credentials.