Bossware is a big legal risk
kolide.com
kolide.com
Not everyone is able to say "no" to all this and still make rent next month. I'm happy the government is finally stepping in.
Can you elaborate with examples or references?
https://www.nytimes.com/2019/08/13/books/review-kochland-sec...
More good news is that since workplace surveillance is already heavily-limited by law in some other highly-productive developed-economy states, this shit’s all probably pointless anyway. Just one of many cases of execs going full “seeing like a state” and wanting everything down to the finest detail to be “legible” and able to sort-by on a spreadsheet, even when it’s actually just noise.
It sounds insane, but believable for the US (but that might be my bias showing, I've always heard bad things about worker's rights in the US).
(presumably someone will be along to say that this is the EU destroying businesses by not allowing them 100% power over the lives of their employees)
That may not have been legal, but it was certainly happening.
I noped the hell out of there without even having spent a week working for them. The fact that they even accepted those kind of jobs told me our sense of ethics was way too different, and I didn't want to contribute to that. If it were "just" web tracking, then I would be able to (barely) accept it, if a bit reluctantly. But that's more or less where I draw the line.
I still haven't found a job since then, and I'm currently barely surviving through freelance gigs. Professionally speaking, leaving that job might have been a mistake; but I still think it was the correct decision.
I know if I don't do it someone else will so it doesn't really make a difference - but at least I can retain some sense that I'm not the kind of person who does bad things, and that's worth something.
With web tracking you can at least be 'careless' in your implementation and 'accidentally' make it not work very well because most of the time nobody will ever test it properly. No way to get away with that with this "Bossware" stuff, it'll be in active use all the time.
Hope you find something better soon.
And users can normally install tracking blockers, either in browser or DNS-based (in your home's router), to at least prevent some thirdparty stuff from loading, so that's some defense against it.
Of course it's not always possible. But the chances that a user can do something against a web service tracking them are still better when compared to an employer's in-device tracking.
I completely agree with making sure things work as much as possible and look OK when stuff like that is blocked and even when JS is disabled.
Analytics can be useful and ads are a necessary evil for the prevalent web business model. Tracking is, ugh, I guess in theory acceptable with informed consent - though I've tested a couple of those "consent frameworks" that popped up after GDPR etc and even ignoring the dark UI patterns let's just say they didn't stand up well to scrutiny regarding doing what they say they do.
Nah it wasn't my intention to give that kind of impression[0]. I was just trying to add to the part I quoted from your comment (also the keywords from my first comment (not the one with the quote) were "barely" and "reluctantly").
It's not that I think it's okay, but I probably should have used the word "tolerate"[1] instead of "accept".
So basically I agree with you. I wouldn't work on something like GFW[2], or ad[3]/gambling/porn/blockchain/dating companies, or "VPN" services (in the diluted sense of the word), or Discord, or smart TVs, or software for IoT, stuff like that.
But I also know that if I want to get a remote job, I'll have to compromise somewhere.
---
[0]: Mic and cam recordings can be trivially circumvented by anyone who knows how to turn on a computer, for example, but even if I have permission/access to them, I won't touch those things unless it's to do something the end user wants to do.
[1]: There's probably a word that better captures the nuance tho. English is not my first language.
[2]: Or anything from countries who don't even try to appear like they follow the GDPR.
[3]: Where the ads are the product/service being sold. Or in other words, if a company uses adsense it's a maybe-work-for-them-but-try-to-find-something-else; if the company is adsense, it's a straight no.
I recently struggled with this. My situation was likely different given the outcome. I was able to prevail on both the sense of decency in the client and their marketing firm by explaining the PII ramifications of what they asked for, and was also able to prevail on how their customers would perceive it.
Not everyone has the luxury of clients and marketing agencies like that. I wasn’t sure whether or not I did until I tried it. I can’t know for sure until it’s needed whether I would have simply refused. I really wrestled with the idea of not doing my level best work as a technical implementer.
I found Kevin Burke’s “Ethics” to be a really great way of working [1]. He based it on an earlier piece by Kyle Kingsbury [2].
For me it's just right to reject every potential company installing bossware alone for your personal health. People burn out under constant monitoring forced to be 100% productive all day. Have a bad day? Sad for you, it lowers your numbers. Sick leave instead? "Oh what a weak person, how unreliable". People with utilizing computers to effectively slave-drive people should be held responsible for the damage they cause. They should pay for the treatment if they drive people into depressions and burnout and neither health insurances or the society.
I also outright refused to work on a project for the RIAA at one time as well.
1. WTF is anyone doing using their personal belongings for their work? Cleanly and clearly demarcating personal and professional is CYA 101, for both employee and employer.
2. WTF is the employer doing if they don't provide all necessary tooling for the job prescribed?
3. WTF are you doing working for above employer? I sympathize not everyone can do so, but the only way such bullshit will change is if enough of the workforce says "nope" and quits for greener pastures.
...this is exactly what the parent comment is talking about. People take these jobs because you need money to live and not everyone has the luxury of being able to turn down jobs with shitty conditions. Employers take advantage of this and do things like require their employees to use their personal belongings.
1. WTF is anyone doing using their personal belongings for their work? Cleanly and clearly demarcating personal and professional is CYA 101, for both employee and employer.
2. WTF is the employer doing if they don't provide all necessary tooling for the job prescribed?
Because then they don't have to spend any company money.
The real evil are companies that require you to use a phone for 2 factor authentication and assert that they have the right to examine your phone because you use it for work purposes.
(Not necessarily directed at parent, but anyone who is unsure or worried about this.)
As a small player, I'm always afraid of this. Two of my companies died because of legal stuff that was outside the economics I could front.
"remove management"
Doesnt that sound great? Cheaper, less subjective.
And sure, its cheaper to let Asia do it. They don't have the regulations. Get in-line and work for the established players!
I've worked in factories and seen the degree to which productivity is an issue. I actually lobbied for us to use the time tracking that was already available to us via our ERP, and management declined. Humans are lazy by default. We seek the highest return on our effort. Building great things (i.e. making life better) requires us to fight this instinct.
Additionally, I have seen absurd abuse of WFH/remote since COVID among co-workers. There have been instances where I truly cannot wrap my head around someone seeing it as anything but theft. I don't particularly like being monitored either, but I definitely understand the motivation for monitoring or RTO initiatives.
I don’t see how someone can read the various articles about how closely workers are monitored in warehouses these days and be this defensive about the surveillance practices. Do you work for a tech company that uses a lot of warehouses? ;)
https://natlawreview.com/article/nlrb-general-counsel-issues...
2nd paragraph of GP's link.
> Abruzzo’s memo cites things like wearable devices for warehouse workers
6th paragraph of OP article.
I don't think the commenter meant literal ankle bracelets. But I think that's a bit pointless. I don't think it's okay whether it is a literal ankle bracelet, or some BLE tag in their badge. Do you think some option is okay?
Yes, definitely. The distinction between a supervisor watching their employee vs. cameras + CV vs. using wearables to automate the watching seems completely arbitrary to me. Are you OK with a cab company monitoring its cars via GPS? Or a trucking company monitoring its loads via tracker? I am, and again, I find the distinction arbitrary. With one caveat–the employee is informed prior to employment that these tools will be used and they are a requirement of employment.
I'd be pretty weirded out by constant camera and CV monitoring too
> Are you OK with a cab company monitoring its cars via GPS? Or a trucking company monitoring its loads via tracker?
Those are (a) not monitoring a person and (b) much more coarse than "what shelf is this person standing in front of". They tell the company that the cab driver parked, not that the cab driver took exactly 3 minutes and 33 seconds in the restroom.
I suppose my biggest concern with it is that it's measuring the wrong thing. If someone's doing as much as their coworkers even though they leaned on a shelf for 5 minutes yesterday, is that really a problem?
By comparison monitoring a car with GPS has legitimate purposes that actually advance the interests of the business.
Aha! The true use case for Neuralink - bossware installed in your brain, for knowledge workers.
"They can't monitor me because I spent my morning mentor Alan the Junior at his desk" - that may be so but it won't stop them from trying, and the lag from deploying bad business intiatives to realising they're bad can be months or years in the making.
Why are you happy from taking learning process and responsibility from individuals? With regulation of sick mindset you potentially keep alive edited form of it.
Instead employees should really refuse to be part of those illegal activity and let company die naturally. This learn both sides.
About 6 months ago I was interviewing with InterSystems, a company that does healthcare software. Only when I signed in for the online coding interview did I learn that they required I have a webcam on myself the whole time.
I don't like using coarse language. But it was the first time I struggled to not use the phrase "fuck you" in my email to the recruiter.
If the former, their fears are not unfounded: Sometimes the person who impressed you in the interview is not actually the same person who arrives for their first day of work. There are also less-audacious forms of interview cheating, where an off-screen cyber-Cyrano is supplying them with answers and/or keyboard-input.
That said, I agree that any workplace with a "webcam on at all times for monitoring" policy for employees is one I would leave ASAP. Not just because it's hostile and offensive, but also because it's indicative of the company doing badly while management is busy "rearranging deck-chairs on the Titanic."
That's the problem.
Granted, I've seen tech employee contracts that do include that wording, but it hasn't been in any of the pre-employment paperwork like NDA, etc., in my experience.
Legally? Probably yes. Practically? Fuck no.
I don't care what they're going to do with it. They aint having it.
I've interviewed hundreds of people since COVID / interviews going online. I'm not aware that it's been a problem for a single candidate, I don't even think we say it explicitly.
But there still is a line like if I am doing take home assignment I will not install spyware on my personal computer.
We can have a zoom/teams call with a person where I share screen if someone wants that with enabled camera as well during coding or for discussion.
Agreed, if they want to lend me a computer for the exercise, that's another matter. :p
It's been a while since I last interviewed in earnest, but my recollection is that those situations (fortunately) correspond with companies that I probably wouldn't want to work for anyway.
I would rather clean toilets with dignity than be bitch-whipped into programming for such psychopathic entities.
If a company can't think of a single way to ensure the person who interviews is actually the person who comes to work the first day (hint, there was a time when webcams did not exist), then that company is probably also inclined to inflict lazy, intrusive surveillance-based schemes on employees after they're hired.
If the work is fully remote, then does it really even matter? If you hire Person A to provide certain business results, but he actually contracts it out to Person B who does all the work, yet the expected business results are provided, then do you actually care?
Seems like it's great signal of how the company thinks, and will behave.
Not necessarily that they'll put all employees under video surveillance, but if they think that interview thing is a good idea, I'd guess probably they'll do numerous other things along the same line of thinking.
Occam's Razor possibilities:
1. The company is normally very enlightened and thoughtful and fair, and has a very subtle and nuanced rationale for why they're coming across as invasive and overbearing in this one narrow instance, and their reasons in this bad first-impressions instance (when they should be thinking about first impressions) were simply somehow not explained.
2. The company is going to behave like a jerk.
The part that would have made me walk away would have been if the video was being recorded and retained, as opposed to merely being watched live.
Trust runs both ways.
LLM’s are fucking terrible at this for anything nontrivial.
They seem pretty solid in my experience, in fact, if they shine at anything it's expository blobs of text.
> LLM’s are fucking terrible at this for anything nontrivial.
Amusingly, one of the common pieces of advice to limit hallucinations is to ask the LLM to walk through the reasoning.
That is, unless companies are lying about how much damage bad hiring does. I don't suspect they are, but they apparently can't also do the math to go back to that option.
Edit: Maybe a library? Most around me have rooms for working in groups.
I imagine there are people who want a remote position who don’t want to travel but at that point <shrug>.
Fake interviewees are pretty rampant. We’re getting to the point where presenting yourself in-person to a government representative, agency or a private attestation company will be part of the onboarding process. At this point it looks like it’ll be iris scans.
In the US it’s even an issue in-person with H1B’s where they get interviewed and hired online, then someone else shows up.
Also the fact that insider threats are almost never budgeted for, and so many companies blanket-approve access to systems like logging systems, customer support systems, source code, etc - means attackers don’t even need to get hired into a very important role to get the data they want.
someone else shows up ? what is the denominator
This may be a reasonable gamble, as many companies do probably not expect such a rochade, and do not have detective measures in place. And if that doesn't work, you still have 3 months time to find another job in an environment that favored job seekers at this time.
[1] https://expatrist.com/losing-a-job-in-germany-with-eu-blue-c...
Oh god no, a piece of not-that-secret information which can't be revoked when eventually leaked.
"This is a courtesy alert that your iris scan has been found on the darkweb..."
Either way, I think this is one of those "if it was used properly, people won't like the limitations, so they'll use it improperly" situations. Kind of like with social security numbers.
"Welcome to Acme Bank. To prove you are the owner of this bank-account, please supply your full name and street address. *ding* Authentication successful! Please choose an amount to transfer."
At best, biometrics can only replace usernames. In other words, information that is quasi-public and not expected to be easily changeable... With the additional problem that sometimes it changes all on its own.
They'd need to get more than one job per pay period for that to be more lucrative than just doing one of the jobs they were approved for.
Also the money would be split between the scammers.
That sounds like more work than actually doing a normal job, but I guess it may be more automatable.
I don't know though, interview processes can be very tedious.
If one is eligible to do the job in the first place
Most are formulaic bullshit.
You can coach someone to pass them in a few weeks, that's what the bootcamp phenomena is about.
Use a short take-home test for coding stuff, and then do a live interview where you do roleplay and situational questions that make it really easy to tell if someone has actually done this stuff as a job, or is just reciting answers they memorized.
Can they help me out? Apparently, those scammers have figured out a way to convince companies they are real applicants, yet somehow I, a real applicant, apparently cannot do the same.
Last I saw even the cheapest of Android phones had some form of “selfie” front facing camera.
Rise of the dumbphones!
Except for one. This place that seemed to have a reasonable use case. They dealt with very sensitive legal cases involving children, and they wanted an audit trail to ensure sensitive media was handled according to their policy.
Work is me trading my time for money, and I can begrudgingly accept some level of monitoring. That's after all what a boss is - they supervise aka monitor.
However the blurrying of boundaries really irks me. This is part of the reason why I carry two phones, refuse to use remote desktops from personal devices and definitely don't connect personal devices to corporate wifi. Similarly that aggressive invasive student exam monitoring software in use makes me thankful I studied in more classic times.
I have been told in at least two interviews that a condition of my employment is that i have a relatively recent Android phone.
Fun fact: That aggressive invasive student exam monitoring software is a YC W'21 company: https://www.ycombinator.com/companies/autoproctor
All knowledge workers (at least) are going to end up with real Bossware, in the form of a an AI chatbot boss.
Of course they will be called AI assistants, co-workers, collaborators, secretaries, etc, but while they will most likely be able to help complete complex tasks in a variety of industries, it's absolutely certain that they will be able to 'help' with todo lists and scheduling.
So, after conversing with your personalized AI to create a new sales report or whatever, the AI is going to helpfully remind you that you have a meeting in 20 minutes, and that's just enough time to squeeze in the product inventory report, if we go for it.
And then at the end of the day/week/month, the AI will 'helpfully' assess your performance and recommend corrective measures.
And make recommendations about you to your human bosses too, of course.
We have some ridiculous timeout on our work machines that triggers the screensaver after 2 minutes of idle time (we can’t change this).
After it’s triggered, you need to enter your password to unlock (company mandated, 10 chars minimum, no repeating chars, at least 1 upper and 1 lower case char, at least 1 special symbol, change every 90 days, can't be too similar to last 10(!) passwords).
Okay, this is annoying. So, for the longest time, I used an open source mouse jiggler app (basically simulated cursor movement).
This worked fine until a recent software update. I wondered why my screen saver was being triggered again. Oh, the mouse jiggler isn’t running! Let’s open it up.
A big dialog box appears on the screen: “THIS APPLICATION VIOLATES COMPANY POLICY AND ITS USAGE HAS BEEN REPORTED.”
Oh… cool.
I went on Amazon and ordered some $5 hardware mouse jiggler dongle. That worked for about a month or so.
Then suddenly, I started getting CrowdStrike notifications: “Functions of a USB device were restricted according to company policy.”
Fun times!
It’s only a matter of time until Zoom starts sending reports of whether I had the window in focus or not during meetings with management.
(This is going to make me embark on a weekend project to use an Arduino, some servos and a 3D printed finger to move my trackball.)
The trick that I heard is to just place the mouse on a clock. The second hand jiggles the mouse every minute. Can be stashed away in a drawer or something. Never tried this though.
If you were really smart you would lobby your IT department to change the ridiculously short timeout, and protest by not working when it locks on you during normal pauses.
Look, I get why some of these policies are in place -- a bunch of it stems from locking down our systems and protecting critical data due to various Sarbanes-Oxley requirements. Plus, sometimes smart people do dumb things, and it leads to bad things (e.g, see the LinkedIn incident) [1].
But man, oh man, is it annoying! Especially if I'm in my own home, with no one around, and I otherwise get my work done.
Of course it's a balance, but think of the wasted productivity from a 2 minute timeout with stupid password requirements like that. That incurs a cost.
I bet they also have many other wonderful ideas and overly-bureaucratic processes that are strangling efficiency and preventing innovation.
I am, generally, very sceptical of corporate surveillance stuff, and think that it should be largely banned. But this particular case isn't surveillance, it's security.
Back then, they hadn't really gotten going with all the monitoring stuff, but I did it from a sense of personal integrity.
I was writing open-source stuff, and there was no way that I was going to allow my company to try to claim it. I didn't use company time, and I didn't use company equipment.
I did not have a "shower clause" in my employment contract, so I was free to work on my own stuff, on my own time.
However, I worked at a company that employed a ton of photographers, and there is no way that they would be able to get photographers to sign over that kind of authority to the company.
That said, I was there for almost 27 years, and a lot could change, in that time.
By the time I left, their HR was starting to get downright rapacious, so newer employees might have had to sign over those kinds of rights.
Do you have admin rights, including to the firmware? Can you, and did you setup from scratch the device that you received from the from the employer? If not, then it is almost 100% there is surveillance. If they let you do all the setup, then maybe 50%.
Just isolate any box your employer touches, both physically and in the network sense, separate visible and sound space as possible, separate WiFi network, etc..
C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A}
[1] https://kb.teramind.co/en/articles/8791095-how-to-verify-if-...
Welcome to America.
Privacy issues.
Security issues.
Employee trust issues.
https://wideangle.co/blog/the-rise-of-bossware-and-threat-to...
I limit what types of work apps I'll install on my personal phone, and try to limit personal usage of work devices.
I am trying to figure out what exactly is the problem people have though: you're literally on a company asset, being paid by the company, you've signed copyright away, you're aware their is no expectation of privacy. Use your cell phone or your home computer for home business, work during company hours, doesn't seem like that big of a deal.
=== EDIT: Re: Comments about about webcams, and nowhere in my comments did I say anything about cameras. Read both the article and my comments before attacking straw men.
What is it that you don't want seen by a company representative, on a company computer, while being paid by the company?
Same idea, and maybe you wouldn’t mind but surely you can see why many people would.
FWIW enough people do mind that this kind of thing is illegal in some countries.
Can you answer this directly: How many people's computers, servers, and backups should video of my child be on?
"seen"
If I do a google search for "cake toppers for lesbian wedding" while my code's compiling, that's morally fine. But if a bored "company representative" decides to take offense to that, now it's a whole goddamn situation that I have to deal with.
Or if I'm on Stack Overflow to copy&paste, and one of the "Hot Network Questions" in the sidebar has an "offensive" phrase in it, is it going to trip their automated flagging criteria?
Maybe you'll sue for it. Maybe all those activity logs become part of the evidence. Maybe there are other people who got fired under similar circumstances, and you form a class action... After all, who can say that the company isn't engaging in illegal discriminatory behavior based on those logs, simply because the logs were conveniently available and detailed?
Lots of big potential problems here for everyone.
The attitude of some employers is very poor.
I haven't seen this implemented for developer workstations; generally BYOD is forbidden for computers. I have seen this implemented for cellphones. If you want to use a personal cellphone for work, you have to install their MDM app and the device becomes, in effect, the company's cellphone.
There are also issues beyond those. What about employers that require you to install software on your person phone so you can access MFA or work email? Some of that software requires you to sign all rights away from your personal phone and there's a risk you may have all your data deleted on your personal phone when you leave the company.
If you have a telephone on your desk, it is illegal for your employer to secretly listen into those calls. However, if you send an email, you employer has every right to secretly read them.
The only difference is, emails don’t exist in the 30s, but telephones did.
So, we according to the article, we are not only talking about screenshots and access to the computer's contents. I will accept a charitable interpretation that you are comfortable with a subset of bossware, but the article was talking about a wider swath.
- They got acquired by 1Password
- They've pivoted away from a managed osquery product.