Employers who use software to take screenshots of workers’ computers(wsj.com)
wsj.com
Employers who use software to take screenshots of workers’ computers
https://www.wsj.com/articles/youre-working-from-home-but-your-company-is-still-watching-you-11587202201
127 comments
Conversely, those employers can’t hire top-tier people. The ones they do hire probably don’t have the FU money to walk away from spyware like this. So they live with it instead.
This is truer in a recession. And the effect can justify calls to unionize.
This is truer in a recession. And the effect can justify calls to unionize.
if only i could be top tier talent, and my employer would let me do only the work i am explicitly given.
when an individual task is complete, there is always someone that could use help, or an idea to document, or one of a million things you want the 'top tier' to be involved in.
there is an infinite amount of work to be done. seriously. 40 hours a week is a way to meter it.
monitoring it, not very effective or valuable. weigh the contribution people make, not the hours they put in. but 40 hours a week is the expected amount of work focus today.
when an individual task is complete, there is always someone that could use help, or an idea to document, or one of a million things you want the 'top tier' to be involved in.
there is an infinite amount of work to be done. seriously. 40 hours a week is a way to meter it.
monitoring it, not very effective or valuable. weigh the contribution people make, not the hours they put in. but 40 hours a week is the expected amount of work focus today.
Most people don't have this luxury
As a company owner, I've resisted the temptation to do this. We did make it easy for our employees to behave themselves by making it very easy to 'clock in' and 'clock out.'
I told everybody that this is a time to be close to family - if your child wants to play ball in the middle of the day, then go ahead! Just clock out before you do. Get your 8 hours in and document your work.
Thankfully everybody has responded well - I have one employee than needs me to randomly call them to keep then honest, but he's a good guy and I think is struggling with a bit of depression. He likes to be called and he likes our chats.
I told everybody that this is a time to be close to family - if your child wants to play ball in the middle of the day, then go ahead! Just clock out before you do. Get your 8 hours in and document your work.
Thankfully everybody has responded well - I have one employee than needs me to randomly call them to keep then honest, but he's a good guy and I think is struggling with a bit of depression. He likes to be called and he likes our chats.
Why is it tied to time, instead of deliverables? I mean, if I work extra hard to get the days work done in 4 hours, why can’t I leave early compared to a co-worker who is working less focused and more slowly?
I get that it’s not easy to set good milestones, and to keep it fair in terms of making sure everyone has approximately equal work, but I feel the same problems exist with required work “time” especially since it doesn’t encourage working more efficiently, effectively or smarter, because you gotta get those 8 hours in regardless.
Unless they’re contractors/consultants who bill by the hour, of course.
I get that it’s not easy to set good milestones, and to keep it fair in terms of making sure everyone has approximately equal work, but I feel the same problems exist with required work “time” especially since it doesn’t encourage working more efficiently, effectively or smarter, because you gotta get those 8 hours in regardless.
Unless they’re contractors/consultants who bill by the hour, of course.
I worked for a startup where the founder/CEO mandated 40 hours of work a week, no more or less.
He would always say “I want you to work your ass off while you’re here but I also don’t want you taking this home with you. The company is paying you for forty hours of your time a week.”
The expectation, which everyone seemed to find fair enough, was that if you didn’t have enough to fill 40 hours that you find other projects to help with or tinker with new ideas.
Honestly it was a great culture and they had a sizable acquisition exit so I guess it worked even as the company got north of 600ish employees by the time they were bought.
Was everyone honest about it? No of course not, but enough were that people bought in.
He would always say “I want you to work your ass off while you’re here but I also don’t want you taking this home with you. The company is paying you for forty hours of your time a week.”
The expectation, which everyone seemed to find fair enough, was that if you didn’t have enough to fill 40 hours that you find other projects to help with or tinker with new ideas.
Honestly it was a great culture and they had a sizable acquisition exit so I guess it worked even as the company got north of 600ish employees by the time they were bought.
Was everyone honest about it? No of course not, but enough were that people bought in.
There is no incentive to find ways to accomplish more or better other than personal drive then, though (and personal drive eventually wears thin on its own, imho). If you have to work 40 hours, even if you get everything done early (in which case you gotta take the next task from the list, a never ending grind -- when do you get to celebrate a job well done?), even if you're head isn't in it (maybe you're not feeling well, or have something else going on, or are just bored, or have a day of mental block), you gotta get your hours in. Even if you have some very focused productive days and get everything done in record time, you gotta get your hours in.
I think I often push work without realizing it, but I feel that often I'm done around 16.00 or before lunch.
If I know I have to be there anyways, I might as well goof off a little.
If no-one cared about the hours but I just had hard deliverables every day/week/month, I'd work much faster so I can go home earlier.
Depends on the project, too. Some I'm more interested in than others.
If I know I have to be there anyways, I might as well goof off a little.
If no-one cared about the hours but I just had hard deliverables every day/week/month, I'd work much faster so I can go home earlier.
Depends on the project, too. Some I'm more interested in than others.
Yeah. I’d also add that goofing off isn’t ok, in the sense that it’s time that’s wasted typically on unimportant time wasters while if you could get off early you could use that time for something useful, like spending it with family or on exercise or a hobby. But you can’t do those things because you’re still technically on the clock, so spend the time on HN or twitter or whatever instead, not helping yourself or your employer.
+1. Outside hourly contractors, if you have a clear sense of what impact/outcome you're seeking, time of day or number of hours shouldn't matter. Often I suspect it's a proxy for NOT having a clear idea of the desired outcomes. Removing a requirement for "8 hours a day" can even be a good forcing function to ensure you DO have a clear and well-communicated set of goals and outcomes. Indexing on time (IMHO) can also have unwanted side effects like people just filling in the time "because they have to", which is pointless for everyone involved.
Consider the practice of "work to rule".
https://en.wikipedia.org/wiki/Work-to-rule
Precisely defining what at employee is to do is not really practical. At some point it's always going to be "do what I mean, not what I say."
https://en.wikipedia.org/wiki/Work-to-rule
Precisely defining what at employee is to do is not really practical. At some point it's always going to be "do what I mean, not what I say."
I limit our employees work to 40 hours a week so we don't have burn out. I want people to work hard and then go home.
So far, so good: Our employees are constantly coming up with better ways of doing things - with less stress, hassle, and annoyance. Over the last three years, our works has gone from suffering 40 hours to an enjoyable but hard-working 40 hours. Our retention rate has gone from 40% to 95%.
So far, so good: Our employees are constantly coming up with better ways of doing things - with less stress, hassle, and annoyance. Over the last three years, our works has gone from suffering 40 hours to an enjoyable but hard-working 40 hours. Our retention rate has gone from 40% to 95%.
I need to be explicit - it's timed to both time and deliverables. 40 hours of productive work - productivity is defines and delivering value to the customer. The customer can be internal.
We don't work overtime and only one person is on call (wait time is paid at time and a half) on Saturday.
We don't work overtime and only one person is on call (wait time is paid at time and a half) on Saturday.
I need to be explicit - it's to both time and deliverables. 40 hours of productive work - productivity is defines and delivering value to the customer. The customer can be internal.
We don't work overtime and only one person is on call (wait time is paid at time and a half) on Saturday.
We don't work overtime and only one person is on call (wait time is paid at time and a half) on Saturday.
This didn't answer the question
Whether this benefits the employee or employer more is very case-specific. Without any rules, even productive people are tempted to work longer hours. They may feel guilty about not being more productive, since this has more to do with emotional state than a realistic idea of how your work compares with others.
Setting limits on how long people work could have a better impact in terms of work-life balance than being able to quit early once in a while.
Setting limits on how long people work could have a better impact in terms of work-life balance than being able to quit early once in a while.
Work and hard work.
We all know it's easy to "work" as in get "stuff done" but "hard work" is the basis of our economy. Part of the problem is the notion of hardness, a dimensionless constant on the Moh scale which you can look up elsewhere. Difficulty, as in the complexity of thought required to predict a system, is another matter altogether. We should speak instead of power, the ability to perform work quickly.
I know a few powerful thinkers. Give them a problem and they'll return an appreciation quickly. An answer will follow, and more thereafter, until things settle, and they can share their understanding.
One of the most useful techniques in this regard is contextualisation, whereby we physically, perhaps synesthaestically, abstract ourselves from our abstractions by being with, and learning from, each other. Think of children and think of Alan Kay.
Children put in all their time to being children. When we're employed we're employed as adults. Eight hours of work is equivalent to eight hours of cooking and cleaning, or playing and teaching, of exploring and learning. When we pay each other to be adults we maintain all the rest of society.
Paid by hour or minute we're best off working as autonomous heroes for the greater good.
I love hacker news, smart people share politely. I can show my Mother on occasion. But Hacker News is still just a bit of a cuter slashdot with pretentions of lambdatheultimate and a healthy dash of shtetloptimised, downed with a bit of whatever you're having yourself.
We all know it's easy to "work" as in get "stuff done" but "hard work" is the basis of our economy. Part of the problem is the notion of hardness, a dimensionless constant on the Moh scale which you can look up elsewhere. Difficulty, as in the complexity of thought required to predict a system, is another matter altogether. We should speak instead of power, the ability to perform work quickly.
I know a few powerful thinkers. Give them a problem and they'll return an appreciation quickly. An answer will follow, and more thereafter, until things settle, and they can share their understanding.
One of the most useful techniques in this regard is contextualisation, whereby we physically, perhaps synesthaestically, abstract ourselves from our abstractions by being with, and learning from, each other. Think of children and think of Alan Kay.
Children put in all their time to being children. When we're employed we're employed as adults. Eight hours of work is equivalent to eight hours of cooking and cleaning, or playing and teaching, of exploring and learning. When we pay each other to be adults we maintain all the rest of society.
Paid by hour or minute we're best off working as autonomous heroes for the greater good.
I love hacker news, smart people share politely. I can show my Mother on occasion. But Hacker News is still just a bit of a cuter slashdot with pretentions of lambdatheultimate and a healthy dash of shtetloptimised, downed with a bit of whatever you're having yourself.
> Unless they’re contractors/consultants who bill by the hour, of course.
Unless an 8 hour day of work was part of the agreement of the job.
There's no more to it than that. You signed up for an 8 hour work day. An emergency situation in which you work from home isn't going to change that.
Otherwise, why would you peg your performance to the lowest common denominator.
Unless an 8 hour day of work was part of the agreement of the job.
There's no more to it than that. You signed up for an 8 hour work day. An emergency situation in which you work from home isn't going to change that.
Otherwise, why would you peg your performance to the lowest common denominator.
> Why is it tied to time, instead of deliverables?
Once you make a deliverable the metric, work interaction and innovation suffers.
Say Bob finishes assigned Task-A in six hours. However Alice is struggling with her Task-B and could do with some of Bob's Java expertise. But in a deliverable-driven environment, Bob's done and clocks out. See ya Alice!
Or Alice is waiting for an informal reply from Trent, but Trent's reply is not a manager-assigned deliverable so he doesn't bother responding. He wants to press ahead and get Task-C finished so that he can clock out.
Instead of focusing on deliverables, most employers therefore focus on 'time dwelling' in the hope that people will interact and share the work burden.
Once you make a deliverable the metric, work interaction and innovation suffers.
Say Bob finishes assigned Task-A in six hours. However Alice is struggling with her Task-B and could do with some of Bob's Java expertise. But in a deliverable-driven environment, Bob's done and clocks out. See ya Alice!
Or Alice is waiting for an informal reply from Trent, but Trent's reply is not a manager-assigned deliverable so he doesn't bother responding. He wants to press ahead and get Task-C finished so that he can clock out.
Instead of focusing on deliverables, most employers therefore focus on 'time dwelling' in the hope that people will interact and share the work burden.
You generally don't hire people who are twice as capable as the existing team by accident. Tech companies invest enormously in sourcing, selecting, and closing people like that. They want to see a return. If you're just going to calibrate your performance to the median, they could have spent less time and money hiring someone cheaper and less talented
I guess I'd understand if the company were not trying to "innovate" or "raise the bar" or anything, just fulfill some mundane requirements at the lowest cost, and paid accordingly.
I guess I'd understand if the company were not trying to "innovate" or "raise the bar" or anything, just fulfill some mundane requirements at the lowest cost, and paid accordingly.
Quite possibly the work is time base, not delivery based. Eg. A call center employees might need to be on-call (time) even if there are no active calls (deliverables).
That's a fair point and certainly a reasonable reason to mandate hours. Thanks for pointing it out.
employees are billed by the hour. that's how employment is defined in most countries. it's a payment for about 40 hours of work per week.
one of the key points of employment is that i get s reliable salary regardless of my performance. sure, if my performance is continuously very bad then my employer may want to make an adjustment (or let me go) and likewise if my performance is good i may expect a raise.
in general that stability of income is more important than the ability to go home earlier. because the latter means that i have to work more if things don't go well because deliverables are often hard to define. in IT at least. what do you count? lines of code? number of issues closed?
one week i may close a dozen issues, the next week a single task may have stumped me, requiring me to do days of research.
deliverables reslly only work on a large scale: "finish this project" or for a sysadmin: "keep the servers running". my customer or employer doesn't care how many hours i spend on that. if there are no problems then i am free, or i may get a bonus for closing a project early.
one of the key points of employment is that i get s reliable salary regardless of my performance. sure, if my performance is continuously very bad then my employer may want to make an adjustment (or let me go) and likewise if my performance is good i may expect a raise.
in general that stability of income is more important than the ability to go home earlier. because the latter means that i have to work more if things don't go well because deliverables are often hard to define. in IT at least. what do you count? lines of code? number of issues closed?
one week i may close a dozen issues, the next week a single task may have stumped me, requiring me to do days of research.
deliverables reslly only work on a large scale: "finish this project" or for a sysadmin: "keep the servers running". my customer or employer doesn't care how many hours i spend on that. if there are no problems then i am free, or i may get a bonus for closing a project early.
Most of the jobs with well-defined deliverables that can be completed in a few hours are pretty tedious, and they are the sort of job whose workers are most easily exploited with sweatshop tactics and in the gig economy.
Some companies also have to bill their customers by the hour. For example certain government contracts, grants and even private contracting are paid out based on hours worked.
Good to hear that you care about your employees and understand that he likes the chats.
Generally, IMO, you shouldn't be hiring people and then checking up on them and their hours to keep them honest. There's better uses of time. That time spent tracking and keeping them honest doesn't really improve you, them or the company.
Generally, IMO, you shouldn't be hiring people and then checking up on them and their hours to keep them honest. There's better uses of time. That time spent tracking and keeping them honest doesn't really improve you, them or the company.
You're right - I shouldn't have to do it. But he's a good guy, and I'm happy to invest the time to see him through this difficult time. I couldn't sustain it if all my employees were like that, but right now it's a small burden to help someone that seems to need it.
Generally yes. But if he has adhd then far away timelines may be less useful than focusing on weekly deliverables. Could very well be a win-win. Good job parent!
Actually clocking in seems a fairly outdated method for tech workers. I certainly wouldn‘t want to work in an environment where the manager has such a low view of trust on the people he employs.
As a salaried employee I find it insulting, demeaning, and even distracting when I'm forced to record hours, not even mentioning what being spied on would do to me (thankfully I've never had to deal with the latter situation). Gladly, my current workplace doesn't have any such procedures. My previous one was fairly stringent on hour-recording even when working at the office.
I am not a child nor an inmate, and can therefore be trusted not to try and game the system to do as little work as I can possibly get away with. I shoot for eight hours. If things go past nine hours without a specific source of pressing urgency, I don't feel uncomfortable asserting my work-life balance. If I really get into the zone and have a super-productive day I don't feel uncomfortable logging off after seven hours.
Whereas if I'm on a clock, I'm watching the clock, constantly. I have trouble entering a deep-work headspace. I feel guilty and second-guess myself every time I stand up for a minute. I'll subconsciously space out at my desk more often because "I'm putting in the hours".
Everybody's different, I just wanted to add a data point. I'm somewhat ADD and if I'm forced to be either completely on and tracking the minutes or completely off, instead of jumping back and forth like I naturally do, my productivity tanks.
I am not a child nor an inmate, and can therefore be trusted not to try and game the system to do as little work as I can possibly get away with. I shoot for eight hours. If things go past nine hours without a specific source of pressing urgency, I don't feel uncomfortable asserting my work-life balance. If I really get into the zone and have a super-productive day I don't feel uncomfortable logging off after seven hours.
Whereas if I'm on a clock, I'm watching the clock, constantly. I have trouble entering a deep-work headspace. I feel guilty and second-guess myself every time I stand up for a minute. I'll subconsciously space out at my desk more often because "I'm putting in the hours".
Everybody's different, I just wanted to add a data point. I'm somewhat ADD and if I'm forced to be either completely on and tracking the minutes or completely off, instead of jumping back and forth like I naturally do, my productivity tanks.
Not sure what your line of business is or what your employees do, but when working with teams of devs, the day is made up out of focused work, small tech meetings and maybe a bigger meeting. Remote or local makes little difference with us here. Outside those, which need to be more or less synchronised, the rest are deliverables. Some days I am done in 2 hours or I just am unproductive (slept badly, cannot be arsed, nothing works anymore after a minor react native update, whatever the reason); some days code is flowing and I stand behind my desk 17 hours (like today). My colleagues are like that as well, at least by far most of them. With your regime, I would be frustrated on both occasions.
I do not understand (and that does not mean you are wrong; maybe there is no wrong or I am) how anyone conflates hours with productivity; you want me to do tasks a1-a10 this week; why is it relevant if I do those Thursday night in 16 hours or 40 hours spread over the week? As long as they get done and done well right? I cannot think which type of work would not work like that but cannot think of any so how is it related to ‘hours behind the screen’? I have tried these things in the past as well with my colleagues over the years and the ‘bums on seats’ only invites people to work slower (to fill the time and not have to do more work) which in turn indeed invites the use of spyware to see if they are working.
Now we have tasks; if some superhuman does them in 5 minutes instead of 40 hours; glory to her. Obviously that does not happen, but 30 vs 40 does sometimes and that is fine with me; stuff gets delivered, people are happy. I also have a few guys who get nothing done one week and over-perform the next; as long as I know that, it is fine. Weekly sprints are overrated anyway imho.
I do not understand (and that does not mean you are wrong; maybe there is no wrong or I am) how anyone conflates hours with productivity; you want me to do tasks a1-a10 this week; why is it relevant if I do those Thursday night in 16 hours or 40 hours spread over the week? As long as they get done and done well right? I cannot think which type of work would not work like that but cannot think of any so how is it related to ‘hours behind the screen’? I have tried these things in the past as well with my colleagues over the years and the ‘bums on seats’ only invites people to work slower (to fill the time and not have to do more work) which in turn indeed invites the use of spyware to see if they are working.
Now we have tasks; if some superhuman does them in 5 minutes instead of 40 hours; glory to her. Obviously that does not happen, but 30 vs 40 does sometimes and that is fine with me; stuff gets delivered, people are happy. I also have a few guys who get nothing done one week and over-perform the next; as long as I know that, it is fine. Weekly sprints are overrated anyway imho.
So you would rather have someone who works 8h and timestamps their time, but performs worse than someone else who achieves the same or more in less time but doesn't document every minute they spend not working in a shift?
Respect to your actions. Valuable lesson to others. You should put it somewhere online as part of sane remote work guide.
Just one minor thing, if your employees are salaried, it's worth finding out what the actual rules are for clocking time. If hourly, then you've already got it figured out.
Congratulations?
A lot of people are saying "not news worthy," but I think this is a far more useful article than the majority of articles posted here:
- It's applicable to most people on this site
- It's actionable: be conscious of what you use your company-issued computer for
I'm convinced that most people aren't aware that this is a common practice. I've talked to people who think it's not possible or that their company doesn't do it. On the flip side, I've worked with enough IT departments to know that most of them have the capability, even if they're not actively using it.
If your computer has any sort of remote management software on it (typically used for pushing mandatory updates), IT can probably also surreptitiously access your filesystem or observe your screen.
- It's applicable to most people on this site
- It's actionable: be conscious of what you use your company-issued computer for
I'm convinced that most people aren't aware that this is a common practice. I've talked to people who think it's not possible or that their company doesn't do it. On the flip side, I've worked with enough IT departments to know that most of them have the capability, even if they're not actively using it.
If your computer has any sort of remote management software on it (typically used for pushing mandatory updates), IT can probably also surreptitiously access your filesystem or observe your screen.
What I wonder is the best way to determine whether this is going on and if so what it is doing exactly (or in broad terms)
If it's on a computer built for you by work / owned by work, all bets are off. Even if they're not taking screenshots, they can be logging keystrokes or web traffic or anything.
If it's on a device you own:
- Do not install software from your employer that requires admin permissions (i.e., requires typing your password).
- If you're on recent versions of Windows or macOS, various powerful actions like taking screenshots are restricted by default and should at least trigger a permission prompt. You can go to Settings or System Preferences and see which apps have been given permission. If you can, try to install apps only from the OS's app store (because those apps are sandboxed more tightly than traditional desktop apps) or apps from reputable publishers (e.g., it's fine to install Word or Photoshop or whatever, but don't install MyCompany Productivity Helper For Employees).
- Try to get work to give you a corporate device, or a way to work via a web browser or via remote-desktop to a computer on your desk in the closed office or something (and make sure that way doesn't involve installing custom software...).
- If you have to install custom apps, make a separate non-admin user account and don't type your admin password when you're logged into it. Then your company can watch your company work but not your personal stuff.
- If you're installing on a mobile OS, installing apps is generally fine but be very careful about installing a mobile device management (MDM) profile. When you install one, you'll be prompted about what sort of access you're giving your company; make sure you're comfortable with it.
BTW, the same goes for schools - for instance, if your school wants you to install some sort of app for taking remote exams, the purpose of the app is almost certainly to intentionally take screenshots so they know you're not looking at Wikipedia. See if you can install it in a non-admin account, or if your school is issuing laptops, use that (and don't use that laptop for personal stuff).
(Shameless plug: a friend and I run a personal security newsletter and we talked about this a bit last issue: https://looseleafsecurity.com/episodes/newsletter-2020-04-05... and we also have a guide to checking up on MDM on your phone: https://looseleafsecurity.com/episodes/newsletter-2019-12-07...)
If it's on a device you own:
- Do not install software from your employer that requires admin permissions (i.e., requires typing your password).
- If you're on recent versions of Windows or macOS, various powerful actions like taking screenshots are restricted by default and should at least trigger a permission prompt. You can go to Settings or System Preferences and see which apps have been given permission. If you can, try to install apps only from the OS's app store (because those apps are sandboxed more tightly than traditional desktop apps) or apps from reputable publishers (e.g., it's fine to install Word or Photoshop or whatever, but don't install MyCompany Productivity Helper For Employees).
- Try to get work to give you a corporate device, or a way to work via a web browser or via remote-desktop to a computer on your desk in the closed office or something (and make sure that way doesn't involve installing custom software...).
- If you have to install custom apps, make a separate non-admin user account and don't type your admin password when you're logged into it. Then your company can watch your company work but not your personal stuff.
- If you're installing on a mobile OS, installing apps is generally fine but be very careful about installing a mobile device management (MDM) profile. When you install one, you'll be prompted about what sort of access you're giving your company; make sure you're comfortable with it.
BTW, the same goes for schools - for instance, if your school wants you to install some sort of app for taking remote exams, the purpose of the app is almost certainly to intentionally take screenshots so they know you're not looking at Wikipedia. See if you can install it in a non-admin account, or if your school is issuing laptops, use that (and don't use that laptop for personal stuff).
(Shameless plug: a friend and I run a personal security newsletter and we talked about this a bit last issue: https://looseleafsecurity.com/episodes/newsletter-2020-04-05... and we also have a guide to checking up on MDM on your phone: https://looseleafsecurity.com/episodes/newsletter-2019-12-07...)
In germany, this would be highly illegal though. (screenshots, keystrokes)
Thank you very much for the detailed answer.
[deleted]
This makes me really glad that our company policy thus far has been giving employees new machines and have them set them up themselves. I know my work laptop has no spyware because I didn't install any.
And you installed no internal apps at all? How did you get on the corporate Wi-Fi? How do you send print jobs to the office printer?
It's quite rare for company-owned macs to be completely unmanaged. Usually the installation method for common corporate utilities is an MDM solution like Jamf (Self Service), which also transmits logs - for example how long each app was in the foreground[1] and what times you're using your computer[2].
1. http://archive.today/tfYtO
2. http://archive.today/MkBKE
It's quite rare for company-owned macs to be completely unmanaged. Usually the installation method for common corporate utilities is an MDM solution like Jamf (Self Service), which also transmits logs - for example how long each app was in the foreground[1] and what times you're using your computer[2].
1. http://archive.today/tfYtO
2. http://archive.today/MkBKE
I have work at multiple start ups, many of which I have been with as a grown from 5 to 500 people. A few have gone public
None of them do any sort of monitoring like this.
At some of them, I have lead the security team. and others, I have been in charge of IT.
Even at the ones where its not my job to handle that, I am supremely confident that we use no such software.
Beyond the policy problems that it would cause (private keys and customer data could be viewed, requiring very broad access roles), it would also be next to impossible to implement from a technological standpoint.
At every company that I've worked at in the last 12 years, engineers have had the ability to wipe their machine and reinstall.
In most cases, they have the ability to swap out hard drives and other components, Bring them to Apple stores for repair, etc.
No one that I know of users custom VPN software, or closed source Cisco stuff anymore.
I think you are dramatically overestimating how common this sort of thing is.
None of them do any sort of monitoring like this.
At some of them, I have lead the security team. and others, I have been in charge of IT.
Even at the ones where its not my job to handle that, I am supremely confident that we use no such software.
Beyond the policy problems that it would cause (private keys and customer data could be viewed, requiring very broad access roles), it would also be next to impossible to implement from a technological standpoint.
At every company that I've worked at in the last 12 years, engineers have had the ability to wipe their machine and reinstall.
In most cases, they have the ability to swap out hard drives and other components, Bring them to Apple stores for repair, etc.
No one that I know of users custom VPN software, or closed source Cisco stuff anymore.
I think you are dramatically overestimating how common this sort of thing is.
Startups don't do the whole Enterprise Active Directory managed desktop computers thing. These days, users can run whatever they want and everything is done using cloud apps. Onboarding is handing people a shrink-wrapped MacBook and sending an invite to GSuite to their personal email. After that, everything's managed using SSO.
I installed Norton, which I uninstalled a year or two later when my manager finally got sick and tired of it blocking connections it shouldn't have and uninstalled it.
And I got on the company Wi-Fi with a password. Still do.
And I got on the company Wi-Fi with a password. Still do.
I guessed my company's admin password and erased their partition.
If I get laid off (they're cutting 20% of the workforce next week), then I consider the computer my severance pay.
If they press the issue, they can come to my house and collect the machine. But I'll lick every part of it before I hand it over.
Childish? Oh, heck yeah. But when I see my own company screwing over its employees and customers to protect the CEO's pay (none of the C-levels took a cut), I just don't care.
If I get laid off (they're cutting 20% of the workforce next week), then I consider the computer my severance pay.
If they press the issue, they can come to my house and collect the machine. But I'll lick every part of it before I hand it over.
Childish? Oh, heck yeah. But when I see my own company screwing over its employees and customers to protect the CEO's pay (none of the C-levels took a cut), I just don't care.
I would seriously reconsider this. They won't come to collect it, they will simply file a police report and the police will show up at your home. Depending on the laptop, where you live, your record, this could end up as a felony, and will certainly hinder your future employment.
I know its tempting and it's likely your only recourse but it won't work out for you in the end.
I know its tempting and it's likely your only recourse but it won't work out for you in the end.
I wouldn’t so much consider this childish, as I would consider it criminal. You may feel justified in doing it, but don’t fool yourself: this would be theft.
This [1] is a good read on what you can expect as remote work becomes widespread in a competitive job market.
[1] https://www.buzzfeednews.com/article/carolineodonovan/upwork...
[1] https://www.buzzfeednews.com/article/carolineodonovan/upwork...
This seems pretty easy to game for a software engineer:
1. Write code for the project and record mouse clicks and keystrokes
2. Replay keystrokes at .5 speed inside a mirrored VM
a more sophisticated tool could also vary speed and add typos.
1. Write code for the project and record mouse clicks and keystrokes
2. Replay keystrokes at .5 speed inside a mirrored VM
a more sophisticated tool could also vary speed and add typos.
Agreed, and bring it on. If this becomes a thing then I'll run a platform you can outsource your busy time in a VM to. This sounds like a ton of fun TBH and makes me think of game automation. Evolving into a game of cat and mouse and giving me an excuse to spend more time messing w/ OpenAI.
This is how the AI takes over, we automate ourselves in silly ways. How do we know we aren't bots doing someone else's work?
Bob was one step ahead of us all
https://www.npr.org/sections/thetwo-way/2013/01/16/169528579...
https://www.npr.org/sections/thetwo-way/2013/01/16/169528579...
Would it change anything if we knew we were? :)
Employer: your keystroke rate is low
Me: I'm thinking about if I should use a string here in c++
Employer: fair enough
Me: I'm thinking about if I should use a string here in c++
Employer: fair enough
Or just play a full screen slide show of various spreadsheets and documents. Will they really study the screenshots that closely to see the repetition?
Sure, spot-check and scrutize a small fraction.
(Not to say I endorse this means of tracking employees' time, I just don't think that's a big impediment to this method.)
(Not to say I endorse this means of tracking employees' time, I just don't think that's a big impediment to this method.)
In my experience employers only tend to look back at things like this once they have a “reason” and are trying to document/justify performance issues. Although I agree it doesn’t seem too far off to have a system that proactively analyzes the screenshots and alerts a manager when Facebook or gmail seems to be open a disproportionate amount of time.
Goodhart's law in action
Or hire a sidekick from India to slowly and circuitously type it all in.
Yes, those are possible to escape. I had few gigs and the spying was required. VM was a successful solution (not automated).
This would be super illegal in Germany and I believe also in the rest of Europe.
Sure, most corporate IT depts could do this - but if caught, they'd face real penalties. The brazen-ness of US employers regarding surveillance of their employees is something that continues to (negatively) amaze me, even after years on HN and Reddit.
Sure, most corporate IT depts could do this - but if caught, they'd face real penalties. The brazen-ness of US employers regarding surveillance of their employees is something that continues to (negatively) amaze me, even after years on HN and Reddit.
I'm not surprised. I worked at a place a decade ago that used desktop recording software on everyone's computer and our manager would regularly review it.
I ended up quitting when I found out.
I ended up quitting when I found out.
I assume if the PC isn't mine e.g. machine provided by employer, or the box isn't mine (router from ISP) It is probably has telemetry of some sort. I also expect device s like a phone/pager etc from an employer to be monitored in one way or another.
Many also use it on computers owned by contractors, requiring its use to bill time.
In that case can't you just install it on a tiny vm on a server?
Some places are super locked down when it comes to what software you can install. For example it took me a month to have pandoc, vim and a few other tools (GNU Tree) and a few other pieces of software installed by IT because it had to be approved by 2 layers of management, approved by IT Security and then it was installed on my PC.
If you are working remotely they will give you a machine that VPNs into another machine.
If you are working remotely they will give you a machine that VPNs into another machine.
This has been a thing for at least 15+ years. In fact, when computers were a bit slower, I would notice a perceptible lag in my mouse movement when this happened.
Honestly, there are better ways to measure productivity based on other parameters, taking screenshots is just silly.
Honestly, there are better ways to measure productivity based on other parameters, taking screenshots is just silly.
When they say "workers' computers" do they mean company-owned machines issued to staff to do their jobs or personally-owned machines that people use for work?
If it's the first, as ugly as it is, it makes sense. Don't do anything on a work computer that you don't want your boss, their boss, and the corp IT/lawyers to know about.
If it's the second, that's wholly unacceptable and ridiculous. I refuse to install company-anything on personal devices with the exception of a push-app for MFA on my phone. Everything else, forget it.
If it's the first, as ugly as it is, it makes sense. Don't do anything on a work computer that you don't want your boss, their boss, and the corp IT/lawyers to know about.
If it's the second, that's wholly unacceptable and ridiculous. I refuse to install company-anything on personal devices with the exception of a push-app for MFA on my phone. Everything else, forget it.
This is referenced during the pandemic, so most likely personal computers. Many employers either sent their employees a desktop or have asked them to use their work laptops, but I would guess the majority allow and encourage employees to use personal computers instead (of which they would require the spyware installation).
It's not news when employers use software to take screenshots of workers' computers. Come again if you catch a worker use software to take screenshots of employers' computer.
What? Did you think the manager who came to look over your shoulder constantly suddenly became trusting of you when everyone went to remote work?
The trouble with taking screenshots is then you have to employ people to spend their day examining and evaluating the screenshots.
Before computers could transcribe voice, the limiting factor of wiretapping is needing some poor schmuck who had to listen to all those utterly banal conversations, which has to be one of the worst jobs ever.
Before computers could transcribe voice, the limiting factor of wiretapping is needing some poor schmuck who had to listen to all those utterly banal conversations, which has to be one of the worst jobs ever.
> The trouble with taking screenshots is then you have to employ people to spend their day examining and evaluating the screenshots.
What I don't understand is how they explain that to their customers.
"Yeah, you're not quite getting what you paid for because we spent a portion of it hiring a couple of guys to look at screenshots of our employees computers. Sorry. You can get free screenshots?"
And customers accept this waste of money?
What I don't understand is how they explain that to their customers.
"Yeah, you're not quite getting what you paid for because we spent a portion of it hiring a couple of guys to look at screenshots of our employees computers. Sorry. You can get free screenshots?"
And customers accept this waste of money?
Not necessarily. You could probably catch 90% of people just by using some simple matching. The top social media sites have a pretty distinctive layout you could match on; and you can diff screenshots to catch people who are constantly AFK.
It's not going to catch someone who has put some thought into how to circumvent these, but it's enough to catch a lot of the non-HN people.
It's not going to catch someone who has put some thought into how to circumvent these, but it's enough to catch a lot of the non-HN people.
[deleted]
In general, the screenshot trace will only actually be looked at when someone decides that they want your ass for other reasons.
Jokes on them, hope they like gay porn
I'm working on a product that logs everything you do on your computer super accurately, but when it comes down to submitting those activities the user can (actually often really needs to) clean them up first.
The raw logged data doesn't leave the computer, the boss or client gets a version that might or might not be an accurate reflection of what the worker did.
The most important thing is that you're able to "remember" what you did two weeks back, how much time you spent on it and for what project. Because that takes a lot of time and is always very inaccurate if you need to do it from memory.
There is no way I want the end user to feel spied on by the tool, that would totally kill the acceptation in the market.
The raw logged data doesn't leave the computer, the boss or client gets a version that might or might not be an accurate reflection of what the worker did.
The most important thing is that you're able to "remember" what you did two weeks back, how much time you spent on it and for what project. Because that takes a lot of time and is always very inaccurate if you need to do it from memory.
There is no way I want the end user to feel spied on by the tool, that would totally kill the acceptation in the market.
“ There is no way I want the end user to feel spied on by the tool, that would totally kill the acceptation in the market.”
Are you selling to the actual user? Usually stuff like this gets bought by the employer.
Are you selling to the actual user? Usually stuff like this gets bought by the employer.
Reminds me of Timely's Memory, which does upload the raw data onto a server, but says that it's only accessible by you.
https://memory.ai/timely/features/automatic-time-tracking
https://memory.ai/timely/features/automatic-time-tracking
This is scary from an acquisition standpoint. Every single employer that signs up would want the raw data/unclean data, so if you sell the company the absolute first thing the buyer will do to extract value is to give their customers what they want.
Bosses panic-buy spy software to keep tabs on remote workers https://news.ycombinator.com/item?id=22728971 (19d ago)
I understand that managers have a need to keep track of how their team members are performing, and that their job is a lot harder when their team is working remotely.
But I think It's possible to collect productivity metrics without obliterating employee trust.
I'm working on a tool to do this but I’ve stalled in the project because I’m having a hard time reconciling whether it benefits companies enough to pay for it (It seems geared towards employees more than companies)
But I think It's possible to collect productivity metrics without obliterating employee trust.
I'm working on a tool to do this but I’ve stalled in the project because I’m having a hard time reconciling whether it benefits companies enough to pay for it (It seems geared towards employees more than companies)
If you have good domain knowledge and regular 1:1s, remote or not, it should be pretty darn easy to know if your team is being productive. Why is this so difficult?
I completely agree, but then why do these tools exist in the first place?
I think it comes down to a few things. 1. There are managers that do not have good domain knowledge. 2. They don't have regular 1 on 1's, or anything else that good managers do.
Essentially you're assuming that all managers are good, or even competent when most of us have had experience to contradict this.
Which is essentially my conundrum: good managers won't need my service, and bad managers won't even be looking for it
I think it comes down to a few things. 1. There are managers that do not have good domain knowledge. 2. They don't have regular 1 on 1's, or anything else that good managers do.
Essentially you're assuming that all managers are good, or even competent when most of us have had experience to contradict this.
Which is essentially my conundrum: good managers won't need my service, and bad managers won't even be looking for it
And this is news how ? You are using a computer furnished by your employer and said emplyor has every right to monitor what uis being done on it in any way they can and want. My company uses ObserveIT and one of the features is to take screen captures, to be used in any way that company sees fit, now or later. If anyone has a problem, they can quit
Not just Windows. It's also fairly common for corporate Macs to transmit usage logs, for example using Jamf (Self Service). I'm fine with this, but willing to bet most people aren't fully aware.
1.http://archive.today/tfYtO
2.http://archive.today/MkBKE
1.http://archive.today/tfYtO
2.http://archive.today/MkBKE
Hypothetical question: if your employer offered you the option of extra compensation to install keyloggers/screen capture software on your work computer, and you know that the logs are only being used for aggregate productivity statistics of the firm (de-anonymized), how much do you think would be a fair price?
Assumption: you use a separate computer for your personal computing needs not related to work.
Assumption: you use a separate computer for your personal computing needs not related to work.
If it's aggregate stats (assume you meant anonymized), I wouldn't care very much.
If someone was watching me without my knowledge, I'd like quit when I found out. (Or perhaps make their life hell.)
Employers should just fess up and state clearly that they are doing this. It's the coverup that's the problem.
If someone was watching me without my knowledge, I'd like quit when I found out. (Or perhaps make their life hell.)
Employers should just fess up and state clearly that they are doing this. It's the coverup that's the problem.
I would decline, if it doubled my salary.
that is invasive, and they don't need the information.
if it was required, I would leave the company.
that is invasive, and they don't need the information.
if it was required, I would leave the company.
accept, reverse engineer, if data is aggregated - send spoofed randomised data, if not - just play back time I actually worked on slower speed and use a VM.
As for price, let them make an offer and see how valuable the data is for them.
As for price, let them make an offer and see how valuable the data is for them.
For those of you with macbooks, you can easily remove the Jamf management software by running `sudo jamf removeFramework` (note the capital F)
This would be completely illegal in France.
Beside the fact that an individual tracking requires the employee to be informed of the fact and that the company must jump through hoops to have this registered - you coukd end up screenshooting private activities.
They are allowed on company devices and company time, and they are protected.
Beside the fact that an individual tracking requires the employee to be informed of the fact and that the company must jump through hoops to have this registered - you coukd end up screenshooting private activities.
They are allowed on company devices and company time, and they are protected.
I remote into my PC at work with citrix.
When I want to surf the web I use my local browser. I would be surprised if citrix can screenshot other active windows, perhaps I'm naive.
When I want to surf the web I use my local browser. I would be surprised if citrix can screenshot other active windows, perhaps I'm naive.
Mostly all issues happen at the top of the hierarchy which is enough to dissolve the company like insider trading, giving a hint to client but those people will never be logged. Mostly I feel it's ok. If a employer is doing it basically means couple of things 1. He is helping a startup and loading them test cases. 2. Well he has some computing power but nothing big to process or analyse so he is throwing it away.
Just asking would anyone be okay if a banking app asks for a selfie or takes a photo of you when you are performing a transaction via mobile, just to know that transaction is valid.
Just asking would anyone be okay if a banking app asks for a selfie or takes a photo of you when you are performing a transaction via mobile, just to know that transaction is valid.
Is there a way to figure out if your machine does this? Is there a list of process names to look for or similar?
In MacOS, the software probably requires screen recording permission in System Preferences.
Certainly would feel creepy, if I knew it was happening.
But, I would ask, beyond a gut feeling of being creepy, what particular objections does anyone have to this? Do you believe employers are not entitled, either legally or ethically, to do this on their own equipment?
But, I would ask, beyond a gut feeling of being creepy, what particular objections does anyone have to this? Do you believe employers are not entitled, either legally or ethically, to do this on their own equipment?
I think the main objection is that these companies are treating their employees as an enemy rather than part of a team.
Seems to me to be a very strong indicator of a toxic workplace
Seems to me to be a very strong indicator of a toxic workplace
I disagree with the characterization of "enemy," but I understand your point. Do we not regularly discuss here amongst ourselves the internal security of our organizations? Are inside threats not a growing part of that concern? [0]
Do we expect orgs not to respond to insider threats, or is it just this particular response that is especially distasteful?
[0] https://enterprise.verizon.com/resources/executivebriefs/ins...
Do we expect orgs not to respond to insider threats, or is it just this particular response that is especially distasteful?
[0] https://enterprise.verizon.com/resources/executivebriefs/ins...
I am seriously baffled at how normal it seems for americans to put up with this. This is illegal in germany. If i would find out about this behaviour i would instantly quit, warn my colleagues, turn to press and the police. Otherwise such things would be considered only a small offense at privacy if you act like this is normal.
Gross.
Paywalled article, please post the full version.
If it is the computer that owned by the employer, then it is their property, they put all kinds of spyware there, nothing news worthy
I've never really understood why people think this line of reasoning is valid. Prior to the panedemic, I used the bathrooms at the office nearly every day. The toilets are undoubtedly their property, but is it ok for them to put whatever kind of spyware they want in there too?
It is taking screenshots of your desktop, not turn on the camera and take your photo.
But they way you do your job is private, think of it as intellectual property, your know-how, your tricks. In EU this would probably be not allowed.
E. G. in Poland it is not allowed to record how teachers teach as it is their IP.
E. G. in Poland it is not allowed to record how teachers teach as it is their IP.
Definitely not like this in the US.
Usually some of paperwork you sign when joining a large company are agreements that the company practically owns anything you do/invent/think while employed.
Basically assume it's all their IP unless you have an agreement stating otherwise.
Usually some of paperwork you sign when joining a large company are agreements that the company practically owns anything you do/invent/think while employed.
Basically assume it's all their IP unless you have an agreement stating otherwise.
In most of Europe it's rather rooted in privacy of communications as a basic right, plus regulated labour rights that come from unionization.
I love the European way. It’s shocking to me considering the US was founded and largely consists of descendants of Europeans, how our work cultures can be so extremely different. Every single person on my family tree for both of my grandmothers are from Germany and Switzerland, going back 5 generations. There has to be shared cultural traits passed down to us.
We need to at least move to being more like Canada, if not Germany. Tough to ever happen as our class war has long been won/dominated by the investment class. Employees here aren’t even cognizant the class war is going on. If they were, they’d choose denial to avoid having to punch up and prefer to focus on fellow workers or energy on disdain for people in public assistance. Ignoring that low tax rates for the wealthy is much larger and harmful public assistance (socialism).
We need to at least move to being more like Canada, if not Germany. Tough to ever happen as our class war has long been won/dominated by the investment class. Employees here aren’t even cognizant the class war is going on. If they were, they’d choose denial to avoid having to punch up and prefer to focus on fellow workers or energy on disdain for people in public assistance. Ignoring that low tax rates for the wealthy is much larger and harmful public assistance (socialism).
Yep, that's why I prefer to do job on my computer, or at least using my hard drive.
I think most companies that need to hire top talent know that these kinds of things drive away talent. So these practices tend to be relegated to a lower tier of companies/employers.