ITKarma picture

Coronavirus has forced millions of people to work from home, and now an extensive group of companies is obsessively advertising their employer programs to employers across the United States.

Often advertising for these services sounds relatively harmless. Some manufacturers sell their programs under the guise of tools for “automatic tracking of time consumption” or “workplace analysis”. Others offer products to companies worried about potential data breaches or intellectual property theft. We will call all these tools bossware. Trackers, even if they are intended to help employers, jeopardize the safety and confidentiality of workers by recording every click of a mouse and pressing a key, secretly collecting information for future lawsuits, and using other spyware capabilities that go far beyond the necessary and prudent manpower management.

It is not right. When a house becomes an office, it does not cease to be a house. Workers should not be subjected to unauthorized surveillance, or to feel under a hood at home - just so as not to lose their job.

What can they do?


Typically, the tracker lives on a computer or smartphone, and enjoys privileges to access everything that happens on the device. Most of them track almost all user actions. We looked at promotional materials, demos, and user reviews to understand how these tools work. There are too many types of trackers to list all of them here, but we will try to sort the tracking systems into general categories.

The most extensive and widespread category of such programs is “activity tracking”. Usually they make a list of applications and sites visited by employees. It may include a list of recipients of their messages and emails - including email headers and other metadata - and the posts they make on social networks. Most trackers also record the input level from the keyboard and mouse - for example, many tools give a per-minute layout of the number of keystrokes that can be used as a measure of productivity. The productivity tracking program will try to collect all this data in simple graphs or charts that will give managers a general idea of ​​what the employees are doing.

Each of the products we studied has the opportunity to often take screenshots of the employee’s device, and some even provide video capture of the screen and the transmission of this video in real time. The authorities can view the pictures sorted by the timeline and study what the employee did at any time during the day. Some products work as keystroke loggers and record every keystroke, including unsent letters and personal passwords. A couple of programs even offer administrators the ability to take control of the user's desktop. Such products usually do not distinguish between work activity and personal account information, bank data or medical information.

Some followers go even further, reaching out to the surrounding worker in the physical world. Companies offering mobile software almost always include GPS tracking. At least two services - StaffCop Enterprise and CleverControl - allow employers to secretly turn on webcams and microphones in their workers' devices.

In general, there are two ways to deploy trackers: this is either an application that the employee can see (and sometimes control), or this is a secret background process that is not visible to the employee. Most of the companies we have studied have made it possible for employers to establish their programs this way and that.

Visible Snooping


Sometimes employees may see a program tracking their actions. They may have the ability to turn off surveillance, and this often takes the form of “entrance to the office” and “exit from the office”. Naturally, if an employee turns off the program, this will be visible to the employer. For example, the program Time Doctor gives employees the ability to delete certain screenshots taken during their work.However, deleting this snapshot will also delete the associated working time, so employees will only be counted for the time that was tracked by the program.

Workers can be given access to a specific piece of information collected about their work. Crossover, a WorkSmart product, compares it to a fitness tracker for working on a computer. Its interface allows employees to look at the conclusions of the system regarding their activity, presented in the form of graphs and charts.

Different companies offering tracking programs offer different levels of transparency for employees. Some give employees access to some of the information, or even to all the information that goes to managers. Others, for example, Teramind, make it clear that they turned on and collect data, but do not talk about what data they collect. In any case, it is often not clear to the user exactly what data about him is collected, unless he asks for this from his employer or carefully studies the program itself.

Invisible surveillance


Most companies that create user-visible tracking software also make products that try to hide from the people whose activities they track. Teramind, Time Doctor, StaffCop and others produce followers that make their detection and removal very difficult. From a technical point of view, these programs are no different from stalkerware - spyware for tracking people without their knowledge. Some companies even require employees to install their programs in a certain way before installing their programs, so that they do not Detected and not blocked this software.

ITKarma picture
Part of the registration procedure in the TimeDoctor service, where the employer chooses between visible and invisible surveillance.

Such software is advertised as a means to monitor employees. However, most of these programs are actually tools for tracking a wide range of applications. StaffCop offers a version of the program to monitor how children use the Internet at home, and ActivTrak claims that parents or school officials can use their software to track children's activities. Judging by the reviews, many consumers use this software not for office needs.

Most companies offering an invisible tracking mode recommend using it only on devices owned by the employer. However, many offer features such as remote and silent installation that allow you to download software to workers' machines, located outside the office , without their knowledge. This works because many employers have administrative privileges on the machines that they give their employees to use. However, some employees use their only laptop, so the company monitors the person all the time without interruption. Such software has a huge potential for misuse for employers, school management and close partners. And the victim of surveillance may never find out that they are being watched.

The table below shows the tracking and control capabilities for a small sample of manufacturers of followers. The list is not complete, and may not give a correct picture of this industry as a whole. We studied the companies referenced in the industry’s manuals and the results of search queries with informative, publicly available marketing materials.

Common surveillance features in monitoring software

Track application launches and website visits


Screenshots or video recording


Recording keystrokes


Activation of the microphone and/or webcam


Invisible Mode


ActivTrak


verified


verified


verified


CleverControl


verified


verified


verified


verified


( 1 , 2 )


verified


DeskTime


verified


verified


verified


Hubstaff


verified


verified


Interguard


verified


verified


verified


verified


StaffCop


verified


verified


verified


verified


( 1 , 2 )


verified


Teramind


verified


verified


verified


verified


TimeDoctor


verified


verified


verified


Work Examiner


verified


verified


verified


verified


WorkPuls


verified


verified


verified




How common are followers?


The employee tracking business is not new, and even before the outbreak of the pandemic, it was quite large.Although it is difficult to assess the prevalence of follow-ups, they no doubt became more popular after workers were forced to switch to remote work in connection with the coronavirus. Awareness Technologies, which owns InterGuard, states that in the first few weeks of the outbreak, it expanded its user base by 300%. Many of the manufacturers we studied use coronavirus in advertising applications.

Trackers are used by some of the largest companies. Among Hubstaff customers are Instacart, Groupon and Ring. Time Doctor announces the presence of 83,000 users; her clients include Allstate, Ericsson, Verizon, and Re/Max. ActivTrak is used by more than 6,500 organizations, including Arizona State University, Amore University, and the city of Denver and Malibu. Companies such as StaffCop and Teramind do not disclose customer information, but declare that their areas of activity include healthcare, banking, fashion, manufacturing and call centers. Based on customer reviews using trackers, you can judge how they use these programs.

We do not know how many of these organizations have chosen to use invisible tracking, because employers do not spread such things. In addition, there is no reliable way for workers to find out, since many programs for invisible surveillance are specially designed so that they cannot be detected. The contracts of some employees stipulate their consent to certain monitoring or a ban on other types of it. But many workers are simply not able to find out if they are being watched. If an employee is worried about whether they are being followed, it would be better to immediately assume that the device issued to him by the employer is monitoring his actions.

What is the collected data used for?


Tracker manufacturers offer their software for various applications. Some of the most common options are tracking time, productivity, compliance with data protection laws, and preventing theft of intellectual property. Some of these cases are legitimate: companies working with sensitive data are often required by law to ensure that data does not leak and will not be stolen from their computers. For employees working outside the office, this may mean a certain level of surveillance. However, the employer should not engage in any surveillance for security reasons, unless it demonstrates that it is necessary, proportionate and consistent with the problem that it is trying to solve.

Unfortunately, many use cases give employers too much power over workers. Probably the largest class of products we have studied is designed for “productivity tracking” or advanced time tracking — that is, recording everything employees do to make sure they work hard enough. Some companies arrange their software as if it was good for both managers and employees. They argue that collecting information about every second of an employee’s working day helps not only the bosses, but also the employees themselves. Other manufacturers, such as Work Examiner and StaffCop , directly advertise their services to managers who do not trust their employees. Such companies often recommend building strategies for dismissal or bonuses based on the metrics issued by their products.

ITKarma picture
Promotional material from the Work Examiner home page

Some firms advertise their products as punishment tools, or to gather evidence for potential lawsuits. InterGuard tells that her The software “can be installed remotely and covertly, in order to conduct covert investigations and collect irrefutable evidence without scaring off a potential criminal.” She goes on to say that this evidence can be used in lawsuits involving unlawful dismissals. In other words, InterGuard can supply employers with astronomical amounts of discreetly collected personal information so as to suppress employee attempts to prove unfair treatment in court.

None of these use cases justify the amount of information typically collected by trackers. Nothing can justify hiding the very fact of surveillance.

Most products periodically take screenshots, and some programs allow employees to decide which pictures they want to share. This means that in addition to snapshots of work letters or social media pages, snapshots of sensitive banking, medical or other personal information may also be there. Programs that record keystrokes even more interfere with personal life, and often end up writing passwords to personal employee accounts.

ITKarma picture
From the Work Examiner site: recording keystrokes - what do they type there?
Recording keystrokes records all keystrokes made by the user. You will see that he printed in any program, whether it be a messenger, website, webmail, or MS Word. You can even intercept passwords entered into programs and websites!


Unfortunately, the collection of an excessive amount of information is often not accidental, but originally conceived. Work Examiner directly advertises the ability to save personal employee passwords. Teramind reports all the information that has been entered into the mail program - even if it is later deleted. Several products extract text data from private messages on social networks, so employers get even the most intimate information from personal user correspondence.

To be honest - these programs are specifically designed to help employers read the personal messages of their employees without their knowledge or consent. Whatever one may say, this is neither necessary nor ethical.

What can be done about this?


Under US laws, employers have too much freedom in installing tracking software on their own devices. Also, little prevents them from forcing employees to install similar software on their own devices (if only it can be turned off after hours). Different states have different rules about what employers can and cannot do. However, workers often have very few opportunities to legally influence overly curious surveillance software.

This should change. Together with the consumer data privacy laws states must protect workers from their employers. To get started:

  • Monitoring employees, even using devices owned by employers, should be carried out as necessary and be proportionate.
  • Tools should minimize the amount of information collected, and avoid the extraction of personal data such as personal messages and passwords.
  • Employees should have the right to know what kind of information managers collect.
  • Workers must have the right to legal assistance and the ability to sue employers who violate privacy laws.

Meanwhile, workers who know they are being watched - and who have nothing against it - should start a conversation with their employers. Companies that use followers in their work should figure out their goals and try to achieve them in less intrusive ways. Trackers often encourage false productivity - for example, by forcing people to twitch the mouse and type in something every few minutes, instead of pausing for thought. Constant observation smothers creativity, reduces trust and leads to burnout. If employees are worried about data security, they need to study tools that are specifically tailored to real-world threats and minimize the risks of personal data leakage.

Many workers are uncomfortable expressing their opinions, and some suspect that their employer is secretly monitoring them. If they are not aware of the extent of this surveillance, they should assume that the devices collect all the information - from the history of site visits to private messages and passwords. If possible, they should avoid using work computers for personal purposes. If employees are asked to install followers on their personal devices, they can ask the employer to give them a separate work device, making it easier to separate personal information from work information.

Finally, employees may be wary of talking about their surveillance, for fear of flying out of work during the period record unemployment [US unemployment is over 11% ]. The choice between obsessive over-surveillance and unemployment is hardly a choice.

Coronavirus has sent us all new trials, and is likely to fundamentally change the way we work. However, we must not allow him to open a new era of even more ubiquitous surveillance. More than ever, we use electronic devices in our lives. And this means that we have even more rights to the confidentiality of our digital life - and neither governments, nor technology companies, nor our employers should intervene in it.

Source