37 ms·

Bossware is a big legal risk

176 points by nickwritesit 2y ago

triyambakam 2y ago
So how do I know if my work computer features such surveillance?
- bitwize 2y ago
  That's the neat thing -- you don't.
- woleium 2y ago
  Just assume it does
  - davely 2y ago
    No kidding! We have some ridiculous timeout on our work machines that triggers the screensaver after 2 minutes of idle time (we can’t change this). After it’s triggered, you need to enter your password to unlock (company mandated, 10 chars minimum, no repeating chars, at least 1 upper and 1 lower case char, at least 1 special symbol, change every 90 days, can't be too similar to last 10(!) passwords). Okay, this is annoying. So, for the longest time, I used an open source mouse jiggler app (basically simulated cursor movement). This worked fine until a recent software update. I wondered why my screen saver was being triggered again. Oh, the mouse jiggler isn’t running! Let’s open it up. A big dialog box appears on the screen: “THIS APPLICATION VIOLATES COMPANY POLICY AND ITS USAGE HAS BEEN REPORTED.” Oh… cool. I went on Amazon and ordered some $5 hardware mouse jiggler dongle. That worked for about a month or so. Then suddenly, I started getting CrowdStrike notifications: “Functions of a USB device were restricted according to company policy.” Fun times! It’s only a matter of time until Zoom starts sending reports of whether I had the window in focus or not during meetings with management.
    - kridsdale1 2y ago
      You can get mechanical mouse mover devices that are not connected to the pc at all. It should be fully undetectable.
      - davely 2y ago
        Ah, that's a good point. I've thought about this, but I use a trackball due to mild RSI. So, I don't think it can help me there. (This is going to make me embark on a weekend project to use an Arduino, some servos and a 3D printed finger to move my trackball.)
        eequah9L 2y ago
        Plug in a second mouse then? The trick that I heard is to just place the mouse on a clock. The second hand jiggles the mouse every minute. Can be stashed away in a drawer or something. Never tried this though.
    - mattmerr 2y ago
      Does watching a video pause the timeout? If so, hypothetically one could stream or locally create a video with no contents but long duration.
      - davely 2y ago
        Ah, that's an interesting point. I haven't tried to correlate that, but it must be true. For example, the screensaver never seems to appear during Zoom calls!
        Izkata 2y ago
        That might also be implemented as "don't start the screensaver if the camera is in use". Easy to detect in either /proc/ or /sys/, I forget which one I was fiddling with.
        2y ago
- Etheryte 2y ago
  Either root the device or mitm yourself, not much outside of that that you can do to ensure nothing fishy is going on.
- 98codes 2y ago
  You have to assume that it does.
- ChrisMarshallNY 2y ago
  That's a big reason that I purchased my own, personal computer, many years ago. I was paid well enough, that it was quite possible. Back then, they hadn't really gotten going with all the monitoring stuff, but I did it from a sense of personal integrity. I was writing open-source stuff, and there was no way that I was going to allow my company to try to claim it. I didn't use company time, and I didn't use company equipment. I did not have a "shower clause" in my employment contract, so I was free to work on my own stuff, on my own time.
  - saagarjha 2y ago
    Are you a contractor? This makes things a lot easier. For salaried employees that kind of agreement is far more common :(
    - ChrisMarshallNY 2y ago
      No, I was an employee. However, I worked at a company that employed a ton of photographers, and there is no way that they would be able to get photographers to sign over that kind of authority to the company. That said, I was there for almost 27 years, and a lot could change, in that time. By the time I left, their HR was starting to get downright rapacious, so newer employees might have had to sign over those kinds of rights.
      - saagarjha 2y ago
        Yeah, fair enough. Employment contracts have gotten a lot worse over the years as lawyers figured out what they could get away with.
- toss1 2y ago
  As many others said, assume that it does, by default. Do you have admin rights, including to the firmware? Can you, and did you setup from scratch the device that you received from the from the employer? If not, then it is almost 100% there is surveillance. If they let you do all the setup, then maybe 50%. Just isolate any box your employer touches, both physically and in the network sense, separate visible and sound space as possible, separate WiFi network, etc..
- halfcat 2y ago
  Generally you won’t, but some vendors documentation lists folder paths you can check, like if this folder exists in your computer it’s running Teramind [1]: C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} [1] https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running# https://kb.teramind.co/en/articles/8791095-how-to-verify-if-...
- paxys 2y ago
  Assume it does. Don't do any personal work on it. Isolate it from your home network.
- SpaceNugget 2y ago
  There's a (_relatively_ benign) bossware-like software on my work provided laptop. It forces updates of browsers and common software like the company VPN. When it updates and restarts my browser, it helpfully mentions that if the browser itself was unable to restore my tabs, I can always ask IT to look up what tabs I had open before the update. Maybe ask your IT services if they can help you remember what you had open a few days ago.
- EE84M3i 2y ago
  Make friends with the folks in the enterprise security team and ask them about their kitting process.
- rockooooo 2y ago
  If your company is even halfway legitimate they will have what they collect / monitor in your employee handbook or a privacy policy somewhere.
CoastalCoder 2y ago
I was surprised (perhaps I shouldn't have been) to encounter bossware-like surveilance in an interview process. About 6 months ago I was interviewing with InterSystems, a company that does healthcare software. Only when I signed in for the online coding interview did I learn that they required I have a webcam on myself the whole time. I don't like using coarse language. But it was the first time I struggled to not use the phrase "fuck you" in my email to the recruiter.
- Terr_ 2y ago
  IMO there's a huge difference between "we do this because we had too many fraudulent applicants and this is a compromise compared to having you interview in-person" versus "this is representative of how the entire employment relationship will go." If the former, their fears are not unfounded: Sometimes the person who impressed you in the interview is not actually the same person who arrives for their first day of work. There are also less-audacious forms of interview cheating, where an off-screen cyber-Cyrano is supplying them with answers and/or keyboard-input. That said, I agree that any workplace with a "webcam on at all times for monitoring" policy for employees is one I would leave ASAP. Not just because it's hostile and offensive, but also because it's indicative of the company doing badly while management is busy "rearranging deck-chairs on the Titanic."
  - paxys 2y ago
    So you are okay with giving random companies an hour of footage of your face and part of your house just for the privilege of going through their automated screening round?
    - VBprogrammer 2y ago
      Emm, yes? What do you think they are going to do with it. They are also considering giving you access to potentially a vast amount of their IP and maybe even customer data.
      - Teever 2y ago
exabrial 2y ago
The reasons given are pretty much a nothingburger and standard compliance items you should be doing anyway! I am trying to figure out what exactly is the problem people have though: you're literally on a company asset, being paid by the company, you've signed copyright away, you're aware their is no expectation of privacy. Use your cell phone or your home computer for home business, work during company hours, doesn't seem like that big of a deal. === EDIT: Re: Comments about about webcams, and nowhere in my comments did I say anything about cameras. Read both the article and my comments before attacking straw men.
- BriggyDwiggs42 2y ago
  Because workers arent slaves or robots, and being on the job doesnt make them such. Your mentality is actually staggering to me.
  - exabrial 2y ago
    Can you answer this question directly: What is it that you don't want seen by a company representative, on a company computer, while being paid by the company?
    - vundercind 2y ago
      How would you feel about audio recording in break rooms and hallways? How about fart-detectors in the chairs, recording all that to some database? Same idea, and maybe you wouldn’t mind but surely you can see why many people would. FWIW enough people do mind that this kind of thing is illegal in some countries.
      - potta_coffee 2y ago
        Ironically, I'm involved with a startup developing fart monitors as we speak. I'm certain it's going to be a huge market. /s
      - brokenmachine 2y ago
Havoc 2y ago
Never seen anything like this IRL despite working at various major companies. Hell the other day I explained to my rather senior boss that the yellow teams icon means away from desk. Work is me trading my time for money, and I can begrudgingly accept some level of monitoring. That's after all what a boss is - they supervise aka monitor. However the blurrying of boundaries really irks me. This is part of the reason why I carry two phones, refuse to use remote desktops from personal devices and definitely don't connect personal devices to corporate wifi. Similarly that aggressive invasive student exam monitoring software in use makes me thankful I studied in more classic times.
- ryandrake 2y ago
  Yep, my policy is to never "cross the streams." Work stays on work-provided (and controlled) devices and personal stays on personal devices, and never the twain shall meet. I work remotely, so I even go so far as to ensure all my work-provided devices are on their own VLAN which is isolated from the rest of my network and only have limited Internet connectivity. I don't really understand people who use work devices for personal (sometimes VERY personal) tasks, or even worse vice-versa: Bring Your Own Device for work tasks.
  - genocidicbunny 2y ago
    In many jobs, you're not provided a separate device to use for work. It's just expected that you will have a personal device that you can use. And if you have a problem with that, you can just go work somewhere else. I have been told in at least two interviews that a condition of my employment is that i have a relatively recent Android phone.
- bitwize 2y ago
  > Similarly that aggressive invasive student exam monitoring software in use makes me thankful I studied in more classic times. Fun fact: That aggressive invasive student exam monitoring software is a YC W'21 company: https://www.ycombinator.com/companies/autoproctor https://www.ycombinator.com/companies/autoproctor
Daviey 2y ago
First time i've looked at kolide in a couple of years, and two things jumped out at me: - They got acquired by 1Password - They've pivoted away from a managed osquery product. A few years ago, I wanted to throw money at kolide to manage compliance in a large enterprise using osquery, but their product/sales team was quite underwhelming. Whilst we were testing it, they switched to requiring slack integration as their control and management plane and wouldn't support the existing workflow... So I had to reluctantly drop them.
halfcat 2y ago
Having run this kind of thing for customers over the years, my takeaway is that every place that wanted this was a completely toxic and paranoid work environment. Except for one. This place that seemed to have a reasonable use case. They dealt with very sensitive legal cases involving children, and they wanted an audit trail to ensure sensitive media was handled according to their policy.
- hi-v-rocknroll 2y ago
  Yep. The need signals a lack of trust within an org, and perhaps a management attitude of infantilism and/or a lack of professionalism amongst workers. There is no quick-fix technology solution to business culture dysfunction.
- LorenPechtel 2y ago
  Yeah, I would not have a problem with intrusive monitoring related to any sensitive data. Just limit the monitoring to dealing with the sensitive data.
paxys 2y ago
Everyone replying with "what's the big deal?" is showing their tech privilege. You may not have to deal with intrusive monitoring, but warehouse workers are increasingly being made to wear ankle bracelets so every movement of theirs can be monitored and stack ranked. Workers in WFH "gig" jobs are made to install always-on keyloggers and other monitoring software on their personal computers and phones (which are required for the job). Companies take photos/videos of them in their homes every few minutes throughout the day. Plenty of jobs require you to hand your social media passwords to your employer. There is an entire class of companies that specialize in all of this. Not everyone is able to say "no" to all this and still make rent next month. I'm happy the government is finally stepping in.
- JanisErdmanis 2y ago
  > Plenty of jobs require you to hand your social media passwords to your employer. Can you elaborate with examples or references?
  - paxys 2y ago
    Why exactly do you think a half dozen states have passed laws specifically banning it? https://www.foley.com/insights/publications/2024/03/ny-social-media-privacy-protections-3-12-2024/ https://www.foley.com/insights/publications/2024/03/ny-socia...
  - topkai22 2y ago
    Here is one https://www.aclu.org/documents/employers-schools-and-social-networking-privacy https://www.aclu.org/documents/employers-schools-and-social-...
  - heymijo 2y ago
    “Kochland” includes a chapter on warehouse operations that tracked workers’ activity down to the minute (each conversation and bathroom trip had to be accounted for) and posted their performance rankings on a bulletin board. https://www.nytimes.com/2019/08/13/books/review-kochland-secret-history-koch-industries.html https://www.nytimes.com/2019/08/13/books/review-kochland-sec...
clausecker 2y ago
As a German, this whole bossware stuff seems so ridiculous. It boggles my mind how any employer would accept this sort of thing.
- ang_cire 2y ago
  You gotta eat, and companies hold all the cards here, and they buy and sell politicians to keep it that way. Welcome to America.
teekert 2y ago
I know I'm (heavily) privileged but man is it nice to just say no to such shenanigans knowing that the company I work for is does not want to loose me. In my eyes this is the healthy relationship: I like the job, they like me doing it. I can make requests, they can do so. I can say no, they can say no. I can walk away, they can walk away (ok technically laws in my country prevent them from being able to walk away but I consider it a matter of pride to leave as soon as they don't appreciate me anymore). All these are just signs of mutual respect.
openplatypus 2y ago
There is so much wrong with bossware. Privacy issues. Security issues. Employee trust issues. https://wideangle.co/blog/the-rise-of-bossware-and-threat-to-privacy https://wideangle.co/blog/the-rise-of-bossware-and-threat-to...
- ttyprintk 2y ago
  One aspect not covered here: if such a device was around a person with classified status, at any hour of the day, shouldn’t we need to label it as a probable eavesdropper? I imagine a chunky yellow label saying that we technically cannot tell if this phone has spyware, because bossware activity is blended in.
tracker1 2y ago
It's generally a good idea to separate work and personal devices. It reduces convenience and can take up more space, but definitely the way to go more often than not.
- advisedwang 2y ago
  You're on work devices ~35% of your waking hours. There's still a need for dignity and privacy within that time. Working doesn't mean you become completely subject to your employer's whims those hours.
  - tracker1 2y ago
    I'm not saying there isn't... It's a matter of trust, and I tend to be a bit paranoid in general. I don't trust work devices, even if working on highly sensitive or secure applications. I limit what types of work apps I'll install on my personal phone, and try to limit personal usage of work devices.
nuancebydefault 2y ago
'bossware' reminds me of the good old 'boss' button that used to be present in some applications and games. You hit it when the boss wandered by.
adr1an 2y ago
This reminds me of what my cousin was doing last year, while on our Christmas lunch. (At a south hemisphere country, we tend to party hard that summer night and meet with family the next day.) She had some macro software moving her mouse and throwing keypresses at some notepad app or whatever. And she would get a random videocall to check on her at some point. I am sure that if they were to add an always-on video feed she would find the way to send some video loopback device like any Linux power user would do xD
jacknews 2y ago
This is going to be impossible to police, and we haven't seen anything yet: All knowledge workers (at least) are going to end up with real Bossware, in the form of a an AI chatbot boss. Of course they will be called AI assistants, co-workers, collaborators, secretaries, etc, but while they will most likely be able to help complete complex tasks in a variety of industries, it's absolutely certain that they will be able to 'help' with todo lists and scheduling. So, after conversing with your personalized AI to create a new sales report or whatever, the AI is going to helpfully remind you that you have a meeting in 20 minutes, and that's just enough time to squeeze in the product inventory report, if we go for it. And then at the end of the day/week/month, the AI will 'helpfully' assess your performance and recommend corrective measures. And make recommendations about you to your human bosses too, of course.
epsilonic 2y ago
Is there any networking hardware that can intercept and obfuscate payloads that are collected by bossware tools? Also, is there a database of known bossware? I’ve used MITM proxy to intercept web analytics payloads, but I’m curious to know if there is anything available at the hardware level.

176 points by nickwritesit 2y ago

triyambakam 2y ago

So how do I know if my work computer features such surveillance?

bitwize 2y ago
That's the neat thing -- you don't.
woleium 2y ago
Just assume it does
- davely 2y ago
  No kidding! We have some ridiculous timeout on our work machines that triggers the screensaver after 2 minutes of idle time (we can’t change this). After it’s triggered, you need to enter your password to unlock (company mandated, 10 chars minimum, no repeating chars, at least 1 upper and 1 lower case char, at least 1 special symbol, change every 90 days, can't be too similar to last 10(!) passwords). Okay, this is annoying. So, for the longest time, I used an open source mouse jiggler app (basically simulated cursor movement). This worked fine until a recent software update. I wondered why my screen saver was being triggered again. Oh, the mouse jiggler isn’t running! Let’s open it up. A big dialog box appears on the screen: “THIS APPLICATION VIOLATES COMPANY POLICY AND ITS USAGE HAS BEEN REPORTED.” Oh… cool. I went on Amazon and ordered some $5 hardware mouse jiggler dongle. That worked for about a month or so. Then suddenly, I started getting CrowdStrike notifications: “Functions of a USB device were restricted according to company policy.” Fun times! It’s only a matter of time until Zoom starts sending reports of whether I had the window in focus or not during meetings with management.
  - kridsdale1 2y ago
    You can get mechanical mouse mover devices that are not connected to the pc at all. It should be fully undetectable.
    - davely 2y ago
      Ah, that's a good point. I've thought about this, but I use a trackball due to mild RSI. So, I don't think it can help me there. (This is going to make me embark on a weekend project to use an Arduino, some servos and a 3D printed finger to move my trackball.)
      - eequah9L 2y ago
        Plug in a second mouse then? The trick that I heard is to just place the mouse on a clock. The second hand jiggles the mouse every minute. Can be stashed away in a drawer or something. Never tried this though.
  - mattmerr 2y ago
    Does watching a video pause the timeout? If so, hypothetically one could stream or locally create a video with no contents but long duration.
    - davely 2y ago
      Ah, that's an interesting point. I haven't tried to correlate that, but it must be true. For example, the screensaver never seems to appear during Zoom calls!
      - Izkata 2y ago
        That might also be implemented as "don't start the screensaver if the camera is in use". Easy to detect in either /proc/ or /sys/, I forget which one I was fiddling with.
        2y ago
Etheryte 2y ago
Either root the device or mitm yourself, not much outside of that that you can do to ensure nothing fishy is going on.
98codes 2y ago
You have to assume that it does.
ChrisMarshallNY 2y ago
That's a big reason that I purchased my own, personal computer, many years ago. I was paid well enough, that it was quite possible. Back then, they hadn't really gotten going with all the monitoring stuff, but I did it from a sense of personal integrity. I was writing open-source stuff, and there was no way that I was going to allow my company to try to claim it. I didn't use company time, and I didn't use company equipment. I did not have a "shower clause" in my employment contract, so I was free to work on my own stuff, on my own time.
- saagarjha 2y ago
  Are you a contractor? This makes things a lot easier. For salaried employees that kind of agreement is far more common :(
  - ChrisMarshallNY 2y ago
    No, I was an employee. However, I worked at a company that employed a ton of photographers, and there is no way that they would be able to get photographers to sign over that kind of authority to the company. That said, I was there for almost 27 years, and a lot could change, in that time. By the time I left, their HR was starting to get downright rapacious, so newer employees might have had to sign over those kinds of rights.
    - saagarjha 2y ago
      Yeah, fair enough. Employment contracts have gotten a lot worse over the years as lawyers figured out what they could get away with.
toss1 2y ago
As many others said, assume that it does, by default. Do you have admin rights, including to the firmware? Can you, and did you setup from scratch the device that you received from the from the employer? If not, then it is almost 100% there is surveillance. If they let you do all the setup, then maybe 50%. Just isolate any box your employer touches, both physically and in the network sense, separate visible and sound space as possible, separate WiFi network, etc..
halfcat 2y ago
Generally you won’t, but some vendors documentation lists folder paths you can check, like if this folder exists in your computer it’s running Teramind [1]: C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} [1] https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running# https://kb.teramind.co/en/articles/8791095-how-to-verify-if-...
paxys 2y ago
Assume it does. Don't do any personal work on it. Isolate it from your home network.
SpaceNugget 2y ago
There's a (_relatively_ benign) bossware-like software on my work provided laptop. It forces updates of browsers and common software like the company VPN. When it updates and restarts my browser, it helpfully mentions that if the browser itself was unable to restore my tabs, I can always ask IT to look up what tabs I had open before the update. Maybe ask your IT services if they can help you remember what you had open a few days ago.
EE84M3i 2y ago
Make friends with the folks in the enterprise security team and ask them about their kitting process.
rockooooo 2y ago
If your company is even halfway legitimate they will have what they collect / monitor in your employee handbook or a privacy policy somewhere.

CoastalCoder 2y ago

I was surprised (perhaps I shouldn't have been) to encounter bossware-like surveilance in an interview process. About 6 months ago I was interviewing with InterSystems, a company that does healthcare software. Only when I signed in for the online coding interview did I learn that they required I have a webcam on myself the whole time. I don't like using coarse language. But it was the first time I struggled to not use the phrase "fuck you" in my email to the recruiter.

Terr_ 2y ago
IMO there's a huge difference between "we do this because we had too many fraudulent applicants and this is a compromise compared to having you interview in-person" versus "this is representative of how the entire employment relationship will go." If the former, their fears are not unfounded: Sometimes the person who impressed you in the interview is not actually the same person who arrives for their first day of work. There are also less-audacious forms of interview cheating, where an off-screen cyber-Cyrano is supplying them with answers and/or keyboard-input. That said, I agree that any workplace with a "webcam on at all times for monitoring" policy for employees is one I would leave ASAP. Not just because it's hostile and offensive, but also because it's indicative of the company doing badly while management is busy "rearranging deck-chairs on the Titanic."
- paxys 2y ago
  So you are okay with giving random companies an hour of footage of your face and part of your house just for the privilege of going through their automated screening round?
  - VBprogrammer 2y ago
    Emm, yes? What do you think they are going to do with it. They are also considering giving you access to potentially a vast amount of their IP and maybe even customer data.
    - Teever 2y ago

exabrial 2y ago

The reasons given are pretty much a nothingburger and standard compliance items you should be doing anyway! I am trying to figure out what exactly is the problem people have though: you're literally on a company asset, being paid by the company, you've signed copyright away, you're aware their is no expectation of privacy. Use your cell phone or your home computer for home business, work during company hours, doesn't seem like that big of a deal. === EDIT: Re: Comments about about webcams, and nowhere in my comments did I say anything about cameras. Read both the article and my comments before attacking straw men.

BriggyDwiggs42 2y ago
Because workers arent slaves or robots, and being on the job doesnt make them such. Your mentality is actually staggering to me.
- exabrial 2y ago
  Can you answer this question directly: What is it that you don't want seen by a company representative, on a company computer, while being paid by the company?
  - vundercind 2y ago
    How would you feel about audio recording in break rooms and hallways? How about fart-detectors in the chairs, recording all that to some database? Same idea, and maybe you wouldn’t mind but surely you can see why many people would. FWIW enough people do mind that this kind of thing is illegal in some countries.
    - potta_coffee 2y ago
      Ironically, I'm involved with a startup developing fart monitors as we speak. I'm certain it's going to be a huge market. /s
    - brokenmachine 2y ago

Havoc 2y ago

Never seen anything like this IRL despite working at various major companies. Hell the other day I explained to my rather senior boss that the yellow teams icon means away from desk. Work is me trading my time for money, and I can begrudgingly accept some level of monitoring. That's after all what a boss is - they supervise aka monitor. However the blurrying of boundaries really irks me. This is part of the reason why I carry two phones, refuse to use remote desktops from personal devices and definitely don't connect personal devices to corporate wifi. Similarly that aggressive invasive student exam monitoring software in use makes me thankful I studied in more classic times.

ryandrake 2y ago
Yep, my policy is to never "cross the streams." Work stays on work-provided (and controlled) devices and personal stays on personal devices, and never the twain shall meet. I work remotely, so I even go so far as to ensure all my work-provided devices are on their own VLAN which is isolated from the rest of my network and only have limited Internet connectivity. I don't really understand people who use work devices for personal (sometimes VERY personal) tasks, or even worse vice-versa: Bring Your Own Device for work tasks.
- genocidicbunny 2y ago
  In many jobs, you're not provided a separate device to use for work. It's just expected that you will have a personal device that you can use. And if you have a problem with that, you can just go work somewhere else. I have been told in at least two interviews that a condition of my employment is that i have a relatively recent Android phone.
bitwize 2y ago
> Similarly that aggressive invasive student exam monitoring software in use makes me thankful I studied in more classic times. Fun fact: That aggressive invasive student exam monitoring software is a YC W'21 company: https://www.ycombinator.com/companies/autoproctor https://www.ycombinator.com/companies/autoproctor

Daviey 2y ago

First time i've looked at kolide in a couple of years, and two things jumped out at me: - They got acquired by 1Password - They've pivoted away from a managed osquery product. A few years ago, I wanted to throw money at kolide to manage compliance in a large enterprise using osquery, but their product/sales team was quite underwhelming. Whilst we were testing it, they switched to requiring slack integration as their control and management plane and wouldn't support the existing workflow... So I had to reluctantly drop them.

halfcat 2y ago

Having run this kind of thing for customers over the years, my takeaway is that every place that wanted this was a completely toxic and paranoid work environment. Except for one. This place that seemed to have a reasonable use case. They dealt with very sensitive legal cases involving children, and they wanted an audit trail to ensure sensitive media was handled according to their policy.

hi-v-rocknroll 2y ago
Yep. The need signals a lack of trust within an org, and perhaps a management attitude of infantilism and/or a lack of professionalism amongst workers. There is no quick-fix technology solution to business culture dysfunction.
LorenPechtel 2y ago
Yeah, I would not have a problem with intrusive monitoring related to any sensitive data. Just limit the monitoring to dealing with the sensitive data.

paxys 2y ago

Everyone replying with "what's the big deal?" is showing their tech privilege. You may not have to deal with intrusive monitoring, but warehouse workers are increasingly being made to wear ankle bracelets so every movement of theirs can be monitored and stack ranked. Workers in WFH "gig" jobs are made to install always-on keyloggers and other monitoring software on their personal computers and phones (which are required for the job). Companies take photos/videos of them in their homes every few minutes throughout the day. Plenty of jobs require you to hand your social media passwords to your employer. There is an entire class of companies that specialize in all of this. Not everyone is able to say "no" to all this and still make rent next month. I'm happy the government is finally stepping in.

JanisErdmanis 2y ago
> Plenty of jobs require you to hand your social media passwords to your employer. Can you elaborate with examples or references?
- paxys 2y ago
  Why exactly do you think a half dozen states have passed laws specifically banning it? https://www.foley.com/insights/publications/2024/03/ny-social-media-privacy-protections-3-12-2024/ https://www.foley.com/insights/publications/2024/03/ny-socia...
- topkai22 2y ago
  Here is one https://www.aclu.org/documents/employers-schools-and-social-networking-privacy https://www.aclu.org/documents/employers-schools-and-social-...
- heymijo 2y ago
  “Kochland” includes a chapter on warehouse operations that tracked workers’ activity down to the minute (each conversation and bathroom trip had to be accounted for) and posted their performance rankings on a bulletin board. https://www.nytimes.com/2019/08/13/books/review-kochland-secret-history-koch-industries.html https://www.nytimes.com/2019/08/13/books/review-kochland-sec...

clausecker 2y ago

As a German, this whole bossware stuff seems so ridiculous. It boggles my mind how any employer would accept this sort of thing.

ang_cire 2y ago
You gotta eat, and companies hold all the cards here, and they buy and sell politicians to keep it that way. Welcome to America.

teekert 2y ago

I know I'm (heavily) privileged but man is it nice to just say no to such shenanigans knowing that the company I work for is does not want to loose me. In my eyes this is the healthy relationship: I like the job, they like me doing it. I can make requests, they can do so. I can say no, they can say no. I can walk away, they can walk away (ok technically laws in my country prevent them from being able to walk away but I consider it a matter of pride to leave as soon as they don't appreciate me anymore). All these are just signs of mutual respect.

openplatypus 2y ago

There is so much wrong with bossware. Privacy issues. Security issues. Employee trust issues. https://wideangle.co/blog/the-rise-of-bossware-and-threat-to-privacy https://wideangle.co/blog/the-rise-of-bossware-and-threat-to...

ttyprintk 2y ago
One aspect not covered here: if such a device was around a person with classified status, at any hour of the day, shouldn’t we need to label it as a probable eavesdropper? I imagine a chunky yellow label saying that we technically cannot tell if this phone has spyware, because bossware activity is blended in.

tracker1 2y ago

It's generally a good idea to separate work and personal devices. It reduces convenience and can take up more space, but definitely the way to go more often than not.

advisedwang 2y ago
You're on work devices ~35% of your waking hours. There's still a need for dignity and privacy within that time. Working doesn't mean you become completely subject to your employer's whims those hours.
- tracker1 2y ago
  I'm not saying there isn't... It's a matter of trust, and I tend to be a bit paranoid in general. I don't trust work devices, even if working on highly sensitive or secure applications. I limit what types of work apps I'll install on my personal phone, and try to limit personal usage of work devices.

nuancebydefault 2y ago

'bossware' reminds me of the good old 'boss' button that used to be present in some applications and games. You hit it when the boss wandered by.

adr1an 2y ago

This reminds me of what my cousin was doing last year, while on our Christmas lunch. (At a south hemisphere country, we tend to party hard that summer night and meet with family the next day.) She had some macro software moving her mouse and throwing keypresses at some notepad app or whatever. And she would get a random videocall to check on her at some point. I am sure that if they were to add an always-on video feed she would find the way to send some video loopback device like any Linux power user would do xD

jacknews 2y ago

This is going to be impossible to police, and we haven't seen anything yet: All knowledge workers (at least) are going to end up with real Bossware, in the form of a an AI chatbot boss. Of course they will be called AI assistants, co-workers, collaborators, secretaries, etc, but while they will most likely be able to help complete complex tasks in a variety of industries, it's absolutely certain that they will be able to 'help' with todo lists and scheduling. So, after conversing with your personalized AI to create a new sales report or whatever, the AI is going to helpfully remind you that you have a meeting in 20 minutes, and that's just enough time to squeeze in the product inventory report, if we go for it. And then at the end of the day/week/month, the AI will 'helpfully' assess your performance and recommend corrective measures. And make recommendations about you to your human bosses too, of course.

epsilonic 2y ago

Is there any networking hardware that can intercept and obfuscate payloads that are collected by bossware tools? Also, is there a database of known bossware? I’ve used MITM proxy to intercept web analytics payloads, but I’m curious to know if there is anything available at the hardware level.