55

I'm employed as a software developer. In my country the employer is not allowed to monitor your activities due to privacy laws. However, due to the nature of some of our clients, our company is allowed to do this due to security reasons. It's specifically stated in my contract that the company can monitor our network activity for security reasons. I accepted this when I applied for the job as I can see why this could be important.

However, my manager has a lot of trouble managing the employees and tends to cause more problems. Our boss seems to like him so there's not much we can do about that. This makes addressing this problem to a position above my manager less likely to have an impact.

My manager often does not know what to do so he tries to make sure we're always working hard on our jobs. This in itself is not a problem. But the methods he uses are unethical. He uses software to forcefully take over our computers from a distance and browses through what we're doing, what browser tabs we have open etc.

While the contract says the employer is allowed to breach a certain degree of privacy due to security reasons, I feel like he's abusing this to an extreme extent and for the wrong reasons.

How can I prevent my manager from abusing this exception in the work environment?

  • 9
    IANAL, but in your Country a contract may not overrule specific privacy laws and I think what your manager is doing is breaking that. They may ask the ínformation or even demand it, but as far as I know you still Need to give it. – Raoul Mensink May 12 '16 at 9:24
  • 4
    the local government has no such power, but this is a common thing in our country sadly enough. – Raoul Mensink May 12 '16 at 10:27
  • 41
    Unplug the Ethernet cable. Turn Wifi off. Call your security people "someone is hacking into my computer". – gnasher729 May 12 '16 at 14:52
  • 55
    Some of my best, most valuable, most productive work has been done sitting where I could stare out of a window with a pad of paper and a pencil. A morning thinking through a design that way may save many days of programming effort and result in a better program. Monitoring computer activity is an ineffective way of monitoring productivity. – Patricia Shanahan May 12 '16 at 15:49
  • 13
    "When this happens it got to the point where it indicates we can have a coffee break. as we cant use our pc's for that moment." - so switch off your PC, and then take the coffee break. – alephzero May 12 '16 at 17:49
122

Monitoring Internet access and employee acitivity on security breakpoints for security reasons is prudent and necessary, and thats why it's allowed.

Another thing you mention, which is not only not necessary, but also highly unethical and I'd hazard also illegal (IANAL, consult a lawyer specialising in employment law for this) is that he has remote access to your computer. This means that he can do stuff under YOUR identity - stuff that YOU would get blamed for in audits or criminal investigations.

You need to bring this specific concern (the taking over your computer) to your boss asap. If he doesn't cooperate, bring it to your boss's boss. If he doesn't cooperate either, get a lawyer, and go looking for a new job.

There are also much better and less intrusive ways of finding out internet traffic and/or history without taking over the computer.

  • 2
    This is a very good point. Doing this alot and making it known also causes the company problems in the long run as it taints the evidence. Now instead of one suspect all the managers are suspects also. So its in the best interests of the company to not do this unless the system is entirely passive. – joojaa May 12 '16 at 15:10
  • 50
    This is scary. How is it even possible that in an environment which deals with security-sensitive information like this, someone can take over a computer just like that? How do you know that this capability is restricted to your manager, and not just anybody on the Internet can take over your computer? How do you even know it is your manager taking over your computer and not an attacker? Would you even be able to distinguish between the two? You should treat the machine as compromised, and do whatever your disaster recovery plan says in such a situation (probably isolate it and report to IT) – Jörg W Mittag May 12 '16 at 15:40
  • 3
    While this will not be the approach that I will take with this situation. I do believe this is the best answer to my question. and will therefor accept it. It does give a good to know perspective to the situation. – Migz May 12 '16 at 15:42
  • 7
    @Kevin Another aspect is that randomly losing control of your computer is really devastating for productivity as a dev. I can't speak for everyone, but when im "In the zone" of efficient coding and someone just interrupts me, thats a good 20-30 min of time to get back there. – Magisch May 13 '16 at 5:59
  • 4
    I'd be weary of bringing this up to the boss, it may be considered to be accusing the boss of being unscrupulous - bring it up to whoever is in charge of security in the form of "how do I document what *I" don't do on my computer" – Raystafarian May 13 '16 at 9:09
16

If security is such a concern that your company has special contract terms related to it, there should be a network security group to look after it. Because security is a major concern, they may have more organizational power and influence than you do.

It might be worth discussing your concerns with them.

They have an interest in people not accessing computers they do not need to access to do their job. The more people with access to information the greater the risk of leaks and the harder it is to track them down. Your manager's ability to "take over" a lot of other computers is a security risk. Breaking in to your manager's account would be a doorway to many computers.

They also have an interest in the security-related contract provision not being misused, because misuse might make it harder to preserve and enforce the provision.

7

He's not abusing it, he has the capability which you have expressly given permission for, and he's using it. I can see how this would be annoying, but it's something you could learn to live with and will probably have to.

Using it just to keep employees on their toes isn't the best use of the capability. It could for instance be very disruptive when people are deep in working on something complex. So unless it's mandated by company policy it appears your manager has too much time on his hands. I have seen some pretty strict company policies in my time though, in which the manager is held responsible for any breaches, where monitoring of activity is done on multiple levels, mostly without the employee noticing.

But there's nothing you can do about it that won't make you seem guilty of trying to conceal something. Even arguing that it is interfering with your work isn't a great idea. Because even a mediocre manager is well aware of that fact.

Possibly your only realistic recourse without trying to organise a mutiny is to ask people who have been there longer and presumably have more knowledge whether it's a company policy or not. At least that way you might get some information without rocking the boat with your manager.

  • I'm quite worried that this is indeed the case. It is as you said, very disruptive. I'm not worried about the activities he may find, but it certainly bothers me and may put un-needed stress on the work. I hope to find other answers that may help me find a way to handle this situation before simply sucking it up. But this was a very helpful answer so far. – Migz May 12 '16 at 9:42
  • 20
    I disagree with your conclusion. There's a difference between monitoring and interference. It seems like the manager is doing a remote desktop session which interrupts the dev's workflow. That's a legitimate grievance the OP can raise with the manager. They're more than welcome to snoop around their computers, all the OP's asking is for them to be discreet. – rath May 12 '16 at 10:22
  • On the other hand this could be a deliberate decision on the manager's part, doing some kind of you are being watched mind-trick. – rath May 12 '16 at 10:24
  • @rath I specifically took that in to account in my answer "Using it just to keep employees on their toes isn't the best use of the capability. It could for instance be very disruptive when people are deep in working on something complex." – Kilisi May 12 '16 at 11:05
  • 23
    He is abusing his capability. Permission was given for these capabilities for a specific purpose, the manager is using it for a different reason. It's certainly abusing and might even be flat out a breach of contract (depending on the actual wording). – Taemyr May 12 '16 at 12:58
7

He uses software to forcefully take over our computers from a distance and browses through what we're doing, what browser tabs we have open etc,.

Who watches the watchman?

Your manager can do whatever he wants on your computer, in your current session, with your digital identity. How safe is that? Is the manager's computer provably secured against malware? Is the manager provably competent to not do anything harmful, for which you would be blamed because the audit shows your account responsible?

  • 1
    This is not really an answer it is just asking for more information with out actually providing any solution. – IDrinkandIKnowThings May 12 '16 at 14:37
  • 16
    I think this is an answer, @Chad. It's phrased as a rhetorical question, but it functions as an answer. It raises concerns which the OP can then raise in turn. – TRiG May 12 '16 at 21:33
  • 1
    Depending on the remote control configuration and software in question, logs of actions taken by the manager while he/she is logged-in should show as originating from a remote user, and would therefore be distinct from OP's digital identity. That said, these actions would still originate from OP's computer and IP address so liability could be an issue if the people looking into any indiscretions are not thorough. – CCJ May 12 '16 at 22:28
7

In my view, companies have a right to know what employees are doing. They are, after all, paying the employees to do certain things, and it is reasonable to want the ability to verify whether the employees are actually doing these things. There is nothing inherently unethical about using tools to monitor what employees are doing on company time.

Aggressive monitoring is not necessarily a great idea, as it communicates a lack of trust in employees and may interfere with their work. Certainly what the boss is doing in this case doesn't seem advisable. It seems disruptive, while also harming employee morale. But I would argue that he is only guilty of being an ineffective manager, not unethical (the question of legality in this jurisdiction aside).

Whether they are illegal in your specific jurisdiction is a much narrower question (which we can't answer, not being lawyers and not even knowing what country's laws apply). I personally find it mind-boggling that a company monitoring employee use of its own resources can be illegal due to "privacy", but there you go.

So, what to do?

  • I would not object on the basis of my privacy rights being invaded. Since I don't think that I have such a privacy right in the workplace (whatever the law says). Plus, "How dare you intrude on my rights by checking whether I am working!" just doesn't sound great, even if you have a legal basis for saying that.
  • A business argument against the monitoring would be the strongest basis for objecting. You have a much stronger case if you can argue that the monitoring is harming the company in some way.
    • If it is interrupting your work, raise the reduction in productivity as an issue. "This is costing us money" is usually the best argument you can make, particularly if you can back it up with evidence.
    • You could also raise the morale issue, but it is trickier. You could tell your boss "This monitoring is making employees unhappy, because we want to feel that we are valued and trusted", or some such argument. However, with this argument your motives are likely to come across as self-interested, even if you are stating it is for the good of the company. "Give us what we want so that morale will be good" will often be heard simply as "Give us what we want."
  • 12
    "In my country the employer is not allowed to monitor your activities due to privacy laws". So in OP the employer does not have the right to know what the employee is doing. – Taemyr May 12 '16 at 12:59
  • 3
    @Taemyr and dan, for what its worth, germany is like that. To monitor activity beyond outgoing internet access logs (and even that needs written consent prior for which the employee can not be not hired or terminated for refusing) monitoring employees is generally illegal in that way. The only exemptions from this are court warrants or probable cause, which involved prior incidents and a written consent from the employees. – Magisch May 12 '16 at 14:08
  • @Taemyr I understand that but I was trying to make a distinction between what I view as ethical and what the law in the jurisdiction states. I view such a law as unreasonable, and I don't think there is anything unethical in the abstract with an employer monitoring use of employee time. – user45590 May 12 '16 at 14:44
  • 6
    @dan1111 Then you where presenting your personal opinion as a fact. – Taemyr May 12 '16 at 14:47
  • @Taemyr the OP is asking for opinions about what they should do, and all answers are assumed to be opinion, surely? We don't need to start every sentence with "In my opinion..." – user45590 May 12 '16 at 15:09
3

IANAL but to me take over your PC is a stretch from "monitor your network activity for security reasons". It has gone beyond monitor, security, and network in my opinion.

Remotely take over a PC to the level you are locked out is clearly beyond monitor by any reasonable interpretation of the word in my opinion.

It indicates we can have a coffee break. As we can't use our pc's for that moment.

Shutting you down is beyond monitor and is just plain not productive.

If a principal comes to classroom to monitor a teacher and takes the chalk from the teachers hand and goes through the desk that is beyond monitor.

Can you do much? Maybe not. Is it really worth the battle of trying to get it shut down? He will still be an ineffective manager, with a boss that supports him, and you are the one that took away his favorite tool. The path of least resistance is to just accept it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.