If you have a corporate laptop of ours I can log into the security dashboard and see the 15th command you issued in the terminal on December 12th, which processes it spawned, which files it accessed, which servers it reached out to... and this is with standard AV software. We're not even set up for worker monitoring (nor do we have interest, our mandate is on the security side not the HR side) but I could probably piece together a decently solid idea if he was pulling up outside messages or pulling in completed work from an outside system even without such additional worker monitoring tools.

Curious what system or provider you have that could do this?

I worked at an audit+consulting firm, and our laptops had at least 5 different "security" applications, most of them spyware. Then 2 anti-viruses (eew).

They actively MITM TLS traffic, getting some Java applications like IntelliJ to work was a mission.

___

I once interned at a defence company where it was common to hear folks saying "if your PC keeps on freezing, it's IT taking screenshots". This was in 2007-2009, so a while ago.

___

My colleague's spouse got sabotaged by their former employer, to make them break their non-compete. The employer spied on their laptop (not a work one, as they'd left). One day the cursor started moving, files getting copied, kind of vibe.

They also sent "customers" to their business, legit and otherwise, to make them err and break their non-compete. Then with some legal muscle, they enforced the non-compete, forcing them out of business. This is a recent thing of 2020.

Most management software on a company laptop (or endpoint in jargon-speak) will be set up to allow this and your company's policy will allow them to activate monitoring software if an investigation is required. It probably won't be used unless you're already in deep shit, which the person in TFA pretty much was.

It's not that unusual.

And, it explicitly mentions concerns about getting the equipment back. So it's a company owned computer.

Could be, or they could be referring to some of the heavy-handed remote monitoring software that gets installed on a lot of corporate laptops.

It's common for companies to lock down corporate laptops and have records of communication from the approved software. These companies also, wisely, don't let just anyone pull up those records on employee computers. You have to engage with HR and/or legal at minimum.

If it's a company computer, they might have been able to screenshot or record the screen.

Why is that strange? That seems pretty normal for a company IT department to be able to do. My employer can read all my email and chat history, and can remotely install arbitrary software on my work laptop without my knowledge.

Also consider that the person writing to this blog might be non-technical, so even though "putting a trace" on something sounds like bad movie dialogue, it's more or less reasonable to say.

right - that's weird language. That said, machines are often under GPO / Mdm type control, and it is trivial if needed to monitor a machine if there is an OK (ie, not used to harass / flirt / spy) on someone.

Normally best practice is that someone outside of workgroup reviews results for a predefined concern (ie, slacking off, running a side business on company time, etc). This is just because you can end up with tons of personal details (ie, bank balances - wow they are rich / poor etc). With remote work I think this is less common / would be less acceptable. I have some light govt exposure and this was sometimes done to see if folks were browsing porn (ie, new firewall or something would start reporting adult site use and then they'd do something on the actual computer to see what was up) or slacking - partly because govt work didn't always have good productivity metrics to work against. More recently they just seem to block things like porn at work by default.

I think it's weird wording from legal. My guess is that the work laptop has security software preinstalled that routes traffic through a proxy that they can see, even encrypted traffic. So they're just collecting John's traffic for analysis

Agreed. This reads like those memes about men writing female characters..

We used to do this in the 90s for suspected fraud/ misuse of office. I’m sure it’s way easier now.