News for hackers. Stuff that matters.
Re:Bossware is a big legal risk by paxys on Wednesday May 15, 2024 @06:10PM (#40373016)
Everyone replying with "what's the big deal?" is showing their tech privilege. You may not have to deal with intrusive monitoring, but warehouse workers are increasingly being made to wear ankle bracelets so every movement of theirs can be monitored and stack ranked. Workers in WFH "gig" jobs are made to install always-on keyloggers and other monitoring software on their personal computers and phones (which are required for the job). Companies take photos/videos of them in their homes every few minutes throughout the day. Plenty of jobs require you to hand your social media passwords to your employer. There is an entire class of companies that specialize in all of this.

Not everyone is able to say "no" to all this and still make rent next month. I'm happy the government is finally stepping in.

Re:Bossware is a big legal risk by JanisErdmanis on Wednesday May 15, 2024 @06:13PM (#40373053)
> Plenty of jobs require you to hand your social media passwords to your employer.

Can you elaborate with examples or references?

Re:Bossware is a big legal risk by paxys on Wednesday May 15, 2024 @06:17PM (#40373078)
Why exactly do you think a half dozen states have passed laws specifically banning it? https://www.foley.com/insights/publications/2024/03/ny-socia...
Re:Bossware is a big legal risk by topkai22 on Wednesday May 15, 2024 @07:17PM (#40373510)
Re:Bossware is a big legal risk by heymijo on Thursday May 16, 2024 @01:13PM (#40380753)
“Kochland” includes a chapter on warehouse operations that tracked workers’ activity down to the minute (each conversation and bathroom trip had to be accounted for) and posted their performance rankings on a bulletin board.

https://www.nytimes.com/2019/08/13/books/review-kochland-sec...

Re:Bossware is a big legal risk by vundercind on Wednesday May 15, 2024 @06:22PM (#40373137)
> Not everyone is able to say "no" to all this and still make rent next month. I'm happy the government is finally stepping in.

More good news is that since workplace surveillance is already heavily-limited by law in some other highly-productive developed-economy states, this shit’s all probably pointless anyway. Just one of many cases of execs going full “seeing like a state” and wanting everything down to the finest detail to be “legible” and able to sort-by on a spreadsheet, even when it’s actually just noise.

Re:Bossware is a big legal risk by manuelmoreale on Thursday May 16, 2024 @04:38AM (#40376339)
Not arguing against your points but I'm wondering if this is more a US related issue? I never heard this being a thing here in the EU but maybe it's just me being unaware of all the various situations. I don't know anyone who works from home (whether in tech and in other sectors) that has to deal with all that nonsense.
Re:Bossware is a big legal risk by fnordian_slip on Thursday May 16, 2024 @04:53AM (#40376393)
Germany reporting in, couldn't see that becoming a thing here. I have about 99% wfh currently, and if my employer would try to implement something like that, the union would probably not even have time to get involved because the works council ("Betriebsrat", not sure if that's a good translation) would swat it down instantly.

It sounds insane, but believable for the US (but that might be my bias showing, I've always heard bad things about worker's rights in the US).

Re:Bossware is a big legal risk by Zak on Thursday May 16, 2024 @07:18AM (#40377063)
The fact that you have a Betriebsrat along with strong unions is why that sort of thing doesn't happen. Many European countries have works councils with a similar union-adjacent role. I'm not aware of an equivalent in the USA.

https://en.wikipedia.org/wiki/Works_council

Re:Bossware is a big legal risk by manuelmoreale on Thursday May 16, 2024 @05:30AM (#40376567)
Yeah I’m in Italy and I don’t know anyone who’s dealing with all that nonsense that’s why I was wondering if this is a US thing.
Re:Bossware is a big legal risk by nicoburns on Thursday May 16, 2024 @06:55AM (#40376950)
I have a friend in the UK (and this was a few years ago when it was still part of the EU) who worked for a company that had always-on screen monitoring installed on company computers and their boss would randomly remotely view people's screens to check on what they were doing throughout the day.

That may not have been legal, but it was certainly happening.

Re:Bossware is a big legal risk by pjc50 on Thursday May 16, 2024 @05:31AM (#40376569)
GDPR prevents most of this. There are rules about email snooping, for example: https://www.edps.europa.eu/data-protection/data-protection/r...

(presumably someone will be along to say that this is the EU destroying businesses by not allowing them 100% power over the lives of their employees)

Re:Bossware is a big legal risk by wccrawford on Thursday May 16, 2024 @06:32AM (#40376844)
I had never heard of this in the US until now, either. But I also don't work in a factory or warehouse, and don't know anyone who does.
Re:Bossware is a big legal risk by gcr on Thursday May 16, 2024 @08:19AM (#40377410)
American here, this feels very uniquely “American Capitalist” to me
Re:Bossware is a big legal risk by Repulsion9513 on Thursday May 16, 2024 @04:52PM (#40382984)
The US has significantly less privacy in general than most of the EU. The way the whole freedom thing is implemented tends to skew heavily towards "businesses can do whatever they think makes the most profit".
Re:Bossware is a big legal risk by quectophoton on Thursday May 16, 2024 @05:33AM (#40376580)
Last year when I started looking for jobs I landed a job in a company that did consulting services. All looked fine on the outside, but when I joined I found out they are doing software for this kind of stalking, and even use AI to classify employees as "productive", "not productive", and other criteria based on their computer's activity.

I noped the hell out of there without even having spent a week working for them. The fact that they even accepted those kind of jobs told me our sense of ethics was way too different, and I didn't want to contribute to that. If it were "just" web tracking, then I would be able to (barely) accept it, if a bit reluctantly. But that's more or less where I draw the line.

I still haven't found a job since then, and I'm currently barely surviving through freelance gigs. Professionally speaking, leaving that job might have been a mistake; but I still think it was the correct decision.

Re:Bossware is a big legal risk by sanitycheck on Thursday May 16, 2024 @06:03AM (#40376716)
I'd have done the same, and have done before when I've found myself on client projects related to online gambling (the business model is to milk addicts for everything they have and more, don't listen to anyone who says otherwise).

I know if I don't do it someone else will so it doesn't really make a difference - but at least I can retain some sense that I'm not the kind of person who does bad things, and that's worth something.

With web tracking you can at least be 'careless' in your implementation and 'accidentally' make it not work very well because most of the time nobody will ever test it properly. No way to get away with that with this "Bossware" stuff, it'll be in active use all the time.

Hope you find something better soon.

Re:Bossware is a big legal risk by quectophoton on Thursday May 16, 2024 @06:36AM (#40376862)
> With web tracking you can at least be 'careless' in your implementation and 'accidentally' make it not work very well because most of the time nobody will ever test it properly.

And users can normally install tracking blockers, either in browser or DNS-based (in your home's router), to at least prevent some thirdparty stuff from loading, so that's some defense against it.

Of course it's not always possible. But the chances that a user can do something against a web service tracking them are still better when compared to an employer's in-device tracking.

Re:Bossware is a big legal risk by tracker1 on Thursday May 16, 2024 @10:38AM (#40379027)
PIhole + Brave + uBlock Origin + Privacy Badger ... I'll deal with the occasional web app not working. More app/site developers should really test to make sure their app works with the ads blocked. When I've worked on public sites, I always tried to make the app degrade gracefully (depending on hidden/reserved element spaces).
Re:Bossware is a big legal risk by sanitycheck on Thursday May 16, 2024 @10:56AM (#40379203)
I also block this stuff, personally - but I'm not sure I completely buy the argument that it's OK to work on something because technically competent people can circumvent it. For example I wouldn't work on China's Great Firewall (not that they'd ask me to) - even though those with sufficient skill and bravery can penetrate it.
Re:Bossware is a big legal risk by tracker1 on Thursday May 16, 2024 @11:02AM (#40379265)
I didn't suggest, or mean to suggest as much... I mean that when I worked on a public site with ads, I made sure that the site continued to look right and operate when analytics and ads were blocked. Unless you're asserting that every website with ads or any kind of analytics/tracking is evil?
Re:Bossware is a big legal risk by sanitycheck on Thursday May 16, 2024 @11:25AM (#40379547)
Oh, absolutely - sorry if I implied that, I sensed the suggestion of it in the parent comment and clumsily followed on from your response to that part.

I completely agree with making sure things work as much as possible and look OK when stuff like that is blocked and even when JS is disabled.

Analytics can be useful and ads are a necessary evil for the prevalent web business model. Tracking is, ugh, I guess in theory acceptable with informed consent - though I've tested a couple of those "consent frameworks" that popped up after GDPR etc and even ignoring the dark UI patterns let's just say they didn't stand up well to scrutiny regarding doing what they say they do.

Re:Bossware is a big legal risk by tracker1 on Thursday May 16, 2024 @12:42PM (#40380407)
Yeah... I'm in the US, mostly having worked on local sites, so hadn't had to deal with that. At most, the tracking I've added is Google Analytics, but have also used other types of tracking in bursts to get usage flows, or ui heat maps on what is moused over/to, etc.
Re:Bossware is a big legal risk by quectophoton on Thursday May 16, 2024 @04:19PM (#40382660)
> I sensed the suggestion of it in the parent comment and clumsily followed on from your response to that part.

Nah it wasn't my intention to give that kind of impression[0]. I was just trying to add to the part I quoted from your comment (also the keywords from my first comment (not the one with the quote) were "barely" and "reluctantly").

It's not that I think it's okay, but I probably should have used the word "tolerate"[1] instead of "accept".

So basically I agree with you. I wouldn't work on something like GFW[2], or ad[3]/gambling/porn/blockchain/dating companies, or "VPN" services (in the diluted sense of the word), or Discord, or smart TVs, or software for IoT, stuff like that.

But I also know that if I want to get a remote job, I'll have to compromise somewhere.

---

[0]: Mic and cam recordings can be trivially circumvented by anyone who knows how to turn on a computer, for example, but even if I have permission/access to them, I won't touch those things unless it's to do something the end user wants to do.

[1]: There's probably a word that better captures the nuance tho. English is not my first language.

[2]: Or anything from countries who don't even try to appear like they follow the GDPR.

[3]: Where the ads are the product/service being sold. Or in other words, if a company uses adsense it's a maybe-work-for-them-but-try-to-find-something-else; if the company is adsense, it's a straight no.

Re:Bossware is a big legal risk by TheNewsIsHere on Thursday May 16, 2024 @03:31PM (#40382193)
> With web tracking you can at least be 'careless' in your implementation and 'accidentally' make it not work very well because most of the time nobody will ever test it properly.

I recently struggled with this. My situation was likely different given the outcome. I was able to prevail on both the sense of decency in the client and their marketing firm by explaining the PII ramifications of what they asked for, and was also able to prevail on how their customers would perceive it.

Not everyone has the luxury of clients and marketing agencies like that. I wasn’t sure whether or not I did until I tried it. I can’t know for sure until it’s needed whether I would have simply refused. I really wrestled with the idea of not doing my level best work as a technical implementer.

I found Kevin Burke’s “Ethics” to be a really great way of working [1]. He based it on an earlier piece by Kyle Kingsbury [2].

[1] https://burke.services/ethics.html

[2] https://jepsen.io/ethics

Re:Bossware is a big legal risk by adapiz on Thursday May 16, 2024 @09:05AM (#40377885)
Thanks to the article I now have the proper word for it: Bossware. I feel reminded of Ploito. It got advertised on HN. 6 months later I'm sure: It was an ad to gain attention. Idk what happened but it seems that the poster and their business owner became very silent 2 months after their pitch. It's still worth to quote the BO > "weed out the lazy and deceitful, thereby forming a healthy and efficient team." It's bossware disguised as a "cool" product to connect teams. You could say it's a Trojan horse. Sure the monitoring is all "optional" but the mentality is baked into the product.

For me it's just right to reject every potential company installing bossware alone for your personal health. People burn out under constant monitoring forced to be 100% productive all day. Have a bad day? Sad for you, it lowers your numbers. Sick leave instead? "Oh what a weak person, how unreliable". People with utilizing computers to effectively slave-drive people should be held responsible for the damage they cause. They should pay for the treatment if they drive people into depressions and burnout and neither health insurances or the society.

Re:Bossware is a big legal risk by tracker1 on Thursday May 16, 2024 @10:36AM (#40379004)
I worked through a couple onboarding/marketing projects for a large financial institution several years ago... I finished up my 6 month contract, but felt icky and didn't want to continue beyond that.

I also outright refused to work on a project for the RIAA at one time as well.

Re:Bossware is a big legal risk by Dalewyn on Thursday May 16, 2024 @06:13AM (#40376748)
>install always-on keyloggers and other monitoring software on their personal computers and phones

1. WTF is anyone doing using their personal belongings for their work? Cleanly and clearly demarcating personal and professional is CYA 101, for both employee and employer.

2. WTF is the employer doing if they don't provide all necessary tooling for the job prescribed?

3. WTF are you doing working for above employer? I sympathize not everyone can do so, but the only way such bullshit will change is if enough of the workforce says "nope" and quits for greener pastures.

Re:Bossware is a big legal risk by ghaff on Thursday May 16, 2024 @07:11AM (#40377036)
Especially when I was traveling a lot I routinely used my personal laptop and phone all the time. You can WTF all you like but situations do differ.
Re:Bossware is a big legal risk by LiquidSky on Thursday May 16, 2024 @08:39AM (#40377611)
3. WTF are you doing working for above employer? I sympathize not everyone can do so, but the only way such bullshit will change is if enough of the workforce says "nope" and quits for greener pastures.

...this is exactly what the parent comment is talking about. People take these jobs because you need money to live and not everyone has the luxury of being able to turn down jobs with shitty conditions. Employers take advantage of this and do things like require their employees to use their personal belongings.

1. WTF is anyone doing using their personal belongings for their work? Cleanly and clearly demarcating personal and professional is CYA 101, for both employee and employer.

2. WTF is the employer doing if they don't provide all necessary tooling for the job prescribed?

Because then they don't have to spend any company money.

Re:Bossware is a big legal risk by mrgoldenbrown on Thursday May 16, 2024 @09:56AM (#40378535)
1 and 2 is how all the gig companies like Uber, door dash, amazon delivery etc work. The line between personal and professional has been blurred intentionally by the big employers. This helps them CYA as you phrase it.
Re:Bossware is a big legal risk by BeetleB on Thursday May 16, 2024 @10:36AM (#40379002)
Regarding 1: Not everyone wants to buy a burner phone to do 2 factor authentication. And many (most?) employers won't provide one just for this.

The real evil are companies that require you to use a phone for 2 factor authentication and assert that they have the right to examine your phone because you use it for work purposes.

Re:Bossware is a big legal risk by lcnPylGDnU4H9OF on Thursday May 16, 2024 @05:44PM (#40383633)
Don't use 2-factor if they're not going to provide the hardware for it. Demand a U2F (e.g. https://www.yubico.com/) if they don't hand out phones. It's not your account and you're only responsible for the security inasmuch as they provide the means to make it secure.

(Not necessarily directed at parent, but anyone who is unsure or worried about this.)

Re:Bossware is a big legal risk by talideon on Thursday May 16, 2024 @07:01PM (#40384366)
I had to make a point of getting a company phone. If I didn't, it would've meant allowing my employer's IT department access to my phone, including the ability to read arbitrary data and to be able to wipe it. That's a big no, but thankfully they saw sense.
Re:Bossware is a big legal risk by steve_rambo on Thursday May 16, 2024 @06:19AM (#40376780)
This is crazy to read. I live in what you consider a highly authoritarian and non-free society and can't imagine something like this happening here. Lower paid jobs are even more privileged in some ways: for example, in many companies you can just not show up for work for a couple of days if you feel like it, and the worst thing you can expect is a small pay cut at the end of the month.
Re:Bossware is a big legal risk by Filligree on Thursday May 16, 2024 @08:01AM (#40377282)
America is a strange place, that’s for sure. It doesn’t look any saner from here in Europe.
[dead]
Re:Bossware is a big legal risk by saagarjha on Thursday May 16, 2024 @09:35AM (#40378269)
Turns out that happiness is not all about air conditioning or sitting in a car.
Re:Bossware is a big legal risk by tracker1 on Thursday May 16, 2024 @10:45AM (#40379092)
It will really vary. Most places I've worked, even in lower paid jobs in my later teens, they're pretty lenient and understanding with personal/sick time.
Re:Bossware is a big legal risk by Repulsion9513 on Thursday May 16, 2024 @04:48PM (#40382937)
I have found, between the span of $8/hour and $88,000/year, that the amount of tracking (and also the amount of "if you have time to lean you have time to clean"-type busywork) is very close to inversely proportional to income in the US.
Re:Bossware is a big legal risk by resource_waste on Thursday May 16, 2024 @08:31AM (#40377518)
>I'm happy the government is finally stepping in.

As a small player, I'm always afraid of this. Two of my companies died because of legal stuff that was outside the economics I could front.

Re:Bossware is a big legal risk by brianmcc on Thursday May 16, 2024 @11:03AM (#40379284)
if "don't aggressively spy on your employees" puts you out of business what on earth's your business model?
Re:Bossware is a big legal risk by resource_waste on Thursday May 16, 2024 @12:23PM (#40380186)
I read this as:

"remove management"

Doesnt that sound great? Cheaper, less subjective.

And sure, its cheaper to let Asia do it. They don't have the regulations. Get in-line and work for the established players!

Re:Bossware is a big legal risk by underlipton on Thursday May 16, 2024 @10:15AM (#40378771)
Well-positioned workers have little recognition of what lower-paid or lower-prestige labor has to deal with, even a few years out of such work. And when they know, they rarely understand. Seemingly small or innocuous things can make a massive difference in your experience at an employer. It was surprisingly frustrating having to throw my phone into a locker at my $16/hr warehouse job like I was entering a SCIF when, really, they just wanted to cut down on people taking photos of OSHA violations. The joke is that it was easy to use their disposition system to sneak photos to my email. Which is to say, this class of policy/tech just encourages people to find undocumented (read: insecure) ways to retain their at-work QoL.
Re:Bossware is a big legal risk by next_xibalba on Thursday May 16, 2024 @10:35AM (#40379000)
I can't find a single source for your claim that warehouse workers are being made to wear ankle bracelets. The closest I see is an Amazon patent from 2018. This kind of hyperbole is not helpful to conversations like this.

I've worked in factories and seen the degree to which productivity is an issue. I actually lobbied for us to use the time tracking that was already available to us via our ERP, and management declined. Humans are lazy by default. We seek the highest return on our effort. Building great things (i.e. making life better) requires us to fight this instinct.

Additionally, I have seen absurd abuse of WFH/remote since COVID among co-workers. There have been instances where I truly cannot wrap my head around someone seeing it as anything but theft. I don't particularly like being monitored either, but I definitely understand the motivation for monitoring or RTO initiatives.

Re:Bossware is a big legal risk by lukevp on Thursday May 16, 2024 @11:49AM (#40379808)
Your company isn’t using remote workers correctly. If there’s no way to measure work output besides physically seeing someone work, then there are fatal flaws in how you measure work output in the first place.
Re:Bossware is a big legal risk by paxys on Thursday May 16, 2024 @10:56AM (#40379197)
It is literally mentioned in the article, but sure.
Re:Bossware is a big legal risk by next_xibalba on Thursday May 16, 2024 @08:10PM (#40384925)
It is not. If I'm wrong, please quote the exact line in full.
Re:Bossware is a big legal risk by elicksaur on Friday May 17, 2024 @01:08AM (#40386577)
As pointed out elsewhere in the thread, the distinction of where a wearable device is worn on the body is not the most important point to most people.

I don’t see how someone can read the various articles about how closely workers are monitored in warehouses these days and be this defensive about the surveillance practices. Do you work for a tech company that uses a lot of warehouses? ;)

Re:Bossware is a big legal risk by ttyprintk on Thursday May 16, 2024 @10:59AM (#40379237)
Nice try. The memo from NLRB mentioned in the article makes the claim. National Law Review is the top search result on Kagi:

https://natlawreview.com/article/nlrb-general-counsel-issues...

Re:Bossware is a big legal risk by next_xibalba on Thursday May 16, 2024 @12:01PM (#40379941)
Neither your link, the article from OP, nor the actual NLRB memo mentions ankle bracelets.
Re:Bossware is a big legal risk by Repulsion9513 on Thursday May 16, 2024 @04:58PM (#40383047)
> For example, employers ... track [workers'] movements using wearable devices

2nd paragraph of GP's link.

> Abruzzo’s memo cites things like wearable devices for warehouse workers

6th paragraph of OP article.

I don't think the commenter meant literal ankle bracelets. But I think that's a bit pointless. I don't think it's okay whether it is a literal ankle bracelet, or some BLE tag in their badge. Do you think some option is okay?

Re:Bossware is a big legal risk by next_xibalba on Thursday May 16, 2024 @05:03PM (#40383107)
> Do you think some option is okay?

Yes, definitely. The distinction between a supervisor watching their employee vs. cameras + CV vs. using wearables to automate the watching seems completely arbitrary to me. Are you OK with a cab company monitoring its cars via GPS? Or a trucking company monitoring its loads via tracker? I am, and again, I find the distinction arbitrary. With one caveat–the employee is informed prior to employment that these tools will be used and they are a requirement of employment.

Re:Bossware is a big legal risk by Repulsion9513 on Tuesday May 21, 2024 @06:13PM (#40434699)
> The distinction between a supervisor watching their employee vs. cameras + CV vs. using wearables to automate the watching seems completely arbitrary to me.

I'd be pretty weirded out by constant camera and CV monitoring too

> Are you OK with a cab company monitoring its cars via GPS? Or a trucking company monitoring its loads via tracker?

Those are (a) not monitoring a person and (b) much more coarse than "what shelf is this person standing in front of". They tell the company that the cab driver parked, not that the cab driver took exactly 3 minutes and 33 seconds in the restroom.

I suppose my biggest concern with it is that it's measuring the wrong thing. If someone's doing as much as their coworkers even though they leaned on a shelf for 5 minutes yesterday, is that really a problem?

By comparison monitoring a car with GPS has legitimate purposes that actually advance the interests of the business.

Re:Bossware is a big legal risk by ttyprintk on Tuesday May 21, 2024 @10:15PM (#40436685)
The fascination with ankle brackets notwithstanding (does a badge worn at the ankle count? How bout an ankle bracelet obscured in the pocket?) I hope the safety aspects dominate anything like that. How many people are in the mine? How many minutes was each employee exposed to over 90 dB?
Re:Bossware is a big legal risk by hammock on Thursday May 16, 2024 @10:47AM (#40379114)
> warehouse workers are increasingly being made to wear ankle bracelets so every movement of theirs can be monitored and stack ranked.

Aha! The true use case for Neuralink - bossware installed in your brain, for knowledge workers.

Re:Bossware is a big legal risk by next_xibalba on Thursday May 16, 2024 @03:19PM (#40382055)
Neither this article nor the actual NLRB memo mention ankle bracelets. This is a hallucination from a member of the perpetually aggrieved class.
Re:Bossware is a big legal risk by brianmcc on Thursday May 16, 2024 @11:07AM (#40379323)
Plus workers in tech are absolutely not immune to this stuff and nobody should be complacent.

"They can't monitor me because I spent my morning mentor Alan the Junior at his desk" - that may be so but it won't stop them from trying, and the lag from deploying bad business intiatives to realising they're bad can be months or years in the making.

Re:Bossware is a big legal risk by t0bia_s on Friday May 17, 2024 @03:26AM (#40387339)
-> I'm happy the government is finally stepping in.

Why are you happy from taking learning process and responsibility from individuals? With regulation of sick mindset you potentially keep alive edited form of it.

Instead employees should really refuse to be part of those illegal activity and let company die naturally. This learn both sides.