Welcome to “Ask a security trainer,” the column where the digital security training team at Freedom of the Press Foundation (FPF) answers your burning questions at the intersection of journalism and security. Submit yours here! Let’s jump right into this week’s question.
Dear DST,
I heard my newsroom’s IT team may be able to remotely access my computer and look at what I type in. I wonder, how would I be able to tell?
Signed,
Super Vision
–
Hi Super,
If your employer gives you a computer, it’s important to remember that they might be monitoring it. This may be a reasonable thing to do to keep the device safe, for example, by ensuring it has the newest security patches or appropriate applications, or to be able to wipe it in case of theft. Unfortunately, we’ve also seen a growing trend of invasive “bossware” for monitoring employee productivity using keystrokes, screenshots, and more.
If you feel comfortable, I’d start by investigating your organization’s policies (e.g., in your employee handbook) surrounding when they may monitor employee devices, and talk to your IT team to learn what its standard practices are.
There are countless potential “layers” of workplace monitoring, so to paint a better picture, let’s talk through a few.
Mobile device management. If your workplace issued you a computer, it may be using mobile device management software to give someone on your team administrative access to the device. MDM can be used in a number of ways, such as configuring your apps, monitoring usage data, or wiping lost or stolen devices. MDM often leverages the operating system settings, which means you can typically go into your settings to see if it’s enabled.
Check if MDM is enabled on your device:
- Mac: Apple menu (top left) > System Settings > General > Device Management
- Windows: Settings > Accounts > Access Work or School
Browser management. Your workplace may also apply this same remote management idea to a browser. For example, administrators may enable management settings on your Chrome browser when you sign into a workplace Google account. They may use this to control browser extension installation and browser version, as well as to see last activity, whether someone entered a password into a phishing site, and more.
In Chrome, you can check if this is enabled by navigating to “chrome://management” in your search bar.
Productivity suite logs. Another layer to consider: When you use a workplace-controlled productivity suite like Google Workspace or Microsoft 365, as you navigate, the administrator may have logs of the activities taking place across documents, emails, folders, and so on. Some versions also allow your messages to be archived, whether they are deleted or not (e.g., via Google Vault, Microsoft Purview). Read our guides to learn more about the monitoring capabilities of Google Workspace and Microsoft 365.
There are many other ways a workplace might monitor your activities on your computer, such as through keystroke loggers, screen-monitoring tools, network analysis, and more. In general, it’s safest to assume that when you’re at the office, or using a workplace device, the employer does have at least some visibility into what you’re doing with that device.
Be prepared, not scared
On our team, we often talk to journalists about being prepared, not scared. Factor these considerations into how you use workplace devices. Keep the “fun stuff” on your personal phone, and you’ll likely be fine.
Given how wide-reaching and, at times, invasive workplace surveillance can be, try to avoid using personal devices for work. If you are asked to install anything from work on your personal phone or computer, search for it in advance to understand the implications for your privacy, and consider asking if it’s possible to have a workplace-issued device instead.
Talk to your IT team about what policies are in place surrounding the use of workplace monitoring tools, and where these policies are listed, so you can take a closer look.
Just know your employer may have a log of that, too.
Best,
Martin Shelton
