Activity monitoring software

[mem80]

I've been just offered the new contract. H
owever, my agency said to me that they ask their contractors to install activity monitoring software on their laptops.
I am not sure whether this is requirement from the agency or the end client - will try to clarify it.

Have you every had such request from your agency / client? Have you installed such software on your laptops?
Is such software (SentryPC) safe in terms of data collection (ex. passwords typing) ?

Contract has been assessed as outside IR35 - how that that requirement relates to the 'Control' factor of IR35?
Is it actually legal to require installing that software? It looks such software sends screenshots of the monitors from time to time - screenshots could contain confidential data: code snippets (intellectual property), names / surnames (GDPR), sometimes passwords, credentials etc. Is it legal to collect such data?

Any advice how to deal with this case and / or your experiences from the past are welcome.

[eek]

Personally I would keep looking

[Protagoras]

Personally I would keep looking

+1.

Also,

Is it clear whether this arises out of a security requirement, or a desire to monitor productivity, or both?

In the case of the former, it's common for clients to issue laptops to contractors, with preinstalled VPN and security software. If this is the case then it would seem reasonable that the client provide the laptop.

I'm sure that many of us prepare work products on the most suitable platform and then copy the deliverables to the client's system (device), as would be expected of a contracting organisation, via a release process. The client's monitoring software won't see all the development work and it won't be captured by productivity monitoring. But then who knows the client's understanding of others' working practices anyway?

[eek]

Got to say the only connection I have to my current client is a Remote Desktop connection to a virtual machine that contains everything.

npw that may have monitoring software on it but I couldn’t care, it’s not my hardware and it probably hasn’t because this contract has way more meetings and less work than I usually want,

[jamesbrown]

I wouldn't touch that at face value, but also because of what it implies about how the client operates more generally (they are likely to want a lot of D&C).

[cojak]

No way would I allow any monitoring software installed on my laptop.

Tell them to supply you with their laptop or use a virtual remote as eek suggested.

[mem80]

Yes - they said they can supply their own laptop.
However, I still have couple of concerns as described in the original post.

Especially:

• capturing keystrokes (ex. passwords related to browser history),
• screenshots (PII, slack conversations, passwords, keys, certificates etc.),
• GDPR (PII info) etc.

Have any of you worked with activity monitoring software on the supplied laptop?
Does the above sounds like a concern for you in such case?

[WTFH]

Have any of you worked with activity monitoring software on the supplied laptop?

I might have done, I don't know, because I may have been supplied with a very secure laptop so I can't check everything that's on there.

If you're worried about browser history, etc, then don't use the client-supplied computer to access anything you don't want them to know about, if they want you to get keys or certificates for things, then you charge them for those and you make sure that you only use the key/certificate/password for that client.
Same with GDPR, don't put personal information on a client's laptop, then it's not an issue.

If it's going to be a big issue for you, then walk away from the contract.

[tazdevil]

Yes - they said they can supply their own laptop.
However, I still have couple of concerns as described in the original post.

Especially:

• capturing keystrokes (ex. passwords related to browser history),
• screenshots (PII, slack conversations, passwords, keys, certificates etc.),
• GDPR (PII info) etc.

Have any of you worked with activity monitoring software on the supplied laptop?
Does the above sounds like a concern for you in such case?

If they supply their laptop for use then simply remote desktop into it from your own box and only do the work stuff in their laptop with everything else such as surfing CUK on your own As for installing anything under direction on my kit, forget it

[ladymuck]

Yes - they said they can supply their own laptop.
However, I still have couple of concerns as described in the original post.

Especially:

• capturing keystrokes (ex. passwords related to browser history),
• screenshots (PII, slack conversations, passwords, keys, certificates etc.),
• GDPR (PII info) etc.

Have any of you worked with activity monitoring software on the supplied laptop?
Does the above sounds like a concern for you in such case?

The only person who can answer details about the data being collected is the client. Have they told you that's what's being collected or are you panicking based on no information?

So you're worried that using a client-supplied laptop to deliver the contracted items to the client is going to collect information about the work you've done to deliver the contract?

Yes, sounds like supervision and, potentially, control so I'd walk away on those counts (especially as it's supposed to be an outside job) but I'm also interested in what you're planning to do that would mean you'd fall foul of their monitoring. Are you planning on outsourcing the work without telling the client, or doing two jobs at the same time so you'd look inactive for half the day?