Covert monitoring means the people being monitored have not been told, or have been told in terms so general that they could not know what is happening. The second form is far more common than the first, and it is usually not a decision anyone consciously took.
The usual case is a disclosed tool with undisclosed capabilities
A company announces that it uses a time-tracking product. The product also captures screenshots, window titles and file activity, and those features are enabled. Nobody lied. Nobody described it either.
Under most regimes this is not adequate notice, because the test is whether a person could understand what is collected about them, not whether a tool was named. And culturally it lands as concealment when it comes out, regardless of what anyone intended.
Covert observation is exceptional, not forbidden
The honest legal picture is narrower than either camp usually claims. European human rights jurisprudence has addressed workplace monitoring directly, requiring prior notice as the norm and treating covert observation as capable of justification only in limited circumstances: a specific and reasoned suspicion of serious wrongdoing, proportionality, limited scope, and no less intrusive means available.
Those conditions describe an investigation. They do not describe a monitoring programme, and the arguments that justify the first are routinely used to defend the second. A programme aimed at everybody, running indefinitely, with no particular suspicion, configured during onboarding and never reviewed, satisfies none of them.
The evidence problem
Material gathered covertly may be unusable in the proceeding it was gathered for. Depending on jurisdiction and forum, it can be excluded, or its use can itself render a dismissal unfair even where the underlying conduct occurred.
That is the outcome worth planning around: the company discovers what happened, cannot act on it, and has additionally created a claim against itself. Where a genuine investigation is required, the sequence that survives review involves legal advice before the observation rather than after it.
Discovery is near certain, and the timing is the worst part
Agents appear in process lists. Battery and network use change. Someone reads a support article, or receives a device with the software already visible, or leaves the company and tells former colleagues what was running.
None of this happens on a schedule the organisation controls. It happens at an arbitrary moment, usually to a group already unhappy about something else, and it arrives as a single revelation about a practice that has been continuous for two years.
What is actually lost
Not the policy, which can be changed. What is lost is the credibility of every statement management makes afterwards. A workforce that has discovered one undisclosed practice reasonably assumes there are others, and there is no announcement capable of settling that.
The asymmetry is the familiar one: the benefit of the covert programme accrued quietly over years, in increments nobody recorded, and the cost arrives at once and is very hard to reverse.
It is aimed at a minority and experienced by everyone
Covert monitoring is nearly always justified by reference to a small number of people behaving badly. The observation, however, falls on the whole workforce, most of whom were not the concern and all of whom pay the cost in trust.
The proportionality question every regime asks is essentially this one, and it is answerable without a lawyer: is what is being done to everybody warranted by what is suspected of a few. Where the answer is no, the disclosed and narrower alternative is usually available and usually sufficient.
Transparent monitoring collects the same data
The practical argument that ends most of these discussions is that disclosure costs almost nothing in data. A tool announced, explained and visible to the people it observes records what it would have recorded anyway, and it does so with the legal exposure removed and the trust intact. The measurement changes only for the person who was going to game it, and the article on measures becoming targets notes that they will find the route regardless of whether they were told.
What this publication will not do
We describe what covert monitoring costs and where the narrow lawful window sits. We do not describe how to conceal monitoring, how to make an agent hard to detect, or how to structure a deployment to avoid a notification duty. That holds however the question is put.
What we cannot verify
The legal position is jurisdictional, fact-specific and moving, and this is a general description rather than advice; the leading European judgments are worth reading in full rather than in summary. Claims about detection rates and about the effect of monitoring on trust come from surveys of varying quality, several run by parties with an interest, and we reproduce none of their figures.
The short version
- The common case is a disclosed tool whose capabilities were never described.
- Naming a product is not notice; the test is whether a person could know what is collected.
- Covert observation can be justified as an investigation, not as a programme.
- Covertly gathered material may be unusable in the proceeding it was gathered for.
- Discovery is near certain and arrives at a moment nobody chooses.
- Disclosure costs almost nothing in data and removes the exposure.