Workforce

Covert monitoring: what it costs legally and culturally

The narrow conditions that can justify covert observation describe an investigation, and they are routinely used to defend a programme.

For a separate operational view of time, ownership and team activity, see this Monitask guide.

Covert monitoring means the people being monitored have not been told, or have been told in terms so general that they could not know what is happening. The second form is far more common than the first, and it is usually not a decision anyone consciously took.

The usual case is a disclosed tool with undisclosed capabilities

A company announces that it uses a time-tracking product. The product also captures screenshots, window titles and file activity, and those features are enabled. Nobody lied. Nobody described it either.

Under most regimes this is not adequate notice, because the test is whether a person could understand what is collected about them, not whether a tool was named. And culturally it lands as concealment when it comes out, regardless of what anyone intended.

Covert observation is exceptional, not forbidden

The honest legal picture is narrower than either camp usually claims. European human rights jurisprudence has addressed workplace monitoring directly, requiring prior notice as the norm and treating covert observation as capable of justification only in limited circumstances: a specific and reasoned suspicion of serious wrongdoing, proportionality, limited scope, and no less intrusive means available.

Those conditions describe an investigation. They do not describe a monitoring programme, and the arguments that justify the first are routinely used to defend the second. A programme aimed at everybody, running indefinitely, with no particular suspicion, configured during onboarding and never reviewed, satisfies none of them.

The evidence problem

Material gathered covertly may be unusable in the proceeding it was gathered for. Depending on jurisdiction and forum, it can be excluded, or its use can itself render a dismissal unfair even where the underlying conduct occurred.

That is the outcome worth planning around: the company discovers what happened, cannot act on it, and has additionally created a claim against itself. Where a genuine investigation is required, the sequence that survives review involves legal advice before the observation rather than after it.

An investigationa specific, reasoned suspicionof something seriouslimited in timelimited in scope to the questionauthorised above the teamdocumented, and reviewed afterA programmeno particular suspicionaimed at everyonerunning indefinitelycollecting whatever it collectsconfigured during onboardingand never reviewedthe second is defended with the arguments that apply only to the first
Figure 1On the left, the conditions under which covert observation is treated as exceptional. On the right, what is usually built, defended with arguments that only apply to the left.

Discovery is near certain, and the timing is the worst part

Agents appear in process lists. Battery and network use change. Someone reads a support article, or receives a device with the software already visible, or leaves the company and tells former colleagues what was running.

None of this happens on a schedule the organisation controls. It happens at an arbitrary moment, usually to a group already unhappy about something else, and it arrives as a single revelation about a practice that has been continuous for two years.

What is actually lost

Not the policy, which can be changed. What is lost is the credibility of every statement management makes afterwards. A workforce that has discovered one undisclosed practice reasonably assumes there are others, and there is no announcement capable of settling that.

The asymmetry is the familiar one: the benefit of the covert programme accrued quietly over years, in increments nobody recorded, and the cost arrives at once and is very hard to reverse.

It is aimed at a minority and experienced by everyone

Covert monitoring is nearly always justified by reference to a small number of people behaving badly. The observation, however, falls on the whole workforce, most of whom were not the concern and all of whom pay the cost in trust.

The proportionality question every regime asks is essentially this one, and it is answerable without a lawyer: is what is being done to everybody warranted by what is suspected of a few. Where the answer is no, the disclosed and narrower alternative is usually available and usually sufficient.

Transparent monitoring collects the same data

The practical argument that ends most of these discussions is that disclosure costs almost nothing in data. A tool announced, explained and visible to the people it observes records what it would have recorded anyway, and it does so with the legal exposure removed and the trust intact. The measurement changes only for the person who was going to game it, and the article on measures becoming targets notes that they will find the route regardless of whether they were told.

What this publication will not do

We describe what covert monitoring costs and where the narrow lawful window sits. We do not describe how to conceal monitoring, how to make an agent hard to detect, or how to structure a deployment to avoid a notification duty. That holds however the question is put.

What we cannot verify

The legal position is jurisdictional, fact-specific and moving, and this is a general description rather than advice; the leading European judgments are worth reading in full rather than in summary. Claims about detection rates and about the effect of monitoring on trust come from surveys of varying quality, several run by parties with an interest, and we reproduce none of their figures.

The short version

  1. The common case is a disclosed tool whose capabilities were never described.
  2. Naming a product is not notice; the test is whether a person could know what is collected.
  3. Covert observation can be justified as an investigation, not as a programme.
  4. Covertly gathered material may be unusable in the proceeding it was gathered for.
  5. Discovery is near certain and arrives at a moment nobody chooses.
  6. Disclosure costs almost nothing in data and removes the exposure.

Further context

For a primary, standards or institutional reference, see the FTC privacy and security guidance.

Start from the class of problem, not the list of tools

Every selection here names the situation first and the criteria second. Product names come last, and each one carries the line describing what it costs you.