Now that the terms “ransomware” and “malware” have been added to the 21st century dictionary, it’s time to learn another: “bossware.” Bossware is software that allows supervisors to monitor employees at all times and automate the task of surveilling them. But unlike computer viruses, which seek to damage our machines, bossware is potentially dangerous to our very bodies and minds.
While there’s no good data on how many companies are using bossware to monitor their employees, we can say with confidence that these tools are widespread and growing at an accelerating rate. Three years ago, a survey of 239 large corporations found that more than half were already using “nontraditional monitoring techniques” such as “analyzing the text of emails and social-media messages, scrutinizing who’s meeting with whom, gathering biometric data and understanding how employees are utilizing their workspace.”
That was before the COVID-19 pandemic forced millions to work remotely, during which time companies doubled down on finding new ways to monitor and manage their workforces.
Warehouse workers who pause for a moment to use the restroom or catch their breath can be flagged by bossware, which records it as “time off task.” Drivers who stop between deliveries to use the restroom can be tracked by GPS sensors that record where they stopped and for how long. Even employees who work from home aren’t safe from this intrusive surveillance. There is a burgeoning industry of companies developing and selling software that can track every click and keystroke that remote workers make, take periodic screenshots of workers’ computer screens, and even use webcams and microphones to monitor workers’ physical movements and activities in their own homes.
Employers feed the data collected by these systems into algorithmic management platforms that automate tasks traditionally employed by human managers, including assessing workers’ productivity and performance and making disciplinary decisions.
In a new report, I look at how these tools — which aim to squeeze every possible drop of productivity from workers — threaten not only their privacy, but also their health, safety, and well-being.
Bossware discourages workers from engaging in lawful, health-enhancing behaviors such as taking breaks to avoid fatigue or using the bathroom. A faster work pace with fewer breaks increases the risk of physical injuries, particularly those stemming from repetitive motion. These practices also increase job strain, which occurs when workers face high job demands but have little control over their work.
Decades of research links job strain to a host of mental and physical health disorders including depression, anxiety, ulcers, and cardiovascular death.
The health and safety threat that bossware presents is particularly acute for disabled workers, especially since the one-size-fits-all standards enforced by bossware systems do not take those workers’ unique health and safety needs into account.
Belatedly, it seems regulators may be catching on. In May, the state of Washington issued a groundbreaking citation against Amazon and fined the tech giant $7,000 for alleged health and safety violations at its Dupont, Wash., warehouse. Ordinarily, a tiny fine by an enforcement agency would be nothing remarkable, as thousands are handed out by authorities every year. But the May citation may be the first of its kind in the U.S. to tie the alleged safety violation to Amazon’s use of automated systems to enforce its productivity standards.
Of course, a $7,000 fine is unlikely to change company behavior, which underscores that existing law is simply not adequate to meet the scale of the threat that exploitative uses of bossware present to workers’ health and safety.
Current laws were not designed for a world where employers use technology to continuously monitor employees, impose a grueling work pace, and effectively eliminate workers’ discretion to take breaks or determine when and how they perform their assigned tasks during the workday.
Most notably, the Occupational Safety and Health Administration (OSHA) does not have standards requiring employers to provide rest breaks, prevent repetitive motion injuries, or protect workers from the well-documented health consequences of job strain. OSHA also does not protect employees who work from home.
Given the potential dangers associated with employers’ uses of bossware, additional legislation and regulation to plug these gaps will be needed to fully protect workers’ well-being. The EEOC should also issue formal guidance warning employers against using bossware to establish or enforce rigid workplace standards that disadvantage disabled workers.
In the meantime, workers and their advocates should make every effort to understand workers’ rights under existing law. The Occupational Safety and Health (OSH) Act generally requires employers to maintain a safe workplace, and its regulations require employers to let workers use the restroom promptly whenever necessary. Workers with disabilities enjoy strong protections under the Americans with Disabilities Act (ADA), which requires employers to reasonably accommodate disabled workers and avoid adopting practices and standards that have the effect of discriminating against them.
Bossware is only going to get more sophisticated and cheaper, and its risks require careful scrutiny by regulators and the public alike.
Employers are already tracking today’s workers with a previously unimaginable level of detail. Imagine how much more intrusive bossware will become if policymakers don’t take it seriously. Our physical and mental health demands lawmakers take action now.
Matthew Scherer is senior policy counsel for worker privacy at the Center for Democracy & Technology.