How your boss can spy on you with Slack, Zoom, and Teams

Virtual workspace tools like Slack and Teams can be incredibly handy, both for those working in the office who need to send a quick message or arrange a meeting, and especially for those working remotely who need to stay in contact with their co-workers. With the rise of remote work, more and more office workers are spending a significant chunk of their day on these tools. However, if you use these then you should be aware that what you do in these systems isn’t private — most likely it can be seen by your boss. Even private conversations may not be as private as you think.

Contents

Slack
Zoom
Teams
Google Workspace
Additional bossware
Combining bossware and AI
Is this legal?
What can I do about this?

Slack

Apps like Slack, Teams, and other common business collaboration platforms are structured via admin permissions. In other words, with the right permissions, your boss can have a large amount of control over the platform and what’s happening on it. And if a manager goes to IT — well, they can ask to see just about anything that happens on the app.

Slack can export data on communication for companies upon request for low-tier plans, and higher-tier plans can give company management the ability to directly access information. Supervisors with permissions can see things like:

Any messages that have been sent on the platform in any way, including the ability to search for a particular time frame or certain words (private or public channels don’t matter in this case).
Any employee’s current status on the platform.
General data about how employees are using the platform, what sort of files are being shared, and so on.

Slack doesn’t delete messages but may limit how companies can search messages or allow employers to decide how long messages are stored. For the high-tier Enterprise Slack subscriptions, employers can look at just about anything as long as Slack has been used.

Zoom

Zoom changed a lot during the remote work boom and has generally become more conducive to employee privacy over time. The app allows you to separate business and personal accounts, for example, which is always a good idea. You can also directly upload Zoom meetings to your desktop instead of the cloud, which adds some additional privacy options for certain videos. However, the business version of Zoom does allow supervisors to do things like:

Read any chat messages sent between employees via a saved transcript after the meeting.
- This particular ability is part of Zoom’s Meeting Archiving feature, which has to be enabled by contacting Zoom Support. Meeting attendees should be notified that the meeting is being archived, and there is a specific notification for letting attendees know that their chat messages are being archived as well.
Review meetings uploaded to the cloud on the business account.
See when meetings take place, who is in them, and when participants join or leave meetings.

At one point, Zoom did have a feature known as “attendee attention tracking.” This feature essentially let meeting hosts know if participants are likely not focused on the meeting because the Zoom app window isn’t active. It’s worth noting that Zoom removed this feature as of April 2, 2020.

Teams

Microsoft Teams allows for a lot of employer tracking, depending on how much bosses want to see. In general, if you’re doing something on Teams, your employer can see it if they want to — there’s not much guaranteed privacy at all. With the right setup, bosses have the ability to:

Track all chats, calls, and meetings in any channel.
Track employee status, including how long they are active on Teams and how long they are away.
See the apps and Teams tools employees are using (within Teams).

Google Workspace

Employers have an incredible amount of spying power in Google Workspace, too, if they’re willing to pay for it. High-tier plans allow supervisors to access the “Vault,” which holds pretty much everything. That means employers can:

Search content from Google Drive, Groups, Chat, Voice Chat, Classic Hangouts, and Google Meet.
Search content sent through connected accounts on Gmail (that includes drafts of emails that weren’t sent).
Track sign-in times and activity.
Track how users create and send content.

Additional bossware

Graphs in Teramind. — Image used with permission by copyright holder

Business collaboration apps are only the beginning. There’s a whole additional field of software known as bossware or tattleware, which employers can demand that workers install. That includes tools like Hubstaff, InterGuard, Teramind, and TimeCamp.

Tools like these can monitor what social media apps you are using and how long you are using them, and even collect data on how you are using social media — including what you’re typing in your personal accounts. Timers and exceptions can be created, so employers have the ability to customize this monitoring software in many ways. Other apps like Hubstaff can take screenshots of your desktop, while Teramind can make real-time recordings on demand. And most bossware can at least track mouse movement and keystrokes to see how “active” you are being.

If that sounds like it could be invasive or harmful, well, the Center for Democracy and Technology appears to agree. They have warned that bossware could be hazardous to an employee’s health.

Combining bossware and AI

A creepy new aspect of bossware that is on the rise is combining these monitoring tools with AI to keep an even closer eye on workers and to predict who might be unhappy or job searching. The data collected on what employees are doing during their working day is being combined with the predictive abilities of AI to give “risk scores” to employees. Tools like RemoteDesk, Veriato, and Perceptyx all use a degree of AI to turn data from employees into predictions about how those employees might behave in the future.

And while these tools might be used for a degree of reasonable risk assessment, like checking patterns of suspicious activity which could indicate embezzlement or fraud, they could also be used to predict fully legal and reasonable behavior like interest in forming or joining a union, or even just looking for another job. A bad boss might decide to push out an employee who they thing is unhappy and looking to leave, or they might not want to fake their workers joining together in a union and pushing for better working conditions.

Adding AI to bossware doesn’t make anything extra visible from you as an employee — your employer will still see the same data such as the contents of your emails and messages. But the risk is that AI will be used to extrapolate patterns, for example highlighting employees who seem unhappy in their jobs based on the way they express themselves in their emails.

Is this legal?

Generally speaking, yes. A few states require employers to provide written notice to employees that they will be monitored, but even this isn’t common yet. As long as an employer doesn’t discriminate by targeting specific employees to monitor and doesn’t monitor employees away from work hours, there’s no legal recourse at this time.

Some few states are considering legal restrictions on bossware. New York, for example, currently has proposed legislation in Senate committee that would restrict bossware and oblige companies to perform a bias audit to check whether the tools were discriminating against certain groups of people. Bossware would still be allowed during working hours under the legislation, but only if it is put forward in the least invasive way and can be shown to serve a legitimate business purpose. This legislation isn’t in action yet though and still has a long way to go before it is.

It’s worth knowing that employers do have to follow state privacy laws and data privacy laws, such as the General Data Protection Regulation in the EU for European workers. They also have to follow anti-discrimination laws, so if it could be proved that bossware was impacting certain groups of employees more than others (in terms of legally protected characteristics like age, sex, or race) then that would be illegal.

However, in practice, there’s not a lot of legal restrictions on bossware yet and it doesn’t look like there will be any soon in many states.

What can I do about this?

Nothing on your business collaboration apps is private. Follow that rule, and you shouldn’t have much to worry about. If your bosses are actively tracking your status and activity as a way to measure your productivity, there are some ways to push back on this, such as making sure your Microsoft Teams status is always active or using a mouse jiggler to simulate mouse activity when you’re AFK. As for particularly invasive bossware, there aren’t many choices right now except considering if the job is worth it and what your other options may be.