Workplace Surveillance and Insider Threat Risk Management: Legal Limits and Privacy Harms

Workplace Surveillance and Insider Threat Risk Management: Legal Limits and Privacy Harms

arXiv:2608.21205v1 [cs.CR] 21 Aug 2026

Haywood Gelman † , John D. Hastings ‡ Suvineetha Herath ‡ , and Quentin Covert §

Abstract—Workplace surveillance is used by organizations to protect corporate assets and monitor employee productivity. This research presents two central arguments on workplace surveillance: although surveillance serves legitimate organizational purposes, over-surveillance can violate legal requirements and data privacy principles; and a primary security objective of workplace surveillance is the detection of insider threats (InT). InT are comprised of individuals with authorized resource access whose intentional or unintentional actions may damage or compromise corporate assets. This paper investigates InT personas to understand behavioral and psychological detection criteria. Employee surveillance tools and techniques are reviewed to characterize the employee surveillance landscape. Workplace privacy laws, examples of over-surveillance, and the resulting privacy harms are addressed. The review identifies research gaps related to over-surveillance, including the generation of excessive alerts that may obscure meaningful InT indicators. The paper concludes with recommendations to improve workplace surveillance transparency, implement InT training programs to improve organizational detection capabilities, and tune InT tools to detect relevant psychological and behavioral indicators. Index Terms—Workplace surveillance, Privacy harms, Insider threat risk management, Electronic monitoring

I. I NTRODUCTION Organizations use workplace surveillance to monitor productivity, protect intellectual property and other sensitive assets, enforce workplace policies, and satisfy legal and regulatory obligations [1–3]. Use of software and hardware tools to monitor activity and network usage are often viewed by employees as an expression of distrust by their employer and a violation of data subject rights [4]. This view can be tempered in light of electronic surveillance’s long history in the workplace [5] with collection for a purpose [6]. This history includes physical monitoring with cameras [2, 7], activity sensors [8], digital monitoring of emails [9], phone calls [10], log analysis [11], user entity behavior analysis tools (UEBA) [12], and social media monitoring [1]. Monitoring also extends to personal phones, tablets, computers, and other electronic devices connected to corporate infrastructure [7]. Much of the literature is dedicated to the opposition to or limitation of employee surveillance based on privacy principles [4, 8, 9, 13]. This study presents a more nuanced view where † The Beacom College of Computer & Cyber Sciences, Dakota State University, Madison, SD, USA. Email: haywood.gelman@trojans.dsu.edu ‡ The Beacom College of Computer & Cyber Sciences, Dakota State University, Madison, SD, USA. Email: john.hastings@dsu.edu ‡ Department of Information & Communication Technology, Carl Sandburg College, Galesburg, IL, USA. Email:sherath@sandburg.edu § The Beacom College of Computer & Cyber Sciences, Dakota State University, Madison, SD, USA. Email: quentin.covert@dsu.edu

focused monitoring is required for organizations to address the true target of employee surveillance policy: insider threat (InT) personas that are responsible for the risk. Perception of organizational risk presented by individuals influence recognition of InT personas, and is directly related to risk of data privacy harms that can occur as a result. This review examines representative cases in which productivity monitoring, biometric technologies, and the collection of sensitive employee information exceeded their stated purposes or created significant privacy risks [14–19]. These cases are analyzed in relation to workplace privacy laws and Solove’s taxonomy of privacy harms [20, 21] to clarify when legitimate organizational monitoring may become disproportionate or harmful. The review also connects workplace surveillance practices to unintentional, intentional, and opportunity-based insider-threat personas [22–25]. It identifies gaps in surveillance transparency, insider-threat education, and the use of behavioral indicators in detection systems, and presents corresponding policy, training, and technical recommendations intended to support more focused and proportionate monitoring. The study is directed by the following research questions: • RQ1: What types and methods of surveillance do organizations employ to monitor employee electronic and physical activity? • RQ2: What are the legal limits of workplace surveillance and what privacy harms can it cause? • RQ3: What gaps exist in employee surveillance approaches, and how can techniques be refined to reduce privacy harms and unnecessary monitoring while improving outcomes? II. M ETHODOLOGY This study conducted a literature review that assessed employee workplace surveillance tools, practices, limits, and privacy harms. Papers were obtained from database searches and websites in peer-reviewed journals, conferences, books, book sections, documents, theses, law review journals, law review journals, reports, NIST standards documents, statutes, and newspaper articles. Searches were executed with IEEE Xplore, ACM, Google Scholar, and targeted Google searches for relevant newspaper articles and standards documents where appropriate. One preprint was collected but not used. Keywords included “employee surveillance”, “employee surveillance AI”, “electronic employee surveillance”, “employee monitoring”, “workplace privacy”, “workplace privacy laws”, “workplace privacy state laws”, “employee surveillance tools”, and “privacy harm”. Similar search criteria was applied to each source

to maintain consistency. Abstracts and overviews for 231 sources were read and relevant, documents compiled, followed by a complete reading of selected sources to attain the 120 utilized in this study, and deduplication applied. Relevance was determined at two levels: pertinence to the research questions and applicability to the paper’s proposals on organizational justification for workplace surveillance. While no categorical measurement was implemented for the methodology, layered literature search methods [26, 27] safeguarded the approach to maintain validity, and to mitigate selection bias through careful search term constructs and organizational discipline [22]. Table I describes the selected databases, records located, records selected, and document types compiled for the study. TABLE I S EARCH C RITERIA AND R ESULTS Database

Located/Selected

Document Types

NIST ACM IEEE Xplore Google Scholar

3/3 15/7 52/24

standards documents conf. paper, journal article conf. paper, journal article

106/54

website statute

31/16 24/16

conf. paper, journal article, doc., book/book section, thesis, preprint, report law review, news articles, court case Publications on legislative websites

Total

231/120

13

Extensive research on employee monitoring during the COVID-19 pandemic is a singular area of research. Although some examples are provided in the context of employee surveillance, pandemic-era employee monitoring is outside the scope of this paper. General Data Protection Regulation (GDPR) defers workplace privacy laws to its member states [28–30]. An extensive analysis of workplace surveillance laws in European Union (EU) member states is also out of scope for this paper, although some examples of GDPR fines are included as examples. The Privacy Act of 1974 [31] addresses aggregation and data management for private citizens’ data in federal databases, but is not related to workplace surveillance and is also out of scope. Workplace privacy laws are culturally and regionally relevant, enabling future work for out of scope areas of study. III. L ITERATURE R EVIEW A. Insider Threats and Risk Management Overview (RQ1) InT risk management addresses causality of behavioral, psychological, and technological indicators through educational perspectives [22]. It also describes InTs as individuals with sanctioned access to information, systems, and infrastructure [22, 32] who compromise, damage, or steal intellectual property, confidential, or proprietary data. Research also defines common personas that determine an individual’s propensity toward sub-criminal behavior [33]. Understanding personas is based on classification of characteristics, motivations, and behaviors (CMB) that drive insiders to commit InT acts [34]. CMB include policy ignorance and computer misuse [35, 36], financial and revenge motivations [37, 38], and Dark Triad

traits [33, 39]. Personas include unintentional insider threat (UIT), intentional insider threat (IIT) [23], and insider threat of opportunity (ITO) [22, 24, 25]. As a result of this combination of factors, and despite the decline in malicious InTs in 2025 and the lower likelihood overall of insider activity [40], InTs possess influence that far outweighs their small numbers due to their trusted status [22]. Greitzer et al. [41] determines a list of “psychosocial indicators” describing patterns of behavior demonstrating precursors of InT risk. Previously described employee surveillance tools collect information on physical movement and digital monitoring. In addition, overarching crime and prevention theories are proposed, including situational crime theory [42], cognitive dissonance [43], general detection and social bond theories [34], and protection motivation theory [44] define the framework around which seminal authors describe the InT risk management landscape. This descriptive research of diverse InT factors proposes that the true target of employee surveillance is the prospect of InTs within an organization, and should not be construed as a quantitative contrast. A brief description of the three most common InT personas follows to position InTs within the structure of employee surveillance. 1) Unintentional InT: Schoenherr [23] attributes insider threats to “individual motivation and social context.” UIT are characterized as possessing an impaired intent to commit an act, while lacking requisite training to prevent one [45]. Characteristics also include difficulty in following policy, and a propensity to overshare information online due to cognitive perceptions of stress and time [23]. UIT make up the largest percentage of InT, with 80% of UIT actions attributable to human error, and to a lesser degree, inattentiveness and fatigue [46]. Employee surveillance for indicators of UIT include “reporting culture” [47], internet monitoring [44], policy adherence and productivity monitoring [48]. 2) Intentional InT: IIT are seen in much smaller numbers than UIT, but have the ability to inflict more harm. This is due to differing CMB [34] and social paths [23]. CMB include a disregard for policies [41], feelings of resentment toward the organization [49], financial hardship [23], and attempts to gain access to content in excess of given permissions [50]. Per DTEX [49], 15% of separating employees stole sensitive intellectual property when they departed the organization. Employee surveillance for indicators of IIT include log analysis [11, 51], social network monitoring [52], human relationship monitoring [53], machine learning [54], and UEBA tools [12]. 3) InT of Opportunity: Though the ITO persona was identified by penumbras in the literature [22], it was first introduced by Padayachee [24] as a malicious insider who waits for the opportunity to commit an InT act. Aspects of the ITO persona were also discussed in related work [25, 33, 39] as Dark Triad traits of narcissism (self-importance), Machiavellianism (arrogance and manipulation), and psychopathy (lack of self control). Characteristics of ITO include heightened intelligence, calm demeanor, and the observational and technical skills to observe an opportunity to act, similar to Dark Traits [25]. Padayachee’s study on minimization of opportunity-

based InT [24] drew connections to the fraud triangle stating the unique nature of opportunity-driven InT activity along with Cressey’s pressure (purpose for committing a crime) and rationalization (justification) [55]. ITO are difficult to detect due to these characteristics, but can be detected through social engineering [56, 57], UEBA tools [12], digital semantic analysis [51], deep log analysis [11], and behavior modeling [58]. Perhaps the most unique of these risks is social engineering, as ITO uses social engineering skills not to influence an individual outside the company to compromise private data or steal credentials, but to influence an internal UIT or IIT to commit an InT act [56, 59–61]. InT personas as described demonstrate surveillance tool intersection between employees and insider threats. Table II synthesizes the connections between surveillance intent, InT personas, the tools deployed to perform surveillance, the laws intended to govern their use, and the privacy harms that result from over-surveillance. The table describes legal gaps where numerous activities are ungoverned. Employers need to proportionally apply surveillance tools and techniques based on the observed risk to the organization, collecting only what is required to perform the task, while maintaining compliance with laws [67].

B. Employee Surveillance Tools and Practices (RQ1) Several categories of employee surveillance tools collect, analyze, and disseminate data for different purposes. Email surveillance is designed to prevent the inappropriate use of corporate email to maintain outside-work activities, protect against harassment, and prevent phishing attacks [1, 7, 68]. AIdriven audio and video monitoring, as well as electronic communications, enables employers to draw machine-controlled insights from large datasets [19, 69]. Camera-based monitoring is intended to capture productivity data locally on personal computers and in open areas to ensure productivity and policy adherence [70]. Internet monitoring, web filtering, and cloud access security brokers are designed to observe and prevent access to unsanctioned websites, file sharing sites, banned content, and excessive use [71, 72]. During increased use of surveillance technologies during the COVID-19 pandemic, employers used advanced internet monitoring software in addition to keyloggers as a way of tracking potentially damaging actions on the part of an unintentional lapse of judgment or awareness [68, 73]. Deep log analytics are implemented through machine learning techniques to discover hidden intent through behavioral system access techniques with security incident event management (SIEM) and syslog tools [58, 74, 75]. UEBA tools are used in conjunction with deep log analytics to create a more complete InT attack visualization [12]. Last, biometric data collection and algorithmic decision making tools are used by employers to validate employability and exclude applicants from consideration based on AI data analysis [19, 76].

C. Surveillance Limits (RQ2) As previously described, the three primary purposes of employee surveillance are to monitor employee productivity, mitigate electronic abuse of corporate resources, and to detect InT risk to information, systems, and infrastructure. Surveillance limits are guided by their adherence to enacted laws for the purpose of accountability, detailed in the section that follows. In 2020, Barclays risked a maximum $1.2B USD UKGDPR fine for implementing surveillance software to monitor the amount of time employees remained working at their desks throughout the day [14]. When originally implemented, the tool provided anonymized tracking to leadership, functionality that was eventually augmented to allow tracking of individual productivity [14]. In a similar example, pre-GDPR, Barclays installed heat and motion sensors under the desks of office workers to monitor the amount of time they spent physically at their desks [7]. Amazon used web cameras to track employees against a metric measuring time away from their desks [77], as well as using AI cameras to track safety of delivery drivers and punished them for violations as determined algorithmically [15]. Amazon France Logistique was fined C32 million by National Commission on Informatics and Liberty (CNIL) in 2023 for monitoring warehouse employees through the use of handheld scanners [17]. The scanner system itself was not designed as a surveillance tool, but was repurposed by collecting scans-per-second metrics for each scanner [78]. The White Castle restaurant chain was successfully sued by an employee claiming violation of biometric rights by the chain in how the company collected and used fingerprint data related to paychecks in Illinois [18]. In 2020, the H&M retail clothing chain based in Germany maintained excessive surveillance on employees in Nuremberg that included personal details on health, time off, and family problems [79]. Accidentally exposed data on a network drive maintained by management enabled full visibility of its contents and revealed the extent of the surveillance [80]. H&M was fined C35.3 million USD by the German EU Data Protection Authority [80]. In these examples of surveillance limits, most were resolved by the organization changing surveillance direction, but examples include a potential GDPR fine [14] and an actual fine [80]. D. Employee Workplace Privacy Laws (RQ2) 1) Workplace Privacy Laws Overview: U.S. state data privacy laws are described universally as a patchwork of state laws with no comprehensive law governing data privacy [81]. The same can be stated regarding workplace privacy laws in the U.S, which according to [82], “These privacy laws mirror the shortcoming of our workplace regulatory system as a whole: a patchwork of federal and state legislation that leaves huge gaps in protection for a large swath of workers under numerous legal situations.” The differences in data privacy laws creates confusion, but regional differences in laws can at least establish a baseline of compliance [81]. The workplace privacy laws enacted by 28 states are organized

TABLE II C ONNECTING I N T, S URVEILLANCE I NTENT, T OOLS , L AWS , AND P RIVACY H ARMS Surveillance Intent

InT Persona

Tools

Laws/Legal Restraint

Privacy Harms

Personal account monitoring

IIT, ITO

Account surveillance

surveillance, intrusion

Theft and productivity detection

IIT, ITO

Audio/video mon.

IRPWA [62] NYS-201-I [63] NYSC52 [64](personal acct. access) MESA [65], NYS-C52 (advance notice)

Perimeter and physical security

IIT, ITO

Camera surveillance

Banned sites, unsanctioned sites Unauthorized access

UIT, IIT UIT, IIT

Analyze access intent

IIT, ITO

Inter/intranet monitoring Keyloggers, location tracking Deep log analytics

Analyze behavioral intent

IIT, ITO

UEBA

MESA [65], NYS-C52 (advance notice)

Analyze access patterns

IIT, ITO

Biometric

BIPA [66]

into key thematic areas. Legal themes include personal social media and online account protection, employee and applicant personal data protection, employer digital monitoring notice requirement, biometric data, and personal vehicle tracking notification. 2) Consent to Recording: Every state in the U.S. has enacted laws that govern one, two, or all party consent to either listen/observe a phone conversation unknown to the other party (eavesdrop), record a conversation, or both [83, 84]. The Electronics Communications Privacy Act (ECPA) also prevents wiretapping at the federal level for one-party consent [85]. Arguments have been made as to the constitutionality of preventing listening/recording under the First Amendment, but legal precedent has positioned one and two party consent laws as outside the sphere of first amendment litigation, in contrast to some legal scholars’ opinions [86]. The legal requirement states that one or both parties to a conversation, state-dependent, must consent to recording for the recording to be legally permissible [84]. In the case of a customer support organization informing a customer that their conversation may be recorded for training, the customer can simply state they do not wish the recording to take place. In the case of clandestine recording without consent, the party recording the conversation would be in legal peril, in some states, as a felony [87]. Consent to recording is an underlying factor in the state workplace privacy laws that follow. The privacy laws discussion is restricted to laws enacted in states specific to workplace privacy, excluding states like Massachusetts and Vermont that have provisions for workplace privacy nested in other laws. For example, Vermont does not have a consent to record law but defers to federal law [84]. 3) Maine Employer Surveillance Act (MESA): Enacted in 2026, this law specifies privacy rights for employees in the workplace. It designates notification requirements when monitoring occurs, the monitoring type, limitations on surveillance in the employee’s home, the type of data collected, and a specified purpose [65]. Specifically, the law excludes protections in home-care settings where employee monitoring is required by

NYS-203-C, MESA (prohibited areas) NYS-52C, MESA, (advance notice) MESA (locator software) MESA [65], NYS-C52 (advance notice)

surveillance, aggregation, identification, exposure, intrusion surveillance, identification surveillance, identification surveillance, interrogation, identification surveillance, aggregation, identification, exposure, intrusion surveillance, aggregation, identification, exposure, intrusion surveillance, identification, secondary use

the service [88]. The law also enforces fines on employers for non-compliance, allows employees the right to refuse access to personal accounts for surveillance purposes, and requires employers to disclose the existence of surveillance practices during interviews for a role [65]. 4) Illinois Right to Privacy in the Workplace Act (IRPWA): IRPWA [62] was the first comprehensive workplace privacy law enacted in the U.S. Enacted in 1992, the law focused on specific allowed and prohibited actions by employers, and is similar to MESA. Like MESA, the law does not prohibit an employer from surveilling employees using corporate assets, however, the law prohibits employers from requiring access to employees and potential employees’ personal electronic accounts through open and surreptitious means [62] or placing inquiries regarding workers compensation claims [89]. The law prohibits employers from retaliation against employee refusal to comply with access requests, enables employers to monitor employees’ electronic use of corporate resources, and requires employers to maintain well-documented policies on surveillance practices [62]. The New York State workplace privacy laws that follow contain a similar personal account access provision, similar to IRPWA. 5) NY State Workplace Privacy Laws: Unlike MESA and IRPWA that enumerate rules in a single law, New York State’s workplace privacy laws are organized under labor and civil rights laws by the right to privacy. New York State Labor Law Chapter 31, Article 7, Section 201-I [63] describes the “request for access to personal accounts”, similar to IRPWA. Provisions include employee protections from providing access to personal devices or content, while maintaining an employer’s ability to electronically monitor devices that utilize corporate resources. New York State Labor Law Ch. 31, Art. 7, Sect. 203-C [90] describes “employee privacy protection” that prohibits video recordings in locations with an expectation of privacy. Last, New York State Civil Rights (CVR) Ch. 6, Art. 5, Sec. 52-C*2 describes “Employers engaged in electronic monitoring; prior notice required”. Provisions of this law require employers engaging in workplace surveillance

to monitor electronic or phone transmissions of any kind provide written notice to new and existing employees on the nature and purpose of the surveillance, with noted exceptions similar to MESA and IRPWA [64]. In the example of a New York Southern District case, “Pure Power Boot Camp, Inc. v. Warrior Fitness Boot Camp, LLC” [91], the court found that accessing an employee’s personal email accounts without authorization violated the Federal Stored Communications Act and prevented the use of the improperly obtained emails in the litigation. E. Privacy Harms (RQ2) Privacy harms may arise when privacy rights, laws, or principles are violated, resulting in physical, financial, reputational, emotional, or other harm to an individual. The concept of risk related to privacy harms is considered difficult to prove as actual harm [21, 92], although several privacy harms described in previous over-surveillance examples describe actual harm arising from violation of a workplace privacy law. Most state workplace privacy laws reserve legal action for state agencies, while private right of action and surveillance notification to employees is granted in Delaware, New York, Maine, Connecticut, and Illinois [62, 64, 65, 93, 94]. 1) Information Collection Activity: Surveillance and interrogation are harms born of surreptitious observation and rigorous questioning regarding private information [20]. New York State Civil Rights (CVR) Ch. 6, Art. 5, Sec. 52-C*2 and MESA require employers to notify employees regarding the nature, extent, and purpose of surveillance [64, 65]. MESA, IRPWA, and NYS 201-I contain specific rules prohibiting employers from requesting access to personal online accounts, establishing a baseline for adherence [62, 63, 65]. Barclays, White Castle, and Amazon caused a surveillance privacy harm in two ways: collection for a purpose and secondary use [16, 18]. H&M violated surveillance harm when they collected personal information from employees and stored for use by management in decision making [80]. The company also violated interrogation harm by engaging in conversations to gather more information for employment purposes [79]. 2) Information Processing Activity: Information processing activities are harms caused by improper use of data postoperation that exposes the data subject to harm [20]. Aggregation, identification, and secondary use are particularly problematic in this set of activities, as data under these harms can be used individually or collectively to cause actual harm [95]. H&M caused an aggregation harm by collecting personal data on employees and storing the data on a server only accessible to management [80]. Barclays and Amazon caused an identification harm by using hardware and software to monitor employee productivity in a way that could identify individual employees [14, 16]. This “downstream harm” [20] occurs when a primary harm (such as aggregation and identification) causes another harm. In the case of Amazon [78], this caused a downstream harm of secondary use, a harm created by now-identified data for another, previously unstated purpose. Amazon’s use

of handheld scanners to track productivity had a secondary use in employment decisions. The Illinois Legislature recently repealed Sections 12 and 13 of IRPWA governing the use of the E-Verify system in employment decisions over concern for discriminatory use [62]. New York City Local Law 144 of 2021 [96] was enacted specifically to address the use of Automated Decision Systems (ADS) in employment decisions, which extends to employee surveillance. The key issue in both state laws is the concern of bias and discrimination in employment decisions based on personal information gathered by the systems. Related work [15, 19, 76] concurs while describing the need for accuracy and accountability in AIbased ADS to avoid “algorithmic harm” [15]. The concern also exists in potential for violation of Title VII of the Civil Rights Act [97], Americans with Disabilities Act [98], Age Discrimination in Employment Act [99], the Pregnancy Discrimination Act [100], and the Genetic Information Nondiscrimination Act [101] in use of ADS and AI-based decision systems. 3) Information Dissemination Activity: Information dissemination is defined by Solove [20] as “revelation of personal data or the threat of spreading information”. Harms arise when private data is promulgated in a manner that causes physical, reputational, or financial loss. The H&M enforcement action caused the harm of exposure by revealing private data on a server to all internal employees [80]. 4) Invasion Activity: As a privacy harm, intrusion arises when workplace monitoring or employer demands extend beyond normal work hours. Disruptions can occur outside of work hours or when an employer encroaches on an employee’s personal time that is not part of a known work expectation [20]. No state workplace privacy laws explicitly define work hours, but analogues exist. [65] describes “audiovisual monitoring in an employee’s residence or personal vehicle or on the employee’s property” as a workplace surveillance restriction only if required for work, as in a home care worker. The Connecticut electronic surveillance law refers to employee-managed premises only [94], but other non employee-surveillance laws may be applicable in this area. The literature argues for reducing employee surveillance to what is necessary to minimize collection noise in the academic sense [102]. As noted previously, employee surveillance is performed to assess employee productivity, to ensure adherence to policy that protects systems, information, and infrastructure, and to mitigate insider threats. Information Technology (IT) departments collect an abundance of log data from SIEM, syslog, and UEBA that often creates log and alert fatigue from alerts with minimal value [103], a situation where important alerts can be missed due to the sheer volume of log data [104, 105]. Excessive employee monitoring can lead to violation of laws, clarification of policies, violation of data privacy principles and harms, loss of reputation, and loss of employee trust. As previously noted, MESA and New York State employee surveillance laws require employers to provide notice to employees as to the nature, extent, and purpose of monitoring. For these reasons, the employee surveillance awareness practice exhibited in MESA and NYS laws creates

a more cyber-aware environment, and may itself reduce the likelihood and severity of UIT [44, 106] and force IIT and ITO to use other means of accomplishing their InT goals [10]. In so doing, excessive logging may be reduced to enable focused analysis on insider threats in organizations, work that could be supported by future empirical research. IV. R ESEARCH G APS (RQ3) A. Inconsistent Workplace Surveillance Program Visibility Awareness of InT programs by employees may reduce the likelihood and severity of attack by redirecting the most sinister InT, and forcing communication methods to outside channels [10]. Outside channels may include flash drives, flash card readers, cloud storage, VPN to unsanctioned destinations, and unsanctioned file share locations. Excessive logging creates alert fatigue for operators [107], but following data privacy principles may lead to reduced logging and greater operator effectiveness [6]. Visibility and accountability in surveillance may provide employees with greater visibility into surveillance practices, but it should also increase awareness of potential risks to employees and organizations from insider threats. New York State [64], Connecticut [94], and Delaware [93] have explicit laws that require employers to notify employees on the existence and extent of surveillance programs. New Jersey law [108] relates to vehicle tracking, and Illinois’ Biometric Information Privacy Act (BIPA) [66] is specific to biometric monitoring. Although the California Consumer Privacy Act (CCPA) [109] requires notice to consumers of data collection, the law does not require notice to employees by employers. This gap can greatly benefit from empirical research. B. Gaps in Insider Threat Education Programs This paper described education as a critical factor both in reducing the number of InT incidents and improving mitigation. The concern is in how InT personas are recognized, and how knowledge of InT is shared through organizations [22]. Few comprehensive security education training and awareness (SETA) programs exist for InT training, most of which apply to federal employees [22]. Int training programs must consist of ontology, framework, persona, policy and methods to ensure success and assist organizations in mitigating insider threats while minimizing surveillance [110]. C. Logging Systems Lack High Fidelity Behavioral Indicators Reducing log noise through awareness of workplace surveillance programs may reduce the number of unnecessary logs managed by IT departments, but logging systems require improved sensitivity for behavioral indicators of compromise (BIoC) to increase fidelity and mitigate psychological and behavioral threats [74]. This process requires integration of UEBA logs with SIEMs and behavioral threat intelligence feeds to correlate InT incident behavior [12].

V. D ISCUSSION : P ROPORTIONALITY (RQ3) Insights imply that workplace surveillance oversight should be performed at three levels. Proportionality in data collection and awareness of surveillance through legal notice demonstrate the need for targeted collection. Insider threats delineate the factors that place organizations internally at risk and establish learning opportunities to limit data collection. Data collection methods describe the technical aspects of collection, where tool calibration can reduce collection to what is necessary. A. Legislate State Workplace Surveillance Laws Most state workplace surveillance laws on do not require notification, creating confusion among employees as to their rights. In support of this, comprehensive workplace privacy laws similar to MESA should be passed at the state level to recognize regional workplace privacy differences. A comprehensive federal workplace privacy law would minimize policy confusion, but may not account for regional perceptive differences regarding workplace privacy. For example, 20 U.S. states have codified sweeping data privacy laws where 4 are focused on protections for specific data [111]. Data privacy laws can be used as a legislative framework for workplace surveillance laws, modified for regional significance. A gap also exists in establishing geographical workplace surveillance limits, and defining normal work hours. Data privacy principles from CCPA [109] and GDPR Art. 5 [6] can be used as a guide for legislatures when crafting laws to define the limits of workplace surveillance. B. Develop Insider Threat Education Platform Most cyber awareness programs exclaim a need for InT training on InT identification through psychological and behavioral means first, technical second [22]. Ontologies define the lexicon of InT [112] while frameworks determine detection methodologies [113, 114]. Personas tune frameworks to define tactics and techniques of detection [5, 25, 33, 38] while policy drives the application of training [106, 115] to provide a complete training program [22, 110, 116–119]. InT training programs, therefore, enable people across an organization to perform the role of InT sensors [120]. Training programs also serve to inform the community on laws in place to prevent privacy harm. C. Improving InT Detection with BIoCs Although not researched empirically in this literature review, existing InT tools should be human-evaluated and aligned with organizational objectives and legal obligations. BIoCs should be tuned to data privacy principles [6], limited to workrelated behaviors, and exclude personality traits, behavioral traits unrelated to technical indicators, protected status, and personal activities. With these restrictions, InT tools should be evaluated for tuning to ingest psychological and behavioral IoCs to reduce false positives and mitigate privacy harm. Tuning indicators will enable UEBA and SIEM tools to distinguish InT from non-InT indicators to improve true-positive match results while adhering to ethical data collection. This

could be investigated through machine learning techniques to analyze anomalies for distinction from baseline behavior [24, 74, 107]. Padayachee [24] stated the need for mitigating InT activity through organizational behaviors, reducing emotional triggers often associated with InT activity, and improving the effectiveness of SETA programs.

[12]

VI. C ONCLUSION

[15]

This paper examined the impact and relevance of workplace surveillance. The literature review identified the three main drivers for organizations to conduct workplace surveillance: policy adherence, protection of intellectual property, and protection against insider threats. The paper discussed InT personas, and connected them to surveillance methods. The paper also described examples of over-surveillance practices, deliberated laws enacted to prevent violation of workplace privacy, and addressed privacy harms mapped to examples. Research gaps in the literature were identified to improve U.S. workplace privacy visibility, advise on implementation of an InT-based educational program for organizations, and recommend ways to improve InT monitoring tools through reduction of log volume, supported by empirical research. This review argues the merits of transparency in workplace surveillance, limiting surveillance data collection to only what’s necessary to address documentable organizational risks, and to clearly define the legal limits of employer workplace surveillance practices. R EFERENCES [1] [2]

[3] [4]

[5]

[6] [7] [8] [9] [10] [11]

A. Vatcha, “Workplace surveillance outside the workplace: An analysis of e-monitoring remote employees,” iSChannel, vol. 15, no. 1, pp. 4–9, 2020. S. A. Applin and M. D. Fischer, “Watching me, watching you. (Process surveillance and agency in the workplace),” in 2013 IEEE Int. Symp. Tech. & Society (ISTAS), 2013. DOI: 10.1109/ISTAS.2013. 6613129 S. Ghoshray, “Employer surveillance vs. employee privacy: The new reality of social media and workplace privacy,” Northern Kentucky Law Review, vol. 40, no. 3, pp. 593–626, 2013. S. E. Chang, A. Y. Liu, and Y.-T. J. Jang, “Exploring trust and information monitoring for information security management,” in 2017 10th Int. Congr. Image Signal Process., BioMed. Eng. Informat. (CISP-BMEI), 2017. DOI: 10.1109/CISP-BMEI.2017.8302319 J. R. Schoenherr, “Understanding surveillance societies: Social cognition and the adoption of surveillance technologies,” in 2020 IEEE International Symposium on Technology and Society (ISTAS), 2020, pp. 346–357. DOI: 10.1109/ISTAS50296.2020.9462205 GDPR Art. 5, Art. 5 GDPR – Principles relating to processing of personal data, 2018. [Online]. Available: https://gdpr.eu/article- 5how-to-process-personal-data/ K. Ball, “Electronic monitoring and surveillance in the workplace,” Luxembourg: Publications Office of the European Union, p. 104, 2021. DOI: 10.2760/5137 I. Ajunwa, K. Crawford, and J. Schultz, “Limitless worker surveillance,” California Law Review, 2017. DOI: 10.15779/Z38BR8MF94 W. P. Smith and F. Tabak, “Monitoring employee e-mails: Is there any room for privacy?” Academy of Management Perspectives, vol. 23, no. 4, pp. 33–48, 2009. DOI: 10.5465/AMP.2009.45590139 M. Pitesa, “Employee surveillance and the modern workplace,” in Business Ethics. A Critical Approach: Integrating Ethics Across the Business World, 1st, Routledge, Taylor & Francis Group, 2012. G. E. Lyon, A. Mink, and R. E. Van Dyck, “Toward an architectural framework to improve accountability in the use of electronic records,” National Institute of Standards and Technology, Tech. Rep. NIST IR 7157, 2004, NIST IR 7157. DOI: 10.6028/NIST.IR.7157

[13] [14]

[16]

[17]

[18]

[19] [20] [21] [22]

[23]

[24] [25] [26] [27] [28] [29] [30] [31] [32] [33]

[34]

S. Khaliq, Z. U. Abideen Tariq, and A. Masood, “Role of user and entity behavior analytics in detecting insider attacks,” in 2020 International Conference on Cyber Warfare and Security (ICCWS), IEEE, 2020, pp. 1–6. DOI: 10.1109/ICCWS48432.2020.9292394 D. A. Cozzetto and T. B. Pedeliski, “Privacy and the workplace: Technology and public employment,” Public Personnel Management, vol. 26, no. 4, pp. 515–527, 1997. D. Ennis, Barclays faces $1.1B fine over alleged monitoring of employees, 2020. A. DeVrio, M. Eslami, and K. Holstein, “Building, shifting, & employing power: A taxonomy of responses from below to algorithmic harm,” in ACM Conference on Fairness, Accountability, & Transparency, ACM, 2024. DOI: 10.1145/3630106.3658958 I. A. Hamilton, Amazon is changing how it measures a key productivity metric called ’Time off Task,’ which workers have blamed for a culture of relentless monitoring and punishing staff who fall behind, 2021. R. A. Sebastian, K. Ehinger, and T. Miller, “Do we need watchful eyes on our workers? Ethics of using computer vision for workplace surveillance,” AI and Ethics, vol. 5, 2025. DOI: 10.1007/s43681-02500726-4 J. Rochford, J. Neville, J. Overstreet, and C. J. Theis, Cothron v. white castle system, inc. Jul. 18, 2023. [Online]. Available: https : //www.courtlistener.com/opinion/9413971/cothron- v- white- castlesystem-inc/pdf/ M. Hickok and N. Maslej, “A policy primer and roadmap on AI worker surveillance and productivity scoring tools,” AI and Ethics, vol. 3, no. 3, pp. 673–687, 2023. DOI: 10.1007/s43681-023-00275-8 D. J. Solove, “A taxonomy of privacy,” University of Pennsylvania Law Review, vol. 154, no. 3, p. 477, 2006. DOI: 10.2307/40041279 S. Herath, H. Gelman, and L. McKee, “Privacy harm and noncompliance from a legal perspective,” Journal of Cybersecurity Education Research and Practice, vol. 2023, no. 2, pp. 1–10, 2023. H. Gelman, J. D. Hastings, D. Kenley, and E. Loiacono, “Toward an insider threat education platform: A theoretical literature review,” in 2024 International Conference on Computer and Applications (ICCA), IEEE, 2024. DOI: 10.1109/ICCA62237.2024.10928083 J. R. Schoenherr, K. Lilja-Lolax, and D. Gioe, “Multiple approach paths to insider threat (MAP-IT): Intentional, ambivalent and unintentional insider threats,” Counter-Insider Threat Research and Practice, vol. 1, no. 1, 2022. K. Padayachee, “A framework of opportunity-reducing techniques to mitigate the insider threat,” in 2015 Inf. Secur. South Africa (ISSA), IEEE, 2015, pp. 1–8. DOI: 10.1109/ISSA.2015.7335064 M. Maasberg, C. Van Slyke, S. Ellis, and N. Beebe, “The dark triad and insider threats in cyber security,” Communications of the ACM, vol. 63, no. 12, pp. 64–80, 2020. DOI: 10.1145/3408864 L. Machi and B. T. McEvoy, The Literature Review: Six Steps to Success, 4th. Corwin, 2022. R. Kumar, Research Methodology: A Step by Step Guide for Beginners, 5th. SAGE Publications, 2019. UK Government, Countries in the EU and EEA, 2024. [Online]. Available: https://www.gov.uk/eu-eea GDPR Art. 88, Art. 88 GDPR – Processing in the context of employment, 2018. [Online]. Available: https://gdpr.eu/article- 88processing-of-employees-personal-data/ GDPR Rec. 155, Recital 155 - Processing in the employment context, 2018. [Online]. Available: https://gdpr.eu/recital-155-processing-inthe-employment-context/ U.S. Congress, Privacy Act of 1974, 1974. [Online]. Available: https:// www.govinfo.gov/content/pkg/USCODE-2018-title5/pdf/USCODE2018-title5-partI-chap5-subchapII-sec552a.pdf K. Padayachee, “A conceptual opportunity-based framework to mitigate the insider threat,” in 2013 Information Security for South Africa, IEEE, 2013, pp. 1–8. DOI: 10.1109/ISSA.2013.6641060 P. Harms, A. Marbut, A. C. Johnston, P. Lester, and T. Fezzey, “Exposing the darkness within: A review of dark personality traits, models, and measures and their relationship to insider threats,” Journal of Information Security and Applications, vol. 71, p. 103 378, 2022. DOI: 10.1016/j.jisa.2022.103378 R. R. Mills, “The current state of insider threat awareness and readiness in corporate cyber security - An analysis of definitions, prevention, detection and mitigation,” M.S. thesis, Utica College, 2018.

[35] [36] [37]

[38]

[39]

[40] [41]

[42]

[43] [44] [45]

[46] [47]

[48] [49] [50]

[51]

[52] [53] [54] [55]

M. Warkentin and R. Willison, “Behavioral and policy issues in information systems security: The insider threat,” Eur. J. Inf. Syst., vol. 18, no. 2, pp. 101–105, 2009. DOI: 10.1057/ejis.2009.12 R. Willison and M. Warkentin, “Beyond deterrence: An expanded view of employee computer abuse,” MIS Quarterly, vol. 37, no. 1, pp. 1–20, 2013. DOI: 10.25300/MISQ/2013/37.1.01 R. Willison and P. B. Lowry, “Disentangling the motivations for organizational insider computer abuse through the rational choice and life course perspectives,” ACM SIGMIS Database: the DATABASE for Advances in Information Systems, vol. 49, no. SI, pp. 81–102, 2018. DOI : 10.1145/3210530.3210537 K. Padayachee, “An exploratory factor analysis of personality factors: An insider threat perspective,” in Human Aspects of Information Security and Assurance, vol. 658, Springer, 2022, pp. 253–264. DOI: 10.1007/978-3-031-12172-2 20 M. Maasberg, J. Warren, and N. L. Beebe, “The dark side of the insider: Detecting the insider threat through examination of dark triad personality traits,” in 2015 48th Hawaii International Conference on System Sciences, IEEE, 2015. DOI: 10.1109/HICSS.2015.423 Verizon, Verizon DBIR: 2026 data breach investigations report, 2026. [Online]. Available: https : / / www. verizon . com / business / resources / Tae3/reports/2026-dbir-data-breach-investigations-report.pdf F. L. Greitzer, L. J. Kangas, C. F. Noonan, A. C. Dalton, and R. E. Hohimer, “Identifying at-risk employees: Modeling psychosocial precursors of potential insider threats,” in 2012 45th Hawaii Int. Conf. on System Sciences, IEEE, 2012. DOI: 10.1109/HICSS.2012.309 S. Mekonnen, K. Padayachee, and M. Meshesha, “A privacy preserving context-aware insider threat prediction and prevention model predicated on the components of the fraud diamond,” in 2015 Annu. Global Online Conf. Inf. Comput. Technol. (GOCICT), IEEE, 2015, pp. 60–65. DOI: 10.1109/GOCICT.2015.20 K. Padayachee, “An insider threat neutralization mitigation model predicated on cognitive dissonance (itnmcd),” South African Computer Journal, vol. 56, 2015. DOI: 10.18489/sacj.v56i1.263 C. Colwill, “Human factors in information security: The insider threat – Who can you trust these days?” Information Security Technical Report, vol. 14, no. 4, 2009. DOI: 10.1016/j.istr.2010.04.004 F. L. Greitzer, J. R. Strozer, S. Cohen, A. P. Moore, D. Mundie, and J. Cowley, “Analysis of unintentional insider threats deriving from social engineering exploits,” in 2014 IEEE Security & Privacy Workshops, IEEE, 2014, pp. 236–250. DOI: 10.1109/SPW.2014.39 CERT Insider Threat Team, Unintentional insider threats: A foundational study, 2013. [Online]. Available: https://insights.sei.cmu.edu/ documents/2255/2013 004 001 58748.pdf N. Khan, R. J. Houghton, and S. Sharples, “Understanding factors that influence unintentional insider threat: A framework to counteract unintentional risks,” Cognition, Technology & Work (Online), vol. 24, no. 3, pp. 393–421, 2022. DOI: 10.1007/s10111-021-00690-z F. L. Greitzer, L. J. Kangas, C. F. Noonan, and A. C. Dalton, “Identifying at-risk employees: A behavioral model for predicting potential insider threats,” Tech. Rep., 2010. DOI: 10.2172/1000159 DTEX Systems, 2024 insider risk investigations report, 2024. [Online]. Available: https : / / www2 . dtex . ai / 2024insiderriskinvestigationsreport M. Alawneh and I. M. Abbadi, “Defining and analyzing insiders and their threats in organizations,” in 10th International Conference on Trust, Security and Privacy in Computing & Communications, IEEE, 2011, pp. 785–794. DOI: 10.1109/TrustCom.2011.103 C. R. Brown, A. Watkins, and F. L. Greitzer, “Predicting insider threat risks through linguistic analysis of electronic communication,” in 2013 46th Hawaii International Conference on System Sciences, IEEE, 2013. DOI: 10.1109/HICSS.2013.453 R. Skaik and D. Inkpen, “Using social media for mental health surveillance: A review,” ACM Computing Surveys, vol. 53, no. 6, pp. 1–31, Nov. 30, 2021. DOI: 10.1145/3422824 C. L. Huertas-Baker, “Exploring the impact of organizational influences on insider threat behaviors: A convergent parallel mixed methods study,” Ph.D. Northcentral University, 2022. O. Brdiczka et al., “Proactive insider threat detection through graph learning and psychological context,” in 2012 IEEE Symposium on Security and Privacy Workshops, 2012. DOI: 10.1109/SPW.2012.29 D. Cressey, Other People’s Money: A Study in the Social Psychology of Embezzlement. Free Press, 1953.

[56] [57] [58]

[59]

[60]

[61] [62] [63]

[64] [65] [66] [67] [68] [69]

[70]

[71]

[72] [73]

[74] [75]

[76] [77]

L. Xiangyu, L. Qiuyang, and S. Chandel, “Social engineering and insider threats,” in 2017 Int. Conf. Cyber-Enabled Distrib. Comput. Knowl. Discov. (CyberC), 2017. DOI: 10.1109/CyberC.2017.91 CERT Insider Threat Team, “Unintentional insider threats: Social engineering,” p. 109, 2014. [Online]. Available: https : / / apps . dtic . mil/sti/pdfs/ADA592507.pdf J. Kim, M. Park, H. Kim, S. Cho, and P. Kang, “Insider threat detection based on user behavior modeling and anomaly detection algorithms,” Applied Sciences, vol. 9, no. 19, p. 4018, 2019. DOI: 10.3390/app9194018 C. M. Sum, C. Shi, and S. E. Fox, “’it’s always a losing game’: How workers understand and resist surveillance technologies on the job,” Proceedings of the ACM on Human-Computer Interaction, vol. 9, no. 2, pp. 1–32, 2025. DOI: 10.1145/3710902 D. Sharma, V. S, and S. Loonkar, “Analyzing the human element in cybersecurity breaches with a focus on social engineering tactics and the risks posed by insider threats,” in 2024 Int. Conf. Adv. Comput. Res. Sci. Eng. Technol. (ACROSET), 2024, pp. 1–6. DOI: 10.1109/ ACROSET62108.2024.10743197 S. Uebelacker and S. Quiel, “The social engineering personality framework,” in 2014 Workshop on Socio-Technical Aspects in Security and Trust, IEEE, 2014, pp. 24–30. DOI: 10.1109/STAST.2014.12 Legislative IS, IRPWA: IGA 820 ILCS 55, 2024. Accessed: Jul. 28, 2026. [Online]. Available: https://www.ilga.gov/Legislation/ILCS/ Articles?ActID=2398&ChapterID=68 NYS Senate, NYS open legislation: Section 201I request for access to personal accounts prohibited Labor (LAB) CHAPTER 31, ARTICLE 7, 2024. [Online]. Available: https://www.nysenate.gov/legislation/ laws/LAB/201-I NY State Senate, NYS Open Legislation — NYSenate.gov, 2022. [Online]. Available: https://www.nysenate.gov/legislation/laws/CVR/ 52-C*2 Maine Legislature, Maine: Employer surveillance, Jan. 11, 2026. [Online]. Available: https://legislature.maine.gov/ros/LawsOfMaine/ #Law/132/R2/ACTPUB/560 Legislative IS, BIPA: IGA 740 ILCS 14, Jun. 14, 2024. [Online]. Available: https://www.ilga.gov/Legislation/ILCS/Articles?ActID= 3004&ChapterID=57 K. Macnish, The Ethics of Surveillance: An Introduction, 2nd. United Kingdom: Routledge, 2026. D. E. Thompson and A. Molnar, “Workplace surveillance in Canada: A survey on the adoption and use of employee monitoring applications,” Can Rev Sociol., pp. 801–819, 2023. DOI: 10.1111/cars.12448 S. Corvite, K. Roemmich, T. I. Rosenberg, and N. Andalibi, “Data subjects’ perspectives on emotion artificial intelligence use in the workplace: A relational ethics lens,” Proc. ACM Hum.-Comput. Interact., vol. 7, no. CSCW1, pp. 1–38, 2023. DOI: 10.1145/3579600 H. G, N. T. Singh, and A. D. Chanu, “Real-time employee monitoring system using CCTV cameras,” in 2023 Int. Conf. Innovative Comput., Intell. Commun. Smart Electr. Syst. (ICSES, IEEE, 2023, pp. 1–7. DOI: 10.1109/ICSES60034.2023.10465336 C. Posey and M. Shoss, “Employees as a source of security issues in times of change and stress: A longitudinal examination of employees’ security violations during the COVID-19 pandemic,” J. Bus. Psychol., vol. 39, no. 5, 2024. DOI: 10.1007/s10869-023-09917-4 D. Nazarov and A. Nazarov, “Intelligent service for monitoring the activities of an employee of an organization,” in 2023 IEEE 25th Conf. Bus. Informat. (CBI), 2023. DOI: 10.1109/CBI58679.2023.10187419 É. Charbonneau and C. Doberstein, “An empirical assessment of the intrusiveness and reasonableness of emerging work surveillance technologies in the public sector,” Public Administration Review, vol. 80, no. 5, pp. 780–791, 2020. DOI: 10.1111/puar.13278 B. Bin Sarhan and N. Altwaijry, “Insider threat detection using machine learning approach,” Applied Sciences, vol. 13, no. 1, p. 259, 2023. DOI: 10.3390/app13010259 P. G. Gopal, N. S. Subhash, and R. A. Anil, “Analysis of employee surveillance system using deep learning models,” in 2022 6th Int. Conf. Comput., Commun., Control Autom. (ICCUBEA), IEEE, 2022, pp. 1–6. DOI: 10.1109/ICCUBEA54992.2022.10010874 K. C. Kellogg, M. A. Valentine, and A. Christin, “Algorithms at work: The new contested terrain of control,” Academy of Management Annals, vol. 14, no. 1, 2020. DOI: 10.5465/annals.2018.0174 A. Staff, Update on our vision to be Earth’s best employer and Earth’s safest place to work, en, 2021. [Online]. Available: https :

[78]

[79] [80] [81] [82] [83] [84] [85]

[86] [87]

[88]

[89] [90] [91]

[92] [93] [94] [95] [96]

[97]

[98] [99]

//www.aboutamazon.com/news/operations/update-on-our-vision-tobe-earths-best-employer-and-earths-safest-place-to-work A. News, France fines Amazon $35 million for ’excessively intrusive’ monitoring of warehouse staff, en, Section: Business, 2024. [Online]. Available: https : / / apnews . com / article / amazon - fine - monitoring workers-privacy-france-d503314234ccacb366e2afaa49d097b1 BBC H&M Fine, “H&M fined for breaking GDPR over employee surveillance,” BBC News, 2020. [Online]. Available: https : / / www. bbc.com/news/technology-54418936 L. Lensdorf, S. Young, and M. Young, H&M receives record-breaking fine for employee surveillance in violation of the GDPR, 2020. C. Cozzens, “The patchwork privacy problem: How the united states’ privacy regime fails to protect its businesses and data subjects,” Seton Hall Law Review, vol. 52, pp. 1157–1182, 2022. Hirsch, J. M. “University of Illinois law review,” University of Illinois Law Review. [Online]. Available: https://illinoislawreview.org/wpcontent/uploads/2020/06/Hirsch.pdf D. O’Rourke, “Electronic monitoring: Do you know the laws?” Survey Research Laboratory University of Chicago, vol. 29, no. 1, pp. 1–16, 1998. Mathiessen, Wickert, and Lehrer, Laws on recording conversations in all 50 states, 2024. U.S. Congress ECPA, 18 U.S. Code Chapter 119 - Wire and Electronic Communications Interception and Interception of Oral Communications, 1986. [Online]. Available: https://www.law.cornell. edu/uscode/text/18/part-I/chapter-119 M. E. Kaminski, “Privacy and the right to record,” Boston University Law Review, vol. 97, p. 77, 2017. Justia N.H. § 570-A:2(I-a), 2023 New Hampshire revised statutes :: Title LVIII - public justice :: Chapter 570-A - wiretapping and eavesdropping :: Section 570-A:2 - interception and disclosure of telecommunication or oral communications prohibited, 2024. [Online]. Available: https://law.justia.com/codes/new- hampshire/titlelviii/chapter-570-a/section-570-a-2/ R. A. J. Roeder et al., “Disposition of bills and summaries of all laws enacted or finally passed,” Maine Legislature, Enacted Law Summaries 12546, 2026. [Online]. Available: https : / / legislature . maine.gov/doc/12546 D. G. Ford and M. Ludlum, “Employee privacy outside the workplace,” 2016. NY State Senate, NYS Open Legislation — NYSenate.gov, 2014. [Online]. Available: https://www.nysenate.gov/legislation/laws/LAB/ 203-C J. Koeltl and T. Katz, Pure Power Boot Camp, Inc. v. Warrior Fitness Boot Camp, LLC, 587 F. Supp. 2d 548, U.S. District Court for the Southern District of New York, 2008. [Online]. Available: https : / / www.courtlistener.com/opinion/1751552/pure- power- boot- camp- vwarrior-fitness-boot-camp/pdf/ D. J. Solove and D. K. Citron, “Risk and anxiety: A theory of data breach harms,” SSRN Electronic Journal, 2016. DOI: 10.2139/ssrn. 2885638 DE Legislature, Delaware code online, 2025. [Online]. Available: https://delcode.delaware.gov/title19/c007/sc01/index.html CT Legislature, Chapter 557 - employment regulation, 2024. [Online]. Available: https://www.cga.ct.gov/current/pub/chap 557.htm#sec 3148d D. J. Solove and D. K. Citron, “The new vulnerability: Data security and personal information,” in Securiing Privacy in the Internet Age, 1st, Stanford University Press, 2008, pp. 111–136. NYCC Local Law 144 of 2021, The New York City Council - File #: Int 1894-2020, 2021. [Online]. Available: https://legistar.council.nyc. gov/LegislationDetail.aspx?ID=4344524&GUID=B051915D-A9AC451E-81F8-6596032FA3F9 C. Wilson et al., “Building and auditing fair algorithms: A case study in candidate screening,” in Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency, ACM, 2021, pp. 666– 677. DOI: 10.1145/3442188.3445928 K. Timmons, “Pre-employment personality tests, algorithmic bias, and the Americans with Disabilities Act,” Penn State Law Review, vol. 125, 2022. M. U. Scherer, A. G. King, and M. J. Mrkonich, “Applying old rules to new tools: Employment discrimination law in the age of algorithms,” South Carolina Law Review, vol. 71, p. 449, 2019.

[100] [101]

[102]

[103]

[104]

[105] [106]

[107]

[108] [109]

[110] [111] [112] [113]

[114] [115] [116] [117] [118] [119] [120]

D. Schwarcz, “Health-based proxy discrimination, Artificial Intelligence, and Big Data,” Houston Journal of Health Law & Policy, vol. 21, p. 95, 2021. M. A. Rothstein, “Predictive health information and employment discrimination under the ADA and GINA,” The Journal of Law, Medicine & Ethics, vol. 48, no. 3, pp. 595–602, 2020. DOI: 10.1177/ 1073110520958887 C. A. Ciocchetti, “The eavesdropping employer: A twenty-first century framework for employee monitoring,” American Business Law Journal, vol. 48, no. 2, pp. 285–369, 2011. DOI: 10.1111/j.17441714.2011.01116.x M. Baruwal Chhetri, S. Tariq, R. Singh, F. Jalalvand, C. Paris, and S. Nepal, “Towards human-AI teaming to mitigate alert fatigue in Security Operations Centres,” ACM Transactions on Internet Technology, vol. 24, no. 3, pp. 1–22, 2024. DOI: 10.1145/3670009 T. Ahmed, A. Shah, M. Kolla, and R. Yellasiri, “Reduction of alert fatigue using Extended Isolation Forest,” in 2021 International Conference on Forensics, Analytics, Big Data, Security (FABS), vol. 1, 2021, pp. 1–5. DOI: 10.1109/FABS52071.2021.9702617 R. Vaarandi and S. Mäses, “How to build a SOC on a budget,” in 2022 IEEE International Conference on Cyber Security & Resilience (CSR), 2022. DOI: 10.1109/CSR54599.2022.9850281 J. D’Arcy, A. Hovav, and D. Galletta, “User awareness of security countermeasures and its impact on information systems misuse: A deterrence approach,” Information Systems Research, vol. 20, no. 1, pp. 79–98, 2009. DOI: 10.1287/isre.1070.0160 F. R. Alzaabi and A. Mehmood, “A review of recent advances, challenges, and opportunities in malicious insider threat detection using machine learning methods,” IEEE Access, vol. 12, 2024. DOI: 10.1109/ACCESS.2024.3369906 NJ Legislature, NJ legislature, 2022. [Online]. Available: https : / / www.njleg.state.nj.us/bill-search/2020/A3950/bill-text?f=A4000&n= 3950 V1 CA Legislative Information, California code, CIV 1798.100. 2020. Accessed: Jul. 27, 2026. [Online]. Available: https : / / leginfo . legislature.ca.gov/faces/codes displaySection.xhtml?lawCode=CIV& sectionNum=1798.100. CDSE InT Training, Insider Threat, 2023. [Online]. Available: https: //www.cdse.edu/Training/eLearning/INT101/ IAPP Priv. Legis. Tracker, US State Privacy Legislation Tracker. [Online]. Available: https : / / iapp . org / resources / article / us - state privacy-legislation-tracker/ K. Padayachee, “Taxonomy of compliant information security behavior,” Computers & Security, vol. 31, no. 5, pp. 673–680, 2012. DOI: 10.1016/j.cose.2012.04.004 J. Ikany and H. Jazri, “A symptomatic framework to predict the risk of insider threats,” in 2019 International Conference on Advances in Big Data, Computing and Data Communication Systems (icABCD), IEEE, 2019, pp. 1–5. DOI: 10.1109/ICABCD.2019.8851020 J. R. C. Nurse et al., “Understanding insider threat: A framework for characterising attacks,” in 2014 IEEE Security and Privacy Workshops, IEEE, 2014, pp. 214–228. DOI: 10.1109/SPW.2014.38 S. M. Ho, “Behavioral anomaly detection: A socio-technical study of trustworthiness in virtual organizations,” Ph.D. Syracuse University, 2009. B. Bloom, M. Engelhart, E. Furst, W. Hill, and D. Krathwohl, Taxonomy of educational objectives: The classification of educational goals. Vol. Handbook I: Cognitive domain. David McKay, 1956. M. Wilson and J. Hash, “Building an information technology security awareness and training program,” NIST, Tech. Rep. NIST SP 800-50, 2003, NIST SP 800–50. DOI: 10.6028/NIST.SP.800-50 D. M. Cappelli, A. P. Moore, and R. F. Trzeciak, The CERT® Guide to Insider Threats: How to Prevent, Detect, and Respond to Information Technology Crimes (Theft, Sabotage, Fraud), 1st. Pearson, 2012. R. Petersen, D. Santos, M. C. Smith, K. A. Wetzel, and G. Witte, “Workforce framework for cybersecurity (nice framework),” NIST, Tech. Rep., 2020. DOI: 10.6028/NIST.SP.800-181r1 F. L. Greitzer and R. E. Hohimer, “Modeling human behavior to anticipate insider attacks,” Journal of Strategic Security, vol. 4, no. 2, pp. 25–48, 2011. DOI: 10.5038/1944-0472.4.2.2

Related documents

• Purpose, Necessity, and Contestability: Documentary Duties When Workplace Scores Become Surveillance#989317
• Privacy and Punishment#773929
• AI Eyes on the Road: Cross-Cultural Perspectives on Traffic Surveillance#1062801
• Is That Lawful? Data Privacy and Fitness Trackers in the Workplace#400386
• Justifying Public Health Surveillance: Basic Interests, Unreasonable Exercise, and Privacy#764346