[Closed] When working from home isn't really home....

One issue that Brexit has thrown up, is working whilst on holiday overseas. We no longer have the right to work in the EU, and this includes working whilst on holiday, which could leave the employer liable if they approve it. (married to an employment lawyer)

How many employees do they have? Enough for them to have a member of staff to check the logs, see where people are connecting from? Enough for them to be bothered where folk are connecting from?
Most secure VPNs will just check if it a company owned laptop and has a specificed set of software installed (eg. anti-virus), not location or source IP as there are so many options from the different ISPs.

I'd just do it.
If the work is being done and she's in an environment where she's able to speak freely (not a busy pub/cafe for example) then I don't think they'd either notice or care.
Even a video call can be dealt with by blurring the background and putting it down to a messy house.

ne issue that Brexit has thrown up, is working whilst on holiday overseas.

So not an issue in this case then as OP it was a UK holiday.

If she would be working away from their premises anyway that day do their have (or rather should have or should need to have) any sort of right to say where she must geographically be that day provided she is setup to work (working internet, computer and any physical papers she would normally have to hand AND the peace and quiet she normally gets in her home office.

Or could this be a prelude to a return to the office in the pipeline and they don't know this far out if she would be physically in the office of not on that day.

I'm confused, are you saying that she does normally/often work from home and for this one day she was just asking if she could work from the 'holiday' home rather than home?

If so, why did she even bother asking, they don't need to know?

FWIW we were told earlier this year (Brexit related I reckon) that all WFH must be within the UK, as last year a fair number WFH at various overseas holiday homes etc.

We had a Teams meeting the other day and someone was in a Costa somewhere rather than being at home; no one was in the slightest bit bothered by it.

As for tracking IPs, I doubt they do it - even if they did it doesn't tell you much. Our ISP (Plusnet) seems to change my IP fairly regularly as the Ads I see on FB keep changing their targeted location 'Residents of XXX couldn't believe how cheap dental implants have become' etc, where XXX is a random city in the UK. Normally XXX is Cambridge, but occasionally I'm given a Manchester IP etc..

Convert - correct, but it may well be the reason an employer has a policy of no holiday working.

I would just work from your holiday home as per your original plan.

If they question a change of IP (which I think would be highly unlikely) just say you had to connect from your mobile data connection (or your neighbour's WiFi) due to your own home broadband connection being unavailable that day due to technical issues.

Edit: And unless you have a static IP at home, it may change anyway periodically (but within the subnet range).

I’m confused, are you saying that she does WFH normally/often work from home and for this one day she was just asking if she could work from the ‘holiday’ home rather than home?

Pre Covid she worked form the office with occasional day at home. Since Covid hasnt worked in the office at all and works every day at home.

As for tracking IPs, I doubt they do it – even if they did it doesn’t tell you much. Our ISP (Plusnet) seems to change my IP fairly regularly as the Ads I see on FB keep changing their targeted location ‘Residents of XXX couldn’t believe how cheap dental implants have become’ etc, where XXX is a random city in the UK. Normally XXX is Cambridge, but occasionally I’m given a Manchester IP etc..

Yes we have a non static IP however I suspect (somebody may correct me) its possible to know the range of addresses that Plusnet "own"

I’d just do it for a UK holiday. Done it myself and know others who’ve done it (heck, even been on a surfing holiday in the UK and one lad logged on in the morning, over lunch and in the evening and put it down as a days work).

If it were abroad I’d be more cautious. We had one lad at our place who went to see his in laws in Eastern Europe recently, didn’t tell us and was planning on working when over there. As soon as he connected from a foreign location our systems detected it and locked his account. So he has to phone his boss and confess. Made him look a bit daft.

any sort of right to say where she must geographically be that day provided she is setup to work

What does the contract say? I've signed contracts in the past where there was a distance limit for working from home (which many people broke, but had to ask permission to break).

Oh, easy to tunnel in via a computer at home if you want to hide where you're working from. Much better to get the employer to see sense though.

Or could this be a prelude to a return to the office in the pipeline and they don’t know this far out if she would be physically in the office of not on that day.

No they have embraced the remote working aspect and are actively taking advantage ref office leases etc.

I would take my guidance from Life Rule #2 - done take the piss.

Work away from the cottage or wherever you're going to; don't ask permission, but perform a normal days' work as you would do at home.

No one will know, nor care.

From the bosses' perspective though, they may not want to set a precedent that it's OK to work on holiday as before you know it, someone could be "woking" from beside the pool and joining a zoom call in their bikini from Magaluf with a cheap cocktail...

What does the contract say? I’ve signed contracts in the past where there was a distance limit for working from home (which many people broke, but had to ask permission to break).

Good point, I will check however I suspect this wasnt considered at that time and may be policy now since Covid.

Sick note, self reporting. Dodgy prawn innit.

Regarding VPNs some security tools will detect and alert on impossible travel but that’s only for being in two geographically distinct places in a short space of time that indicate someone else is using your account so you’re safe there as UK ‘one place’. Plus ISPs reassign IP addresses all the time and mobile working makes it too hard to want to audit this stuff, but of course should they get disciplinary they would have a record of the IP and ISP in use on that day.

We're planning a holiday next year to take advantage of the extra bank holiday in June (hoping Lizzie makes it that far) but it would likely mean I'd have to work on the 1st June. As we'd be in Cardigan, my boss has agreed in principle I could WFHoliday that day. Only straw is HQ in Sweden has declared local bank holidays don't apply to our timetable.

I doubt anywhere would actually check IP. Are they going to run a report of who has logged in from IPs then compare that to their home location? Could it be a GDPR issue- why would IT need to have access to everyone's home address unless it is explicitly said your WFH IP will be compared to your logon IP.

I've been led to believe that if you are working remotely & handling any personal data you need to ensure you're on a secure connection.

As Scuttler says, unlikely to be spotted by most overworked IT depts, unless it's from abroad.

Easy test would be log in via mobile hotspot or whatever while working at actual home on a day at some point before you go. Will assure that the system would work at her end, and also give an indication of whether it gets spotted.

You might need to use a trusted network. The holiday home/coffee shop/whatever may not be trusted. Public hotspots shouldn't allow you to access other machines on the same network but you might.

We have to be careful what we connect to what and from where - not because there is a security risk necessarily, but because we have rules that we have to stick to and if we don't it potentially opens us up to liability if anything goes wrong. Which it has in the past.

Yes we have a non static IP however I suspect (somebody may correct me) its possible to know the range of addresses that Plusnet “own”

No, you can reverse look up an IP and see who owns it, but they can still sublet it etc.

Wouldn't prove anything...

No they have embraced the remote working aspect and are actively taking advantage ref office leases etc.

Ah, Manager just being an arse then?

Easy test would be log in via mobile hotspot or whatever while working at actual home on a day at some point before you go. Will assure that the system would work at her end, and also give an indication of whether it gets spotted.

Test this today via my phone hotspot from a different ISP and see if the VPN connects. If flagged then it was due to a local WIFI failure etc.

You might need to use a trusted network. The holiday home/coffee shop/whatever may not be trusted. Public hotspots shouldn’t allow you to access other machines on the same network but you might.

We have to be careful what we connect to what and from where – not because there is a security risk necessarily, but because we have rules that we have to stick to and if we don’t it potentially opens us up to liability if anything goes wrong. Which it has in the past.

Whilst that might be a very fair point I suspect there are millions of UK workers currently working away from the office using all manner of internet connections as their default way of working and their employer hasn't double checked. Pre covid I had a good long while using a neighbour in the area's wifi as it was stronger in one room than our own and his dogs name was the first password I tried and it worked!

I work in IT security for a bank, there's naff all chance of anything being flagged if you're logging on remotely from somewhere else in the UK. Nobody has the time to manually check that level of logging and they would spend half their lives unlocking accounts if they had an risky login setup paranoid enough to trigger from a different UK IP.

Crack on, don't over think it, don't make a fuss about it and you'll be fine.

For working from home in the UK I wouldn't have even asked about doing it from a UK holiday cottage. Problem now is that they have been asked and have said no.

Depending on the relationship with the line manager I'd have an informal chat and see what they say. If you are covering the work as if you were at home there isn't really a reason for not agreeing.

Nobody will care

I'm not sure any business would waste the money and effort on monitoring its employees so closely about every aspect of their contract

except maybe MI5?!

They will only care if something goes wrong, e.g. if your wife doesn't show up and they don't believe her excuse, even then if she is a good employee they would be daft to sack her

Of course they will say no if asked, that is the letter of the rules. If they say yes everyone will be at it.

Your only problem now is that you've asked, and it may have raised someones spidey-sneses

Ah, Manager just being an arse then?

I've thought this through a bit more and I can 'sort of' understand it. It might be a precedence thing. You wife's job sounds like she is virtually visible all through the working day but there well be employees that are not. And it could be argued it takes some extra discipline to work when at a holiday location and everyone else is holidaying. And there are holidays and there are holidays.

Anyway employer came back and said “computer says no”

This is the bit that worries me. Your wife has been expressly told no. Regardless of whether its fair, right or whatever is she not leaving herself open to disciplinary action (or worse if the manager truly is an arse) by going against an express instruction.

I realise that being caught out is fairly slim. I mean if the work is getting done it shouldn't be an issue.
I know in our place if that happened (a days leave being refused in those circumstances) a reason to have a face to face meeting on that day would be invented....

As a manager, I'd be more concerned about her splitting her holiday, rather than where she was working from. Company won't notice. Personally, I would not have asked. If she has a company VPN, be sure to sign in on that and leave it on all day. Or as others say, run a mobile hotspot.

We had people stuck in mainland Europe unable to return, working from parents homes etc last year.

EDIT: for reference, in all communications we've had (big corporate), the definition of "Home" has never been stated as main place of residence. It's simply been taken to mean "not office". Does she have a distance from office clause in her contract?

I have a few colleagues (local authority) that have done this recently with no issue and with connection to our servers via Cisco Anyconnect Secure Mobilty Client. Some have extended holidays and visited family by combining it with remote working. They've either taken work laptops with them or used their own. That's both UK and abroad. My employer is very flexible though as we are in a remote location and people have struggled seeing family over this period of covid

We placed an order with a company but our credit card company couldn't complete the transaction as the company were working from home and their line wasn't secure.

except maybe MI5?!

Not MI5 but I would be surprised if some of you dont work for this employer

I think it's more of an HR issue than an IT issue.

For obvious reasons a lot of the people we manage IT for WFH, some use secure VPN connections, but it's not practical for all of them because it's not always easy to get a static IP from a home ISP and they can be unreliable.

I can imagine HR throwing a shit-fit, because that's what they like to do, at the idea of a 'working holiday' and your mistake was asking, this was a situation when forgiveness is far easier than permission.

Personally, I'd run a test, connect to a hot spot, or a friends house, see how it works. If it doesn't then IT might have set up a secure connection from your house and asking them to the same on a holiday rental internet connection wouldn't be practical, if it does... you have to ask how good a memory does your Wife's boss have? You've asked, they've said no, if you get there and it doesn't work, she might be in trouble.

This is the bit that worries me. Your wife has been expressly told no. Regardless of whether its fair, right or whatever is she not leaving herself open to disciplinary action (or worse if the manager truly is an arse) by going against an express instruction.

I'd have thought (depending on the industry/work/regulation, and not exposing any data protection risks or anything like that, which given she works from home all the time seems unlikely), the most she's opening herself up for is 'a word', if she's found out, which she won't be.

I also don't quite get the problem, just book the holiday she can book, don't book the day she can't, and she works that day but from a different remote location from where she usually works. Why would she even have asked if that was okay?

The lesson to learn is that, in these situation, 'tis better to seek forgiveness than permission.

Whilst that might be a very fair point I suspect there are millions of UK workers currently working away from the office using all manner of internet connections as their default way of working and their employer hasn’t double checked.

Yes but you miss the point. It's not whether or not it's actually a security risk, it's whether or not the company has prohibited it for some reason or other. A reason of which you might not be aware but is still important.

Just do it.

1) Nobody is checking.
2) It's easier to ask for forgiveness than permission.

Weird one, have they supplied equipment and training for home working, not just a laptop and charger, have they changed her work pattern to home worker, etc, etc?

I work for a large government department, lots of home working just now, and they couldn't care where we logged in from, unless we are designated home workers, or working from public areas where security breaches could occur (peering over the shoulder and so on).

I've never heard of this type of ranging for home working, what if they want to work from your parents house, or friends house, or whatever, is that banned, because a lot of folk in our place do this, if you are logging on to a secure server then as long as you have a secure connection, i can't see a huge issue here, unless they have a duty of care issue with supplied environment/equipment, it just seems like a weird rule to limit actual homeworking.

You've asked and they've said no...What'll she do if they follow up?

I mean, chances are they won't, but what's that phrase? It's not the crime, it's the cover up...

I also don’t quite get the problem, just book the holiday she can book, don’t book the day she can’t, and she works that day but from a different remote location from where she usually works. Why would she even have asked if that was okay?

She asked for the week off. 1 day was refused hence she offered the solution of working that day thinking it would be ok. I agree she could have said nothing hence my question about software that actively tracks this. As I mentioned she is very professional so that day would be a working day, no question. She also never has to go into the office or extend her shift etc so (unlike my previous roles) there is no danger of any issue escalating meaning she had to travel to the office etc or continue to work on a problem.

Interesting replies, cheers!

I'd also be worried about a company tracking my location via logging in to the server, honestly, i cannot see that being written down anywhere in your Ts and Cs, what do they do with this data, how is it held securely, how are those who can access it vetted and so on, i can understand keystroke loggers, to make sure you're actually doing stuff during the working day, but tracking, i'd want to read how they manage that in the contract!

if you are logging on to a secure server then as long as you have a secure connection,

The wife's work laptop only connects to the intenet via a VPN to work, so being on an insecure wifi hotspot (which she often is) isn't a problem as everything is encrypted. The VPN terminates in Germany, so she always appears online with a German IP address.

It also only connects to appoved USB devices, so you can't just copy files to a memory stick - it won't recognise it.

It's not 'working from holiday', shouldn't have termed it as such. She won't be on holiday that day, just working from a different location. Would she need to check permission before moving house?

Weird one, have they supplied equipment and training for home working, not just a laptop and charger, have they changed her work pattern to home worker, etc, etc?

I work for a large government department, lots of home working just now, and they couldn’t care where we logged in from, unless we are designated home workers, or working from public areas where security breaches could occur (peering over the shoulder and so on).

I’ve never heard of this type of ranging for home working, what if they want to work from your parents house, or friends house, or whatever, is that banned, because a lot of folk in our place do this, if you are logging on to a secure server then as long as you have a secure connection, i can’t see a huge issue here, unless they have a duty of care issue with supplied environment/equipment, it just seems like a weird rule to limit actual homeworking.

Agreed, in absence of a reason from the employer, this sounds like a HR thing to me, not IT.

I know we shouldn't fall back on lazy stereotypes, but my word, HR people are a different breed. We deal with them a lot. We're 20 months into Covid now, but still a lot of organisations are on a war footing, without the benefit of reams of pages of rules and regs, OP's wife might simply have fallen into the trap of asking a question no one has asked before, and without a document to give them an answer, a lot of managers will simply default to 'no' rather then make a decision that will bite them in the arse later.