Early in 2024, a finding that shouldn’t have been shocking still managed to surprise a lot of people: eight in ten companies now actively track office attendance through some form of automated system. Badge swipes, card readers, network authentication logs. Meanwhile, 400,000 federal workers received new return-to-office mandates, and the private sector followed suit with companies large enough to track the metric. What wasn’t widely discussed was what lives behind these policies, and why IT workers specifically need to understand this infrastructure from both sides of the divide.

If you’re an employee being tracked, you should understand how comprehensive that tracking actually is. If you’re the person building that tracking system, you should understand what you’re building and what the consequences might be for your career, your conscience, or both.

The surveillance infrastructure behind modern return-to-office policies is more sophisticated and more intrusive than most employees realize, and it reveals something important about how power flows through organizations in 2024.

The Badge Reader Is Just the Obvious Part

When a company implements “return to office three days a week,” the management narrative focuses on culture, collaboration, spontaneous hallway conversations, and team cohesion. The actual enforcement mechanism is rarely discussed, but it’s technically straightforward: badge readers at the entrance, timestamped in central systems, and the capacity to correlate who was in the office when.

This is, on the surface, reasonable. You need to know who’s actually complying with the policy, and you need that data if there’s ever a security incident where you need to know who had physical access to the space. But the infrastructure doesn’t stop there. Most companies that invested in badge tracking also did the math on the opportunity: if you’re tracking physical presence, you can track VPN logins, you can track authentication against corporate systems, you can correlate network activity.

Here’s where it gets complicated. If someone’s badge shows them in the office from 9am to 5pm, but their VPN logs show them never connecting to corporate networks during that time, what does that tell you? That they swiped in and then left? That they sat at a desk but didn’t actually work? Or that they were working on something that didn’t require corporate network access, which is legitimate?

The data alone doesn’t answer these questions. But the data combined with other signals does start to paint a picture, and that picture can be used in ways both reasonable and unreasonable.

This is where most return-to-office implementations become problematic. They start with a simple goal (ensure people show up), but the data infrastructure created in the service of that goal becomes available for other uses. Once you have badge data, VPN logs, and Teams activity status correlated with physical location, you have the capability to identify who’s being productive, who’s coasting, who’s actually collaborating versus who’s just sitting quietly at their desk.

None of this is theoretical. Companies are already correlating this data.

The Hidden Layer: Activity Monitoring and Behavioral Analysis

For IT workers specifically, the surveillance question gets more invasive because many companies also implement endpoint monitoring, application-level logging, or keyboard activity tracking as a secondary layer of control. This is often justified as security or compliance rather than as employee surveillance, but the distinction doesn’t matter much from the employee’s perspective.

If your company has deployed mobile device management (MDM) on your laptop, they can see what applications you’re running, when you’re running them, and how frequently. Some implementations even log keystroke activity at the application level. VPN logs show not just when you logged in, but which network segments you accessed and for how long. Email and chat systems log everything, obviously, but so do many project management tools, and the data is often aggregated into dashboards that managers can view.

The narrative from security and IT leadership is usually that this is necessary for compliance, security, and risk management. Sometimes it is. But sometimes it’s cover for what’s actually happening: comprehensive behavioral surveillance designed to identify who’s most productive, who’s at risk of leaving, who’s underperforming, and who needs to be managed more closely.

Where this becomes genuinely problematic is when the company uses this data to make decisions about layoffs, promotions, or compensation without transparency about how they’re using the data. If you’re being ranked against your peers based partly on badge swipe frequency and Teams status, you deserve to know that. Most companies don’t tell you. You find out by accident, or you don’t find out at all.

The return-to-office mantra is that it’s about culture and collaboration. The infrastructure is about visibility and control. These aren’t mutually exclusive, but they’re not the same thing, and employees should be aware of the difference.

What This Means if You’re Being Tracked

The first practical reality is that, unless you work for a company with explicit privacy protections or a transparent data policy, you should assume you’re being tracked more comprehensively than you realize. Not because the IT team is trying to spy on you, usually, but because once the infrastructure exists to track something, it’s available to use.

The second practical reality is that the way you work might need to adjust accordingly. This isn’t about paranoia. It’s about operating intelligently within the environment you’re in.

If your company is correlating badge data with activity data, showing up to the office and then sitting invisible is counterproductive; you’re getting none of the benefits of being remote and all the inconvenience of commuting. If you’re going to be in the office, be visible about it. Use collaboration tools actively. Participate in meetings. Be the person who was productive when they were there. This isn’t authenticity theater; it’s just not handicapping yourself by being physically present but invisible.

Conversely, if you’re remote and you know activity monitoring exists, you should understand what signals matter. Most tools track idle time, and idle time is often interpreted as not working. Being strategic about when you’re visible, when you respond to messages, when you’re actively in calls or doing work that generates a visible trace, is just common sense. You’re not being dishonest. You’re just communicating clearly about when you’re working.

The uncomfortable truth is that surveillance creates incentives for performative productivity, and people tend to optimize for what’s measured rather than for what actually matters. When you know you’re being watched, you change your behavior, and sometimes that’s good (you’re more focused) and sometimes that’s bad (you’re more concerned with looking busy than being useful).

The other thing you should do is understand what your company’s data policy actually is. Most companies have privacy policies that are either genuinely protective or aggressively broad depending on how the company views employee rights. Read yours. Find out what data is being collected, how long it’s retained, who can access it, and what it’s used for. If the policy is vague, ask questions. If you get pushback for asking, that tells you something important about your employer’s relationship with transparency.

What This Means if You’re Building It

For IT workers who are the ones implementing these systems, there’s a different ethical dimension. You’re not spying on your coworkers for fun. You’re building infrastructure that your company has asked you to build, usually for legitimate reasons that include security, compliance, or management visibility. But you should still think carefully about what you’re building and why.

The easiest path is to just build what you’re asked to build, treat it as a technical problem, and not think about the implications. A lot of IT people do this. It’s comfortable because you’re just executing requirements, and you’re not responsible for how the requirements are used.

But you actually are responsible, at least partially. If you’re building a system to track whether people are productive, based on activity metrics that are actually measuring performative productivity rather than actual work quality, you’re building a tool that will probably produce bad outcomes. People will optimize for the metric rather than the goal, and the company will make worse decisions about who to promote, who to fire, and how to structure work.

This is where negotiating workplace boundaries matters, and it matters specifically for people building the systems that enforce those boundaries. If you’re asked to implement keystroke logging, or to correlate badge data with application usage to identify “unproductive time,” or to build a system that profiles employees based on behavioral patterns, you can push back.

You can say: I’ll build activity logging for security purposes, because that’s legitimate. I won’t build a system designed to identify and measure individual productivity based on application usage because that’s likely to produce perverse incentives. You can say: I’ll help you track office occupancy for space planning purposes. I won’t help you correlate that with individual worker performance because that’s surveillance disguised as policy enforcement.

These aren’t easy conversations to have, especially if your company doesn’t have a strong culture of pushback from technical teams. But your position is stronger than you might think. Good IT people are scarce, and if you’re being asked to build something you think is problematic, your manager usually wants to find a solution that works for you rather than lose you over it.

If your company isn’t willing to listen to that kind of input, that tells you something about whether it’s a place you want to work long-term.

The Broader Pattern

Return-to-office policies have become a control mechanism dressed up as a culture initiative, and the surveillance infrastructure supporting them is more sophisticated than the public narrative suggests. For employees, this means understanding that you’re not just being asked to be in the office; you’re being asked into a tracking system, and you should know what that system is measuring.

For IT workers specifically, it means understanding both sides of this problem. You might be on the being-tracked side, and you need to understand what’s actually happening. Or you might be on the building-it side, and you need to think carefully about what kind of system you’re creating and what incentives it’s going to produce. Either way, the ability to evaluate your employer’s return-to-office mandate clearly is becoming a critical career skill.

The good news is that companies are starting to realize that surveillance-based management produces mediocre outcomes. The feedback loop is slow, but it’s there. In the meantime, you need to operate with clear eyes about what’s actually happening in your workplace, and make decisions based on that reality rather than the narrative you’re being told.

Your badge swipe is being tracked. Your network activity is being logged. What you do with that knowledge is up to you.