Detect If Employees Are Working Abroad On A VPN
One of the challenges resulting from remote work and "work from home" policies is employees secretly working overseas behind a VPN. When staff hides their true location using a VPN, companies can face serious tax, labor-law, and data-residency risks.
In this post, we will explore VPN detection methods and other clues how companies can detect if their employees are using a VPN including IP checks, analyzing timezone mismatches and latency measurements
Legal risks when employees are using VPNs
Employees secretly working from abroad can trigger a number of legal problems for the company. This includes violating local labor laws, failing to file or withhold the correct corporate and payroll taxes. Another risk comes with exposing confidential company or customer data in a jurisdiction that does not comply with your privacy and data residency rules, for example GDPR regulation.
How To Check If A Employee Is Using a VPN
So how can you check if a employee is using a VPN to fake their true location?
1. Check the IP address
Use the Focsec VPN Detection API to check if the employee IP address is associated with a VPN service. Focsec reliably detects the vast majority of VPN services with a high degree of confidence. You can simply paste the IP address manually for a one-off check or use the Focsec API to build a fully automated VPN IP check system. This will check for VPN usage whenever your employee interacts with your company systems.
2. Check Device Time Zone
By default, laptops and phones automatically set the system time to the real, local time zone. The local time zone is generally determined by the WiFi or cellular network the device is connected to. You can check device log files for the time zone of the device and check if that time zone matches the location you expect them to be in.
For example, if you expect an employee to be in New York (UTC-5) but their laptop says it’s on Central European Time (UTC+1), that six-hour jump signals they might actually be somewhere in Europe.
Note that this is not a fool-proof method, as automatic time zone switching can be disabled on most phones and operating systems.
3. High connection latency
When traffic is routed through a VPN, this adds a extra delay to all network connections. If an employee assigned to your Berlin office consistently shows several hundred milliseconds of latency to a server also located in Berlin, traffic is probably being routed halfway around the world. Tracking the average latency among employees and reviewing any outliers could be another way of detecting VPN use.
Again, this is not a fully accurate method, as high latencies may also be the result of bad WiFi connections or other network issues.
Stay compliant
With just a few signals such as the IP address, device time zone or network latencies, you can spot employees using VPNs, without installing any intrusive monitoring software. When you need real-time detection of VPN use among your workers, Focsec can help. Contact us for a demo, learn how to keep your remote workforce fully compliant and mitigate legal risks.