Everything else running on the machine

A careful browser is a single program on a machine that is running a great deal of other code. That other code has its own purposes, and none of them are hostile by default.

It is easy to picture a computer as one window at a time. In practice a modern desktop runs dozens of background processes, most never chosen individually and many of which arrived with the system. They index, update, scan, report and wait for input. Each was written to do something reasonable.

The reason they belong in an exposure catalogue is not that they are spying. It is that several of them hold logs, several of them talk to the internet on their own schedule, and one category of them was installed by somebody other than you.

What the other software sees

Operating system telemetry

Systems collect diagnostic information about themselves: crashes, performance, which features are used, what hardware is present. The level is usually configurable and the stated purpose is product improvement. Its relevance here is that it is a channel from the machine to a company, running on a schedule of its own, independent of any browser.

Security software

Scanners inspect files, and inspecting a file means reading it. That is the job. It becomes an outbound channel at the submission step: meeting something it does not recognise, a scanner commonly sends a hash, or in some configurations the file itself, to a service for analysis. That is a long standing and legitimate design, and it is also the mechanism by which a file on a disk becomes a file at a company. Anything downloaded is a candidate, which links back to files you downloaded.

Updaters

Applications check for new versions by contacting a server at intervals. Each check says a machine with this application and this version exists at this address at this time. Individually trivial. Collectively they mean an ordinary connection produces a steady, identifiable pattern of traffic unrelated to what the user is doing, which is part of the picture on the shape of the traffic.

Accessibility and input tools

Some tools legitimately need to see everything on the screen or everything typed, because that is the function: screen readers, dictation, predictive text, translation overlays, automation utilities. These are not malicious and for many people they are essential. They do sit between the user and the application with full visibility, and some process input on a remote service rather than locally.

Remote support software

Remote assistance tools exist so somebody else can see and control the screen. Once installed, that capability is present whether or not a session is running, and the control over when it runs sits partly with whoever set it up. A machine that once had a support tool installed for a good reason is a machine where that question needs asking.

What it does not see

None of this reads the network for you. Software on your machine sees what is on your machine, and a scanner has no view of a Tor circuit, an entry guard or a market server. The observers in the Tor section and this one do not overlap.

Most of it is also not watching in the sense people imagine. Telemetry is aggregate and structured, not a transcript. An updater asks about a version number. A scanner is looking for known patterns, not reading a document for meaning. Assuming every background process is a recorder overstates the case considerably.

And on a personal machine that you set up yourself, the list is mostly what came with the system plus what you installed. It is knowable. The category that is not knowable is the next section.

Why a work machine is a different object

A machine issued by an employer is administered by that employer. That is not a loophole, it is the arrangement, and it is usually documented in a policy that was signed at some point and read by very few people.

Administration means an agent with privileges above the user account, whose functions can include software inventory, remote configuration, log collection, web filtering, content inspection, screen capture and location. Which of those are switched on varies enormously. The point is not that all of them are on. The point is that the decision is not yours, and the answer can change on a Tuesday without anybody telling you.

The same logic applies to a machine shared with a household, a machine lent out, and a machine given to you by anybody at all. Ownership and administration are separate questions. Lending the machine covers the human version of this, and borrowed wifi covers the network version.

What changes the answer

4 things change how much this action gives away. None of them takes it to zero, and none of them is a promise.

1. Treat a work machine as a work machineThe single practical point on this page. A device administered by an employer is not a private device, whatever it is used for and whatever hours it is used in. Nothing done on it changes that, and the policy is usually available to read.
2. Know what is installed on a machine you rely onLooking at the list of installed applications is an ordinary thing to do and most people have never done it. It tells you which of the categories above are actually present. It says nothing about what any of them are configured to send.
3. Separate machines separate their softwareA machine used for one purpose has a smaller and more predictable set of processes than a machine used for everything. That is a structural difference rather than a setting. It does not make any individual program behave differently.
4. Understand what a scanner does before judging itSecurity software inspecting files is doing the job it was installed for, and removing it trades one exposure for a much more common one. The useful knowledge is that submission to a remote service is a normal part of that design.

What this card is not

This card names no product and no vendor, and it does not suggest disabling security software, updates or accessibility tools. It describes categories of software that are ordinarily present.