Htydjtk

the risk of exposing another clients work via (2) - software becomes unpatched leaving a giant hole in my system or a screenshot of a chat with another client

This is why I will not use screen-logging software, and I do not know of a single free-lancer who will allow it on their computer.

You likely signed NDAs with your clients. Installing this software likely breaks the NDA

How to (possibly) salvage this situation - Explain The above reason to them, and suggest other ways to build trust with them. Something like

I can't install software like that because you could inadvertently see what I'm working on for other clients. That's a violation of their trust (and possible NDA), so I can't really budge on that. I have several references XYZ if you're worried about work ethic.

DO NOT LET ANYBODY SPY ON YOUR PROPERTY AND WORK!!

If you work on the clients premises, using their property and licenses then they have every right to keylog and screencapture.

But that's not the case!

I'm afraid you gave them ideas with your too detailed, itemized timesheets.

Why would you even do that?

You give an estimate and once you draw up a contract you name a more accurate amount of time and price.

Once milestones are reached or the job is finished you invoice and bill your tasks / time.

If it's very different to your estimate you better talked about whatever caused the price hike when it occurred and they better agreed to it.

If they insist, thank them for considering to work with you but respectfully decline out of security concerns.

Let me reiterate:

DO NOT LET ANYBODY SPY ON YOUR PROPERTY AND WORK!!

This is VERY common.
UpWork requires screenshots for you to have escrow claims. Because of the popularity of UpWork it is safe to say this is a common practice.

The Upwork client installs a program that takes a screenshot every 10 minutes and checks keyboard/mouse activity over each time slot to determine if you really were at the keyboard and approximately how active you were.

Personally I found it unpleasant at first but quickly got used to it. The clients rarely check it. It's mainly just that in the event of a dispute, the escrow mechanisms don't work without the paper trail of activity.

Note: the tracker is optional. If you don't use it then you have little chance of recovering funds as it is required for the escrow dispute resolution process.

Others have given good answers whether or not this is normal (no!), but I wanted to give an example reaction. The tone should be confident, a kind of "take it or leave it" approach (which, IMO, this is):

Hi,

I have been in the industry a number of years. I have delivered a lot of software on time and on budget. I am aware of time management and perform as you may expect from a professional.

Asking me to use tracking software gives me the impression that you do not trust me and that won't help the project for either of us. If you want, I can give some testimonials of other clients about how it's like to work with me, but using tracking software has to be a hard no for me.

Please let me know whether you want to continue with this project, [ and here something positive depending on how much you would like this project ].

Dedicated devices

Such a requirement isn't common, but it happens sometimes. One reason for highly monitored environments like this one is security controls, but security goes both ways - they don't want you to do unauthorized things, but you also don't want them to do unauthorized things with your data or, worse, data of your other clients.

This means that if something like this is implemented, it's absolutely incompatible with the notion of "my home computer (which is also my work computer)" - if they do screenshot time tracking, then that must be done on a separate device that's dedicated to their project only, at least while their project is ongoing. E.g. start with a clean wiped machine, set up things for their project (including that time-tracking thing), use that machine only for that project and nothing else, and wipe the machine as soon as the project ends, which is a common part of NDAs if you work with sensitive data of that customer.

If you're working on your home computer that contains data of other customers as well, then you can't meet such a requirement; you'd need to get a separate work machine, and you'd have to evaluate whether what they're paying you is adequate to justify that.

Your problem around this request is based on your setup. The reason there's a privacy concern is because you haven't split up your personal and work correctly; nor have you split your clients.

By creating a single VM per client; you will at no point have any issue with cross contamination of key log data or personal data.

There are many reasons why doing this is advantageous - such as limiting the impact of malware to your business, accidentally breaking NDA's and as you just found out, meeting strange requests from clients.

Is it common practice? Well, I can't talk about freelancing, but most financial institutions use key loggers to protect themselves; often without the knowledge of the employees. It is worth highlighting that the collection of the data is legal; but the use of any passwords etc is not.
The fact that they're asking for evidence that you're working the timesheet that you submit doesn't seem unreasonable; and if you have a better proposal on how you can present it then you can make a counter offer.

As for the direct implication the client does not trust me; I disagree with this blanket statement. It might be that the person who's doing the outsourcing isn't trusted; or one of many other options; and even if it is true, so what? Would you trust someone's word without any evidence to back it up? It seems actually like they're taking a very reasonable stance by wanting evidence.

You can always respond that you need to be paid in advance before delivery of the goods - which is also very reasonable.

Speaking to whether or not you should do this, I think you have your answer here.

I am not desperate for work.

One of the primary benefits of being a good freelance developer is the ability to choose your clients and work on your own terms. If you don't feel comfortable with this (and who would blame you), simply decline. Probably not someone you want to work with anyway.

It's important to remember that YOU are in charge of your business and responsible for how you do your work, how much you charge, etc. If you find yourself in a situation where you're struggling for clients or money, then by all means, reevaluate, but it doesn't sound like that's the case.

When done tactfully and with confidence, you will command respect and attract higher quality clients through a willingness to take control, dictate the process, or walk away when the situation calls for it.

I personally would decline because of privacy concerns (both yours and other clients of yours).

However, I would also propose an alternative. I would ask them to provide a similar machine that would have the screenshot tracking thing and that computer could solely be used for work related to the client that requested you install the screenshotting software.

I have never even heard of this concept, maybe its an Americanism, but in the UK ... never.

However, I did it to myself a long time ago in an attempt to help me fill out my timesheets at the end of the week by installing a program that kept track of what program was active every few seconds. I found that, as a software developer, the 2 programs I used the most by far, and I mean over 50% of the time combined, were Firefox and Microsoft Word.

Word is obvious, all those specs and documents, but Firefox's 2 main websites viewed were StackOverflow and MSDN (3rd FYI was Outlook.. don't you love corporate work environments!)

So my problem quickly became how to tell what I was working on, if a significant amount of my time was spent reading stuff, even though it was work-related. I gave up as it was useless (if fun statistically).

So unless they're just being paranoid that you're working (rather than judging you by results) then tell them you don't use it because its a waste of time.

No, this isn't a normal request. And from your own descriptions, I think you can improve your invoicing techniques. Clients don't care about your lunch breaks. All they care about is seeing what you did and how much it cost. Be clear, concise, and imagine you are the client reading the invoice. The goal should be, "Wow, look how much work was done in that little time!". Examples:

Bad: "2.5 hours: fixing bugs, research"

No one wants to pay for bug fixes and research! But they are happy to pay for "updates".

Good: "2.5 hours: updating interfaces, adding low battery indicator, adding flux capacitor monitoring, additional database development"

You don't need a ton of detail, just enough to show you've been busy and the hours are reasonable.

My answer is similar to Peteris's but a bit further.

While being monitored, it's foolish to not treat this workstation as known infected with spyware. It should be in a DMZ on your network (or have its access restricted to egress and nothing else).

Knowing that someone doesn't trust me is annoying--I understand they don't necessarily know I'm trustworthy--but it's still difficult to not find this insulting.

The only way I'd ever agree to a intrusion like this is if the expected pay would more than cover

a) the cost of a workstation dedicated to the task, and

b) the requisite hassle for setting it up as above, and

c) being enough left over to justify the work at all.

Even so, I'd likely consider a VM.

Obviously there are other factors: How much do you need the work? How likely is this client to bring you future work--or refer other appealing clients?

As for how common this is...I've never seen it, but that's my experience.