Many companies utilize a remote workforce to tap into non-core competencies, to fill talent gaps, to lower labor costs, to provide a local presence, and to benefit from operational efficiencies and economies of scale. Often, a third-party will be used to provide staff augmentation or managed services, particularly in offshore and nearshore locations. Typical functions include technology, operations, manufacturing and customer service.
With organizational structure, scale, standards and productivity as key objectives, companies will often create new, or leverage existing Offshore (ODC) and Nearshore Delivery Centers (NDC). While these terms may sound sophisticated to the layperson, they simply represent facilities that provide the necessary infrastructure to house and support local staff. It’s also best-practice to reduce the concentration risk that accompanies too much consolidation in a single location, particularly for critical operational functions. The purpose, of course, is to reduce exposure to regional disasters, economic instability or geopolitical risks. In recent years, this has led to companies seeking to diversify their ODC and NDC portfolio across more disparate regions, even within the same country.
Often, when workers at such centers are exposed to confidential data, like non-public personal information (NPPI), companies will further introduce so-called “cleanroom” policies and facilities. This is especially true when third-parties, rather than full-time employees are manning these privileged workloads. As such, cleanrooms typically employ a range of enhanced security controls, including: secure entry and clearance; video surveillance; prohibited access to cell phones and other personal devices; limited access to email and attachments; desktops and applications configured to client specifications; disabled or limited access to peripherals, including USB ports and printers; and closely monitored, secure communications channels. For industries like financial services and healthcare, in particular, the use of cleanrooms is commonplace.
For those companies that offshore at scale, India has been an early, and frequent destination. The availability of an educated and motivated workforce, particularly in STEM-related disciplines, and a significantly reduced labor cost presents a workforce arbitrage opportunity. In Asia, other popular offshore locations include China, Pakistan and Malaysia. When time-zone, proximity, and language are key considerations, nearshore locations may be preferred, like those in Eastern Europe and Latin America. The common demographic is that these locations are typically within second, or third world countries. When resident proximity or culture are added dimensions, nearshore locations may also include lower-cost developed areas, such as Nashville, Manchester and Dublin.
Many large and global companies, in particular, have significant operational dependencies in these regions. So, when India announced a very strict lockdown in the face of COVID-19, just days ago, corporate executives and board members at these companies surely shuddered. First, it’s important to remember that India, like many other offshore and nearshore locations, is a third world country. Network and broadband infrastructure to the home is not ubiquitous, and only 17-20% of India’s population is estimated to have such access, so transitioning to a work-from-home arrangement isn’t seamless.
Second, the economic impact of such a lockdown or shelter-in-place policy is devastating. The impact to developed nations like the United States is bad enough, but the impact to a third world country already exemplified by a high poverty rate is likely to be far worse. In India, for example, there are already reports of mass chaos, police brutality and hunger amongst the population. Such conditions may incentivize some individuals to pursue alternative, and possibly unethical sources of income. If price gouging for commodities like toilet paper is an example of bad behavior in the United States, could displaced ODC staff be drawn to sell confidential information or engage in extortion?
To reduce the risk of such activities, continued employment, where feasible, and a strong social support system must be provided to workers, including extended outreach from managers and counselors to ensure that personal engagement is maintained and valued. Ultimately, this is a difficult time for everybody, but the attention, caring and kindness of others can help dissuade individuals from going astray. This is the first, and best line of defense.
While some work-from-home capabilities can be more readily utilized or enhanced, companies may also need to adapt long-standing policies and contractual terms that require staff to physically work from an ODC, especially with third-parties who provide staff augmentation or managed services from such facilities. Where sufficient broadband and home access to a computer is available or can be provided, remote desktop technologies can be utilized to allow workers to operate, similar to any other work-from-home scenario.
The use of individual remote desktop connections (RDC), however, must give way to server-side remote desktop facilities, like Virtual Desktop Interface (VDI) platforms or Citrix. The problem with RDC is that the session is explicitly tied to a single desktop host. If that desktop goes down, who’s around at the office facility to restore it? Frankly, this is not limited to offshore or nearshore workers; it plagues everyday onshore workers, too. While the cost of setting up on-premise VDI infrastructure may be prohibitive for some companies, cloud vendors, like AWS and Azure, also offer such services, thereby limiting upfront cost, infrastructure expertise and complexity.
The ability to emulate cleanrooms, however, is perhaps one of the most difficult capabilities to address. How can the most robust security controls be achieved, especially those that employ physical means? While remote desktop technology will reduce the risk of cross-contamination from malware on a host PC and administrative settings can be deployed to prohibit users from taking screenshots of these windows, how do you prevent someone from taking a picture of the screen with another device, for example?
Here’s where new technologies, like augmented reality (AR) glasses, have potential. The onboard digital display is actually quite small, largely making the computer-generated field of view visible only to the wearer. The ability to photograph the screen with an external device is therefore rendered impractical. Moreover, these glasses can be driven by a relatively inexpensive and company-supplied smartphone, which can be further locked down and connected to a secure network hotspot. For enhanced security, perhaps glasses could be outfitted with biometric sensors that authorize users by first performing a retinal or iris scan. Through Bluetooth, the phone can be paired to a keyboard and mouse. The virtual display can also present multi-screen functionality and a more immersive experience for team collaboration. And, since the user is accessing remote desktop and compute, the phone’s own hardware specifications are unlikely to be constraints. This would be an innovative application of new technology to a mission-critical function.
For the duration of COVID-19, there are crucial steps that can be taken to limit the impact to business operations, including to maximize the use of offshore and nearshore capacity. In the aftermath, too, there will be lessons learned that will better prepare companies for another mass disaster, whether due to a pandemic or other forces. It’s also clear that there will be lasting consequences that may alter the ways in which people work, and even broader adoption of work-from-home policies than has typically been the case. This should be anticipated. The application of new technologies, innovative thinking and policy updates that maintain, if not enhance worker portability, worker productivity and information risk will be critical.
