Unauthorized Work Location

The subject performs work-related duties from a foreign jurisdiction without notifying or obtaining approval from the organization, in violation of defined location, legal, or contractual requirements.

This behavior commonly occurs when a subject travels internationally and continues to access corporate systems while physically located outside their approved working jurisdiction. In many cases, the subject does not disclose the travel, preventing the organization from applying appropriate legal, regulatory, and security controls.

A frequently observed variant involves annual leave extension abuse, where the subject initially travels abroad under approved leave but remains in that jurisdiction beyond the authorized leave period and resumes work remotely without declaration. In this scenario, the subject transitions from compliant absence to unauthorized international working, often assuming the original approval implicitly extends to remote work activity.

Undeclared international remote work introduces material risk, including:

• Breach of data residency and cross-border data transfer restrictions
• Violation of employment law and tax obligations
• Exposure of corporate systems to untrusted or high-risk environments
• Breach of contractual or client-imposed geographic controls

This behavior is often rationalized by the subject as low impact or temporary. However, it represents a failure of governance and visibility over where sensitive systems are being accessed. In regulated environments, even short periods of undeclared international access may constitute a compliance breach.

If repeated or unchallenged, this behavior may contribute to Behavioral Drift, where undeclared cross-border working becomes normalized within teams or functions .

The subject performs work-related activities from a jurisdiction explicitly prohibited or classified as high-risk by the organization, in violation of policy, regulatory obligations, or contractual restrictions.

These jurisdictions are typically defined based on legal, regulatory, geopolitical, or security considerations. This includes sanctioned countries, regions subject to export control restrictions, locations with elevated cyber threat activity, or jurisdictions where data access is restricted due to sovereignty or client requirements.

Unlike general undeclared international remote work, this behavior involves access from locations where work is explicitly disallowed, regardless of disclosure. Even where the subject has notified the organization of travel, performing work from these jurisdictions constitutes a direct infringement due to the inherent risk profile.

Operating from prohibited or high-risk jurisdictions introduces severe exposure, including:

• Breach of international sanctions or export control laws
• Unauthorized cross-border transfer or access to regulated data
• Increased likelihood of interception, monitoring, or compromise by hostile entities
• Violation of contractual obligations with clients, governments, or partners

In some cases, subjects may knowingly disregard restrictions due to convenience or personal circumstances. In more serious scenarios, this behavior may indicate coercion exposure, or deliberate or inadvertent data exfiltration to a third-party.

This sub-section represents a high-severity infringement category, as the risk is intrinsic to the location itself, not just the lack of approval.