Can employer see which state you are in if logged into their VPN?

Question

If you connect to your employers VPN, can they tell from your IP address or the wifi you are connected to which state or location you are in?

Answer 1

They would be able to see the IP address of the incoming VPN connection (where you're dialing in from) and can perform lookups to see where that IP is registered.

This won't give them an exact location, but a city usually. It should also be noted that the information stored within the databases that these whois services reference might contain stale information so they're nowhere near fool proof. In addition these whois services typically state the location of the IP address is the location of the ISP office so accuracy can be off by hundreds of kilometres.

Answer 2

• Can they see what state you are in if you're logged via a VPN or TOR?

Probably not if you do it correctly.

• Will you raise any suspicions by using a VPN or TOR?

Possibly.

• Can the employer figure out you're working from another state if they want to?

Most likely.

There are just too many things that can give out your location, aside from your IP address. Your time zone which may often be inadvertently revealed by some software such as Git, your daily activity pattern, your ping, your real IP that accidentally ends up in some logs that you share, some kind of a backdoor rootkit your employer may have in your corporate laptop, some random person casually giving out the name of the city you're in while you're on the phone, your... inability to receive any mail and packages to the address where you are supposed to be or to show up for an important meeting.

Perhaps more importantly though, lying is... bad, regardless of any circumstances.

Answer 3

If they have a VPN for this anyway, why would you need to worry about where you are using it from?

It is possible to circumvent this through some of the means above, at the risk of (in many cases) making things look worse.

Using your phone's WIFI could be one solution, but there are a lot of variables, and probably cost (a VPN would add non-negligible network overhead).

If you do nothing, they can make a guess, in many cases, about where you are. If your not being in a specific state is an issue, unless you live right on a state border, then you would have an issue.

Answer 4

Possibly. There's no guarantee, but if this is a risk you should assume they can. There are a few tools that they can use.

IP Address Geolocation Databases

There are a few companies that offer databases where you enter an IP address and they guess where they are physically located. This is an imperfect process, as demonstrated by the infamous Kansas farm case:

As any geography nerd knows, the precise center of the United States is in northern Kansas, near the Nebraska border. Technically, the latitudinal and longitudinal coordinates of the center spot are 39°50′N 98°35′W. In digital maps, that number is an ugly one: 39.8333333,-98.585522. So back in 2002, when MaxMind was first choosing the default point on its digital map for the center of the U.S., it decided to clean up the measurements and go with a simpler, nearby latitude and longitude: 38°N 97°W or 38.0000,-97.0000.

As a result, for the last 14 years, every time MaxMind’s database has been queried about the location of an IP address in the United States it can’t identify, it has spit out the default location of a spot two hours away from the geographic center of the country. This happens a lot: 5,000 companies rely on MaxMind’s IP mapping information, and in all, there are now over 600 million IP addresses associated with that default coordinate. If any of those IP addresses are used by a scammer, or a computer thief, or a suicidal person contacting a help line, MaxMind’s database places them at the same spot: 38.0000,-97.0000.

Which happens to be in the front yard of Joyce Taylor’s house.

But very often these searches will indeed guess if not the state at least the region of the country.

Contacting the ISP

The American Registry for Internet Numbers (ARIN) is the organization that assigns IP address blocks. They have a public searchable database of IP addresses that tells you who they've been assigned to, including contact information. (Here's the result for a Google IP address.)

Your employer could search the IP address and then contact its owners (generally an ISP), and ask them to help them narrow down where the devices with that IP address may have been located at a specific point in time. This could be accompanied by a nice or not-so-nice letter from a lawyer, or even a court subpoena to give it extra oomph.

Reverse DNS lookups

Often the DNS names for an ISP's hosts are organized by geography, and thus have hints as to where the IP address is located. So a reverse DNS lookup for the Google IP address in the previous example gives us the hostname sfo03s01-in-f4.1e100.net, which you might guess is in the San Francisco Bay Area (the San Francisco International Airport's code is "SFO.")

Cell phone geolocation

If your device is a cell phone, similar remarks apply as in the "Contacting the ISP" point, but in addition they can use tower signal data to pinpoint fairly accurately where you were located at that point in time.

Conclusion

You should assume they can figure out your state with minimal effort using a public geolocation database or other public information. And if they're motivated enough to get the law involved, they can likely find out much more precisely than just the state.

References

The Electronic Frontier Foundation has a useful white paper for law enforcement and courts on the proper use of IP address for identifying locations and individuals:

• Mackey, Aaron, Frank Stanton, Seth Schoen and Cindy Cohn. 2016. "Unreliable Informants: IP Addresses, Digital Tips and Police Raids: How Police and Courts are Misusing Unreliable IP Address Information and What They Can Do to Better Verify Electronic Tips." Electronic Frontier Foundation white paper. Available for download.

Their recommendations to police on how to use IP addresses to identify locations and individuals (section 5) are relevant to your question, so you may want to read it.

Answer 5

You should not even contemplate that. You must be lawful to your employer and hiding the source address without a good reason to do so when connecting to the corporate VPN can be seen as a hostile action(*). If your manager can know that, you should be prepared to explain why you have hidden the original IP address.

As an employer, I would warn that I can admit that you did not realize exactly what you were doing and that anyone should have a second chance. But do not do it again!

That being said, if the protocol is compatible, TOR is normally a good way to hide an IP address. Or if it is relevant you could try to setup a relay in your home, or on a machine in the cloud on which you have administrative rights: you connect to that machine which in turns connects to the VPN. But you have been warned of possible consequences, and you should not expect this operations to be undetected:

• TOR (and common VPNs) are well known things nowadays, so it is likely that their terminal address is either detected directly as a VPN end point or be in a place where you should not be, a datacenter for example
• a relay in the cloud is likely to present an address in a range belonging to a large datacenter, where again you have no reason to be
• an at home relay is probably the safest way... provided you do not post on facebook a photo showing you hundred kms from there or someone else can know that you cannot be there...

---

(*) It is hostile for many reasons:

• simply hiding a normaly not sensitive information is suspect at first sight
• if you use more than the provided VPN to connect to your corporate network, you may add possibility of interception of sensitive informations - after all they provided you with the VPN to protect that connection