Costa Rica’s Finance Ministry is still working to fire 36 employees accused of installing a mouse-jiggler program to make it look as if they were working during remote-work shifts. The ministry will not yet say whether the software exposed any of its systems. The ministry announced the dismissal proceedings on Sept. 10.
Vice Minister of Revenue VÃctor Carvajal said at the time that the program simulated mouse movement on institutional computers, so the employees appeared active and their screens did not lock during the workday. Carvajal said the 36 work in the ministry’s revenue, expenditure and administrative areas. He said the evidence pointed to possible job abandonment and that the employees would lose their telework arrangements while the dismissal process runs its course.
The program identified in the case is called Move Mouse. The ministry says it uses web-browsing controls and monitors the security of its equipment, yet the employees were able to install the program on government computers without authorization. Jeffrey Taylor, the ministry’s director of technology and digital innovation, said the ban on unauthorized software rests on the institution’s information-security and software-management policies, along with other general regulations. He did not specify which provisions apply or what sanctions they carry.
Asked whether the program led to data theft, infections or exposed credentials, Taylor said the state of the investigation did not allow the ministry to provide further information. He said the ministry took immediate steps to stop the installation and use of the software once the cases were identified. A technical team is now drafting a plan to tighten controls, he said.
The ministry oversees the country’s tax collection and holds tax records for individuals and businesses. In April 2022, a ransomware attack by the Conti group knocked its tax and customs systems offline for weeks. Costa Rica’s professional association for computing, the Colegio de Profesionales en Informática y Computación, said mouse-jiggler tools are not malicious in themselves and have legitimate uses. It warned, however, that keeping a session open with no one at the keyboard can expose information and systems to unauthorized access.
The association also cautioned that the mere presence of such a program on a computer does not prove misconduct. It said investigators should establish who installed it, who ran it and why, noting that the user account linked to an installation does not always identify the person responsible.
The dismissals must still clear administrative proceedings before they become final. The ministry, now headed by former President Rodrigo Chaves, has not named the employees.
