the risk of exposing another clients work via (2) - software becomes unpatched leaving a giant hole in my system or a screenshot of a chat with another client

This is why I will not use screen-logging software, and I do not know of a single free-lancer who will allow it on their computer.

You likely signed NDAs with your clients. Installing this software likely breaks the NDA

How to (possibly) salvage this situation - Explain The above reason to them, and suggest other ways to build trust with them. Something like

I can't install software like that because you could inadvertently see what I'm working on for other clients. That's a violation of their trust (and possible NDA), so I can't really budge on that. I have several references XYZ if you're worried about work ethic.

DO NOT LET ANYBODY SPY ON YOUR PROPERTY AND WORK!!

If you work on the clients premises, using their property and licenses then they have every right to keylog and screencapture.

But that's not the case!

I'm afraid you gave them ideas with your too detailed, itemized timesheets.

Why would you even do that?

You give an estimate and once you draw up a contract you name a more accurate amount of time and price.

Once milestones are reached or the job is finished you invoice and bill your tasks / time.

If it's very different to your estimate you better talked about whatever caused the price hike when it occurred and they better agreed to it.

If they insist, thank them for considering to work with you but respectfully decline out of security concerns.

Let me reiterate:

DO NOT LET ANYBODY SPY ON YOUR PROPERTY AND WORK!!

This is pretty common.
UpWork requires screenshots for you to have escrow claims. Because of the popularity of UpWork it is safe to say this is a common practice. (HubStaff and various others operate similarly)

The Upwork client installs a program that takes a screenshot every 10 minutes and checks keyboard/mouse activity over each time slot to determine if you really were at the keyboard and approximately how active you were.

Personally I found it unpleasant at first but quickly got used to it. The clients rarely check it. It's mainly just that in the event of a dispute, the escrow mechanisms don't work without the paper trail of activity.

Note: the tracker is optional. If you don't use it then you have little chance of recovering funds as it is required for the escrow dispute resolution process.

Edit: I should add that I don't think software development is hourly work. Unless it's some kind of rote typing, most software development is about solving problems at all times of the day. I think it's more like art. You can't put Picasso in a room and say OK give me 2 paintings a day on a 9 to 5 shift, and we'll be monitoring your canvas. It's nonsense.

Others have given good answers whether or not this is normal (no!), but I wanted to give an example reaction. The tone should be confident, a kind of "take it or leave it" approach (which, IMO, this is):

Hi,

I have been in the industry a number of years. I have delivered a lot of software on time and on budget. I am aware of time management and perform as you may expect from a professional.

Asking me to use tracking software gives me the impression that you do not trust me and that won't help the project for either of us. If you want, I can give some testimonials of other clients about how it's like to work with me, but using tracking software has to be a hard no for me.

Please let me know whether you want to continue with this project, [ and here something positive depending on how much you would like this project ].

Speaking to whether or not you should do this, I think you have your answer here.

I am not desperate for work.

One of the primary benefits of being a good freelance developer is the ability to choose your clients and work on your own terms. If you don't feel comfortable with this (and who would blame you), simply decline. Probably not someone you want to work with anyway.

It's important to remember that YOU are in charge of your business and responsible for how you do your work, how much you charge, etc. If you find yourself in a situation where you're struggling for clients or money, then by all means, reevaluate, but it doesn't sound like that's the case.

When done tactfully and with confidence, you will command respect and attract higher quality clients through a willingness to take control, dictate the process, or walk away when the situation calls for it.

Dedicated devices

Such a requirement isn't common, but it happens sometimes. One reason for highly monitored environments like this one is security controls, but security goes both ways - they don't want you to do unauthorized things, but you also don't want them to do unauthorized things with your data or, worse, data of your other clients.

This means that if something like this is implemented, it's absolutely incompatible with the notion of "my home computer (which is also my work computer)" - if they do screenshot time tracking, then that must be done on a separate device that's dedicated to their project only, at least while their project is ongoing. E.g. start with a clean wiped machine, set up things for their project (including that time-tracking thing), use that machine only for that project and nothing else, and wipe the machine as soon as the project ends, which is a common part of NDAs if you work with sensitive data of that customer.

If you're working on your home computer that contains data of other customers as well, then you can't meet such a requirement; you'd need to get a separate work machine, and you'd have to evaluate whether what they're paying you is adequate to justify that.

There's an angle to this that I think you could take which hasn't been addressed:

Instead of posturing why you don't do this because of the risk to OTHER clients or yourself...

Explain why you don't do this because of the risks to the client requesting it

Generally speaking, you always want to posture this in terms of the person requesting it, rather than yourself, and why the requestor "doesn't actually want this". Place the negatives, and the potential burdens, squarely on them and not yourself, and posture it as something you're not doing to better serve their interests in not doing it:

"If I installed this type of software for every client, there would be the risk of a breach in my computer, and they might be able to read your proprietary data and code, which would be a security risk to you. I value you as a client, and I understand your concerns, and that's why as a professional this is simply something I do not allow, as a general rule to all my clients, for your own safety."

Posture this as you doing them a favor and looking out for them by not doing this, ever, as a general rule. If they insist, offer them a solution that would make you comfortable but places all related costs on them, up to and including that they purchase related equipment for you, and they pay you for your time setting up the associated environment(s). If they're serious and have a serious concern, they will pay for it. If they're not (or if they're just being arbitrarily abusive) they'll move on to someone else, and you will be better off for it (since you've said you aren't desperate for this work).

Contractor vs Employee

Furthermore, another angle not covered here yet is that this degree of client involvement and interference into directing your work risks creating (in the US) a legally defined employee/employer relationship, rather than one of a contractor.

If you are working as an employee of a contracting agency, this is not an issue (you are already in an employee relationship with someone in relation to the job in particular, and if your employer wants to let someone else they're contracting with direct you this much that's within your employer's purview: but it's also an onus on them to provide equipment and be liable for creating any related security risks as your employer). If you are working as a fully independent contractor (which is what I assume in this case, from tags and wording), this is a situation your clients should wish to avoid: they are commissioning work from you, not hiring you as an employee, and that distinction is actually important.

Note that this is just a rough opinion, and if you have specific concerns you should hire a lawyer to look into specific situations (and also let me insert a generic "I am not a lawyer, nor am I your lawyer/etc" disclaimer).

I would personally recommend that you be careful with how much you share with them, and posture it as a matter of professionalism that you are simply logging billable hours in relation to work product, versus detailing your day. Focus on what you got done in relation to a given set of billable hours, rather than on logging breaks/etc as such. There's a degree of oversharing which can set up the wrong expectations.

This is someplace where when working as a fully independent contractor, I would, personally, take a page from how attorneys generally handle billable hours. Yes it includes things like "research" and the time spent doing that. No it does not (that I've ever seen or anywhere I've worked, having spent time in a law office) include things like "took a break". Document what you did, clock the time on it. That's what you bill the client. The rest is actually none of their business: they're paying for a result, they're not hiring you as an employee. (unless you come to a different mutual agreement to work as an employee for them)

No, this isn't a normal request. And from your own descriptions, I think you can improve your invoicing techniques. Clients don't care about your lunch breaks. All they care about is seeing what you did and how much it cost. Be clear, concise, and imagine you are the client reading the invoice. The goal should be, "Wow, look how much work was done in that little time!". Examples:

Bad: "2.5 hours: fixing bugs, research"

No one wants to pay for bug fixes and research! But they are happy to pay for "updates".

Good: "2.5 hours: updating interfaces, adding low battery indicator, adding flux capacitor monitoring, additional database development"

You don't need a ton of detail, just enough to show you've been busy and the hours are reasonable.

Your problem around this request is based on your setup. The reason there's a privacy concern is because you haven't split up your personal and work correctly; nor have you split your clients.

By creating a single VM per client; you will at no point have any issue with cross contamination of key log data or personal data.

There are many reasons why doing this is advantageous - such as limiting the impact of malware to your business, accidentally breaking NDA's and as you just found out, meeting strange requests from clients.

Is it common practice? Well, I can't talk about freelancing, but most financial institutions use key loggers to protect themselves; often without the knowledge of the employees. It is worth highlighting that the collection of the data is legal; but the use of any passwords etc is not.
The fact that they're asking for evidence that you're working the timesheet that you submit doesn't seem unreasonable; and if you have a better proposal on how you can present it then you can make a counter offer.

As for the direct implication the client does not trust me; I disagree with this blanket statement. It might be that the person who's doing the outsourcing isn't trusted; or one of many other options; and even if it is true, so what? Would you trust someone's word without any evidence to back it up? It seems actually like they're taking a very reasonable stance by wanting evidence.

You can always respond that you need to be paid in advance before delivery of the goods - which is also very reasonable.

I personally would decline because of privacy concerns (both yours and other clients of yours).

However, I would also propose an alternative. I would ask them to provide a similar machine that would have the screenshot tracking thing and that computer could solely be used for work related to the client that requested you install the screenshotting software.

I have never even heard of this concept, maybe its an Americanism, but in the UK ... never.

However, I did it to myself a long time ago in an attempt to help me fill out my timesheets at the end of the week by installing a program that kept track of what program was active every few seconds. I found that, as a software developer, the 2 programs I used the most by far, and I mean over 50% of the time combined, were Firefox and Microsoft Word.

Word is obvious, all those specs and documents, but Firefox's 2 main websites viewed were StackOverflow and MSDN (3rd FYI was Outlook.. don't you love corporate work environments!)

So my problem quickly became how to tell what I was working on, if a significant amount of my time was spent reading stuff, even though it was work-related. I gave up as it was useless (if fun statistically).

So unless they're just being paranoid that you're working (rather than judging you by results) then tell them you don't use it because its a waste of time.

It's better to avoid uncomfortable clients.

How to do this?

Increasing your rate for them.

If they have special requests like this, just double your rate.

If they agree or not, in any case you gain.

My answer is similar to Peteris's but a bit further.

While being monitored, it's foolish to not treat this workstation as known infected with spyware. It should be in a DMZ on your network (or have its access restricted to egress and nothing else).

Knowing that someone doesn't trust me is annoying--I understand they don't necessarily know I'm trustworthy--but it's still difficult to not find this insulting.

The only way I'd ever agree to a intrusion like this is if the expected pay would more than cover

a) the cost of a workstation dedicated to the task, and

b) the requisite hassle for setting it up as above, and

c) being enough left over to justify the work at all.

Even so, I'd likely consider a VM.

Obviously there are other factors: How much do you need the work? How likely is this client to bring you future work--or refer other appealing clients?

As for how common this is...I've never seen it, but that's my experience.

If you are in the UK, and claiming to be working as a contractor, HMRC (Her Majesty's Revenue and Customs) will have a field day. As a contractor, you get paid to do the work - there is no way you would let someone observe your work in so much detail unless you are an employee. So if they find out about this, it will cost you a ton of money.

This is on top of all the arguments about security, privacy, possible exposure of other clients' data and so on.

Screenshot time-tracking is not common. But if applied properly, it is beneficial for everyone.

1. Such a request is normal only for their own devices.

I have met such a behavior at clients and I can understand it. As far as it is happening only on their device dedicated for accessing their infrastructure, this is not a concern. For other cases, read further:

I am always using tracking of my activities with benefit, but the recordings must remain internal.

2. When working on my computer, the recording is mine, not theirs.

During my software developer contracting period, I deliberately found and installed a tool which records window on top and screenshots. It gave me flexibility on addressing multiple projects and customers, switching between them without need of immediate writing down their hours, billing them accurately and auditing myself if I needed to additionally review my time spent. Moreover, if some work got lost due to editor instability, it was easy to restore it from screenshots. At that time, I would disclose the screenshots to the customer, but only during their personal presence in my office, with me controlling the computer and without video recording. That way they would be able to verify my billed periods and even if other screenshots would briefly appear on screen for 0.3 secs, I would not see it as a concern. If they would ask to have a few screenshots, I would redact them to remove unrelated information first.

3. The recording can be fully disclosed only if made on their workstation.

Applies to both freelancing and employment. Also in my case, during my current employment period, I continue to use this tool to give accurate billing for all projects. And here, I would give the entire track to my employer, even proactively (I mean, recording is my initiative, not their requirement) because on company's computer I have nothing to hide.