There's several parts to the story. The first part is compliance to HR policy. I'm not here to defend either the policy or the breach.

The interesting parts to me are twofold:

Firstly, the sharing of how to hide your location from your employer, the normalising of "this is how you nomad on the sly" it's a subculture all of its own I didn't think about but now, clearly "needs to exist" under demand from the sly nomad community.

Secondly the ways MFA leaks info, which I found extremely surprising. But then, ops checking on you is now increasingly normal: work mate got called for "excessive SSH outbound" which made him very angry: it's his normal day to day working pattern. His laptop snitched on him after an upgrade, and his prior pattern not being logged raised a flag. So, the new MFA told a tale. And, the community says "yea this is how to ensure the MFA device only says what you want it to say"

This is all a bit silly. The war on WFH includes a war on digital nomads. Hiding your location is also a bit meh. What if something crops up which rationally needs your real presence at work?