News from our institutional cooperation network

Costa Rica's CPIC issues recommendations on tools that simulate activity on computers

26 October 2026 · Originally published by CPIC, Colegio de Profesionales en Informática y Computación ↗

In October 2026 the Colegio de Profesionales en Informática y Computación (CPIC) published guidance on managing mouse jigglers in public and private organizations. It calls for clear policies, proportionate controls and verifiable technical evidence.

The Colegio de Profesionales en Informática y Computación (CPIC) of Costa Rica issued technical recommendations in October 2026 for public and private organizations on tools known as "mouse mover" or "mouse jiggler". These are programs or small USB devices that imitate pointer movement so that a computer does not become idle or lock its session.

CPIC notes that such tools can serve legitimate needs, such as keeping information displays, presentations or long processes running, or supporting testing and technical support, so they should not automatically be treated as malicious software. It warns, however, that an unattended active session can expose information and systems, and that deliberately using the tools to bypass lock policies or appear active to monitoring cannot be justified.

When a tool is detected, it suggests distinguishing between presence, installation, execution and purpose of use. Presence alone does not prove improper conduct, and a user account linked to an installation does not necessarily identify who performed it, especially with shared accounts, automated processes or remote administration. IT teams should document the conditions in force, and technical capability should be separated from institutional authorization. Pointer movements or session time are also limited indicators of productivity.

Where a real risk exists, the Colegio proposes preserving digital evidence with integrity, traceability and chain of custody, blocking or removing unauthorized applications, controlling applications and peripherals, applying least privilege, configuring automatic session locking and strengthening event logging. The measures draw on the NIST Cybersecurity Framework 2.0 and the CIS Controls v8.1, and each organization should assess them in light of its own technological and regulatory context.