When Your Company Remote-Wipes Your Personal Phone 446
Xenographic writes "NPR has a story about someone whose personal iPhone got remotely wiped by their employer. It was actually a mistake, but it was something of a surprise because they didn't believe they had given their employer any kind of access to do that. This may already be very familiar to Microsoft Exchange admins, but the problem was her iPhone's integration with MS Exchange automatically gives the server admin access to do remote wipes. All you have to do is configure the phone to receive email from an MS Exchange server and the server admin can wipe your phone at will. The phone wasn't bricked, even though absolutely all of its data was wiped, because the data could be restored from backup, assuming that someone had remembered to make one. But this also works on other devices like iPads, Blackberry phones, and other smartphones that integrate with MS Exchange. So if you read your work email on your personal phone or tablet, you might want to make sure that you keep backups, just in case."
Gosh. What a surprise. (Score:2, Insightful)
Re:Hmmmmmm (Score:5, Insightful)
Is this meaning that the Mails were deleted on the server?
No, that wouldn't wipe a phone or raise questions about it being bricked if not for backups. Did you even read the summary?
This is more like the inverse or the equal-and-opposite of (previous?) MS e-mail clients that would automatically execute code from unknown sources as a "feature". Instead of an MS e-mail client it's an MS e-mail server, and instead of downloading and executing code automatically without asking the user to confirm it wipes the phone automatically without asking the user to confirm.
The solution is a simple one. If a company requires you to use a phone for business purposes that will be sending/receiving business e-mails and subject to remote wiping by that company, then that company needs to issue phones to their employees that may not be used for non-business purposes. Then there wouldn't be any problems with a company wiping a phone that is actually company property.
The surprise is in the scope (Score:5, Insightful)
I don't think most folks are shocked at the remote wipe capability - they just expected that it would be confined to the exchange data only, not the MP3's, games, photos, etc.
Re:we have the same policy at work (Score:5, Insightful)
I don't think most people read it but when you think about the type of proprietary (and often confidential) data your email inbox has, you have to understand why the company does it.
That's a perfectly acceptable policy for any company that provides smart phones to its employees. I don't know if it's true with your company, but I would consider that an overreach if you want me to connect my personal phone with your network and give you the ability to delete all of my pictures and other personal data solely at your discretion. I'm sure you would understand why the owner would find that objectionable.
Re:we have the same policy at work (Score:5, Insightful)
What do you do to protect your employees interests in not having their own data annihilated by accident?
Also, are you expecting employees to take work with them, using their own devices; or is the company willing to bare the costs of either providing a device or the work not being done?
It would seem most unusual to me for an employer to require their employees to provide expensive equipment for company use, and with the agreement that the company may treat it as its own.
*shrug* (Score:1, Insightful)
Re:One More Reason... (Score:3, Insightful)
I think you'll need to hate pretty much every company in the world.
Re:One More Reason... (Score:5, Insightful)
http://en.wiktionary.org/wiki/spick-and-span
Also, from the wikipedia article on the product, someone did try boycotting it in 1999 (http://en.wikipedia.org/wiki/Spic_and_Span). I think that's stupid. "Spick and Span" was first recorded in the 16th century. "Spic" has only existed since early 1900s, wasn't documented until 1910, and even then was documented as "spiggoty" as a slur against Italians. I'd say it's pretty safe to say that when "Spic and Span" was created (1933 in Ohio), "spic" being a slur wasn't even on the radar for them.
I think the situation is similar to the word "niggardly" (http://en.wikipedia.org/wiki/Controversies_about_the_word_%22niggardly%22). People see something that, without any context (context like the spelling of the word or idiom...), could be conceived as racist. People take offense as something because of their own ignorance.
The problem is, you're not being color-blind. You're seeing color issues where there aren't any. You're trying to get people riled up at racism that isn't even there. You're not helping to stop racism, but you are helping to chill language and communication and encourage ignorance. You have, by trying to be on the right side of something, wound up on the wrong side of everything.
And there goes my karma...
Re:we have the same policy at work (Score:4, Insightful)
My personal iphone is connected to a gmail account that I forward a copy of all my work email.
That way I get work email, but it is still my account.
Re:we have the same policy at work (Score:4, Insightful)
Then don't connect your personal phone to the company network.
It's that simple. It's the company's data, not your personal data, and they have measures in place to protect it. If you don't want to abide by those measures, you don't have to.
At least in the US, if you're required to provide equipment required by your job, and your employer doesn't pay for it, then you can write it off on against your personal tax burden. So if you find yourself in that rare situation where work requires you have a smartphone, and won't pay for it, get one separate than your private phone and save on your taxes at the end of the year.
Re:we have the same policy at work (Score:3, Insightful)
Simple - don't give company access to your personal phone.
If the company wants you to have mobile email, they can pay for it themselves - after all, you're just as likely to not have a smartphone as to have one, so if the employer wants you to have one, they can provide it. I don't see why I should pay for a data plan on my phone that my employer can eat into. What - I went with a 100MB plan and you sent me 200MB of email? I'm not paying the extra $500 that usually costs.
The usual reason why personal iPhones and such are being connected to company networks is simple - the employee wishes to have their email (or needs to have it) and doesn't want the company standard blackberry, or to carry two phones, or other reason. Of course, most companies balk at using personal equipment connected to the corporate networks, either. Still, if you have to have email, either take the company hardware and deal with that issue (better) or use your own hardware and deal with remote wipe (worse option). Most people prefer carrying around just their iPhone instead of iPhone+Blackberry, though.
Comment removed (Score:5, Insightful)
Re:we have the same policy at work (Score:5, Insightful)
Re:we have the same policy at work (Score:3, Insightful)
It's to protect the company's interests should a phone be lost or stolen.
I don't think that wiping the entire phone's data goes far enough to protect their interests. Every company should have the ability to remotely wipe your smartphone, and your home computer, and the computers of all family and friends within 6 degrees of separation. Also, they should be able to kill you, because your brain contains precious precious data, too. Really, they ought to be able to take off and nuke the entire site from orbit. It's the only way to be sure.
Way too far is not enough, I say, when it comes to protecting a company's interests.
Re:we have the same policy at work (Score:5, Insightful)
It's the company's data, not your personal data, and they have measures in place to protect it.
No it's not. He was talking about them wiping all your personal data. "Measures in place" to protect company's data that also wipe your personal data are a bit creepy.
Re:Hmmmmmm (Score:3, Insightful)
The solution is a simple one. If a company requires you to use a phone for business purposes that will be sending/receiving business e-mails and subject to remote wiping by that company, then that company needs to issue phones to their employees that may not be used for non-business purposes.
Why require they be used strictly for business? If the user is willing to take the risk of losing it all, then let them. One less low-value rule to worry about enforcing.
In most companies, it is expected that equipment bought and paid for by the company is to be used only for business purposes. This is standard practice with company computers, landline phones, etc. Not to mention it's rather unprofessional to conduct your personal business while you're on the clock and certainly a sign of poor time management.
Also, I support the notion of private property when I retain the right to eject an unwanted person from my home. I likewise support the notion of private property when a company that lends you a phone and pays all the costs of that phone gets to tell you how you may use that phone.
Now the requirement that company-paid phones should only be used for business might be backed up by potential disciplinary action. Or it might be backed up by "our company data has been secured; don't cry to us if you put something else on there and now it's gone". Either way is alright by me, and which one it is would be up to the company and employees to work out.
Re:we have the same policy at work (Score:3, Insightful)
So you want me to have to carry around a second device because some dev is too lazy to isolate the e-mail stored on my phone from everything else?
Re:we have the same policy at work (Score:3, Insightful)
I meant the protection is for the company's data. It's their data, and their protection. You don't like what their protection does to your phone and your data? Then don't hook up your phone to their systems.
It's just like having a personal laptop. Would you bind your personal machine to the company's AD environment, giving them full administrative control? No? Then don't use your personal machine on their network. Use a company-provided machine, or a work-dedicated machine that you can write off on your tax return.
Re:we have the same policy at work (Score:5, Insightful)
It's just like having a personal laptop. Would you bind your personal machine to the company's AD environment, giving them full administrative control? No? Then don't use your personal machine on their network. Use a company-provided machine, or a work-dedicated machine that you can write off on your tax return.
I use my personal machine at work every day. I connect via standard protocols like ssh and smb, and never give up admin control, nor would I ordinarily do so. If they explicitly asked me to, I would say no, buy me a company machine instead, but if they said, "hey, if you install this software you can connect to our email servers" I don't really think it would occur to me to go check if the ordinary behavior of that software gives them root on my box. That wouldn't even occur to me.
Re:we have the same policy at work (Score:4, Insightful)
Of course one reason such "massive security breaches" happen is that companies have stupidly draconian policies which make "normal" operation so annoying/dangerous that clueful employees bypass it as a matter of course.
Yeah, they can threaten "you might be fired!", but threats are very rarely effective unless they coincide with common sense — which policies like "we can wipe whatever we want!" don't.
I suppose the larger the company, the more likely they are to choose "draconian/bluster" over working with the employees to find an agreeable technical solution...
Re:we have the same policy at work (Score:4, Insightful)
I have the same thing here. I always inform staff that I can and will wipe their phones. At their request, and that they should inform me at once if they lose of have their phone stolen.
My personal iphone is connected to a gmail account that I forward a copy of all my work email.
That way I get work email, but it is still my account.
I guess I'll pile on, too...
Depending on where you live and what you do, HIPAA has some exciting new personal liability built right in at no extra charge! So when that claims processor blasts PHI out to the wrong e-mail list, you, sir, have just transferred and stored it in a manner that will have you in court by yourself. Just you in the "Little Old Lady Victim vs. Evil (your name here)" By this time your employment will be a distant memory and your former company has no obligation to defend you. Depending on the company's policies and compliance they will get dinged, but that is a cost of doing business and a separate process that has nothing to do with your personal liability. Have you planned financially for that scenario?
Well if it is security setting for Exchange Server (Score:2, Insightful)
Then the simple solution is to not use your personal phone to check your business e-mail. If my employer wants me to check my e-mail when I am out and about, then they can provide me with the equipment to do so. Otherwise I will not use my personal phone to check my business e-mail.
Re:we have the same policy at work (Score:2, Insightful)
I suppose it depends on the work environment, but we regularly deal with sensitive customer information (i.e. financials, SSNs, credit cards, etc) and this sort of information ends up in internal emails.
Sending an e-mail containing someone's credit card details should be a criminal offense. Anyone who e-mailed SSNs internally should go to jail for doing so. Shoddy security practices by people in an organization in no way justify the destruction of someone else's property.
E-mailing sensitive financial details of customers is an utterly reckless practice, and trying to "wipe a terminated employee's phone" doesn't address the security issue at all.
Carrying around such sensitive information as CCs/financials on a mobile device without strong cryptography and basic security is at diametrical opposite to safeguarding corporate data. And frankly, the organization deserves what they get if they fail to prohibit the practice or fail to promptly terminate employees who adopt a practice of doing so.
The simple fact is anything truly critical such as that should not be available on anyone's Blackberry, iPhone, or any device taken off of company property, aside from encrypted formats where the decryption keys are not available on the device without a secure authorization process.
Re:we have the same policy at work (Score:5, Insightful)
Re:we have the same policy at work (Score:3, Insightful)
My company doesn't require me to have a smartphone, to read my emails from home, to take my laptop home, to work on evenings or weekends, or to do anything that anybody here would object to.
They also fire the few worst performers in every department just about every year.
That means that EVERYBODY uses their personal phones for work, distributes their cell-phone numbers, reads emails from home, takes their laptops home, works on evenings and weekends, and does all kinds of stuff that everybody here would object to.
Sure, it isn't "policy" but if you don't do it you just lose your job anyway.
That means that I care about stuff like this.
It isn't a big deal - when I get around to it I'll just use a patched email client that handshakes with the server and agrees to wipe my phone and do all that intrusive stuff that makes corporate happy, and then silently ignores any such requests. It will of course confirm that it is doing all of that stuff anytime the server asks it to.
The only way the company is going to know if my phone is running the code that they think it is running is when they supply the phone - so the problem has an easy solution.
Re:we have the same policy at work (Score:3, Insightful)
It would seem most unusual to me for an employer to require their employees to provide expensive equipment for company use, and with the agreement that the company may treat it as its own.
Why do you think the USA has such a high level of productivity? EVERYBODY expects their employees to do this stuff. Sure, it isn't written policy, but if you don't do it you "aren't competitive."
Why would the employer pay for an employee to use a cell phone when they can just fire the slowest worker every year and pretty soon everybody is happily volunteering their personal phone numbers to keep their jobs?