Wipeout: When Your Company Kills Your iPhone

http://www.npr.org/2010/11/22/131511381/wipeout-when-your-company-kills-your-iphone

by prakashk • 16 years ago

37 77 16 years ago

npr.org

rbanffy2• 16 years ago

"somehow work could get through AT&T, who I thought controlled my phone"

And that is the problem. Your phone is controlled by someone else. It's not really your phone.

martey• 16 years ago

No, the problem is that she changed her phone's settings without realizing the ramifications. Despite the fact that Amanda thinks AT&T controls her iPhone, the fact of the matter is that they could only block it from the network, not remove all of the information from it.

rbanffy2• 16 years ago

She gave her company control over her phone because she didn't think of it, because it felt completely natural for her that AT&T would be in control of her phone, not her.

People's misconceptions about the technologies they build their lives around sometimes give space to a lot of pain.

callahad• 16 years ago

Do any enterprise solutions allow more granular wiping?

I'd be completely fine with my workplace being able to nuke their own information, so long as they couldn't touch my personal data.

Well, I wouldn't be perfectly fine with it, but it seems like a reasonable minimum level of separation.

dfghjkhgbfd• 16 years ago

You would need a lot of granularity - wipe business emails but not personal ones, wipe documents that were mentioned your employer, but not your CV, business calls/contacts but not personal ones to workmates?

smackfu2• 16 years ago

The question is whether an Exchange wipe should wipe stuff that isn't managed by Exchange (mail / calendar / contacts). That seems like a reasonable level of granularity.

OTOH, a corporation really does want to wipe the whole thing if it's lost, which is why the Exchange level wipe works this way. It's listed as a business feature: http://www.apple.com/iphone/business/integration/

j0• 16 years ago

Touchdown (for Android) http://www.nitrodesk.com/dk_touchdownFeatures.aspx keeps all of the Exchange Activesync'd data separate from the main email on the phone, so when you get wiped only corporate email/calendar get wiped. I don't think anything similar exists for iPhone.

jokermatt999• 16 years ago

I can't speak for iPhone (though I imagine it's similar), but pretty much all your data can be recovered to your phone just by logging into your Google Account, from what I understand. If you use AppBrain, the apps you have installed will be saved too.

adolph2• 16 years ago

Its nice to see this issue get some additional coverage.

I've been going back and forth about having my phone linked to Google this way. I don't like the concept of handing them an invitation to remote wipe my phone. On the other hand, there does not seem to be a better way to do over the air contact syncing etc (without signing up for MobileMe). My current position is to also sync to my desktop as a "if Google dies somehow" data store and think of my phone as somewhat more disposable repository.

gvb• 16 years ago

This is not Google per se, it is a Microsoft Exchange ActiveSync plugin feature. When you install the Exchange ActiveSync plugin[1], it requests that you authorize the software to have the authority to wipe your phone. You must accept that or not use ActiveSync.

The advantage of ActiveSync is "push" email notifications and integration of your Exchange calendar and address book with the base Android calendar and address book.

If you use IMAP to access the Exchange server, the Exchange server cannot wipe your phone.

If you connect to Google's servers (IMAP), Google cannot wipe your phone via their servers.

[1] On my Nexus One, the ActiveSync email plugin was pre-installed and I don't remember seeing the request for wipe permissions when I first configured it. When Google (or whoever) pushed an update for the ActiveSync plugin, it did ask me for wipe permission. That was my first clue that I sold my soul.

adolph2• 16 years ago

Yes, it isn't a Google-specific issue in general; the link to Google is me-specific in that I linked my phone to Google in this way. I did it for specific reasons (contacts mostly) and initially without knowledge of the possibility or remote wipe.

It is interesting that the Android plugin has some UI words about the authority to wipe the phone. In my recollection iOS did not display anything like that.

It is also interesting that Google's set-up tutorial for iOS promotes the ActiveSync method but doesn't mention remote wipe:

http://www.google.com/support/mobile/bin/answer.py?answer=13...

tomjen33• 16 years ago

And that is why I don't connect to Exchange.

arethuza2• 16 years ago

That's certainly why I don't connect any personal devices to the company Exchange infrastructure - they pay for an iPhone so I use it for work.

I have a dumb phone, iPod and an iPad for personal use - which I find a better combination than one do everything device.

tomjen33• 16 years ago

Do you have very large pockets?

mthomas• 16 years ago

I believe that is also possible with Android phones when you use the default Exchange connectivity app. I've ended up using a different program to connect to Exchange.

URSpider94• 16 years ago

What the article doesn't mention is that, if you back up all of your data to your desktop, you can retrieve it by restoring the phone. You will still lose the corporate data, but you will get back your apps and personal data.

If you are using Exchange at work, I would definitely recommend keeping your personal data (email, contacts, calendar) in a separate account, which the iPhone will seamlessly combine for you.

smackfu2• 16 years ago

How many people are using Exchange to sync their Google accounts to their iPhone/iPad? How many of them realize that is an invitation for Google to wipe your device?

jon_hendry• 16 years ago

It's not clear Google has that kind of control. They don't control the Exchange server. They're just feeding data to it.

spicyj• 16 years ago

Google in fact does run the Exchange server that you connect to; setting up Google Sync gives them just as much power as setting up any other Exchange account would.

Timothee• 16 years ago

I remember a similar story from a couple of months ago, and for that reason haven't connected my work email on my phone. I'll only consider doing it if the company starts paying for the phone and the plan. Until then, it's not worth the risk for me.

Silhouette25• 16 years ago

I'm not sure what is worse:

- the fact that this is technically possible,

- the fact that the software and service providers think it is appropriate to offer the feature,

- the fact that some employers (such as the one in the article) actually think it is even slightly reasonable behaviour to use the feature on someone's personal phone,

- the fact that the wiping behaviour isn't already clearly illegal with horrific penalties, or

- the idea that the kind of employee waiver mentioned in the article might actually be considered a fair and enforceable part of any employment contract.

This is just so completely wrong, it's hard to know where to start!

maukdaddy3• 16 years ago

If you put sensitive company data on your phone, you have consented to this behavior. Some companies make it an explicit acceptance, others implicit. If you don't like this kind of thing, use a DIFFERENT phone for work and personal.

As an example. You use your phone for company business and have sensitive data on customers, including payment info, birth dates, addresses, socials, etc. If your company knows this data exists on your phone, they have a LEGAL obligation to wipe that data in certain circumstances.

Silhouette25• 16 years ago

> If you put sensitive company data on your phone, you have consented to this behavior. Some companies make it an explicit acceptance, others implicit.

So allowing any company data onto your phone is not only consent but implicit consent to the company arbitrarily wiping your entire phone?

I'm with the guy in the original article: I would love to see you make that argument with a straight face while standing before a judge in court. I imagine the consequences would be... expensive.

tptacek7• 16 years ago

There's nothing wrong about it at all; it's a completely reasonable due-diligence security mechanism.

First and most importantly, employers cannot remote-wipe your phone if you haven't paired it with their Exchange infrastructure. Remote-wipe is part of the technical contract you enter into when you link your phone to your company's internal infrastructure. Therefore, while it's totally reasonable to be outraged at the prospect of your employer wiping your phone, the answer is simply "don't let them".

Why do IT departments need this capability? That's easy: when you synced your phone up to their email system, you collected an unspecified number of company secrets. Some of those secrets come with a legal obligation to safeguard them. In a surprisingly large number of companies, some of those obligations have theoretical criminal penalties attached to them.

Turning off your Exchange access doesn't get rid of secrets Exchange disclosed to you already. Companies turn over tens or even hundreds of employees a week. It's absurd to suggest that they'd leave this matter up to chance, with or without a "scrub your device regularly" policy.

More to the point: when companies lose PI, PII, or financials, they end up in the newspaper. Usually, when there's even a reasonable likelihood that data has been exposed, companies are required to notify impacted business partners, incurring contractual and legal expenses. Even if you just left the phone in a bar, and the thief is almost certainly just going to wipe the phone anyways. It's naive to suggest that companies accept the risk of landing in the paper or in court every time someone loses a phone.

It's also perfectly reasonable to point out (bad) IT departments that require you to tie your personal phone to their email systems. By all means, bring up "remote-wipe" when they refuse to buy you a crappy Blackberry instead of letting you B.Y.O.

Silhouette25• 16 years ago

> There's nothing wrong about it at all; it's a completely reasonable due-diligence security mechanism.

Nonsense. There is absolutely nothing diligent about having an ability to wipe someone's personal data that has no connection to your business, under any circumstances.

> Remote-wipe is part of the technical contract you enter into when you link your phone to your company's internal infrastructure. Therefore, while it's totally reasonable to be outraged at the prospect of your employer wiping your phone, the answer is simply "don't let them".

So, here's Flawed Cliché #1 in the opposition argument: "If you don't like it, don't sign up for it."

Unfortunately, if this sort of behaviour is tolerated, it becomes an assumption by management that it is acceptable. Refusing to accept it yourself then gets you a black mark in some manager's mental file, at best.

Moreover, the risk to the personal phone here is completely disproportionate. This sort of link could be established by an employee without any awareness of the potential consequences, in response to a casual request by a manager before the employee goes off to a conference the following week.

> Why do IT departments need this capability? That's easy: when you synced your phone up to their email system, you collected an unspecified number of company secrets. Some of those secrets come with a legal obligation to safeguard them.

Flawed Cliché #2: "You have to protect company secrets."

Firstly, this is a complete straw man: protecting company secrets from the company mail server does not in any way require deletion of personal data on a personal phone.

Secondly, if the company has legal or regulatory constraints in how it handles some data, it should not be providing access to that data on a system that is not supplied, properly configured and fully secured by the company's experts anyway.

> Companies turn over tens or even hundreds of employees a week. It's absurd to suggest that they'd leave this matter up to chance, with or without a "scrub your device regularly" policy.

Flawed Cliché #3: "We need to secure our data when people leave to protect us against inside jobs."

Firstly, anyone who is pulling off an inside job is probably not going to leave the only copy of valuable/sensitive data on their personal phone.

Secondly, maybe you should be more careful with who you hire if this is a serious problem. Someone who is determined to pull off an inside job isn't going to be stopped by such a simplistic approach.

Basically, your entire counter-argument is a non-argument. Nothing you have said in any way justifies a company having the power to interfere with your personal data, and if they need that kind of power over company data because of its sensitivity then they should not be relying on employees' own devices anyway.

ghurlman• 16 years ago

Here's where: If you don't want to give your company any control of your phone, refuse to use it for work.

jodrellblank13• 16 years ago

This is just so completely wrong, it's hard to know where to start!

You could start by not being a panicky reactionary mess about it.

It is useful to be able to wipe a remote mobile device with access into a company computer system when it it is lost, compromised or in unfriendly hands.

From that follows that software developers made it possible and providers made it available and employers think it reasonable to use on any mobile device which agreed to access their servers, personal or not.

It isn't illegal with "horrific penalties" - why would it be?

Silhouette25• 16 years ago

> It isn't illegal with "horrific penalties" - why would it be?

This whole discussion is about a company wiping an employee's personal phone, by accident and for no reason, including cutting off an active call and disrupting the navigation system they were using. Do you really not see why this behaviour is unacceptable?

jpspeno• 16 years ago

Zimbra 6 supports remote wipe too.

thought_alarm• 16 years ago

I don't get it.

Where I've worked, if an IT guy started accidentally nuking people's Blackberrys that IT guy wouldn't just be fired, he would be destroyed.

On the other hand, if your device is actually lost then you would want the entire device to be nuked.

I suppose it boils down to how much the employer is willing to invest in its employees. If the employer is not willing to pay for the devices the employee uses for work, then the employer is probably not going to manage those devices responsibly. For that reason, I would never connect my personal device to work unless my employer was willing to pay for it.

If your employer acts like they're doing you a favor by allowing your device on their network, then that's probably a good indication that you shouldn't do it.

jodrellblank13• 16 years ago

The whole article is based on this:

Stanton wouldn't have been surprised to see this kind of remote control on a company phone.

But this iPhone was hers.

"It was my account, in my name [and] I'd paid all the bills," Stanton says. "It didn't make any sense to me that somehow work could get through AT&T, who I thought controlled my phone, and could completely disable the phone and the account."

The whole news item is "person doesn't understand how a system they use works, as a result gets confused shocked and indignant".

There's no news here. Exchange ActiveSync has been working that way for, what, 4-7 years or so.

If you haven't learned what something can do, then you have every right to be confused, but pretty much no right to be annoyed.

This kind of nuanced technology with personal phone and phonebill connected over a third party network to a company email and calendar does not have "a nontechnical explanation" for how it works. There is no nontechnical explanation for what kind of security problems you might end up with if someone steals a mobile phone with a live email account - from revealed information in emails and calendars and address books and live address book searches, to social engineering to forged messages. The phone might have a VPN connection.

Someone else got trampled by the march of technologic complexity, that's perhaps the news.

gcb• 16 years ago

the news is that this happen by accident :)

i expect that if my phone is ever lost or stolen, and the IT guy find someone bruteforcing some email password, that they will call and check if it's me or not before wiping my personal phone.

The warning always say "if phone is lost". it never mention "if you forget your password" or anything. that's a huge difference for the average joe to understand... hell, even the guy that writes xkcd got locked out of his android phone one day playing with the lock pattern!

Silhouette25• 16 years ago

> If you haven't learned what something can do, then you have every right to be confused, but pretty much no right to be annoyed.

Pretty much every legal system in the world exists because such a position is more idealistic rather than realistic. No human being has the capacity to fully understand every interaction and agreement they participate in as a routine part of daily life. If people actually stopped to read and understand all the small print, taking expert advice where they needed it to fully appreciate the implications, then society would literally collapse in days. Likewise, if everyone refused to use any device where they had not received full technical training in every aspect of the functionality, society would fall apart.

We counter this problem using legal techniques, such as requiring that any term in a contract must be reasonable and understood by both parties for it to be enforceable. The law in most jurisdictions also explicitly recognises that not all contractual agreements are made between parties of equal bargaining power and resources, and therefore tends to give the benefit of the doubt to the little guy. In this case, if it isn't illegal for a company to exert this kind of control over an employee's personal property without the involvement of flashing neon signs and professional legal advice, perhaps it should be.

wglb• 16 years ago

Do you feel that "We actually have a one-page waiver that says, you know, if you're going to connect your personal phone to the corporate e-mail system, that we do have the capabilities if the phone is lost to remote wipe it — and we will — and then have the employee agree [to] and sign that form," Davis says. is a flashing neon sign?

What I find odd is that a company allows people to keep confidential company information on a personal device at all.

There are many reasons to require this, including insider information, or other legally-required barriers, as well as company-protected information.

JunkDNA• 16 years ago

My employer solved the issue of people not knowing about this very easily. Before you can connect to exchange with a personal device, you had to sign a document saying that that they could remote wipe your device if it gets lost as well as when you terminate employment.

Wipeout: When Your Company Kills Your iPhone

Related Stories