I have the "Google Apps Device Policy" app on my Android phone so that I can use work email/Slack/etc, and it has these permissions: Erase all data, Change the

I have the "Google Apps Device Policy" app on my Android phone so that I can use work email/Slack/etc, and it has these permissions: Erase all data, Change the screen lock, Set password rules, Monitor screen unlock attempts, Lock the screen, Set the device global proxy, Set screen lock password expiration, Set storage encryption, Disable cameras, Disable some screen lock features. I explicitly agreed to these permissions when I installed the policy on my phone. The obvious intention here is to make sure there are reasonable measures in place in case my phone is lost or stolen. I think the main possibly-problematic permission here is "Set the device global proxy", which apparently could be use to intercept SMS messages (according to the article, I think). Other than that one, I'm pretty sure most of the scary capabilities listed in the article (the ones affecting privacy) don't apply here. Maybe other MDMs have those permissions? My understanding of the Android security model is that permissions changes need to be explicitly approved by the user, so I think an app update or config change wouldn't be able to extend the permissions without my agreement. Also note that the app is written by Google, so my company isn't even running custom code on my phone. Even if the permissions do somehow change, I always have the option to remove the app, which un-applies the policy and disconnects my work Google account. I suppose this sort of thing depends on the situation and how much you trust your employer, but I think that for many cases this article is a bit alarmist. Note that you run into similar problems if you ever log in with personal Google on your work computer. Since your employer owns the computer, I believe they have legal access your Google cookie and could use it to read your email and anything else associated with your Google account. But I do it anyway because it's convenient and I trust my coworkers, and I am quite certain that nobody is reading my personal email. But I also work at a small company where I know everybody. YMMV.