11 ms·
Wipeout: When Your Company Kills Your iPhone
- rbanffy 16y ago"somehow work could get through AT&T, who I thought controlled my phone" And that is the problem. Your phone is controlled by someone else. It's not really your phone.
- martey 16y agoNo, the problem is that she changed her phone's settings without realizing the ramifications. Despite the fact that Amanda thinks AT&T controls her iPhone, the fact of the matter is that they could only block it from the network, not remove all of the information from it.
- rbanffy 16y agoShe gave her company control over her phone because she didn't think of it, because it felt completely natural for her that AT&T would be in control of her phone, not her. People's misconceptions about the technologies they build their lives around sometimes give space to a lot of pain.
- callahad 16y agoDo any enterprise solutions allow more granular wiping? I'd be completely fine with my workplace being able to nuke their own information, so long as they couldn't touch my personal data. Well, I wouldn't be perfectly fine with it, but it seems like a reasonable minimum level of separation.
- dfghjkhgbfd 16y agoYou would need a lot of granularity - wipe business emails but not personal ones, wipe documents that were mentioned your employer, but not your CV, business calls/contacts but not personal ones to workmates?
- smackfu 16y agoThe question is whether an Exchange wipe should wipe stuff that isn't managed by Exchange (mail / calendar / contacts). That seems like a reasonable level of granularity. OTOH, a corporation really does want to wipe the whole thing if it's lost, which is why the Exchange level wipe works this way. It's listed as a business feature: http://www.apple.com/iphone/business/integration/ http://www.apple.com/iphone/business/integration/
- j0 16y agoTouchdown (for Android) http://www.nitrodesk.com/dk_touchdownFeatures.aspx http://www.nitrodesk.com/dk_touchdownFeatures.aspx keeps all of the Exchange Activesync'd data separate from the main email on the phone, so when you get wiped only corporate email/calendar get wiped. I don't think anything similar exists for iPhone.
- jokermatt999 16y agoI can't speak for iPhone (though I imagine it's similar), but pretty much all your data can be recovered to your phone just by logging into your Google Account, from what I understand. If you use AppBrain, the apps you have installed will be saved too.
- adolph 16y agoIts nice to see this issue get some additional coverage. I've been going back and forth about having my phone linked to Google this way. I don't like the concept of handing them an invitation to remote wipe my phone. On the other hand, there does not seem to be a better way to do over the air contact syncing etc (without signing up for MobileMe). My current position is to also sync to my desktop as a "if Google dies somehow" data store and think of my phone as somewhat more disposable repository.
- gvb 16y agoThis is not Google per se, it is a Microsoft Exchange ActiveSync plugin feature. When you install the Exchange ActiveSync plugin[1], it requests that you authorize the software to have the authority to wipe your phone. You must accept that or not use ActiveSync. The advantage of ActiveSync is "push" email notifications and integration of your Exchange calendar and address book with the base Android calendar and address book. If you use IMAP to access the Exchange server, the Exchange server cannot wipe your phone. If you connect to Google's servers (IMAP), Google cannot wipe your phone via their servers. [1] On my Nexus One, the ActiveSync email plugin was pre-installed and I don't remember seeing the request for wipe permissions when I first configured it. When Google (or whoever) pushed an update for the ActiveSync plugin, it did ask me for wipe permission. That was my first clue that I sold my soul.
- adolph 16y agoYes, it isn't a Google-specific issue in general; the link to Google is me-specific in that I linked my phone to Google in this way. I did it for specific reasons (contacts mostly) and initially without knowledge of the possibility or remote wipe. It is interesting that the Android plugin has some UI words about the authority to wipe the phone. In my recollection iOS did not display anything like that. It is also interesting that Google's set-up tutorial for iOS promotes the ActiveSync method but doesn't mention remote wipe: http://www.google.com/support/mobile/bin/answer.py?answer=138740&topic=14252 http://www.google.com/support/mobile/bin/answer.py?answer=13...
- tomjen3 16y agoAnd that is why I don't connect to Exchange.
- arethuza 16y agoThat's certainly why I don't connect any personal devices to the company Exchange infrastructure - they pay for an iPhone so I use it for work. I have a dumb phone, iPod and an iPad for personal use - which I find a better combination than one do everything device.
- tomjen3 16y agoDo you have very large pockets?
- arethuza 16y agoI use a backpack, usually with my iPod in my jacket pocket when walking to/from work. I have a pretty terrible attitude towards phone usage - I rarely answer it (I usually let it ring out and return the call if it is from someone important). Most people I deal with regularly know to text or email me rather than phoning.
- tomjen3 16y agoThat would also work, but I would find it too annoying to have to carry a backpack everywhere. But hey if it works for you, that's great.
- mthomas 16y agoI believe that is also possible with Android phones when you use the default Exchange connectivity app. I've ended up using a different program to connect to Exchange.
- URSpider94 16y agoWhat the article doesn't mention is that, if you back up all of your data to your desktop, you can retrieve it by restoring the phone. You will still lose the corporate data, but you will get back your apps and personal data. If you are using Exchange at work, I would definitely recommend keeping your personal data (email, contacts, calendar) in a separate account, which the iPhone will seamlessly combine for you.
- smackfu 16y agoHow many people are using Exchange to sync their Google accounts to their iPhone/iPad? How many of them realize that is an invitation for Google to wipe your device?
- jon_hendry 16y agoIt's not clear Google has that kind of control. They don't control the Exchange server. They're just feeding data to it.
- spicyj 16y agoGoogle in fact does run the Exchange server that you connect to; setting up Google Sync gives them just as much power as setting up any other Exchange account would.
- Timothee 16y agoI remember a similar story from a couple of months ago, and for that reason haven't connected my work email on my phone. I'll only consider doing it if the company starts paying for the phone and the plan. Until then, it's not worth the risk for me.
- Silhouette 16y agoI'm not sure what is worse: - the fact that this is technically possible, - the fact that the software and service providers think it is appropriate to offer the feature, - the fact that some employers (such as the one in the article) actually think it is even slightly reasonable behaviour to use the feature on someone's personal phone, - the fact that the wiping behaviour isn't already clearly illegal with horrific penalties, or - the idea that the kind of employee waiver mentioned in the article might actually be considered a fair and enforceable part of any employment contract. This is just so completely wrong, it's hard to know where to start!
- maukdaddy 16y agoIf you put sensitive company data on your phone, you have consented to this behavior. Some companies make it an explicit acceptance, others implicit. If you don't like this kind of thing, use a DIFFERENT phone for work and personal. As an example. You use your phone for company business and have sensitive data on customers, including payment info, birth dates, addresses, socials, etc. If your company knows this data exists on your phone, they have a LEGAL obligation to wipe that data in certain circumstances.
- Silhouette 16y ago> If you put sensitive company data on your phone, you have consented to this behavior. Some companies make it an explicit acceptance, others implicit. So allowing any company data onto your phone is not only consent but implicit consent to the company arbitrarily wiping your entire phone? I'm with the guy in the original article: I would love to see you make that argument with a straight face while standing before a judge in court. I imagine the consequences would be... expensive.
- maukdaddy 16y agoI hope you're joking. Too lazy to look right now, but I'm pretty sure legal precedence for this is already established. If you read almost every company's AUP you'll see that by using or connecting to their systems you are consenting and giving up your right to privacy.
- jpspeno 16y agoZimbra 6 supports remote wipe too.
- thought_alarm 16y agoI don't get it. Where I've worked, if an IT guy started accidentally nuking people's Blackberrys that IT guy wouldn't just be fired, he would be destroyed. On the other hand, if your device is actually lost then you would want the entire device to be nuked. I suppose it boils down to how much the employer is willing to invest in its employees. If the employer is not willing to pay for the devices the employee uses for work, then the employer is probably not going to manage those devices responsibly. For that reason, I would never connect my personal device to work unless my employer was willing to pay for it. If your employer acts like they're doing you a favor by allowing your device on their network, then that's probably a good indication that you shouldn't do it.
- jodrellblank 16y agoThe whole article is based on this: Stanton wouldn't have been surprised to see this kind of remote control on a company phone. But this iPhone was hers. "It was my account, in my name [and] I'd paid all the bills," Stanton says. "It didn't make any sense to me that somehow work could get through AT&T, who I thought controlled my phone, and could completely disable the phone and the account." The whole news item is "person doesn't understand how a system they use works, as a result gets confused shocked and indignant". There's no news here. Exchange ActiveSync has been working that way for, what, 4-7 years or so. If you haven't learned what something can do, then you have every right to be confused, but pretty much no right to be annoyed. This kind of nuanced technology with personal phone and phonebill connected over a third party network to a company email and calendar does not have "a nontechnical explanation" for how it works. There is no nontechnical explanation for what kind of security problems you might end up with if someone steals a mobile phone with a live email account - from revealed information in emails and calendars and address books and live address book searches, to social engineering to forged messages. The phone might have a VPN connection. Someone else got trampled by the march of technologic complexity, that's perhaps the news.
- gcb 16y agothe news is that this happen by accident :) i expect that if my phone is ever lost or stolen, and the IT guy find someone bruteforcing some email password, that they will call and check if it's me or not before wiping my personal phone. The warning always say "if phone is lost". it never mention "if you forget your password" or anything. that's a huge difference for the average joe to understand... hell, even the guy that writes xkcd got locked out of his android phone one day playing with the lock pattern!
- Silhouette 16y ago> If you haven't learned what something can do, then you have every right to be confused, but pretty much no right to be annoyed. Pretty much every legal system in the world exists because such a position is more idealistic rather than realistic. No human being has the capacity to fully understand every interaction and agreement they participate in as a routine part of daily life. If people actually stopped to read and understand all the small print, taking expert advice where they needed it to fully appreciate the implications, then society would literally collapse in days. Likewise, if everyone refused to use any device where they had not received full technical training in every aspect of the functionality, society would fall apart. We counter this problem using legal techniques, such as requiring that any term in a contract must be reasonable and understood by both parties for it to be enforceable. The law in most jurisdictions also explicitly recognises that not all contractual agreements are made between parties of equal bargaining power and resources, and therefore tends to give the benefit of the doubt to the little guy. In this case, if it isn't illegal for a company to exert this kind of control over an employee's personal property without the involvement of flashing neon signs and professional legal advice, perhaps it should be.
- JunkDNA 16y agoMy employer solved the issue of people not knowing about this very easily. Before you can connect to exchange with a personal device, you had to sign a document saying that that they could remote wipe your device if it gets lost as well as when you terminate employment.