4 ms·

Just because you don't like it, or disagree with it, doesn't make it wrong. These are well-established IT security and legal issues.

Silhouette 16y ago
> These are well-established IT security and legal issues. No, they aren't. For one of my clients, I work with high-end security hardware used in places like banks, medical facilities, etc. These are the kinds of place where you access the server room through an airlock. They are affected by issues like SarbOx and HIPAA in the US, various international data protection legislation, etc. If your device doesn't comply fully with every single point on their standard network security checklist, they won't even consider buying it. You get the idea. And exactly none of those things, in any way, according to even the most conservative experts, would require the kind of invasive wiping of personal data on a personal phone that we are discussing here. Several people replying to my post have claimed without citation that such a facility is somehow a legal requirement for businesses handling sensitive data. My disagreement with their position doesn't make them wrong. The facts do. (Edit: This comment got hit by a downvote faster than any human being could possibly have even read it. If anyone would like to have a discussion based on cited laws/regulations, facts with supporting references, etc. then I will be happy to debate with them. If anyone would like to debate the ethical issues surrounding merging work life and personal life, I'm game. But if all we're going to do is make vague claims about the law somehow requiring this kind of facility and downvote anyone who disagrees, then this whole conversation is rather pointless.)
- tptacek 16y ago
  Suffice it to say that your experience is not controlling here: I too have clients, and many of them allow iPhones, and all of them use Exchange. Your "legal requirement" argument is a red herring. I think you just want to argue. Nobody is claiming that companies have a "nuke from orbit" legal requirement; what they have instead are requirements to safeguard data and penalties if the fail.
  - Silhouette 16y ago
    > Nobody is claiming that companies have a "nuke from orbit" legal requirement This entire discussion is about wiping a personal phone completely, not just company data on it. I challenged this behaviour in my original comment. You replied to that post and said explicitly that there was nothing wrong with it, citing legal obligations to protect company data, PR risks of leaks, etc. Several other posters have made similar arguments nearby. I replied to you and pointed out that none of these arguments require or justify giving an employer the ability to wipe an employee's personal phone entirely. Since that time, you have in various posts accused me of not reading things before replying to them, mocked me, accused me of just wanting to argue, and generally been rude and unconstructive. You have not, however, actually defended your position in your original post that the ability to remote wipe an entire personal phone is a "completely reasonable due-diligence security mechanism" or addressed any of the three specific points I made in reply.
- jodrellblank 16y ago
  I know you read my comment here ( http://news.ycombinator.com/item?id=1935284 http://news.ycombinator.com/item?id=1935284 ) because you replied to it before writing this comment. Yet you still talk about "invasive wiping of personal data on a personal phone" as if someone somewhere wrote if (RemoteWipe) { companyData.Erase(); personalData.Erase(); } Do you understand that the iPhone does not keep personal and company data separate? Do you agree that the distinction between personal and company is vague and human defined? What kind of high-end security hardware are you talking about? If you used an advanced Cisco software VPN client, you could (so I hear) have it scan the client computer and enforce policies on it. If it was used on a personal computer, these would be invasive in a similar way yet you would not blame Cisco or the company if the user didn't understand this, would you? Would you be outraged that it's even technically possible?
  - Silhouette 16y ago
    > Do you understand that the iPhone does not keep personal and company data separate? Yes, of course. I just think it's the employer's problem in this case, not the employee's. > Do you agree that the distinction between personal and company is vague and human defined? No. The argument made by many people disagreeing with me in this discussion is predicated on the employee downloading data from the company Exchange system. That provides an objective standard for what constitutes "company data". If you're going to try to broaden that in some ill-defined way to any other data the employee has, you might as well argue that any employer should have the right to audit any and all of an employee's personal property, communications or brainwaves. I am aware that some employers actually do seem to think that at least the first two are reasonable, but I vehemently disagree with them, and so does the law in most places. > What kind of high-end security hardware are you talking about? The relevant ones here typically record/block/modify network traffic: intrusion detection, data leakage prevention, lawful intercept, that kind of thing. > If you used an advanced Cisco software VPN client, you could (so I hear) have it scan the client computer and enforce policies on it. If it was used on a personal computer, these would be invasive in a similar way yet you would not blame Cisco or the company if the user didn't understand this, would you? You mean if (a) an employee was asked to work from home, (b) the employee was asked to access the company network using company-provided software installed on their personal computer (the VPN client), and (c) that software then reformatted the employee's hard drive because someone in corporate IT hit the wrong button by accident, would I have the same problem with it? Yes, of course. As I keep saying, if the company requires that kind of control, it should be issuing employees with dedicated systems at company expense, configured appropriately. I struggle to see any circumstances under which installing software on an employee's personal property that gives the employer the ability to wipe the entire machine arbitrarily would ever be justified.

Silhouette 16y ago

> These are well-established IT security and legal issues. No, they aren't. For one of my clients, I work with high-end security hardware used in places like banks, medical facilities, etc. These are the kinds of place where you access the server room through an airlock. They are affected by issues like SarbOx and HIPAA in the US, various international data protection legislation, etc. If your device doesn't comply fully with every single point on their standard network security checklist, they won't even consider buying it. You get the idea. And exactly none of those things, in any way, according to even the most conservative experts, would require the kind of invasive wiping of personal data on a personal phone that we are discussing here. Several people replying to my post have claimed without citation that such a facility is somehow a legal requirement for businesses handling sensitive data. My disagreement with their position doesn't make them wrong. The facts do. (Edit: This comment got hit by a downvote faster than any human being could possibly have even read it. If anyone would like to have a discussion based on cited laws/regulations, facts with supporting references, etc. then I will be happy to debate with them. If anyone would like to debate the ethical issues surrounding merging work life and personal life, I'm game. But if all we're going to do is make vague claims about the law somehow requiring this kind of facility and downvote anyone who disagrees, then this whole conversation is rather pointless.)

tptacek 16y ago
Suffice it to say that your experience is not controlling here: I too have clients, and many of them allow iPhones, and all of them use Exchange. Your "legal requirement" argument is a red herring. I think you just want to argue. Nobody is claiming that companies have a "nuke from orbit" legal requirement; what they have instead are requirements to safeguard data and penalties if the fail.
- Silhouette 16y ago
  > Nobody is claiming that companies have a "nuke from orbit" legal requirement This entire discussion is about wiping a personal phone completely, not just company data on it. I challenged this behaviour in my original comment. You replied to that post and said explicitly that there was nothing wrong with it, citing legal obligations to protect company data, PR risks of leaks, etc. Several other posters have made similar arguments nearby. I replied to you and pointed out that none of these arguments require or justify giving an employer the ability to wipe an employee's personal phone entirely. Since that time, you have in various posts accused me of not reading things before replying to them, mocked me, accused me of just wanting to argue, and generally been rude and unconstructive. You have not, however, actually defended your position in your original post that the ability to remote wipe an entire personal phone is a "completely reasonable due-diligence security mechanism" or addressed any of the three specific points I made in reply.
jodrellblank 16y ago
I know you read my comment here ( http://news.ycombinator.com/item?id=1935284 http://news.ycombinator.com/item?id=1935284 ) because you replied to it before writing this comment. Yet you still talk about "invasive wiping of personal data on a personal phone" as if someone somewhere wrote if (RemoteWipe) { companyData.Erase(); personalData.Erase(); } Do you understand that the iPhone does not keep personal and company data separate? Do you agree that the distinction between personal and company is vague and human defined? What kind of high-end security hardware are you talking about? If you used an advanced Cisco software VPN client, you could (so I hear) have it scan the client computer and enforce policies on it. If it was used on a personal computer, these would be invasive in a similar way yet you would not blame Cisco or the company if the user didn't understand this, would you? Would you be outraged that it's even technically possible?
- Silhouette 16y ago
  > Do you understand that the iPhone does not keep personal and company data separate? Yes, of course. I just think it's the employer's problem in this case, not the employee's. > Do you agree that the distinction between personal and company is vague and human defined? No. The argument made by many people disagreeing with me in this discussion is predicated on the employee downloading data from the company Exchange system. That provides an objective standard for what constitutes "company data". If you're going to try to broaden that in some ill-defined way to any other data the employee has, you might as well argue that any employer should have the right to audit any and all of an employee's personal property, communications or brainwaves. I am aware that some employers actually do seem to think that at least the first two are reasonable, but I vehemently disagree with them, and so does the law in most places. > What kind of high-end security hardware are you talking about? The relevant ones here typically record/block/modify network traffic: intrusion detection, data leakage prevention, lawful intercept, that kind of thing. > If you used an advanced Cisco software VPN client, you could (so I hear) have it scan the client computer and enforce policies on it. If it was used on a personal computer, these would be invasive in a similar way yet you would not blame Cisco or the company if the user didn't understand this, would you? You mean if (a) an employee was asked to work from home, (b) the employee was asked to access the company network using company-provided software installed on their personal computer (the VPN client), and (c) that software then reformatted the employee's hard drive because someone in corporate IT hit the wrong button by accident, would I have the same problem with it? Yes, of course. As I keep saying, if the company requires that kind of control, it should be issuing employees with dedicated systems at company expense, configured appropriately. I struggle to see any circumstances under which installing software on an employee's personal property that gives the employer the ability to wipe the entire machine arbitrarily would ever be justified.