5 ms·

On Android, the work profile is supposed to solve that problem: you only add your corp account and install corp apps in work profile, and it's (at least suppose

On Android, the work profile is supposed to solve that problem: you only add your corp account and install corp apps in work profile, and it's (at least supposed to be) isolated from your personal, default profile on your phone. This is even explicitly stated in work profile enabling flow. The spy activities described in the article is not about actual personal activities on the phone. One is looking at other's corp calendar, which can only be done inside corp profile (you need your corp account to be able to look at other's calendar); The other is making changes on the corp proxy type of thing, which obviously also can only be done with corp account.

inetknght 6y ago
> the work profile is supposed to solve that problem: you only add your corp account and install corp apps in work profile Wait until your personal phone, with its work profile, comes into scope of a work-related deposition. You'll find just how paper thin that argument is.
- eschneider 6y ago
  Yeah, you haven't lived until you've had all your work email subpoenaed. Been there, done that.
- jedimastert 6y ago
  This isn't a legal argument as much as a technical one. Work profiles prevent employers from accessing non-work-profile information
  - black_puppydog 6y ago
    And as a non-legal argument, it won't hold up in a context where anything non-legal essentially doesn't matter.
- joshuamorton 6y ago
  Why would my personal phone come under a work-related deposition? Work emails written on my phone might be, but those are accessible without physically taking my phone.
  - dylan604 6y ago
    Because some lawyer convinced a judge that there may be pertinent information on it. If there's any suspicion that you may have used your personal device to communicate with co-workers, then they'll want to see it. You can't prove you didn't without turning it over. If they find you didn't use it, then thanks. If they find you did, game over. That's the point of the discovery process. They don't know what information is out there, so they're going to get as much of it as they can and sort it out later.
    - joshuamorton 6y ago
      > If there's any suspicion that you may have used your personal device to communicate with co-workers, then they'll want to see it. No, they'll want to see the communication. Which the company will be compelled to provide. The device isn't relevant. (In my, admittedly limited, experience, this is how these processes actually work)
      - dylan604 6y ago
        The original discovery request may be something along the lines of "please submit all communications that occurred in an electronic format via printed copies, blah blah leaglese". You then wait until the last day allowed in the discovery request, and then send over what ever print outs you have decided to release. If opposing counsel feels you've left something out (intentionally or otherwise), they can/will go to a judge to get a warrant. That warrant will not state "collect print outs of communications from personal devices". It will state "collect any personal electronic devices".
        joshuamorton 6y ago
        > If opposing counsel feels you've left something out No, this isn't correct. If opposing counsel has evidence[0] that the personal devices have relevant communications not already provided, they can file for a subpoena to have you turn over personal electronic devices. Your counsel can file a counter-motion, and you'll probably have a hearing. No where will there be a warrant, unless you're in criminal proceedings. Like I said already: as far as I know, litigation holds and discovery are fairly common, and what you're describing is not. To clarify, this is all assuming you use a work profile and a personal profile. [0]: I don't necessarily mean evidence in the legal standard, but they need some basis for this. "A feeling" isn't enough.
- kevincox 6y ago
  If they take my phone in court I'm not too concerned. I just don't want them to be able to sniff my personal profile info without me knowing.
  - garmaine 6y ago
    > I just don't want them to be able to sniff my personal profile info without me knowing. They will, and you won't. (I've been there.)
    - IndexPointer 6y ago
      Care to elaborate? Was this using work profiles?
- ehsankia 6y ago
  But that's no longer "spying", is it? You just shifted the goal post.
  - inetknght 6y ago
    > You just shifted the goal post. Arguably. I don't see it as such though. I see it as: if my phone would be fine in a deposition then I don't have to worry about work spying on their device. But if I have to worry about what work might find out on a device then I'd be a lot more worried about what might show up in a deposition. What's said in private is supposed to stay private. It helps to demonstrate that it has stayed private if it can't be compelled especially from unrelated circumstances. Whether "private" means discussions with your family, your friends, your coworker, your boss, your commander, your patient, your client... ...it's very important to keep work separate.
- phendrenad2 6y ago
  Does this apply to just having Slack on your phone?
  - inetknght 6y ago
    Slack records a device id when you log in -- have you noticed that you get a notification saying that you've logged in from that device? And a lawyer won't care that it's your personal device. They'll want to see it because it shows up in an audit log from your employer. They'll want to check: have you saved any work content? Have you copy/pasted work messages elsewhere? Just about anything is fair game once the device is identified.
    - phendrenad2 6y ago
      Well that settles it. Next time I switch companies, I'm getting a separate secondary slack device. Also probably important for keeping the company out of your side-projects.
- IndexPointer 6y ago
  Let's say I don't care about a deposition, but I am only scared of my company spying on my personal activity. Should I be worried if I use a work profile?
floatingatoll 6y ago
iOS offers 'work profile' support for this as well, as of mid-2018. Specifics can be found on page 8 of https://www.apple.com/business/docs/resources/Managing_Devices_and_Corporate_Data_on_iOS.pdf https://www.apple.com/business/docs/resources/Managing_Devic...
ehsankia 6y ago
As per your second point, realistically it was probably even done on work devices and not personal phone anyways. As for the second example, the person actually submitted a change to a corp extension, so that must've also been done on a work device. So none of these example have anything to do with personal devices.

inetknght 6y ago

> the work profile is supposed to solve that problem: you only add your corp account and install corp apps in work profile Wait until your personal phone, with its work profile, comes into scope of a work-related deposition. You'll find just how paper thin that argument is.

eschneider 6y ago
Yeah, you haven't lived until you've had all your work email subpoenaed. Been there, done that.
jedimastert 6y ago
This isn't a legal argument as much as a technical one. Work profiles prevent employers from accessing non-work-profile information
- black_puppydog 6y ago
  And as a non-legal argument, it won't hold up in a context where anything non-legal essentially doesn't matter.
joshuamorton 6y ago
Why would my personal phone come under a work-related deposition? Work emails written on my phone might be, but those are accessible without physically taking my phone.
- dylan604 6y ago
  Because some lawyer convinced a judge that there may be pertinent information on it. If there's any suspicion that you may have used your personal device to communicate with co-workers, then they'll want to see it. You can't prove you didn't without turning it over. If they find you didn't use it, then thanks. If they find you did, game over. That's the point of the discovery process. They don't know what information is out there, so they're going to get as much of it as they can and sort it out later.
  - joshuamorton 6y ago
    > If there's any suspicion that you may have used your personal device to communicate with co-workers, then they'll want to see it. No, they'll want to see the communication. Which the company will be compelled to provide. The device isn't relevant. (In my, admittedly limited, experience, this is how these processes actually work)
    - dylan604 6y ago
      The original discovery request may be something along the lines of "please submit all communications that occurred in an electronic format via printed copies, blah blah leaglese". You then wait until the last day allowed in the discovery request, and then send over what ever print outs you have decided to release. If opposing counsel feels you've left something out (intentionally or otherwise), they can/will go to a judge to get a warrant. That warrant will not state "collect print outs of communications from personal devices". It will state "collect any personal electronic devices".
      - joshuamorton 6y ago
        > If opposing counsel feels you've left something out No, this isn't correct. If opposing counsel has evidence[0] that the personal devices have relevant communications not already provided, they can file for a subpoena to have you turn over personal electronic devices. Your counsel can file a counter-motion, and you'll probably have a hearing. No where will there be a warrant, unless you're in criminal proceedings. Like I said already: as far as I know, litigation holds and discovery are fairly common, and what you're describing is not. To clarify, this is all assuming you use a work profile and a personal profile. [0]: I don't necessarily mean evidence in the legal standard, but they need some basis for this. "A feeling" isn't enough.
kevincox 6y ago
If they take my phone in court I'm not too concerned. I just don't want them to be able to sniff my personal profile info without me knowing.
- garmaine 6y ago
  > I just don't want them to be able to sniff my personal profile info without me knowing. They will, and you won't. (I've been there.)
  - IndexPointer 6y ago
    Care to elaborate? Was this using work profiles?
ehsankia 6y ago
But that's no longer "spying", is it? You just shifted the goal post.
- inetknght 6y ago
  > You just shifted the goal post. Arguably. I don't see it as such though. I see it as: if my phone would be fine in a deposition then I don't have to worry about work spying on their device. But if I have to worry about what work might find out on a device then I'd be a lot more worried about what might show up in a deposition. What's said in private is supposed to stay private. It helps to demonstrate that it has stayed private if it can't be compelled especially from unrelated circumstances. Whether "private" means discussions with your family, your friends, your coworker, your boss, your commander, your patient, your client... ...it's very important to keep work separate.
phendrenad2 6y ago
Does this apply to just having Slack on your phone?
- inetknght 6y ago
  Slack records a device id when you log in -- have you noticed that you get a notification saying that you've logged in from that device? And a lawyer won't care that it's your personal device. They'll want to see it because it shows up in an audit log from your employer. They'll want to check: have you saved any work content? Have you copy/pasted work messages elsewhere? Just about anything is fair game once the device is identified.
  - phendrenad2 6y ago
    Well that settles it. Next time I switch companies, I'm getting a separate secondary slack device. Also probably important for keeping the company out of your side-projects.
IndexPointer 6y ago
Let's say I don't care about a deposition, but I am only scared of my company spying on my personal activity. Should I be worried if I use a work profile?

floatingatoll 6y ago

iOS offers 'work profile' support for this as well, as of mid-2018. Specifics can be found on page 8 of https://www.apple.com/business/docs/resources/Managing_Devices_and_Corporate_Data_on_iOS.pdf https://www.apple.com/business/docs/resources/Managing_Devic...

ehsankia 6y ago

As per your second point, realistically it was probably even done on work devices and not personal phone anyways. As for the second example, the person actually submitted a change to a corp extension, so that must've also been done on a work device. So none of these example have anything to do with personal devices.