7

What are the reasons for forbidding bringing a personal computer to the office (not for primary work use, but disallowed in any case)?

  • 14
    Why don't you just ask the person/department that doesn't allow it? – Hilmar Sep 16 '13 at 14:14
  • 2
    Music - buy an MP3 player. "Google Searches on the side" - well, why? – Thorbjørn Ravn Andersen Sep 16 '13 at 14:43
  • 3
    Related: workplace.stackexchange.com/q/2936/325 – Monica Cellio Sep 16 '13 at 15:19
  • 3
    Its simple. Your company does not have a BYOD policy. – Ramhound Sep 16 '13 at 18:00
  • 5
    Security, security and security. And legal liability. – A E Jan 8 '16 at 22:21
20

This is certainly a norm that varies hugely by industry, and also reflects a changing trend in IT support within companies. A couple reasons, mostly macroscopic, but a few particular hardcore tech resources.

Corporate Style

I've noticed that companies vary, overall, in the nature of what they will permit in terms of employee behavior relating to personal use of technology in an office environment. I've seen everything from what I'd classify as "shut up and work, drones!" to "as long as you don't break anything, have a blast". Certainly the bigger, more corporate, more old-school companies seem to err on the side of controlling and forbidding, while smaller, newer, funkier companies tend to come down on the side of "do what you want".

Reasons on a corporate level for forbidding stuff like this:

  • The "if everybody did it" rule - especially in a big enough company, this is a real factor, since if even 20% of the population consistently does something, in a 1000 person campus, that means 200 people.

  • The "we don't want to make waves" rule - companies that have been successful for a long time tend to have a really cautious reaction to anything "new". I realize that really portable personal computers are by no means new - but in the life of a 50 year old company, they really are.

  • The "what if" - the same instinct for self preservation leads to all sorts of "what if" scenarios, typically spawned by lawyers and HR reps - the "what if the employee violates HR rules and causes a sexual harassment suit", "what if they browse somewhere bad and then we get tagged with bad behavior in the media".

I'm not making a judgement call on whether these ideals are good or bad, correct or incorrect - merely pointing out that they factor into organizational decision making. A reason and a good reason are two different things. :)

That said, every company will vary here.

Speaking of the point that "I'm the boss and I don't like it" - I wouldn't rule it out, but I'd also posit that there's IT related trends that influence it. One that I've noticed is that some companies have what I think of as an older culture. I don't mean that everyone in the company is old, but that the culture, largely influenced by upper management, is one where "reasonable personal use" includes the phone, because of course your family needs to be able to call you... but that it doesn't include the Internet, because who ever heard of family communications being by email and IM? Who's family has a computer at home? So... if you're on a computer for personal reasons, you must be goofing off.

IT Trends

There's a sliding scale here that's been evolving pretty much since there was an IT department. The sliding scale is between what employees are allowed to do with any work-provided technology resource that they use for non-work purposes and what's forbidden. The scale tends to move depending on how in-demand a given resource is, and how possible, cheap or easy it may be to protect from any ill effects. And what the tradeoff is for the company. It's always going to be easier to provide a resource that does no harm and costs nothing than to provide a resource that (even in a small amount) consumes a resource.

Particular Tech Issues and Specific Rules

Reasons I've seen for "no personal computer use at work".

1 - Network bandwidth - yes, the guest network will be isolated from the work network, but chances are, bandwidth usage is all the same. It would be a rare and truly huge environment that paid for a separate pipe for the guest network vs. the corporate LAN. If you're streaming media, you're consuming tremendously more bandwidth than non-streamers and it fits into the "if some # of people do it" rule. Chances are good that the company won't want to lock down streaming sites, as the reason for the guest network may to allow this for certain work related purposes.

2 - Viruses - Yes, a more obvious rule would be - don't do things that send viruses to work resources - like mix USBs that attach to your personal machine and your work machine, and sending email from your personal account to your work account - but the big kicker is, it only takes one mistake to cause a big problem.

3 - Highly secure environments - Certain highly secure environments do have "authorized equipment only" rules - the point being that ANY recording/data upload capability on an un-scanned system is a security risk. If your phone/laptop/tablet can get a virus on, there's a potential case that the virus can be used to take pictures or recordings. Not the kind of thing you'll see in a business with low/moderate security risks. A thing about these sorts of environments - the rules can bleed over into other areas as the need to adhere to such rules become part of the culture, and are enforced in many settings that may not, strictly speaking, require this type of caution.

4 - Someone misused it - Possibly my least favorite reason. But when someone else has screwed it up for everyone, this happens. Ideally, if someone is messing on the personal system and not doing work while at work, then the issue that should be addressed is not doing work while at work - not the personal system. But get burned enough, and management will sometimes get dumb here. Personnel cases like this frequently thrive on vague rules and management can end up forbidding privileges quickly in order to draw a firm line.

  • 1
    I'd also add that it's generally easier to blanket "ban" stuff like this from a policy standpoint than it is to approach it on a "what makes sense?" perspective. I run into this sort of thing all the time, most of our IT policies are designed to prevent the system from people who have no clue how to use a computer... – enderland Sep 16 '13 at 17:33
  • 1
    Also there is the "I am the boss and I do not like it" reason. Nothing else but personal preference. – Thorbjørn Ravn Andersen Sep 17 '13 at 13:37
  • 1
    RE item 4, many many mangers, and almost all larger corporations, subscribe to the utterly silly belief that if a mistake was made a process must be put into place to prevent it from ever happening again. This basically creates nightmare processes designed to prevent a one-off error from happening again and introduce new errors through their ever increasing complexity. Apparently there is no ability to recognize that human beings make mistakes no matter what processes are in place. – HLGEM Jan 8 '16 at 18:41
  • 3
    If personal computers are "allowed", and connection to the network is "allowed", then a personal computer that doesn't work on the network will need to be supported, because it is suppose to work. As an IT person, I absolutely abhor supporting personal systems on the corporate network because it's always a mess. I don't want to fix the guy's virus loaded computer, nor connect it to the network, nor try to fix why he has multiple bit torrent clients running and using up 5000 ports. – Nelson Jan 9 '16 at 2:44
  • @Nelson: Hm, I don't think that follows. You can allow employees to use e.g. a guest network during breaks, but still tell them the helpdesk will not support them. If it works for them, fine, if not, tough luck. The helpdesk could be instructed to only suport guest network access for real guests, e.g. visiting customers. – sleske Jan 11 '16 at 15:38
16

From the perspective of most companies, the real question is why would it be allowed? Since there is no business need for you to bring your personal computer, why on earth would they allow it? It is a risk in many ways, so unless there is a compelling business need, there is no reason to take the risk.

Risks include:

  • Using up company network bandwidth for personal business (you think, "Well I don't use too much" but make that times every employee in the company and it could be potentially very costly)
  • Doing work for pay for other companies as a freelancer during work hours
  • Possibility of introducing a virus
  • Possibility of industrial espionage
  • Possibility of the person doing non-work related things during work hours.
  • Possibility of person accessing things he should not in the work place (such as porn) during work hours
  • Unfair treatment of employees if some can bring it in and others cannot for security reasons
5

This has generally not been allowed at any place I've worked. The most common reason is that the IT department doesn't want devices they have no control over accessing the network and introducing malware, etc.

Management likely doesn't see any legitimate reason to allow this either. Using your own equipment implies that you might mingle personal and company business on your laptop... for software developers this can lead to IP issues, etc.

4

Executive Summary

Several companies I have worked for have entirely banned the use of personal devices for doing anything work related for three reasons:

  1. Viruses
  2. Leaking Confidential Information
  3. Labor Regulations

At the end of the day, your ability to use this power only for good tends to be less important than the person who manages to not use it for good and cause lasting harm to the business.

Viruses

No security is 100%. We can pretend that it shouldn't be an issue, yet it is. To minimize risk of infecting the network or work computers, entirely banning personal computers from work is one method.

Leaking Confidential Information

So I want to run a bunch of documents through google translate. I transfer them to my personal PC so that I can copy-paste. When I get home, I'm running a file sharing program and accidentally share the folder that the documents were contained in. Now I have managed to give total strangers access to confidential company information.

We all believe "nobody would be that dumb!" yet people are commonly that dumb. If there are major companies who lose a bunch of unsalted password hashes, do you really think a single individual who is given the formula for Ice-Nine should be trusted not to find a way to screw it up?

Labor Regulations

While many people are salaried, there are companies/countries which are very strict about number of working hours and the potential for violating regulations by forcing people to work for free. In Japan at least, employers would often give employees absurd amounts of work and expect them to do it at home or on the weekends on their home PCs, so that nobody would know they were actually working (since there is no actual paper trail).

2

Probably as a measure against virus contamination over the network. If your computer has a virus it can infect others. Since propagation methods of viruses differ all these have to guarded/secured. The IT department probably chooses the easier route of denying network access to your laptop.

What you do with the computer is irrelevant. They would have to vet every kind of use, and then you might still start to use it differently once you have been granted access.

2

or do Google searches on the side while working on my work computer

Assuming there is no way to copy files from your work computer to your laptop (which may bring security issues into it), you've hit the nail on the head. The business is paying for you to be at work, and although the Google searches may be work related, the point is they might not be (and indeed may be visits to Facebook, twitter, P*rn etc).

Companies tend to like you to go via their equipment to allow them to control/monitor your usage, which they cannot do if it's your kit (even on the guest network).

Now you may be the most conscientious person in the company but the next one might not be.

Also you are using bandwidth for guests by using the guest connection, which may look bad when the important CEO they're trying to get business from has his connection drop out whilst trying to get the vital doc.

Of course in this era of fast smartphones/tablets/chromebooks etc this is a bit of a moot point, but this is the thinking, at least until they can find a way from stopping you surfing facebook from the can on your phone.

1

This is a late answer, but not seeing an answer addressing a situation I deal with, I'll go ahead and answer.

An employer might prohibit you from bringing a computer to your workplace just to avoid potential problems.

To wit: My employer is contracted to provide services at a client's site, and I am tasked to work at that site. The client provides the computers I use to do my work. The client also has very strict security and claims the right to inspect people and vehicles as they enter or exit the premises. Any computer that is taken off site is supposed to have paperwork proving it can leave the grounds:

  1. If I take a system owned by the client off the premises, I am supposed to have paperwork - signed by the person who oversees my work for the client - showing I can take it with me.
  2. If the computer is owned by my employer, I am supposed to have paperwork from them (my employer) backing that up.
  3. If I bring my own computer onto the premises, I'm supposed to have a receipt showing I purchased the computer. (Which I have to admit I don't always have - having bought one computer second hand directly from the previous owner, no receipt was provided and might not be accepted even if I had one.)

If I am stopped by security and have a computer without proper paperwork there will be trouble. They will seize the computer and then contact my management chain - both corporate and within the client - to find out what is going on. The computer might be confiscated for several days while an investigation is done. In order to reduce the possibility of problems in a situation like this, an employer might simply tell their employees that they can't bring a personally owned computer to their work site.

0

Some companies are ending these policies by setting BYOD or Bring-Your-Own-Device policies. They allow the employee to bring in their smartphone or tablet into the office and either use the employees 3G/4G bandwidth or use the employee or guest account on the wifi.

Some employees like these policies, others don't because they want to keep their personal devices off the company networks. They also don't want to be able to see company email on their devices 24/7.

Some employers are allowing these connections because it makes the employees feel better, by allowing them access to their own devices. The risks can be greatly minimized by planning for the connections, and requiring virus protection software and limiting the ways the devices can be used.

Many schools are allowing BYOD because if they want to move into the world of e-textbooks access has to be universal.

The reasons for not allowing the devices: virus exposure, bandwidth issues, protection of company secrets; can all be handled in other ways. Ask your company to look into changing the policies.

  • 1
    only one sentence at the end of that is close to answering the question (I didn't downvote, but I suspect that's why) – Móż Sep 18 '13 at 5:52
  • I up-voted back to 0. Partially because it is true as Moz says, you did have an actual response to the question in there, even if it was short. But also, I think your answer was VERY relevant to the overall environment created by the question/answer(s) here. BYOD is a pretty good sized movement, and network security can easily handle it. I won't detail how simple it is, but I can say I agree with your points. Some companies even give money to their employees for BYOD, just like employees get extra money for using their own Car at some jobs. Saves the company money in the long run. – Suamere Sep 19 '13 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.