89

Throughout the four years I've been working for my employer, I've used my personal phone to keep-up with emails outside the office. It is not a requirement of the job, but it is strongly implied that you should be doing it, and I know of no one who does not.

Starting in February, the security team is requiring that anyone who wants access to any organization resources on his/her personal phone or tablet install VMWare's WorkSpace ONE. The team has taken great pains to stress that the software will not track location, browsing data, email or text messages, photos, outgoing or incoming phone calls (The security team emphasizes that it has disabled these features on WorkSpace ONE). The software creates a container around company resources, encrypts the phone, and installs an email configuration. When you leave the organization, the container and all data and resources within it, will be removed from the personal device.

I generally trust that the organization will not snoop on its employees, and I understand the need for a solution such as WorkSpace ONE. Nevertheless, I still feel uneasy about installing the Mobile Device Management (MDM) software on my phone. I've asked my manager about a work phone and that's not a possibility. I also asked what would happen if I don't install the software (it has also been stated that installation of WorkSpace ONE is optional), and my manager says I can still use OWA to access my email outside work.

My concern is that, although optional, there will be a time when someone needs to reach out to me after hours, and I will be faulted for not having the software on my phone. Should I just disregard my misgiving and install WorkSpace ONE?

Improve this question
8
  • 161
    "I will be faulted for not having the software on my phone." It's unreasonable to mandate your employees to be connected, not provide them the hardware, and then throw a fuss when they decided they didn't want to voluntarily donate their phone to the company.
    – Alexander
    Jan 3, 2020 at 2:28
  • 58
    What happens if you don't have a personal smartphone? What if you are using a basic phone (the one that only lets you make calls and send text messages)? How will they install this WorkSpace ONE then? Is it a requirement of the job to have a personal smartphone?
    – Uchiha Madara
    Jan 3, 2020 at 3:44
  • 9
    What is your actual concern with not installing it? You say you can still access your email without it. Whether it would be too big of a convenience for you personally or what consequences you might face for not checking your email is something you should be able to answer better than we can. As for your concern with installing it, that sounds like a security issue more than a workplace one and relates to how much you trust the application, your company and/or your ability to review the settings or permissions (if you can see them).
    – Bernhard Barker
    Jan 3, 2020 at 10:14
  • 49
    Not really an answer on it's own: Tracking etc is off NOW. How difficult is it to 'accidentally' turn back on?
    – Martijn
    Jan 3, 2020 at 12:10
  • 2
    It's important to note that the app named in this question (Workspace ONE) when used with any remotely modern mobile OS does not encrypt the entire device - only the "work" profile and the apps installed as part of that profile. If your admin issues a command to wipe your whole phone, it only wipes the company-owned content and does not impact your personal data. I'm mentioning this because the question, along with many of the comments and answers seem to be based on a fear that the company will be able to destroy your personal data at will (which is not true).
    – dwizum
    Jan 7, 2020 at 21:20

14 Answers 14

Reset to default
11

There's nothing wrong with a sandboxed phone app

I mean that in two ways. First, the phone "app" is sandboxing all the company data within the app. Presumably it's tunneling its connection through a VPN (because not doing so would be stupid). This means that no other app on your phone can surveil company data, because it's all inside this sandbox.

Honestly, I really like this security model. It does require the single app to be all-singing/all-dancing, including every sub-app (email, calendaring etc.; you can't use your preferred third party app because that would mean breaking out of the sandbox). So you have to put up with the suck of their typically half-baked afterthought sub-app. But if the security need is there, it's worth it.

What happens in the sandbox stays in Vegas. Everything inside it belongs to the company anyway; if they want to remote-wipe it, bon appetit.

But second, this corporate app is sandboxed from the rest of your phone. Location information? NO. Read your phone's address book? NO. Read your phone's list of phone calls made? NO. Read emails from your phone's email app? NO. No, no, no. So you don't really need to care if Eve Admin changes the eavesdropping policy; the phone won't let the app have it!

Of course, this isolation is dependent on your phone's operating system actually providing this isolation, but iOS does and I hear Android added it in the version after my phone. If your phone does not, time to upgrade, possibly away from a phone vendor who hates your privacy.

Although it's fair for the app to require a phone passcode.

Sorry, I really, really, really like this security model - the app which is both sandboxing and is itself properly sandboxed.

Assuming your phone is capable of sandboxing the app, definitely go for it.

However, if the company insists on more surveillance, then heck no

Usually if permission for a resource is denied, an app will just do its best without access to your photo library, say. However it's possible (but evil) for the app to passive-aggressively refuse to run unless certain permissions are granted. So if the app says "Sorry, cannot run because you haven't given me access to your browsing data" (excuse me, what!??) obviously, don't put up with that.

Improve this answer
4
  • 2
    I upvoted this because many (all?) of the other answers seem to gloss over the subtleties of how modern MDM works. You're not handing over full unhindered control of your entire device, you just giving them control over what's in a specific container on your device (and that container only includes their content, anyways). It's really a shame that the majority opinion doesn't seem to take this into account.
    – dwizum
    Jan 6, 2020 at 16:20
  • "it's possible (but evil) for the app to passive-aggressively refuse to run unless certain permissions are granted" -- that's how every app/addon security model I've seen worked. You can't even install the app unless you grant it all the permissions that it asks for. Evil or not, the alternative is currently to not use a smartphone at all.
    – ivan_pozdeev
    Mar 15, 2020 at 4:13
  • 1
    @ivan_pozdeev no longer true. I've added links to support my claim that both Apple and now Android allow the phone to grant permissions to apps on a function by function basis, i.e. camera yes, address book no. That is true; please revert DV. Thanks.
    – Harper - Reinstate Monica
    Mar 15, 2020 at 5:35
  • Double-checked in Android 6 that this is indeed so. I have a hard time imagining a corporate collaboration app that could meaningfully work without accessing device's storage, but since I've never seen one, I leave that on your conscience.
    – ivan_pozdeev
    Mar 15, 2020 at 6:05
201

It's a great time to do the reasonable and explain that if the company expects to be able to reach you on a mobile phone then they should provide one. If they don't care enough to shell out for 50-100 USD refurbished android, problem solved, you are now free of using personal phones for work purposes.

While I am personally not against doing a bit of work on a phone, when you must surrender control over hardware you own to the company, it's time for them to provide their own phones. And it's for pragmatic reasons as accidents happen, and then all your personal stuff from that phone is gone. Takes one accidental press of a button usually and poof. Not sure if that's the case with this specific software, but there may also be other issues with it.

Additionally, you then have off button on all the work stuff when you are, say, on vacation, or just after hours.

Improve this answer
1
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Neo
    Jan 3, 2020 at 23:18
75

Segregate Work and Personal Phones

A simple and best advise is to keep personal and work phones separate, and it should take care of most of the concerns which one may possibly encounter in scenarios like this.

If your employer doesn't provide you with a phone/smartphone, just get a cheap/usable enough smartphone for work related communications.

Improve this answer
9
  • 34
    While this shouldn't be necessary, it might ultimately be the easiest and best solution. Pick your battles etc.
    – Gertsen
    Jan 3, 2020 at 10:02
  • 24
    Then you are paying monthly charges for two phones, no? Is the company reimbursing you for the extra?
    – user30748
    Jan 3, 2020 at 17:15
  • 4
    @MichaelJ. a pay as you go plan or entry-level data-only plan should be more than enough for an occasional email.
    – Qsigma
    Jan 3, 2020 at 21:15
  • 4
    @Qsigma or tether from one to the other
    – Tim
    Jan 4, 2020 at 22:53
  • 6
    No one ever mentions that if you're doing work-related stuff on your personal phone, and your company gets in a lawsuit, it's your personal phone that gets discovered.
    – IllusiveBrian
    Jan 5, 2020 at 21:22
39

I also asked what would happen if I don't install the software (it has also been stated that installation of WorkSpace ONE is optional), and my manager says I can still use OWA to access my email outside work.

My concern is that, although optional, there will be a time when someone needs to reach out to me after hours, and I will be faulted for not having the software on my phone. Should I just disregard my misgiving and install WorkSpace ONE?

No.

Your manager told you that it was optional, and that you could still use OWA.

If you continue to have misgivings, just do as your manager suggested for as long as it is permitted.

I would also keep trying to get a work phone periodically. But that's not urgent. It seems silly to me that the company doesn't provide the tools required to get your job done. Maybe they will eventually reconsider.

Improve this answer
4
  • 28
    To me it sounds like an indication that this isn't required to get the job done, that reading emails outside of work isn't actually part of the job, and consequently this would be a great opportunity to start enforcing that ;)
    – Lightness Races in Orbit
    Jan 3, 2020 at 15:31
  • This is the most reasonable solution imo. Not confrontational, no app required on personal phone but email access possible when/if you decide to check it.
    – Paolo
    Jan 3, 2020 at 17:56
  • 2
    This is what I was looking for. I've had companies require this if you wanted to access VPN or install the native Outlook app or other company apps, but it was not required to just connect to email over the web. Just add a OWA link to your home screen and check it every once in a while.
    – JPhi1618
    Jan 3, 2020 at 19:11
  • Indeed. It's not even like OWA is some obscure product: the Outlook mobile app "speaks OWA" so you don't even have to use a web browser. (And OWA-compatible email clients aren't new, either)
    – Aaron F
    Jan 10, 2020 at 18:36
14

My concern is that, although optional, there will be a time when someone needs to reach out to me after hours, and I will be faulted for not having the software on my phone.

If that time comes, they can just buy you a new phone/tablet.

Either way, it's their decision, their fault.

Improve this answer
1
  • 4
    If someone really needs you after hours, they could actually call rather than rely on email.
    – Robin Bennett
    Jan 6, 2020 at 9:17
8

From your company's perspective, this is standard operating procedure for a BYOD ("bring your own device") infrastructure.

I am typically on the other side, advising and supporting customers in setting up MDM (I'm a security architect).

First, technical details: I'm familiar with a number of MDM systems, but not this one. But if set up in BYOD mode, the MDM should not be able to track, block or encrypt your phone without your explicit permission. The MDM client will be able to safely remote wipe or block access to the container that has the company data and apps, but not your private data or apps.

You could do some research on Workspace ONE and it's BYOD device mode and verify for yourself the claims made by the security department. On the MDMs that I support I would be able to say that you have nothing to worry about as in BYOD device mode, with device ownership set to employee, there is in fact very little the MDM client can do outside the container and if it attempts any of that, your phone OS will prompt you.

Secondly, from a personal perspective, I have had a private phone in addition to a work phone for 20 years and I continue that tradition simply because I want to keep work and private life segregated not only in respect to data but also phone number. I leave my work phone at home when I go on holidays, for example, and only the CEO has my private number in case of real, actual emergencies.

IMHO you should not just disregard your concerns for the simple reason that the phone is your property. The company can offer to supply additional features to you on it, but it can never demand it.

That said, the caveat is, of course, that the USA isn't exactly big on employee rights and you most likely are at-will employed, so they can sack you for this or for having the wrong hair cut. Your concern that it might impact your career even though it by all rights should not may not be unfounded.

Improve this answer
6

It's good your company has started the practice of trying to control what happens with company information. If your phone gets stolen, they can wipe the company email from it to protect the company. Good on them.

My company ensures this policy in a different way. If you want to install your work email on your phone, you'll have to accept IT can wipe the email account from the phone AND you need to set a pin code to lock your screen.

Your company has opted for a different solution and even though they have explained they will not use all the features at the moment, there might be a point in the future this will change and you are right to be skeptical about putting this on your personal phone.

You have three options:

  • Do not install it and use OWA
  • Not be available outside of work time, unless they provide you a company phone
  • Accept company software on your personal phone

Your manager has said the company phone is not an option, so it's really up to you if you would like to inconvenience yourself by using OWA or install company software on your private phone, or to inconvenience the company by not being available after work hours.

Since you already had a conversation with your manager, you could drop him a quick email with a summary. In this email you can point out the reduced availability as you will not install this software on your personal phone.

In case you get blamed later on, refer to the email.

Improve this answer
7
  • 5
    Or option four: Buy a cheap extra smartphone and dedicate it for work usage.
    – Gertsen
    Jan 3, 2020 at 10:03
  • Thanks for your comment. Buying an extra smartphone would still be a personal phone.
    – Caroline
    Jan 3, 2020 at 10:33
  • 3
    Technically true, but it'd be a clean personal phone. One you can turn off in the weekends and after hours. It'd solve 99.9% of the problems a company issued phone would.
    – Gertsen
    Jan 3, 2020 at 10:35
  • 1
    OPs question is about being available after work hours. I don't think it would solve all issues as location tracking could still be a thing. (interviewing at the competitor?) You're right that photos, texts and calls are protected though, unless done on the "wrong" phone. Biggest issue here is the company not providing company phones, while expecting employees to be available after work hours.
    – Caroline
    Jan 3, 2020 at 11:06
  • If your phone gets stolen, they can wipe the company email from it to protect the company. → Wiping the phone remotely is a nice added value for security, but a peripheral one. Security organizations do not rely on it. What they rely on is the ability to force you to have your phone locked, and have a PIN which is resistant to brute force attacks (what it should be depends heavily on the phone and its ability to defend against such attacks)
    – WoJ
    Jan 3, 2020 at 14:55
5

You don't have to login to the account your OS to read email. You can access emails in browser (sometimes you have to enable "desktop mode", sometimes not). Sometimes that kind of access does not require the remove management software. That enables you to be connected in emergency case, but the phone will not spit notifications while you are doing your out-of-the-work stuff. If they really need you they can call and ask to read the email.

Don't forget to sign out as you are done! Since you are avoiding recommended way, you would be seen as more responsible if you lose the phone and it causes security breach.

Improve this answer
1
  • 3
    I don't think this is generally true. They may well have decided to make email (whether by HTML, exchange, POP, SMTP, or whatever) only accessible to local IP addresses. It that case OP won't be able to access it except through the VPN.
    – DavidW
    Jan 3, 2020 at 13:15
3
  • Just comply with it and install the thing on your phone
  • Stand your ground and don't install it on your personal device
  • Tell someone (your manager?) that they should give employees work phones. If they are happy to do it, all is good. Else, refer to the other two suggestions

I don't see what else you can do. I, for myself, would NEVER let them install this on my personal phone. This is the kind of thing that would make me quit the job.

Improve this answer
2
  • I wouldn't quit, they'd have to fire me. But if they want me to install something on a phone to access business emails they will either have to provide me with a phone or I just won't access business emails.
    – xyious
    Jan 3, 2020 at 17:51
  • Yep, and it's not petty either. I'm a contractor so I rarely have a corporate phone from the client but I draw the line here. Many of these MDM apps demand all sorts of permissions, sometimes upto and including resetting the phone entirely.
    – Dan
    Jan 4, 2020 at 10:24
3

DEFINITELY DO NOT install any software on your device which could encrypt your device. If the device is encrypted, then, if your company wants, they can just change the encryption key on you and now your phone is bricked forever, and they can do this for any reason; heck, if you happen to piss off the IT guy one day he can just go back and brick your phone if he feels like it, and then what will you do?

DO NOT do this. Heck, I would just go ahead and say, do not install any software on your personal device that your company requires, because realistically you have no idea what's in it or how it's configured, it could be a rootkit or a virus or something else. It's way more trouble than it's worth. As others have said, if your company believes you need to be contacted outside of work hours, they should provide you a company device to use, or pay you to buy one yourself.

But aside from all of this, it sounds like you are the one who wants to be contacted outside of work; the company is saying "if you want to be contacted outside of work, do this thing", and you're saying "yeah I like working unlimited free unpaid overtime". That itself is not healthy. Leave your work at home and go have a personal life. Whatever emails come in after hours can wait until the next business day. If your company wants you available after hours, ask them to put it in writing and compensate you for it. Otherwise, get your company email off your phone and leave your work at work.

Improve this answer
6
  • 4
    It's 2020. MDM software does understand the concept of ownership and an MDM client set to "employee owned" will not be able to encrypt or wipe the entire device - only the container.
    – Tom
    Jan 4, 2020 at 0:33
  • 1
    @Tom And if it's configured wrong? If there's a bug? If the SysAdmin is just straight up malicious? Bear in mind you're not just installing a version of MDM, you're signing up to get every update (Good, bad and ugly) as time goes on. You can't just handwave away genuine and real concerns
    – Dan
    Jan 4, 2020 at 10:26
  • 4
    @Dan if the MDM requests extended permissions, your device will prompt you and require you agree. The SysAdmin can not just reconfigure a BYOD to a company owned device under your ass. Now yes, the MDM client could contain malware. That's a risk you take with every app you install. But MDM companies have a reputation and big corporate customers and check their stuff probably much better than Tea Timer v3.2 or Random Clicker Game do.
    – Tom
    Jan 5, 2020 at 12:14
  • Even if it could encrypt your phone, why do you suggest it could brick the phone (meaning it could not be factory reset and would be effectively destroyed)?
    – Yogu
    Jan 6, 2020 at 9:31
  • 2
    @Ertai87 that's the part where OP should ask the IT department. None of the MDM I use touch things outside the container on a BYOD device. I suspect there was a misunderstanding.
    – Tom
    Jan 6, 2020 at 19:16
2 
the security team is requiring that **anyone who wants access** to any organization resources on his/her personal phone or tablet install

This isn't a serious request or requirement. If it was vital to reach you, the company would be providing a company cell phone or tablet. If you've been getting by without having this sort of access, then you don't need it, and I would take no action.

Improve this answer
1

It might sound silly, but have you considered buying a separate phone for work? Would spending $200 for a refurbished phone plus the annual cost of an additional line ($100-200) be worth it to you? Your cost is probably less than the business's to provide you a phone with service.

If it is not worth it, this is a good justification for not spending your time working outside of the office. Consider that spending your personal time is like spending your personal money; maybe a good investment, maybe not.

Improve this answer
1
1

I'm going to try and provide a different insight then the answers here. Do you, in your current position, need to access data from your mobile for any given item?

My company has the same policy as yours, but I told them if they enforce them I would delete all my company data of my phone (Such as email, slack) and only allow the program on my work laptop, which I only use when I am actually working beit remote or in the office. They have agreed with this proposition, and the fact they can only reach me during office hours then is not a problem since I am abiding my company policy.

Maybe talk to your security officer about a solution like that?

Please note, this only works if you don't need to be standby to reply to work related items outside of your work like me.

Improve this answer
1

The options before you are pretty good. Your manager says you can use OWA to get to email without the MDM install, so you can do that, or if it's more useful to you overall you can let them install it and incur a low risk of something going wrong.

I have had things like this installed on my phones in the past and it's been fine. I think people are way too hysterical about it (especially when the requirement is less, like "hey use google authenticator for 2fa" - "NOT ON MY DEVICE YOU CORRUPT FATCATS" - what?) A full MDM is a different thing, but if the company seems to be competent and managing it right, why not? I personally don't want to have to be carrying 2 phones around even if "work is paying for one." I've had MDM on my phone several times before, left a company, that account gets locked/wiped, and I go on with my life. (To be honest sometimes the account has stuck around in some areas longer than I wanted and took some doing to delete, and a month later occasionally my phone would be like "hey how about reentering your password for this account you don't have any more?" but that's it.)

The important thing is to determine the real risk and the real utility, not the Internet emotional posturing approach. For this product, with this company, what are the real risks and likelihood, and then what is the impact on you doing something different or not at all. That analysis can lead you to the right answer for you.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .