Installing organization's app on your phone with "always on location" and tracking permissions

Question

I work at a small start up. At times I am asked to download their mobile app for testing purposes. The end users of this app usually are delivery / riders who use it for pickup and drop up purposes.

Now there is nothing wrong with the app, I just don't feel comfortable giving an "always on" location permission and the "tracking" (iOS) to an app that I will just be using once or twice a month. When asked about why the "tracking" feature needs to be enabled and what data it collects, I was told (non verbatim) "Tracking in iOS is used for high accuracy location info" which kinda seemed dodgy as I would expect any and all location info to be under the "location settings" and not tracking. This is a software industry that builds this app, so this can not simply be a case where an individual is simply not aware of the tech being used.

So the question, should I go ahead and tell that I do not feel comfortable giving an app on my personal phone (not work issued) said permissions? Should I go on and ask my query to higher level tech / team leads on how tracking is used?

Or is it part of my work and hence I am liable to have said app? No contract / NDA I signed specifically said having this app is a part of the job.

EDIT : I should have mentioned this earlier but looking at @joeqwerty's suggestions, I did also ask for alternatives, if a web / desktop app was offered (I have no issues giving tracking permissions to my work laptop), but none were offered.

Answer 1

Ask for a company phone to use for testing purposes.

If you're going to be testing an in-development app on a phone, it probably shouldn't be your own personal device. After all, if a bug bricks your phone, how would your family contact you? Additionally, if you left the company, you'd be taking potentially sensitive corporate data with you that could potentially be leaked to your competitors.

In addition, if the testing is being carried out on employee phones, it's likely that it would result in an ad-hoc test regime that doesn't fully capture the potential breadth of devices that the business intends to support - so it may be in the business's best interest to build a proper testing lab containing at least one copy of every device you intend to support to allow for formal testing on each such device.

Instead, ask for your employer to provide a device for testing purposes, which would remain company property and remain on company premises at all times. They provide you with computers to code on and servers to host your development stuff on (repo servers, build servers, etc), and this is just another piece of hardware that you need to do your job.

I would suggest the use of an iOS emulator, but apparently Apple discourages their use for iOS app development, according to a company that sells testing on actual Apple devices over the Cloud.

Answer 2

Regardless of any NDA or contract, an employer can't force you to do anything with your personal property.

They may choose to fire you if you fail to cooperate, but they can't force you to install their application on your personal phone.

Tell them you're not comfortable installing the app on your personal phone and ask them what alternative solutions might exist.

Answer 3

So the question, should I go ahead and tell that I do not feel comfortable giving an app on my personal phone (not work issued) said permissions?

You can express that feeling if you think it's "safe" to do so within the context of your company.

Should I go on and ask my query to higher level tech / team leads on how tracking is used?

If this would make you feel more comfortable about using the app, then you should ask.

Realistically, just turn location tracking on for this app while you are at work, then turn it off when you leave for the day. Or for even more security, uninstall the app when you leave work each day and reinstall it when you start work the next day. Both are simple solutions to your lack of comfort.

Answer 4

So the other answers are correct, that the company should really supply you with a work phone. They haven't though, even though you have expressed your unease. Maybe they would if you really pushed, but they might also not take it very well. If the job is good overall, then perhaps this is not the hill you want to die on. It also has a relatively confrontation free workaround;

Buy a burner phone

The cheapest "Smart" phones are not that expensive, this may be location specific, but I can get an android phone that would install apps and the like for about the same cost as a months worth of phone credit. You don't need any credit on the phone to install an app via wifi. I might have missed it, but I don't think you stated anywhere that the app is iOS only?

If your boss is annoyed by fact that you haven't got an iphone to test the app on, you will have to decided if you want to;

A) firmly state that this is the only phone you will be installing the app on,

or

B) tell a lie and say you lost your iphone.

The lie does have the slight advantage of preventing any argument, but you would then have to leave your iphone at home. I suspect it won't even come to this, nobody will remember what brand phone your phone was.

Edit in response to the comments;

• Yes, asking around your friends/family for a spare old phone is a better and cheaper idea. Very environmentally friendly too.

• Should you later go back to bringing your iphone to work, and someone is perceptive enough to notice, you can simply say you found it. Don't do that until you are sure that all talk of installing apps is over. Losing your phone once is plausible, twice is suspect.

Answer 5

Refusing to do what your employer asks may mark you as "not a team player" or "difficult"

This is especially true if basically every other employee does so and it would be true even if what they're asking is not reasonable.

If you're marked as such, the consequences may vary from getting fired (probably not too likely, if they're reasonable) to making opportunities to advance or work on interesting projects less likely (whether intentionally or subconsciously on their part). Refusing may not be fully responsible for that by itself, but it could get the ball rolling (or make it roll faster). If they think you're not that committed, they may see further signs of a lack of commitment when you do perfectly innocuous things (that most/all other employees also do) like not attending a team event because you have other plans or taking a long holiday.

I imagine the risk of getting sued (or anything like that) due to this alone would be negligible to non-existent. But of course I'm not a lawyer and this is not legal advice.

It should be fine to raise some concerns

It should be fine to raise some concerns about installing the app and ask about alternatives (or, preferably, offer alternatives, because you're presumably much more motivated than they are to find an alternative). Although you should at least be somewhat careful about which objections you actually raise and how you phrase them, as to avoid implying things like "I don't trust you" (by objecting to the permissions on your device specifically) or "you shouldn't trust me" (by implying that you may maliciously or neglectfully leak some sensitive company data).

Note that some alternatives may just not seem that viable or necessary to the company at present, like building a proper testing lab or giving an employee (or every employee) a company device when they only use it very rarely. This would likely be especially true if we're talking about an early-stage startup that may want to avoid unnecessary expenses (even small ones).

Should you explicitly refuse?

If raising concerns or trying to find alternatives didn't work out, should you refuse to install the app?

That's ultimately something you need to decide for yourself, based on how likely you think the above risks are based on your knowledge of the company and how much you actually care about those risks compared to this one aspect of your privacy.

Answer 6

There is an issue of boundaries here. It is not that installing the app on your phone really has much of an influence on your life it is just it is something you pay for which your employer thinks they can use for there economic activities. This is in essence unreasonable.

They are a tech company, regardless of size or success tech companies make enough money to buy employees work cellphones. I don't care how good the job is, if insisting that employers respect employees boundaries makes you a non-team player, then too bad.

I don't expect anyone in my team to give a single damn about me. We go to work to further the goals of the company who pays our salaries. We have to work together, but no form of friendship is expected or required. I have a family I have a mother. No colleagues of mine is either.

This team-player poppycock just sounds like a way in which certain employers try to befriend you so as to make it easier to take as much advantage of you as they can.

I think in India they have the problem same as in South Africa that people think having a job is such a miracle that you have to endure any and every exploitation just to be employed. This may be the case in some profession but it shouldn't be the case for a suitably qualified tech professional.

Answer 7

These options are generally available:

• Just say no and ask them to make budget accessible for obtaining current test devices. This would be the normal situation, which one might expect as a mobile developer - which may also include industrial scanners, label printers, as well as anything else, which cannot be emulated.
• Buy any cheap and/or refurbish test device, on which you will neither set up your accounts and which you will always leave at your desk - then they can geofence it as much as they want, it will never leave the perimeter, unless intentionally carrying it outside of the boundaries, while being paid to do so.
• Put your device into a metal box, whenever leaving the corporate compound, in order to shield it's radio (this should well count as having it "installed", unless they would have requested constant internet access).
• It would be far less of a private issue, when the recording of GPS data would be strictly limited to office hours ...as I once did when writing a fleet tracking tool, which was also installed on private devices (they've rather welcomed it, not having to deal with another one device).

The security argument against BYOD in other answers might be wrong (at least for Android), because EMM (dpm) supports work profiles to be setup - which then can be remotely wiped.

And frankly speaking, the argument "that everybody is doing it", almost implies that it is wrong. Why they need to use peer pressure to manipulate their employees into supplying them with their private hardware? To me this doesn't seem well-funded or the funds might be diverted elsewhere.

Answer 8

1. Uninstall immediately.
2. Tell your boss in writing and some little 'why'.
3. If they say "you have to", ask for that in writing. Don't install.
4. If they get really shirty then get their threats in writing. Don't install.
5. Point out that when you're not at work, you're not being employed by them and when you are at work they know where you are. (If you drive in your own car to work then what would anyone think about having to put a tracker on it? When that outrage sinks in, ask why a phone is different?)
6. You may have privacy and data protection laws on your side. Ask for a list of the data collected and how it is being used and how it is being kept according to local privacy laws.
7. Tell your colleagues. They might resent being spied on but don't have the balls to say no.

If your employer rules by fear then jump ship ASAP.

Answer 9

Your company's policy and their responses to your questions show that they don't understand the issues or they do and have something other than software testing in mind. I think your best option would be to just leave your phone at home whenever you go somewhere you don't want them to know about. (Spending time with CEO's spouse whenever CEO is out of town, calling in sick when you're on a job interview, etc.) You should get a cheap prepaid, if you need one, for calls when you're without your Iphone. It won't cost anything compared to loss of your job or hurting your performance evaluation.

And you should start looking for a job.