With all the news lately regarding the NSA’s surveillance program, it is not surprising that people are concerned, and even a little apprehensive, regarding what information others can view on their personal electronic devices. With the recent surge of BYOD, the clash between personal and corporate data is even more apparent. But what can an employer really view on an employee’s BYOD smartphone or tablet? And when it comes to the use of personal devices, do employees trust their employers?
Recently, MobileIron, a mobile device management software developer, conducted a survey (MobileIron Trust Gap Survey) of 3000 workers across the United States, United Kingdom and Germany. Of those 3000 workers, 80% now use personal smartphones and tablets for work related functions. But only 30% surveyed “completely trust their employer to keep personal information private.” 41% of employees surveyed did not think their employer could see anything on their mobile devices – and 15% were not sure what the employer could see. “There’s a ton of confusion out there, and so the trust gap has widened. Employees don’t really know what their employer can and can’t see.” Ojas Rege, vice president of strategy at MobileIron, told CIO.com, What Can Employers Really See on a BYOD Smartphone or Tablet. “They’re just guessing.”
With a well-crafted BYOD policy, however, an employee should not be surprised about what an employer can see on a personal device. Notice is important, so you might consider telling employees what information the organization needs to see and why. By way of example:
- Apps: An employer has a stake in regulating what applications an employee can use on their personal devices for security purposes (e.g. protecting against outside access to client information, and to prevent the loss of proprietary information.)
- Litigation or Pre-Litigation: In the event of litigation or pre-trial investigation personal devices may be subject to search and review for evidentiary reasons. A BYOD personal device becomes just like any other evidentiary tool that may contain relevant information.
- Corporate Information. Regardless of what an employee may think, all corporate information, whether generated through the use of personal or corporate devices, or personal emails and data, belongs to the employer. The device may not belong to the company, but the information certainly does. Employees ought to understand this before using their personal devices for work purposes.
When looking at BYOD, employers should also consider what information employees don’t want them to see. The survey illustrated the type of personal information and activities most workers were concerned about – personal emails, text messages, photos, videos, voicemails and Web activities. Not surprisingly, younger employees, ages 18-34, were far more concerned about personal privacy than workers over the age of 55. Depending on how the organization manages their mobile devices – it may or may not have access to this kind of information. To make an informed decision about using a personal device, employees should know whether this information will be accessible to and/or monitored by the employer.
The survey certainly demonstrated there is a “trust gap” with employee use of personal devices for work purposes. So how should an employer bridge the trust gap? Unfortunately, the survey really demonstrated that no matter what a company does, whether it places employees on notice of all monitoring activity in writing, asks an employee permission to review a personal device or explains in written detail the purpose behind the surveillance, only 30% of workers believed these measures would increase their level of trust. Roughly 30% of the respondents stated that there was nothing an employer could do to increase their level of trust in the company.
Yet, a complete BYOD policy that spells out what information is needed and why should give an employee some measure of comfort in knowing the circumstances around which a personal device may be investigated or monitored. Armed with that information, the employee can then decide whether they want to use their personal device for work purposes. From the company perspective, a solid and tailored BYOD policy might dispel some of the negativity surrounding monitoring activity on corporate and/or BYOD personal devices.