Hacker News Reader

I think you read about 100 words into my comment, got angry, and started typing. If you hadn't, you'd have seen that I wasn't talking about insiders pulling heists.

> I think you read about 100 words into my comment, got angry, and started typing.

Physician, heal thyself. You wrote:

> Companies turn over tens or even hundreds of employees a week.

Unless this is some difference I have never previously encountered between British and American English usage, that seem a pretty clear reference to employees coming and going. In the context, what else could you possibly be referring to apart from the danger of leaking data because employees who used to have legitimate access still had the data after they left?

Just because you don't like it, or disagree with it, doesn't make it wrong. These are well-established IT security and legal issues.

> These are well-established IT security and legal issues.

No, they aren't.

For one of my clients, I work with high-end security hardware used in places like banks, medical facilities, etc. These are the kinds of place where you access the server room through an airlock. They are affected by issues like SarbOx and HIPAA in the US, various international data protection legislation, etc. If your device doesn't comply fully with every single point on their standard network security checklist, they won't even consider buying it. You get the idea.

And exactly none of those things, in any way, according to even the most conservative experts, would require the kind of invasive wiping of personal data on a personal phone that we are discussing here. Several people replying to my post have claimed without citation that such a facility is somehow a legal requirement for businesses handling sensitive data. My disagreement with their position doesn't make them wrong. The facts do.

(Edit: This comment got hit by a downvote faster than any human being could possibly have even read it. If anyone would like to have a discussion based on cited laws/regulations, facts with supporting references, etc. then I will be happy to debate with them. If anyone would like to debate the ethical issues surrounding merging work life and personal life, I'm game. But if all we're going to do is make vague claims about the law somehow requiring this kind of facility and downvote anyone who disagrees, then this whole conversation is rather pointless.)

Suffice it to say that your experience is not controlling here: I too have clients, and many of them allow iPhones, and all of them use Exchange.

Your "legal requirement" argument is a red herring. I think you just want to argue. Nobody is claiming that companies have a "nuke from orbit" legal requirement; what they have instead are requirements to safeguard data and penalties if the fail.

> Nobody is claiming that companies have a "nuke from orbit" legal requirement

This entire discussion is about wiping a personal phone completely, not just company data on it.

I challenged this behaviour in my original comment. You replied to that post and said explicitly that there was nothing wrong with it, citing legal obligations to protect company data, PR risks of leaks, etc. Several other posters have made similar arguments nearby.

I replied to you and pointed out that none of these arguments require or justify giving an employer the ability to wipe an employee's personal phone entirely.

Since that time, you have in various posts accused me of not reading things before replying to them, mocked me, accused me of just wanting to argue, and generally been rude and unconstructive. You have not, however, actually defended your position in your original post that the ability to remote wipe an entire personal phone is a "completely reasonable due-diligence security mechanism" or addressed any of the three specific points I made in reply.

I know you read my comment here ( http://news.ycombinator.com/item?id=1935284 ) because you replied to it before writing this comment. Yet you still talk about "invasive wiping of personal data on a personal phone" as if someone somewhere wrote

  if (RemoteWipe) {
    companyData.Erase();
    personalData.Erase();
  }

Do you understand that the iPhone does not keep personal and company data separate? Do you agree that the distinction between personal and company is vague and human defined?

What kind of high-end security hardware are you talking about? If you used an advanced Cisco software VPN client, you could (so I hear) have it scan the client computer and enforce policies on it. If it was used on a personal computer, these would be invasive in a similar way yet you would not blame Cisco or the company if the user didn't understand this, would you? Would you be outraged that it's even technically possible?

> Do you understand that the iPhone does not keep personal and company data separate?

Yes, of course. I just think it's the employer's problem in this case, not the employee's.

> Do you agree that the distinction between personal and company is vague and human defined?

No. The argument made by many people disagreeing with me in this discussion is predicated on the employee downloading data from the company Exchange system. That provides an objective standard for what constitutes "company data".

If you're going to try to broaden that in some ill-defined way to any other data the employee has, you might as well argue that any employer should have the right to audit any and all of an employee's personal property, communications or brainwaves. I am aware that some employers actually do seem to think that at least the first two are reasonable, but I vehemently disagree with them, and so does the law in most places.

> What kind of high-end security hardware are you talking about?

The relevant ones here typically record/block/modify network traffic: intrusion detection, data leakage prevention, lawful intercept, that kind of thing.

> If you used an advanced Cisco software VPN client, you could (so I hear) have it scan the client computer and enforce policies on it. If it was used on a personal computer, these would be invasive in a similar way yet you would not blame Cisco or the company if the user didn't understand this, would you?

You mean if

(a) an employee was asked to work from home,

(b) the employee was asked to access the company network using company-provided software installed on their personal computer (the VPN client), and

(c) that software then reformatted the employee's hard drive because someone in corporate IT hit the wrong button by accident,

would I have the same problem with it?

Yes, of course. As I keep saying, if the company requires that kind of control, it should be issuing employees with dedicated systems at company expense, configured appropriately. I struggle to see any circumstances under which installing software on an employee's personal property that gives the employer the ability to wipe the entire machine arbitrarily would ever be justified.

Exactly how does a DLP system help a company whose employees are allowed to use iPhones for company mail, when company mail is streaked through with protected information like bacon is with pig fat? People put network DLP systems on their perimeters, so they can catch data walking out the front door. Protected information is supposed to walk over email; people use it to get their jobs done.

> Exactly how does a DLP system help a company whose employees are allowed to use iPhones for company mail, when company mail is streaked through with protected information like bacon is with pig fat?

Exactly, it doesn't!

If you have data that is important enough for leakage control at the edge of your network, then it must not be accessible outside of your controlled systems at all.

An employee's personal phone is never a controlled system for the purposes of this policy.

After all, what if the phone isn't stolen, but infected by a data-stealing virus during the employee's personal use?

This is called a "risk". Companies do different things in response to different risks. To the "company will lose $100MM if one of 150 different people lose their phone" risk, many companies have adopted the "nuke from orbit" control. To the "phones may be infected by data-stealing viruses" risk, most companies have adopted the "qualified stake holder for affected data has signed a document attesting to the company's acceptance of that risk".

If companies had the black-and-white perspective on risk you have here, nobody would ever be able to deploy a line of code.

I don't have a black-and-white perspective on risk, but either the data is worth protecting at a remote-wipe kind of level or it's not.

In most cases, the ability to wipe a typical employee's personal phone in response to anything would be a ludicrous over-reaction.

On the other hand, if you have someone who really does need to access sensitive data on their phone, and leaking that data is a $100,000,000 kind of risk, and there is $100,000s of layered security that normally protects that data, then maybe company IT should be authorised to spend $100s on a properly secured device that they can remote wipe if necessary, in preference to giving an obvious attack vector straight past that security.

As you say, it's about the risk. I don't see any circumstances under which risking using an employee's personal phone to access genuinely sensitive data off-network is justified. Either the damage if it leaks is bad, in which case the barrier for providing a company phone is pretty low, or the damage is negligible, in which case requiring a remote wipe facility that can destroy the employee's own property is silly.

Yes, of course. I just think it's the employer's problem in this case, not the employee's.

I think it's the employees. You know, because it's their phone and in their interest to keep it separate. Did they ask their phone vendor for a phone which could keep the data separate? Did they read the user manual? Did they vote with their feet or dollars? Did they give a damn at all?

> Do you agree that the distinction between personal and company is vague and human defined?

No. The argument made by many people disagreeing with me in this discussion is predicated on the employee downloading data from the company Exchange system. That provides an objective standard for what constitutes "company data".

But if I sync my contacts with a company Exchange server, I cannot add contacts without them being stored on the Exchange server. If I add a personal contact, those details are sent to the company. Is this now personal or company data? How is the Exchange server to know that you don't want contact X deleted? And why should it listen to you if that would just be a way around it's security?

If I open an email with a picture and save it, it goes into the camera roll as a copy. Is that now a personal copy or a company file?

If I get a company email with a link to the corporate intranet and I login, is the cached data in Safari which has corporate data in it but which did not come from the Exchange server, is that company or personal?

If you're going to try to broaden that in some ill-defined way to any other data the employee has, you might as well argue that any employer should have the right to audit any and all of an employee's personal property, communications or brainwaves.

No, that would be stupid.

As I keep saying, if the company requires that kind of control, it should be issuing employees with dedicated systems at company expense, configured appropriately

No it shouldn't. If the company requires work from home it should issue dedicated systems at company expense. If it merely requires control over whatever system you use then it should only provide advice and understanding when you agree to that control.

Just because a company requires control should you wish to access things remotely does not mean that they are obliged to provide the device. Only if they require you to use a device should they provide one. If they do not require it but you choose to provide one, they should be allowed to require restrictions and refuse if you do not agree.

The interesting bit is that these restrictions are

a) not intuitive to a nontechnical person

b) obvious to anyone who knows about them.

I struggle to see any circumstances under which installing software on an employee's personal property that gives the employer the ability to wipe the entire machine arbitrarily would ever be justified.

When that personal property has no other support for erasing important data apart from wiping the entire machine, yet the company mandates that devices be able to erase company data.

What else do you want? You keep switching between:

- Some perfect device which does not exist

- The scenario in the newsitem, where nothing bad happened except the person was shocked and annoyed

- Some hypothetical scenario where extreme damage was done to the person

What are you really arguing? That it's unfair? That it's less than ideal? That the company is horrible? That Microsoft is horrible?

What's your point?

iPhones and other activesync devices cannot but wipe everything or nothing, and companies do demand the ability to wipe data.

Some companies may demand employees buy personal devices for work use, that's unpleasant and possibly illegal. Many do not.

Those that do not often give people the option to use approved personal devices if they prefer them to work provided ones.

If people choose to do that without understanding what they are doing, that is unfortunate. In an ideal world it wouldn't happen, but it does actually happen.

The best thing to do is:

a) Have backups of your important stuff

b) Have a mindset where you can accept things goind weirdly in systems you don't understand.

c) Have a mindset that you accept the more technical and complex the systems involved in your life are, the more this sort of thing is going to happen.

My position is simple, and I don't think I have been inconsistent with it anywhere in this discussion.

1. If it is the employee's device, then everything belongs to the employee by default.

2. If the employer wants to allow access to certain company facilities or data using that device, then it is the employer's responsibility to ensure that such access complies with any necessary policies, without affecting anything that is none of the company's business.

3. If the employer can not or will not do this, then they should not provide the access in the first place.

4. They always have the option of providing suitable company hardware to the employee with whatever restrictions may be necessary to comply with their policies, at their own expense.

5. Arguments about how the company allowed but didn't require access, the employee consented, etc. are very weak here. Most employees would not be aware of the implications of such policies, and in many workplaces there is a fine line between what is required and what is not required (but if you don't do it we'll penalise/fire you). You're just leaving room for the employer (with its expert system administrators and retained lawyers and heavyweight HR leverage and much greater financial resources) to trample on the employee while wriggling out of any consequences.

> The best thing to do is:

> a) Have backups of your important stuff

> b) Have a mindset where you can accept things goind weirdly in systems you don't understand.

> c) Have a mindset that you accept the more technical and complex the systems involved in your life are, the more this sort of thing is going to happen.

I wonder if you'd feel the same way if, say, your identity was stolen because your home network was compromised by a zero-day exploit in whatever browser you are using to read Hacker News and a data-stealing worm sneaked in. I'm sure you're aware of the theoretical risk of that happening, and you chose to connect to the Internet anyway, so I guess you've accepted the consequences, and anything bad that happens will be your fault rather than the malicious attacker's.

I most strongly disagree with 2. and 3.

The person who wants the end result gets to agree to the other person's policies.

If your employer wants your device to have email then they get to agree to your policies about your phone. [Edit: except for the big point that this is impossible with current iPhones and Exchange servers].

If you want your phone to have access to your ecompany email then you get to agree to their policies.

I wonder if you'd feel the same way if, say, your identity was stolen because your home network was compromised by a zero-day exploit in whatever browser you are using to read Hacker News and a data-stealing worm sneaked in. I'm sure you're aware of the theoretical risk of that happening, and you chose to connect to the Internet anyway, so I guess you've accepted the consequences, and anything bad that happens will be your fault rather than the malicious attacker's.

My response: Oh shit, now I have to deal with identity theft.

Your response: Let's legislate to forbid providing internet browsers unless the browser provider and ISP can guarantee this can't possibly happen because it's not reasonable for me to audit their code. Let's legislate websites to forbid access unless they can guarantee this can't happen. How could they be allowed to let me on their website without forcing me to consult expert legal advice and have big neon sign warnings about what an accident on their website might do to my computer?!

> The person who wants the end result gets to agree to the other person's policies.

And in this case, does it sound like the victim made an informed decision that she wanted this end result?

> My response: Oh shit, now I have to deal with identity theft.

I take it you've never actually been on the wrong side of this one, then. I don't believe anyone who has would be so cavalier about it. And yes, I have. It's one of the reasons I'm so adamant in discussions like this that (a) sensitive data must be properly protected, and (b) systems should not be designed so that they can seriously damage an individual without adequate safeguards.

> Your response:

Find perp. Do very unpleasant things to him. Ensure that victim does not suffer any more than necessary due to perp's actions.

Nonsense. There is absolutely nothing diligent about having an ability to wipe someone's personal data that has no connection to your business, under any circumstances.

There is no clear cut destinction, on an iPhone. It's not about dilligence, but practicality - there is no other way to wipe an iPhone but "completely" or "not at all".

Firstly, this is a complete straw man: protecting company secrets from the company mail server does not in any way require deletion of personal data on a personal phone.

The phone does not make that distinction. It is not possible to remotely wipe half an iPhone.

Basically, your entire counter-argument is a non-argument. Nothing you have said in any way justifies a company having the power to interfere with your personal data

There is no distinction on an iPhone. It does not make a distinction. Personal data is not kept separately. Company data is not kept separately. There are no divisors. There is no restriction. No sandboxing, no virtual machines. The distinction you keep making between "personal data" and "company data" is in your mind not in the iPhone data store. The iPhone data store is binary data stored in a nonsentient device which has no person itself and no understanding of personhood. There is no distinction between personal and company data in iOS. Email on an iPhone is just another app which does not distinguish personal from company messages. Your personal inbox and your exchange inbox can be merged into one unified inbox on an iPhone because an iPhone does not make a distinction between personal and work data. You can have a personal Exchange email account.

> It's not about dilligence, but practicality - there is no other way to wipe an iPhone but "completely" or "not at all".

Not being able to do something properly is not an excuse for doing it badly and causing serious damage to someone as a result.

In this case, if an employer cannot (a) allow an employee iPhone to connect to their mail store and (b) secure their own data appropriately without also (c) compromising the employee's, then they should not permit that access in the first place. They should provide the employee with a dedicated device, at company expense, over which the company can have whatever control it requires.

That sounds like it makes life better for everybody. People who would rather use iPhones for corp mail than 3-year-old Blackberries, and who accept that the tradeoff for using them is potential "nuke from orbit", can't... so you can avoid having to think about whether to give your IT department that power. Everybody wins!

It is obvious from the fact that we are discussing the original article at all that this issue is more complicated than you make out.

I already addressed the underlying issue you raise in my original reply; it was point #1. Perhaps you would care to further the debate by replying there, instead of resorting to sarcasm and mockery?

Not being able to do something properly is not an excuse for doing it badly

Yes it really is. I'm not a builder but if I had to shelter from weather I would make a shelter. And my excuse for it being a low quality shelter is that I can't make a perfect one. And that would be better than nothing because at least I wouldn't die. Your idealism is idealistic but not helpful.

If iPhones couldn't read company email they wouldn't be as useful or as popular. If they could do so, but only by enforcing a horrible dual-personality where you had to manually switch between contexts they wouldn't sell as well or be as popular or useful. If they share data they are easier to use and more popular but not as easy to secure.

You say "not being able to do something properly" without addressing the fact that there is no accepted "proper" way to do it. They didn't ignore the proper way because they were lazy or stupid. Exchange email started on Windows Mobile devices for office use. That it has spread to consumer phones means the assumptions under which it was designed no longer hold.

and causing serious damage to someone as a result.

1) As far as we are told, no damage at all happened to her, she didn't even get lost after losing her navigation system.

2) We don't know that /serious/ damage happened to her.

3) The more serious the potential damage, the more important it was for her to have a backup of her important data and a backup of her important systems. There's no getting around this tradeoff.

4) The more serious the potential damage, the more important it is for her to understand what she is doing when making changes to her device and not blankly follow instructions to hook it up to things willy nilly.

Your second paragraph is a "person should be protected from all harm they don't understand by an all seeing overlord" argument, and it falls down where anyone else wants to do anything else or accept a different risk profile than uninformed easily panicked J. Bloggs.

>> Not being able to do something properly is not an excuse for doing it badly

> Yes it really is.

I don't really know what I can say to this post. You have somehow turned this whole incident into the victim's fault, mitigating the consequences of the company IT staff's mistake into the victim's responsibility, and my argument that it is not reasonable for an employer to introduce such a drastic facility to destroy an employee's personal property without giving the employee fair warning into some unbounded "no-one should be responsible for anything" argument. We live in two different universes.

I haven't turned it ino that, I see it as that - apart from the fault bit.

Nobody is at fault. The user didn't understand, the phone and email system isn't perfect, the IT staff made a mistake.

These things happen. It doesn't need government legislation, lawyers and compensation. Shit happens.

What do we do differently in future? We could try educating people about IT, but people don't care about IT. We could try legislation, but that costs time and money and makes life less pleasant.

We could try not getting upset when everything isn't perfect and ideal. That helps.

What makes you think the employee didn't get fair warning?

> Nobody is at fault.

?!

The corporate IT people screwed up and issued a data-loss command they apparently had neither reason nor authorisation to issue. Someone's personal property was completely wiped as a result.

We don't know how much valuable personal data was on that phone, but it could have held e-mails, photographs, etc. They could have been important, have great sentimental value, even have been evidence in a legal action (e.g., photos taken after a road accident).

In any case, this is clear cut negligence. The phone wipe might not have been deliberate, but the damage was done and it is absolutely clear who was at fault.

> What makes you think the employee didn't get fair warning?

Well, for one thing, this:

"It was my account, in my name [and] I'd paid all the bills," Stanton says. "It didn't make any sense to me that somehow work could get through AT&T, who I thought controlled my phone, and could completely disable the phone and the account."

Does that sound like the employee was properly informed to you?

We don't know how much valuable personal data was on that phone, but it could have held e-mails, photographs, etc. They could have been important

Then they should have a backup.

In any case, this is clear cut negligence

?! Unless you want a world where every employee's every mouse click is monitored by another employee and everything takes two people, three times as long and costs four times as much in auditing you have to accept that accidents are not the same as negligence.

Remote wipe is a web interface. Assuming the IT staff was supposed to wipe a different device, they either misread or misremembered the ID or misclicked (or were misinformed). One click.

If you put your life on the line where one click can destroy it and you have no backup, and you still connect your device to systems you don't understand, you're running a huge risk and no amount of legislation will ever help you.

Does that sound like the employee was properly informed to you?

It sounds like someone who doesn't know how something works. They could well be someone who had it explained, agreed, then forgot. Or wasn't listening, or didn't care. Lots of people do that. Like the executives in your other comment who sat through a security presentation and then moments later showed they hadn't understood it at all on a conference call.

> Then they should have a backup.

That would be the part where you turned mitigating the IT guy's screw-up into the victim's responsibility again.

> Assuming the IT staff was supposed to wipe a different device, they either misread or misremembered the ID or misclicked (or were misinformed). One click.

If you have a system that can do that much damage because of a single missed click, then it's not just negligence, it's gross negligence.

> If you put your life on the line where one click can destroy it and you have no backup, and you still connect your device to systems you don't understand

If you don't understand the system, how are you supposed to know that one click can do this? It's clear from the article that the victim in this case didn't understand that it was possible at all.

> They could well be someone who had it explained, agreed, then forgot.

Seriously? You think that an employee was told, clearly and unambiguously, that by connecting their phone up to work e-mail they ran the risk of having their entire phone wiped including all of their non-work-related stuff at any time just because someone missed a single mouse click over in IT, and they forgot this?

If the discussions about this article everywhere I read other than HN are at all representative, most employees given a clear explanation of this policy would have immediately turned around and told corporate IT to shove it, demanding a company phone to use instead of allowing their personal one anywhere near such a system.

That would be the part where you turned mitigating the IT guy's screw-up into the victim's responsibility again.

But I'm not. No matter what you do to the IT person, how much you sue him or her for, how hard you torture them, how much you hang draw and quarter them or put their head on a spike, or whatever, however much you take out your frustration on them you will not change the fact that your ultra important files are now gone.

The only way to change that is to take a backup.

I'm not interested in blaming the "victim" (accidents don't have victims, crimes have victims) and I'm not interested in punishing the person who made a mistake, assuming it was a genuine mistake.

I'm interested in making it not happen again, mitigating the consequences (for both parties), and doing so without ruining everyone elses life because one person was dumb and another careless.

If you don't understand the system, how are you supposed to know that one click can do this? It's clear from the article that the victim in this case didn't understand that it was possible at all.

If you hit your head hard enough, your frontal lobes can tear on the sharp bits inside your skull. If you don't understand this you can still drive a car. You can still make and sell cars. You can still walk over a cracked pavement or ride a bicycle.

Ignorance is only a defense in the sense that it gets people to feel sorry for you, ignorance does not make the universe undo the damage or help you compensate for the damage. Ignorance may be a defence, but it's still a stupid policy.

I don't understand what this change may do to my phone so I will take a backup -> good.

I don't understand what this change may do to my phone but I trust the government will have prohibited the employer from allowing it do anything I would consider bad -> bad.

Seriously? You think that an employee was told, clearly and unambiguously, that by connecting their phone up to work e-mail they ran the risk of having their entire phone wiped including all of their non-work-related stuff at any time just because someone missed a single mouse click over in IT, and they forgot this?

No more than they would be told that a single misclick of the accountant's mouse might lead to them not being paid that month, or that a single misclick of the HR's mouse might lead to them being marked deceased, or a single click of the HR's mouse might select the wrong file to upload and leak their SSN to the world.

It is not reasonable to inform everyone of everything which might go wrong. There is too much which might go wrong.

> No matter what you do to the IT person [...] you will not change the fact that your ultra important files are now gone. The only way to change that is to take a backup.

No, you could also not give the employer such a destructive power in the first place. Moreover, if you must give them that power, you could ensure that it cannot be invoked accidentally by a single person missing a single mouse click. You don't seem able to understand that not allowing the problem to arise in the first place would automatically avoid the negative consequences for all concerned.

You also seem to be latching onto something about government prohibiting actions, as if I'm advocating some sort of specific statute law to prevent this behaviour. The only thing I'm saying is that everyone should be responsible for their own actions and the consequences thereof, and that if someone through their carelessness harms another then the law should deal with the culprit accordingly. This is a basic principle of common law and common sense, I'm just applying it in context.

If I had a penny for every user that ignored important facts about IT I could retire.

We had a great IT security presentation at a medium-sized company I used to work for once, one of those annual "click through all the slides so we know you've read it" things that US companies seem to love.

As I understand it, the material was put together by an outside team of expert security consultants, who came in and audited the company's usual policies and the access requirements for people to do their jobs sensibly.

The executives watched the presentation and concluded that this was great, because now all of their staff would know not to leave CDs with sensitive data lying around on their desks when they went home.

The front-line grunts -- who were mostly geeks, this being a software company -- concluded that more than 98% of the recorded data leakage incidents in this 5,000 person company, and 100% of the serious ones, would have been prevented by (a) refusing to exempt senior/executive management from the corporate IT security policies that applied to all other staff and (b) requiring sales people only to use company laptops with the standard security software installed and maintained by corporate IT when going off-site.

(I'm pretty sure that I really am remembering the statistics here accurately, BTW. Listening to the executives on the conference call after watching the presentation was the kind of bang-head-on-wall moment you don't quickly forget.)