Comment by jodrellblank | Hacker News Reader

Comment by jodrellblank | Hacker News Reader

Parent Full thread

Nonsense. There is absolutely nothing diligent about having an ability to wipe someone's personal data that has no connection to your business, under any circumstances.

There is no clear cut destinction, on an iPhone. It's not about dilligence, but practicality - there is no other way to wipe an iPhone but "completely" or "not at all".

Firstly, this is a complete straw man: protecting company secrets from the company mail server does not in any way require deletion of personal data on a personal phone.

The phone does not make that distinction. It is not possible to remotely wipe half an iPhone.

Basically, your entire counter-argument is a non-argument. Nothing you have said in any way justifies a company having the power to interfere with your personal data

There is no distinction on an iPhone. It does not make a distinction. Personal data is not kept separately. Company data is not kept separately. There are no divisors. There is no restriction. No sandboxing, no virtual machines. The distinction you keep making between "personal data" and "company data" is in your mind not in the iPhone data store. The iPhone data store is binary data stored in a nonsentient device which has no person itself and no understanding of personhood. There is no distinction between personal and company data in iOS. Email on an iPhone is just another app which does not distinguish personal from company messages. Your personal inbox and your exchange inbox can be merged into one unified inbox on an iPhone because an iPhone does not make a distinction between personal and work data. You can have a personal Exchange email account.

> It's not about dilligence, but practicality - there is no other way to wipe an iPhone but "completely" or "not at all".

Not being able to do something properly is not an excuse for doing it badly and causing serious damage to someone as a result.

In this case, if an employer cannot (a) allow an employee iPhone to connect to their mail store and (b) secure their own data appropriately without also (c) compromising the employee's, then they should not permit that access in the first place. They should provide the employee with a dedicated device, at company expense, over which the company can have whatever control it requires.

That sounds like it makes life better for everybody. People who would rather use iPhones for corp mail than 3-year-old Blackberries, and who accept that the tradeoff for using them is potential "nuke from orbit", can't... so you can avoid having to think about whether to give your IT department that power. Everybody wins!

It is obvious from the fact that we are discussing the original article at all that this issue is more complicated than you make out.

I already addressed the underlying issue you raise in my original reply; it was point #1. Perhaps you would care to further the debate by replying there, instead of resorting to sarcasm and mockery?

Not being able to do something properly is not an excuse for doing it badly

Yes it really is. I'm not a builder but if I had to shelter from weather I would make a shelter. And my excuse for it being a low quality shelter is that I can't make a perfect one. And that would be better than nothing because at least I wouldn't die. Your idealism is idealistic but not helpful.

If iPhones couldn't read company email they wouldn't be as useful or as popular. If they could do so, but only by enforcing a horrible dual-personality where you had to manually switch between contexts they wouldn't sell as well or be as popular or useful. If they share data they are easier to use and more popular but not as easy to secure.

You say "not being able to do something properly" without addressing the fact that there is no accepted "proper" way to do it. They didn't ignore the proper way because they were lazy or stupid. Exchange email started on Windows Mobile devices for office use. That it has spread to consumer phones means the assumptions under which it was designed no longer hold.

and causing serious damage to someone as a result.

1) As far as we are told, no damage at all happened to her, she didn't even get lost after losing her navigation system.

2) We don't know that /serious/ damage happened to her.

3) The more serious the potential damage, the more important it was for her to have a backup of her important data and a backup of her important systems. There's no getting around this tradeoff.

4) The more serious the potential damage, the more important it is for her to understand what she is doing when making changes to her device and not blankly follow instructions to hook it up to things willy nilly.

Your second paragraph is a "person should be protected from all harm they don't understand by an all seeing overlord" argument, and it falls down where anyone else wants to do anything else or accept a different risk profile than uninformed easily panicked J. Bloggs.

>> Not being able to do something properly is not an excuse for doing it badly

> Yes it really is.

I don't really know what I can say to this post. You have somehow turned this whole incident into the victim's fault, mitigating the consequences of the company IT staff's mistake into the victim's responsibility, and my argument that it is not reasonable for an employer to introduce such a drastic facility to destroy an employee's personal property without giving the employee fair warning into some unbounded "no-one should be responsible for anything" argument. We live in two different universes.

I haven't turned it ino that, I see it as that - apart from the fault bit.

Nobody is at fault. The user didn't understand, the phone and email system isn't perfect, the IT staff made a mistake.

These things happen. It doesn't need government legislation, lawyers and compensation. Shit happens.

What do we do differently in future? We could try educating people about IT, but people don't care about IT. We could try legislation, but that costs time and money and makes life less pleasant.

We could try not getting upset when everything isn't perfect and ideal. That helps.

What makes you think the employee didn't get fair warning?

> Nobody is at fault.

?!

The corporate IT people screwed up and issued a data-loss command they apparently had neither reason nor authorisation to issue. Someone's personal property was completely wiped as a result.

We don't know how much valuable personal data was on that phone, but it could have held e-mails, photographs, etc. They could have been important, have great sentimental value, even have been evidence in a legal action (e.g., photos taken after a road accident).

In any case, this is clear cut negligence. The phone wipe might not have been deliberate, but the damage was done and it is absolutely clear who was at fault.

> What makes you think the employee didn't get fair warning?

Well, for one thing, this:

"It was my account, in my name [and] I'd paid all the bills," Stanton says. "It didn't make any sense to me that somehow work could get through AT&T, who I thought controlled my phone, and could completely disable the phone and the account."

Does that sound like the employee was properly informed to you?

We don't know how much valuable personal data was on that phone, but it could have held e-mails, photographs, etc. They could have been important

Then they should have a backup.

In any case, this is clear cut negligence

?! Unless you want a world where every employee's every mouse click is monitored by another employee and everything takes two people, three times as long and costs four times as much in auditing you have to accept that accidents are not the same as negligence.

Remote wipe is a web interface. Assuming the IT staff was supposed to wipe a different device, they either misread or misremembered the ID or misclicked (or were misinformed). One click.

If you put your life on the line where one click can destroy it and you have no backup, and you still connect your device to systems you don't understand, you're running a huge risk and no amount of legislation will ever help you.

Does that sound like the employee was properly informed to you?

It sounds like someone who doesn't know how something works. They could well be someone who had it explained, agreed, then forgot. Or wasn't listening, or didn't care. Lots of people do that. Like the executives in your other comment who sat through a security presentation and then moments later showed they hadn't understood it at all on a conference call.

> Then they should have a backup.

That would be the part where you turned mitigating the IT guy's screw-up into the victim's responsibility again.

> Assuming the IT staff was supposed to wipe a different device, they either misread or misremembered the ID or misclicked (or were misinformed). One click.

If you have a system that can do that much damage because of a single missed click, then it's not just negligence, it's gross negligence.

> If you put your life on the line where one click can destroy it and you have no backup, and you still connect your device to systems you don't understand

If you don't understand the system, how are you supposed to know that one click can do this? It's clear from the article that the victim in this case didn't understand that it was possible at all.

> They could well be someone who had it explained, agreed, then forgot.

Seriously? You think that an employee was told, clearly and unambiguously, that by connecting their phone up to work e-mail they ran the risk of having their entire phone wiped including all of their non-work-related stuff at any time just because someone missed a single mouse click over in IT, and they forgot this?

If the discussions about this article everywhere I read other than HN are at all representative, most employees given a clear explanation of this policy would have immediately turned around and told corporate IT to shove it, demanding a company phone to use instead of allowing their personal one anywhere near such a system.

That would be the part where you turned mitigating the IT guy's screw-up into the victim's responsibility again.

But I'm not. No matter what you do to the IT person, how much you sue him or her for, how hard you torture them, how much you hang draw and quarter them or put their head on a spike, or whatever, however much you take out your frustration on them you will not change the fact that your ultra important files are now gone.

The only way to change that is to take a backup.

I'm not interested in blaming the "victim" (accidents don't have victims, crimes have victims) and I'm not interested in punishing the person who made a mistake, assuming it was a genuine mistake.

I'm interested in making it not happen again, mitigating the consequences (for both parties), and doing so without ruining everyone elses life because one person was dumb and another careless.

If you don't understand the system, how are you supposed to know that one click can do this? It's clear from the article that the victim in this case didn't understand that it was possible at all.

If you hit your head hard enough, your frontal lobes can tear on the sharp bits inside your skull. If you don't understand this you can still drive a car. You can still make and sell cars. You can still walk over a cracked pavement or ride a bicycle.

Ignorance is only a defense in the sense that it gets people to feel sorry for you, ignorance does not make the universe undo the damage or help you compensate for the damage. Ignorance may be a defence, but it's still a stupid policy.

I don't understand what this change may do to my phone so I will take a backup -> good.

I don't understand what this change may do to my phone but I trust the government will have prohibited the employer from allowing it do anything I would consider bad -> bad.

Seriously? You think that an employee was told, clearly and unambiguously, that by connecting their phone up to work e-mail they ran the risk of having their entire phone wiped including all of their non-work-related stuff at any time just because someone missed a single mouse click over in IT, and they forgot this?

No more than they would be told that a single misclick of the accountant's mouse might lead to them not being paid that month, or that a single misclick of the HR's mouse might lead to them being marked deceased, or a single click of the HR's mouse might select the wrong file to upload and leak their SSN to the world.

It is not reasonable to inform everyone of everything which might go wrong. There is too much which might go wrong.

> No matter what you do to the IT person [...] you will not change the fact that your ultra important files are now gone. The only way to change that is to take a backup.

No, you could also not give the employer such a destructive power in the first place. Moreover, if you must give them that power, you could ensure that it cannot be invoked accidentally by a single person missing a single mouse click. You don't seem able to understand that not allowing the problem to arise in the first place would automatically avoid the negative consequences for all concerned.

You also seem to be latching onto something about government prohibiting actions, as if I'm advocating some sort of specific statute law to prevent this behaviour. The only thing I'm saying is that everyone should be responsible for their own actions and the consequences thereof, and that if someone through their carelessness harms another then the law should deal with the culprit accordingly. This is a basic principle of common law and common sense, I'm just applying it in context.

If I had a penny for every user that ignored important facts about IT I could retire.

We had a great IT security presentation at a medium-sized company I used to work for once, one of those annual "click through all the slides so we know you've read it" things that US companies seem to love.

As I understand it, the material was put together by an outside team of expert security consultants, who came in and audited the company's usual policies and the access requirements for people to do their jobs sensibly.

The executives watched the presentation and concluded that this was great, because now all of their staff would know not to leave CDs with sensitive data lying around on their desks when they went home.

The front-line grunts -- who were mostly geeks, this being a software company -- concluded that more than 98% of the recorded data leakage incidents in this 5,000 person company, and 100% of the serious ones, would have been prevented by (a) refusing to exempt senior/executive management from the corporate IT security policies that applied to all other staff and (b) requiring sales people only to use company laptops with the standard security software installed and maintained by corporate IT when going off-site.

(I'm pretty sure that I really am remembering the statistics here accurately, BTW. Listening to the executives on the conference call after watching the presentation was the kind of bang-head-on-wall moment you don't quickly forget.)

Reply on news.ycombinator.com