Imagine you are in your car using the GPS app on your smartphone to navigate through a city you’ve never been. All of a sudden your phone just shuts off. Without any error message or warning your phone goes black. When you power it back on, everything is gone: your contacts, photos, even the ability to make calls has be erased.
This so-called “remote wipe” is exactly what happened to Amanda Stanton’s iPhone while on a business trip. When she got home, she learned that it was her employer that accidentally sent out the smartphone-sabotaging command via e-mail. This eradication is something that can potentially happen with company-issued smartphones and other devices.
But this wasn’t a company-issued phone; this was Stanton’s personal phone for which she was the one paying the bills.
“It was my account, in my name [and] I’d paid all the bills,” Stanton says. “It didn’t make any sense to me that somehow work could get through AT&T, who I thought controlled my phone, and could completely disable the phone and the account.”
After digging deeper into how it was possible that her company had wiped all the information off her personal phone, Stanton found that it was her work e-mail that was responsible.
Most smartphones come loaded with Microsoft software, making it possible to execute remote commands like erasing the phone’s memory and turning off functions like Bluetooth, the Web browser and even the phone’s camera. This command is created so that phone data can be erased in case the phone is lost, so that companies can manage how employees use their company-issued phones.
But by taking a personal smartphone and syncing it with a company e-mail, it allows the company to send remote commands to the phone as if it were company-issued. As shocking and unheard of as this sounds, this isn’t a new concept, and is something most companies already know of.
Anthony Davis, who runs an IT department for a manufacturing company in Seattle, says he makes a point of letting people know that when they opt to get company e-mail on their personal phones, they’re signing up for more than just e-mail.
“We actually have a one-page waiver that says, you know, if you’re going to connect your personal phone to the corporate e-mail system, that we do have the capabilities if the phone is lost to remote wipe it – and we will – and then have the employee agree [to] and sign that form,” Davis says.
Most companies, however, aren’t as transparent about what control employees are giving up when they sync their phones with work e-mail. Lewis Maltby, president of the National Workrights Institute, says he’s not sure what a court would say about a company that wipes an employee’s phone without permission; but he says he’d like to find out:
“I’m salivating right now at the prospect of this lawsuit.”
As for Stanton, it is unclear if she is going to try to take her case to court. But one thing is for sure: she won’t be syncing any work e-mail accounts to her personal smartphone anytime soon.