What's interesting is this: the ability to hook up a phone via ActiveSync (the protocol in question) can be configured per account. If IT did not want him to hook up his phone, they should have not given him those rights. Wiping devices like this is a bad idea.
But don't blame the feature.
(full disclosure: I work on the MS Exchange team)
The problem is, there is no way a user will expect that they are giving away that privilege merely by adding an Exchange account to their personal phone. This is a gaping security hole in the mobile client software and it's entirely the fault of the phone developers. Just giving the server the name of my device without telling me is a breach, as far as I'm concerned.
It's not about data ownership, it's about access. Your data being on a device does not authorize you to access that device.
In fact, I'd personally recommend employees not link their phones. Work isn't so important it should be always on.
Remote wipe is there for a good (regulatory) reason.
Would you be happy with just an email wipe, if that option were available?
In most cases there is more than just email, and the line between exchange and personal blurs. How do you remove the exchange data from a contact originating from exchange but updated with Facebook data? What about company restricted WiFi passwords? Attachments saved outside of the mail program?
It's complicated, and when properly used: a last resort.
Edit since I can't reply below: Linking with activesync is optional. The policies are part of the bargain. Your examples either weren't optional (RIAA) or were things you'd choose not to do (EA).
For the first scenario, I see no problem at all with remote wipe, but I do have a problem with the assumption that deliberate destruction of personal data is acceptable, for any reason. What if an employee had some paperwork at home? Would you condone burning their house to destroy it? Is a car bomb appropriate to destroy a briefcase left in a car?
What right does anyone have to destroy other people's property in the course of protecting their own? Would you support game manufacturers like EA being able to remote wipe your computer if they suspected you of running a pirate copy of a game? The RIAA if they suspect you of torrenting?
When you find the example of the company that requires you to purchase a personal phone and sync it with their corporate mail server, you be sure and let us know. Until then, by all means, scream from the rooftops that this feature exists... but don't pretend there's no valid reason for it.
Orrin Hatch: http://news.bbc.co.uk/2/hi/2999780.stm.
but don't pretend there's no valid reason for it.
If my house has been broken into before, there's a "valid reason" for me to install a tripwire that automatically fires a shotgun blast at the intruder. That won't go over well in court, and neither should this.
Joining your personal phone to exchange is much like joining your personal computer to the corporate domain. You don't do it unless you want corporate IT to administer it and corporate policy allows it.
Edit: I sympathize with people who lost data, and do agree that the phone should warn you before completing the join. That said, as a business owner, I only allow exchange (and not POP or IMAP) for exactly this reason. I need to be able to wipe the company data if a phone is lost, or someone is fired (and not cooperative), etc. The real world isn't always nice.
Also, the full device wipe is by design, and the feature is called "Remote Device Wipe." The details can be found here:
http://technet.microsoft.com/en-us/library/bb124591.aspx
Note that the storage card is also wiped (where attachments and other sensitive data may be saved).