That really can give you cause of action against a company?
In a similar matter what if I had all of that information on my personal phone, am I correct in assuming that it shouldn't give you the right to sue if that information were released. (As it assumes you either gave me that information, or it was obtained through you in some way)
And in the case of the email attachment, if you are sending radioactively sensitive customer data in any way through email isn't that the real problem and not that the phone could get out.
Regardless of whether it should or shouldn't happen, IT controls people have to assume it will. The contract for syncing with a corporate Exchange server, in many places, simply requires you to allow your phone to be wiped.
If you don't like it, don't sync with your company's Exchange server. What's so hard about that?
The problem that the posts points out is that there's no warning about this "contract" whatsoever. No matter what mobile device I've ever used, I have never, ever had a dialog tell me that by syncing my phone with an Exchange server I'm letting my company's IT department hold my personal information by the balls.
Additionally, we're talking about a lack of separation between two entities' data (personal & company-owned data).
If I had a user access clause for my website, "by accessing content on this website I am granted full access to indiscriminately wipe any and all data on your device, belonging to me or not" and was given the capability to do it - that would be ludicrous. The only difference I see is that I'm not in an employer relationship with my users. Even still, an employer-employee relationship with a company does not grant them the right to delete any and all data on any device of mine.
Also, since we're in HN (startup city, what?) who has ever worked for a startup that DISCOURAGED working from home on a personal laptop or having access to email 24x7? I've certainly never worked for one.
If I drank enough rye to kill the requisite number of brain cells required for me to allow people to sync their personal gear with our IT, I'd definitely tell people "we will be nuking your gear from orbit periodically as a precautionary measure".
Yes, but this lack of separation is caused by the employee choosing to sync their work email with their personal device.
Unless the employer requires this, then it's entirely the employees fault.
But the post wrongly blames Microsoft and Exchange, when it's the person's workplace he should be blaming for supposedly not having clear enough policies.
The policy where I work is: linux laptop (I imagine BSD might also be ok), access to code is via sshfs (or TRAMP) only. I don't think this is that unusual.
(Nobody at my office should have more than "P. McKenzie" and my phone number saved on their phone. Including full name, email address, a photo, my address, and the like would give me a cause of action against the company if the phone was ever lost or if that information were misused.)
A smart device capable of downloading an email attachment could cause a multi-million dollar incident if it was lost. All it would take is a bug tracking system report with an attached file showing e.g. the wrong number of lines printed per page of radioactively sensitive customer data.