The person who wants the end result gets to agree to the other person's policies.
If your employer wants your device to have email then they get to agree to your policies about your phone. [Edit: except for the big point that this is impossible with current iPhones and Exchange servers].
If you want your phone to have access to your ecompany email then you get to agree to their policies.
I wonder if you'd feel the same way if, say, your identity was stolen because your home network was compromised by a zero-day exploit in whatever browser you are using to read Hacker News and a data-stealing worm sneaked in. I'm sure you're aware of the theoretical risk of that happening, and you chose to connect to the Internet anyway, so I guess you've accepted the consequences, and anything bad that happens will be your fault rather than the malicious attacker's.
My response: Oh shit, now I have to deal with identity theft.
Your response: Let's legislate to forbid providing internet browsers unless the browser provider and ISP can guarantee this can't possibly happen because it's not reasonable for me to audit their code. Let's legislate websites to forbid access unless they can guarantee this can't happen. How could they be allowed to let me on their website without forcing me to consult expert legal advice and have big neon sign warnings about what an accident on their website might do to my computer?!
And in this case, does it sound like the victim made an informed decision that she wanted this end result?
> My response: Oh shit, now I have to deal with identity theft.
I take it you've never actually been on the wrong side of this one, then. I don't believe anyone who has would be so cavalier about it. And yes, I have. It's one of the reasons I'm so adamant in discussions like this that (a) sensitive data must be properly protected, and (b) systems should not be designed so that they can seriously damage an individual without adequate safeguards.
> Your response:
Find perp. Do very unpleasant things to him. Ensure that victim does not suffer any more than necessary due to perp's actions.
1. If it is the employee's device, then everything belongs to the employee by default.
2. If the employer wants to allow access to certain company facilities or data using that device, then it is the employer's responsibility to ensure that such access complies with any necessary policies, without affecting anything that is none of the company's business.
3. If the employer can not or will not do this, then they should not provide the access in the first place.
4. They always have the option of providing suitable company hardware to the employee with whatever restrictions may be necessary to comply with their policies, at their own expense.
5. Arguments about how the company allowed but didn't require access, the employee consented, etc. are very weak here. Most employees would not be aware of the implications of such policies, and in many workplaces there is a fine line between what is required and what is not required (but if you don't do it we'll penalise/fire you). You're just leaving room for the employer (with its expert system administrators and retained lawyers and heavyweight HR leverage and much greater financial resources) to trample on the employee while wriggling out of any consequences.
> The best thing to do is:
> a) Have backups of your important stuff
> b) Have a mindset where you can accept things goind weirdly in systems you don't understand.
> c) Have a mindset that you accept the more technical and complex the systems involved in your life are, the more this sort of thing is going to happen.
I wonder if you'd feel the same way if, say, your identity was stolen because your home network was compromised by a zero-day exploit in whatever browser you are using to read Hacker News and a data-stealing worm sneaked in. I'm sure you're aware of the theoretical risk of that happening, and you chose to connect to the Internet anyway, so I guess you've accepted the consequences, and anything bad that happens will be your fault rather than the malicious attacker's.