For example we needed to program an Arduino-type board, but that's not possible with our work laptops (no admin rights, USB ports disabled, etc); we never found a solution other than a personal laptop. Or a colleague needed to run a supplier's simulation tool that needed admin rights, and couldn't get an exception fast enough. Or you need to run a Linux tool.
This is not very persuasive. What you really have there is two work laptops.
My personal laptop comes everywhere with me. Doesn't yours?
Also, corporate has given itself the right to search any and all devices on me while at work, so that's double incentive to leave the home laptop at home.
I've had to check an account while at work to deal with my kid attempting to pay college tuition with one of my credit cards. Also looked up records so he could call the DMV to rectify something. Yeah, sometimes they're things that can wait a day, but a break from bug hunting can be nice.
I carry three. One is from work, the other is from a different department in that same work. They both insist I have a particular type of phone running particular software. But work never calls me on those phones. They always call my personal phone.
People view and use their phone as an extension to their body. I don't think it's possible to change that.
It's isolated from my phone, my employer can't see anything outside the profile and I just disable it on weekends/vacations.
It's not a big deal... until it is. Like when your boss/coworker gets involved in a work dispute and you get dragged into a deposition.
iOS doesn't allow that however - there the Apple will give everything over to employer if they so ask.
A deposition about a work related issue may ask to see all devices that you use in connection with your employer. So yes, a deposition will care when you say you didn't use your personal phone for work if you can prove it by it not being on any device list found with work-related services.
A device list can be obtained (usually easily, sometimes with a court order) through many services you use. G Suite, Github, Microsoft Account, Slack, Reddit, etc... these all track what devices have logged into them with your account. Signal and Telegram have your phone number. And of course any email sent has a list of addresses to which it was sent. So make sure your personal devices aren't found to be communicating with coworkers or vendors and you'll have a valid argument for "I didn't use my personal device for work".
Whether it will stick will largely depend on how good the lawyers are because that's just one way your device can be in scope for a deposition. Another way would be if any messages from coworkers are sent to/from your personal email or phone number then that can also bring your devices into the scope of a deposition. It might depend on whether the content or context of the messages suggests that they're related to the subject of the deposition and that the conversation had been moved (eg, an attempt to hide it). Again, it largely depends on the quality of the lawyers involved.
They need you to hand it over. If its your personal device, you just say piss off, no you can't have it.
That's not how a subpoena works if it's on the same physical device. Good luck finding a judge who understands the concept of a "software wall."
That's a tall order.
Also, the title says that GOOGLE spied on someone - which is not a deposition, is it?
This is assuming you aren't in a "hand over all electronic devices" kind of situation.
Yes.
Source: Been subpoenaed three times and my attorneys have had restrictions placed on what can/cannot be searched... like I am assuming most competent attorneys can provide. The party has to have reasonable indication that relevant data is on personal devices so the opposing counsel doesn't go goldfishing through a bunch of stuff to turn up potentially unrelated dirt in discovery.
Also, you can’t just not respond to a deposition or refuse to hand over your phone as evidence in a crime. That’s obstruction of justice and possibly contempt of court.
Basically, you can sit there for hours on end explaining that it’s impossible to break the “wall”, but that’s time and time in money in the court system (literally), or you can just fork over the phone because it’s not your personal one.
The primary reason for this would be against thieves, but it would work against courts as well, and the user wouldn't have a choice.
People here are choosing to make things harder for themselves by coming up with ideas to skirt the law, but it doesn’t work and will only make the police go harder on you. The law (and precedent) is not on your side in this battle.
Destruction when handing to a mugger is still ok.
Judge: "Hand over that phone right now"
You: "Sure, I can hand it over, but all data will then get wiped by the device automatically due to Google/Apple/Samsung's anti-theft design and I don't have a choice"
After that it's upto the Judge whether to proceed with the handover or not. It will be the judge who destroyed the data if so.
The primary motive of that design would be against thieves, but it would incidentally happen to work on judges as well. The owners of the phones would have no choice.
Yes, they could do that, and of course, in that case, my eyes would be on it and they would only be able to ask for things pertinent to the case, which likely means all corporate accounts, not dig through personal accounts.
Them being unable to take the actual device means that they'd have to play by the rules.
That idea extended to civil procedure and phones is that the discovery process for a civil case would be for things related to the lawsuit of which your personal phone might not be. They could certainly request it, but a good lawyer would argue that your personal phone has no connection to the work phone (of which the lawsuit is about) as evidenced by the fact that you have two phones (you intend to separate the two matters). Separate profiles on the same computer (phone) would be harder to argue.
It’s not a clear cut matter and would certainly depend on how the judge is feeling, but if there’s a possibility of keeping your personal and work life separate, why not do so? Don’t put all your eggs (data) in one basket (phone) and the like.
Which is likely legally allowed for a deposition.
> They need you to hand it over. If its your personal device, you just say piss off, no you can't have it.
Telling the courts/lawyers to piss off is not a viable option. That's not how depositions work. You might be able to get a lawyer to file legal motions with expert testimony attached pointing out they shouldn't need access to the whole phone for the reasons you said, but 99% of people will not bother getting a lawyer for something like this.
No, that is now how subpoenas and depositions work. I've been involved in a few. The judge needs a specific reason to approve inclusion of your personal device: like a record of information having been sent to it specifically or being used in a context relevant to the case at hand. And the information request will have to be specific to the case at hand, so you can just return with "There is no information on those devices relevant to the subpoena parameters" (said under oath).
If they demand your personal device anyway, because the subpoena is too broad or something, you can fight it with the judge and argue why it shouldn't be included.
If you never, ever mix personal and work then you should have no difficulty getting your personal devices excluded from a work related inquiry.
Regular MDM used to do that (just as Android used to do that), but Apple has been working on the same "wall" to separate work and personal info.
https://www.apple.com/business/docs/resources/Managing_Devic...
I certainly know of people who have suggested and gotten changes to agreements like this. But you need to be professional about it.
"Poor culture fit".
It's like asking what the best way to write a lisp in INTERCAL would be. The best way is to not do it.
A lot more things are open to negotiation than some people imagine. Even including buying a fridge at your local chain store or similar. Not every time, and not to everyone who merely says "I want".
But who would pay $3K for a contract review??
Special cases are special. But most cases are not special.
Sometimes businesses literally put some services on different physical boxes in case a court sees fit to collect the entire machine. If you had a bunch of other VMs on it... shrug.
Something like a fingerprint scanner that needs to be scanned at least once every 24 hours or all data gets erased.
You: "Sure, I can hand it over, but all data will then get wiped by the device automatically due to Google/Apple/Samsung's anti-theft hardware design and I don't have a choice in the software settings to disable that"
After that it's upto the Judge whether to proceed with the handover or not.
At this point, if the judge proceeds with the handover, it will be the judge who destroyed evidence.
Even if you wiped the data, if the government wants to seize your crud, they're still gonna take it.
Imagine a hypothetical phone that is covered in fingerprint sensors where if it senses foreign hands touching it, it auto-deletes everything. That might not be the most feasible hardware implementation but I'm sure we can think of something to that effect.
You want to automate the destruction of evidence? I understand thats typically treated as confirming whatever is the most damaging possibility.
I walk around with two phones now, one for work and my personal one.
Its foolish to think they wouldn't use it.
I usually have four phones: Work, Personal, Personal (other country sim), emergency backup (in a buddy pouch, powered off).
I technically carry 4 phones...
If you require rootkits then the work phone is now a desk phone.
The spy activities described in the article is not about actual personal activities on the phone. One is looking at other's corp calendar, which can only be done inside corp profile (you need your corp account to be able to look at other's calendar); The other is making changes on the corp proxy type of thing, which obviously also can only be done with corp account.
Wait until your personal phone, with its work profile, comes into scope of a work-related deposition.
You'll find just how paper thin that argument is.
Arguably. I don't see it as such though. I see it as: if my phone would be fine in a deposition then I don't have to worry about work spying on their device. But if I have to worry about what work might find out on a device then I'd be a lot more worried about what might show up in a deposition.
What's said in private is supposed to stay private. It helps to demonstrate that it has stayed private if it can't be compelled especially from unrelated circumstances. Whether "private" means discussions with your family, your friends, your coworker, your boss, your commander, your patient, your client...
...it's very important to keep work separate.
They will, and you won't. (I've been there.)
No, they'll want to see the communication. Which the company will be compelled to provide. The device isn't relevant. (In my, admittedly limited, experience, this is how these processes actually work)
No, this isn't correct. If opposing counsel has evidence[0] that the personal devices have relevant communications not already provided, they can file for a subpoena to have you turn over personal electronic devices. Your counsel can file a counter-motion, and you'll probably have a hearing.
No where will there be a warrant, unless you're in criminal proceedings.
Like I said already: as far as I know, litigation holds and discovery are fairly common, and what you're describing is not. To clarify, this is all assuming you use a work profile and a personal profile.
[0]: I don't necessarily mean evidence in the legal standard, but they need some basis for this. "A feeling" isn't enough.
I used to keep work email and calendar on my personal phone. A few years later, I disabled the email because it distracted from life. I leave the calendar simply to let me know when I have an early meeting (my day normally begins at 9, but work with teams in India, so occasionally have earlier meetings).
Anyways, that is just backstory to say, getting rid of my phone was the best thing I ever did, I have a burner with a few hundred minutes on it, in my truck for emergencies but I honestly never use it.
A good deal of people could actually untethered themselves from their phone dependency and actually find out that they enjoy it a lot more than being leashed to one.
I've set up my email client on my phone, so that it only notifies me if one of my developers emails me. I use the VIP feature of Samsung's email client, which seems to be unique to that specific client, since I haven't been able to find another with it. I can check the email (if I can), and decide to answer right away (if I can), or just snooze the notification for later.
Everyone else can KMA after hours. Or text, if it's an emergency - but they better say what the emergency is in the text, or they may not get a reply.
Maybe not quite as simple to set up, but you should be able to get something similar on most clients with a folder and a filter. I've done this for some of my important/urgent folders, with K9-Mail set to only show notifications from those folders (notification class).
Now that work from home is a thing, I also like having an standard way to communicate with work and be at least partially productive in case my laptop dies. I have my Do Not Disturb settings set so that the work profile doesn't show me email or chat settings outside of work hours on weekdays so I can start email triage during my morning bowel movement if I want, but it won't nag me if I'd rather spend that time in quiet contemplation.
Then you're required to sign a document acknowledging that when you leave the company they will remotely wipe your phone, including all of your personal apps, documents, photos, etc.
Mixing personal and work hardware is never a good idea.
I run into coworkers who then decide to use the company phone as their only phone, because the company phone is usually the top of the line iPhone or Samsung Galaxy replaced every 2 years when their personal phone otherwise is some mid range Android or 2+ year old iPhone.
Even when pointed out that the company can wipe it when they leave or even if they just suspect its been compromised, they don't seem to care. I just don't get it.
Maybe their lives are just not tethered to their phones. I use my phone for phone calls, texting, and maps/navigation. That's about it. It would be a bit inconvenient to lose my contact list without warning, but I export those periodically in case I lose my phone.
If someone intends to leave, they can first revoke the company's access to their phone.
If the company has the software installed to remote wipe a phone, they have the software to stop you from locking them out.
This also goes for company-issued computers. I've run into more than a couple people that learned the hard way that they were being monitored through company equipment.
We need "permissions" for employment, a standardized listing of privileges you give up when you sign your employment contract. If your employer breaches this, you get a fat payout courtesy the NLRB. You could say, "Sounds like you should just read your employment contract," and I would reply, "Sure, and I guess we don't really need Miranda rights either."
2) This is why I only ever sign into Slack on my phone, not my work email. It neatly compartmentalizes work stuff, and isn't subject to the device-wide security policies that you sometimes have to agree to when signing into company email.
I will always want separate phones for employers that want to use MDM on the device, or else I just won't do any work on the phone... which unfortunately in some companies is looked down on. Glad I'm in a better environment these days (mdm exists on the sly, but I am not pressured to use email outside work hours) That said, this is also why I don't want to shift into the management path either, because that changes once you are in mgmt.
Use Swappa or similar. Used phones are not that expensive. And you can just Hotspot from your personal phone, you don't need data for it.
YMMV, but that worked well for me.
https://resources.infosecinstitute.com/topic/xhelper-malware...
Unless the factory image and firmware are completely immutable they can be infected. There have been other non phone malware that can survive on certain chips on computer motherboards which would exist independently of both RAM and hard disks. Even GPUs can be infected if they have memory that does not clear when the capacitors discharge.
https://arstechnica.com/information-technology/2020/11/intel...
xhelper certainly won't survive a full reimage, which is an actual "factory reset" and only available to those with fully unlocked phones such as some of the Mediatek-based ones. That's done by holding down a button while plugging into USB with the battery disconnected, which causes it to go into BootROM mode (and this is really a ROM). Then SPFlashTool can be used to erase and rewrite the entire internal eMMC.
http://networkingathome.blogspot.com/2017/04/restoring-mtk-b...
Completely aside from denying observability to shitbag panty-sniffers like Google HR, it is important to me to be able to wipe that phone when I leave to know there is no remaining access/sensitive info/etc. while also not wiping anything important to me.
Same reason I keep personal stuff off my work laptop and vice/versa.
Also, never use employer-supplied computers for personal stuff, and don't login to your personal accounts with it. If you work at Google you can afford a laptop that you truly own.
Patently false, for many values of ‘everything’ and ‘phone’.
An MDM has zero visibility into an iPhone’s browsing history, iMessage content, or the content of any app not installed directly by the MDM. So things like Signal, WhatsApp, and even the default mail app are off limits.
Some MDM profiles can have pretty nasty access enabled (e.g. route all IP traffic via Corp net, access device location at all times, remote wipe etc).
Take a look at what your MDM profile says if you have one installed.
Old smartphones are cheap these days
You're absolutely correct- any device that work expects you to do work on, should be bought and paid for by them.
(And I'm sorry, but "profiles" do not cut the mustard.)
Android is very specific about company-owned vs personally-owned phones. Personally-owned lets you setup devices with a work profile where very little non-work data is available to the employer. They don't know your personal apps, they dont know your IP address, and they dont know where these apps go (ie no personal network logs). They have no access to these either.
Even for company-owned devices (which require a specific setup, if you bring in your own device that means factory reset and things like hitting 7x the white screen on the first new setup page), the mobile device management api doesn't give you all that much. There's no remote access/rootkit, you can't see private messages (they can see messages you send over a work chat app they own, so if its google hangout chat f.e., by looking at the hangout service itself)
Here are the different modes: https://developers.google.com/android/work/terminology and you can follow the API links to see what they do if you want to verify what I just wrote.
But I agree that if they were talking about the "Android" feature, an employer could choose not to go that route.
I definitely had my personal account as the primary on my N5 along with a work profile and I believe that's the first device/OS combo where it was feasible, if you ignored the annoying duplicate app icons in the launcher. The first truly "tolerated" personal devices were probably the Christmas gift Chromebooks from a few years earlier, as long as you used Yubikeys.
Didn't the policies even predate Android? They definitely were there well before Lollipop. Unless they were introduced post-Aurora, in 2010 — i.e. in the N1/Eclair days, keeping the phone vintage theme.
* Employer says "hey, we have all these convenient corporate app, wouldn't it be nice to be able to check work messages and work docs on your mobile? Just install our app to "corp-ify" your phone"
* Employer now views your mobile device as containing sensitive company IP and therefore they have the right to snoop on anything on your phone.
If you install corp on your phone, Google views it as a right to rootkit your phone, view all your private messages, etc. I learned this the hard way. Whether this is ethical, or legal, I don't know, but it's one of those things that seem obvious to some and not obvious to others.
If your employer expects you to use a mobile device at work, have them pay for your phone and only use it for work purposes, assume that HR can view EVERYTHING on your phone, because they can, especially at a company like Google that has both deep mobile expertise and insane paranoia around things like IP protection and stopping whistleblowers.