Who should own your smartphones?

IT organisations are loosening smartphone policies, allowing employees to bring in personal iPhones and BlackBerrys - should you?

By Galen Gruman, San Francisco | Thursday, 25 March 2010
Surprise: You probably can't control as much as you may want
Further complicating this issue are the legal ramifications of dual-use devices.

The laws on what employers can do with employees' personal equipment and accounts haven't caught up to today's mix of devices and cloud services, notes Peter Vogel, an attorney at Gardere Wynne Sewell who specializes in Internet, computer, and e-discovery issues. There are plenty of misunderstandings as to what a business can and can't control.

Despite the legal ambiguity from conflicting court decisions and the lack of precedent in many areas, patterns have developed in cases involving home PCs and other personal technology that may influence your smartphone ownership strategy.

For example, corporate email belongs to the company, and the company has full access to it, no matter where the employee accesses it. Plus, the company can set policies for what is transmitted through corporate email.

"But email issues are complicated by employees who use Webmail services such as Gmail, AOL, and Hotmail to conduct company business. Many courts have ruled that employers lose confidentially and potentially valuable trade secrets when employees send confidential information via Webmail," Vogel says. That reasoning could easily be applied to the use of personal smartphones.

International issues also pop up, Vogel notes: "Generally in the U.S. emails are private to employers, while in the E.U., Canada, and Japan emails are private to employees. Furthermore, in the E.U. there are data privacy laws for individuals called the 1995 Data Directive that permits citizens of the E.U. to access any computer that contains data about them and change that data. The U.S. has nothing like this at all, and when there is communications between the E.U. and U.S., determining which law applies gets very complicated."
In a 2008 case, a federal court ruled that text messages on police department-paid pagers belonged to the police officers, not the police department, because the messages were stored by a carrier. The department wanted the messages to see which were personal so that they could calculate how much the officers owed the department for personal use. Vogel says this case was decided on very narrow grounds -- the fact that the messages were stored at the carrier, which is subject to different laws than a company that stores its own records -- but nonetheless raises the kind of ambiguity sure to surface as smartphones are used increasingly for both personal and corporate activities.
You might try to deal with these and other issues through employment agreements, Vogel suggests.

"Generally employees are bound to the terms of employment agreements," he explains. "So if the employment agreement states that the employees provide their own PDAs or smartphones but the employer pays a monthly allowance, one would have to look at the terms of the employment agreement to see if the employee is entitled to privacy."

But "generally just having a corporate policy is not enough without some affirmation of the employees to agree," Vogel notes. "Companies run the risk that courts will conclude that even though corporate policies are in place, they are either unenforced or selectively enforced. As a result, without rigid enforcement, a company cannot depend on the courts to adopt these corporate policies regarding who owns emails and text messages and who is entitled to privacy."

Another issue: What information on these devices is discoverable in a court case?

"Every state is wrestling with this," says Telwares' Voellinger. "Pennsylvania, for example, assumes that the moment information goes out onto public networks, it's discoverable." That could cover anything delivered through the Internet, for example, which smartphones and PCs use routinely.

The practical issues of personal smartphone use
Beyond the law are practical considerations: If an employee uses a personal smartphone for business purposes and then leaves the company, customers and partners can still contact that former employee -- and may not know how to contact his or her replacement. If the company issues the smartphone, the phone number can be moved to another employee, Voellinger notes. But this risk is not that new nor is it smartphone-specific.

Moreover, although BlackBerrys, Windows Mobile devices, iPhones, and Palm Pres support remote-wipe capabilities, there's a risk that an employee-owned device could still retain corporate data when the employee leaves, Voellinger says. The risk here can be largely managed by requiring employees to use smartphones that meet specific requirements, so the devices you let access your networks are ones you know you can manage as needed, no matter who owns them.

Some employees may be less apt to answer a personal smartphone after hours when it is subsidized by the employer than to answer a work smartphone issued by the employer, Voellinger says. The reason: The employee figures the subsidy just applies to work hours, especially if getting reimbursed for extra work usage is a painful process. On the other hand, if the phone is routinely used for work and business purposes, there may be no rigid work/home time boundaries in the employees' mind.

Forrester's Schadler also recommends that your corporate policy be thought out more than most are: "Most firms that support iPhones require their employees to sign a statement that lets the company do a remote wipe on the device and implement other policies in exchange for application support. [We recommend that you] extend this policy-based approach to cover jailbreaking, password requirements, and use of features such as cameras and GPS for work purposes."
In the end, who should own your smartphone? Sometimes the employee, sometimes the company, and sometimes one of each. There are good reasons for all three scenarios, even in the same company. The trick is to understand the ownership options that make the most sense in your context, not fall back to "this is how we've always done it."