Employer BYOD Concerns: Part 2 of It’s 2013. Do You Know Where Your BYOD Policies Are?

In Part 2 of “It’s 2013. Do You Know Where Your BYOD Policies Are?” we will discuss employer BYOD concerns. Check out Part 1 to learn more about employee interests; Part 3 will present developing trends and suggest best practices for BYOD policy drafting and implementation.
The Employer’s Perspective on BYOD
While BYOD provides employees with enhanced user experience, their employers welcome BYOD for cost savings, increased productivity, and improved employee satisfaction. Yet, these benefits come with certain costs, primarily data security risk, as well as regulatory compliance risk.

Why BYOD Keeps CIOs Awake at Night
Security management becomes much more difficult the less control an IT department has over the relevant data and hardware. BYOD by its very nature makes control a challenge. Security breaches may result from inadvertent action. For example, sensitive information could be accessed by unauthorized individuals who are using a friend’s iPad, or sensitive data may be inadvertently placed in a shared cloud folder. The proliferation of cloud-based services such as Dropbox and Siri make this accidental leakage all the more concerning. A security breach can also result from active external penetration, through theft, hacking, malware, or espionage. Finally, intentional leakage of information by authorized employees poses a third category of information security risk.

Information Security Strategies
To prevent the various types of breaches described above, IT departments will generally employ a range of tools and practices. Security tools include password protection, forced disabling of certain applications, and remote wipe controls. A growing number of companies provide mobile device management (MDM) solutions to help manage BYOD programs. These solutions typically manage devices by enforcing security policies, managing password controls, controlling the installation of applications, and remotely wiping a device. In addition to these technology-based controls, policies and practices may prohibit or require certain activity from employees.

Security Strategy Example: Cloud-Application Risks
As an example of a BYOD security strategy, IBM prevents its employees from using many cloud-based applications, including Apple’s Siri. In response to concern by IBM and others, Apple revealed this Spring that user data generated through the use of Siri remains in cloud storage for 2 years. Dropbox and similar cloud-based storage services are frequently used by employees even though the risks have been widely reported. If employees will be handling sensitive information regularly, then tools and policies must be in place to ensure that this information is not sitting unprotected in a cloud environment.

Compliance with Data Security and Breach Notification Laws
Federal and state laws regulate data security and other activity surrounding the use of mobile devices. Many of these laws were created to prevent unauthorized access to third party personally identifiable or sensitive personal information. Such laws include the Health Insurance Portability and Accountability Act (HIPAA), Drivers Privacy Protection Act of 1994 (DPPA), Fair Credit Reporting Act, Gramm Leach Bliley Act, Federal Trade Commission Act, and NASD Rule 3110. Most states have also adopted security breach notification laws over the last decade. Most of these laws require certain breach notification policies and other incident reporting and response procedures, which may be more difficult when employees do not report promptly the loss or improper access to personal devices. Noncompliance can trigger stiff fines and other penalties.

Other Compliance Regimes to Consider
The application of other laws to the BYOD context may not be immediately obvious. Export laws, such as the Export Administration Act regulate the carrying of certain information outside of the United States, or exposure of this information to certain foreign nationals. The executive or engineer who takes a Blackberry on a personal vacation may be inadvertently “exporting” protected technology in violation of U.S. trade controls. In addition, the devices may be accessed in customs as a security measure–exposing restricted information.

Finally, companies must be careful to avoid violations of the Fair Labor Standards Act and other labor laws if they explicitly or implicitly require non-exempt employees to access and reply to emails outside of clearly defined working hours. Approximately 200 police officers are arguing in an ongoing lawsuit that the City of Chicago owes them overtime pay for time spent checking email outside of work.

Most of the federal and state regulations mentioned above do not apply explicitly to BYOD practices. Yet, BYOD practices may exacerbate the risk of noncompliance, and therefore compliance should be considered when designing and implementing a BYOD strategy. Ignoring these laws could prove costly.