Privacy and microsoft exchange sync on Phone

[carling220]

Hello,

I recently tried to sync my personal iphone 4 with works microsoft exchange email system. I was put in to quarantine as currently they only allow work owned phones, all blackberries. The reason I was told, was that they need to be able to remote wipe phones connected. Whether this is because they physically can't wipe iphones, or whether it's a liability thing with regard to personal phones im unsure.

I afterwards began to wonder whether I had just surrendered any control over my mobile or data to the company. Even in in quarantine, i expect certain information was sent between the phone and the network. In this situation, is any there any scope for the administrator to access personal e-mails, contacts, photos or anything; sms's etc, using phone information sent?

My device isn't actually sync'd I don't believe as I said above, so this same question applies to if It did one day become sync'd and they eventually allow personal phones (which i heard was possible)?

I understand from the internet, that certain criteria are asked of the client device, i.e camera y/n, password required y/n, and these dictate the answer sent to the network and therefore access or not. I also understand remote wipe is possible when sync'd. Does this control allow access to the phones information or any control over the device beyond remote wipe? OR, is the criteria the only control?

Is there any syncronisation between other phone data and the network/mailbox, beyond mail and calendar? Such as texts or photos etc.


I am unsure if this is the correct topic area but spent 5 minutes choosing, lol.

Any help appreciated. It's not a huge issue, but I decided I'd like to understand what was going on and not distribute my personal information to all of the administrators.

 

[joutlaw]

Microsoft's ActiveSync cannot by itself see your personal contacts, emails, photos, sms, or other information on the phone. Your company would need a Mobile Device Management (MDM) solution in place, and an agent on your phone to see some of that data. That may include GPS location history or application inventory, but most cannot see SMS messages. Personal email, photos, and contacts might be available if you sync your phone with your work PC, but they aren't available through a MDM or ActiveSync.

When you add ActiveSync to your phone it polls the Exchange CAS server for the ActiveSync policy. This is what defines the device restrictions such as remote wipe functionality, PIN enforcement, lock enforcement, and the ability to disable features on the phone such as the camera, WiFi or Bluetooth.

Most companies are more concerned with the data not being at risk in the wild versus snooping on an employees personal phone. I would suspect there would be remote wipe and PIN enforcement with auto-wipe after so many incorrect attempts as something most if not all companies would require for a employee's personal phone to be allowed to sync to their mailbox.

 

[joutlaw]

Also I'm surprised they quarantine after the fact, instead of just disabling ActiveSync by default on all mailboxes.

 

[joutlaw]

Check out this article. It goes into more detail:
http://technet.microsoft.com/en-us/library/bb123484.aspx

 

[carling220]

Many thanks for your reply, very useful.

I suppose now I would just need to get my device removed from this quarantine list to avoid in future being sync'd if they one day change policy. I removed the mailbox from my iphone in the mail app already.

This MDM agent on the phone I would think would need to be installed manually as opposed to an automatic remote online process? And as you say, this process even cannot access too personal of information such as gmail, contacts and photos.

I have not sync'd my mobile with my works computer, so am now reassured my data such as gmail, contacts and photos are secure.

Since i've read this active sync criteria such as pin lock and remote wipe can in fact work with Iphones, I would assume they block these devices to avoid the prickly situation of affecting peoples personal phones, even in the fortunately limited manners you described.

The fact that active sync allows mail sync and can affect a phones camera use, password requirements and other things, indicates the level of remote control is limited by the active sync software, not the method by which it works, as performing the already mentioned tasks must surely mean further control of a phone remotely is possible some how, but restricted for specific uses required in active sync.

I will tomorrow read over the link you provided for further understanding. It goes to show that you do have to be very careful with data these days and very few people are aware of what actually goes on with systems people take for granted.