Can my employer access sensitive information if they pay my phone bill?

October 6, 2016 7:19 AM

I work for a company that has offered to pay my cell phone bill. I'd like to take them up on it and consolidate my two phones since I'm currently carrying a work and personal phone everywhere. But is it too good to be true??

Would the company be able to access sensitive information such as text messages, emails, pictures, browsing history, etc? I'm asking if this is logistically possible; I am aware that it would be unethical and/or illegal but would like to assume the worst for the purposes of making a decision. The phone is my personal iPhone 6, Verizon is the carrier if that has anything to do with anything.

posted by sparringnarwhal to Computers & Internet (18 answers total)

If they're just paying the bill, no. If they install corporate management software on the device, it will give them some level of control over it, but it's usually limited to things like having a policy to wipe the device after n number of bad logins and that sort of thing.
posted by Candleman at 7:23 AM on October 6, 2016 [2 favorites]

How are they planning on paying it? Will they let you be the account holder and just expense the bill, or do they want to own the account and just let you use a phone?
posted by brainmouse at 7:24 AM on October 6, 2016 [4 favorites]

I'm not sure about the illegality. If you're worried about this, in addition to the logistics, read the phone policy, computer use policy, security policy, and everything else in the handbook. I would not assume it's illegal for them to access anything on something they're paying for.
posted by mark k at 7:30 AM on October 6, 2016 [2 favorites]

My husband's company pays for his phone/internet bill. He just has to scan the front page of the bill and submit it through expenses.
posted by heathrowga at 7:33 AM on October 6, 2016 [2 favorites]

I worked for a major US corporation that for years paid for employees' phones, but did so only by asking for a scan of the summary page from the bill then sending a payment. Later, they reworked the program, restricting us to certain vendors, controlling our plans, not allowing us to buy phones through these plans (we had to buy them on our own), and having complete control of payment and complete access of records.

We also had company vehicles we drove extensively during the day as part of our jobs. After the changeover to more regimented control, they took to accessing our cell phone records after accidents to see if we'd been speaking on our phones, texting, or otherwise using mobile data during the incident. If so, we were immediately terminated.
posted by DirtyOldTown at 7:48 AM on October 6, 2016

Response by poster: It looks like they will add me to their corporate account, but no one from the company has or will at any point Have access to my phone so that rules out monitoring software...I think? I will keep my phone number.
posted by sparringnarwhal at 8:03 AM on October 6, 2016

I'd check on that to be safe. At the company I worked at, they did not have monitoring software, but they could access our data and phone logs.
posted by DirtyOldTown at 8:09 AM on October 6, 2016

I'd much rather (and do!) carry two phones rather than let them intermingle into my personal business like this. They don't need to be involved in my social contacts or pictures of my kid or my personal email.

Also look at it this way--I can turn the corporate phone off when it's not time to work. (If you're required to be on call anyway, this may not matter so much.) But with corporations trying to pull so hard on the work-life balance tether, workers need to pull back any way they can.

Once you're in, how hard will it be to get out? If you change jobs, are you going to have to give up your number?
posted by stevis23 at 8:09 AM on October 6, 2016 [19 favorites]

I'd check as well. My corp recently upgraded to a Microsoft Outlook mail server/client setup and, if you wanted to access email from the Outlook app on your phone, you had to install a Microsoft security thingy that wanted access to all kinds of stuff. I stuck to using the web interface.
posted by JoeZydeco at 8:36 AM on October 6, 2016

So, there are two sides to this question -- the legal and the technical. Company BYOD policies will vary greatly, and with the phone bill reimbursement there might be varying levels of rights asserted over the company's ability to see what's on your personal phone.

On the technical side, it's a question regarding what MDM software (if any) they'd want to install. Some of this software could be a virtual rootkit, where the company would have broad access to the device. Some of it is a limited rootkit, which gives the company access to the "corporate" box on the phone. A lot of software also gives the company the ability to initiate a remote wipe of the entire device, even if they don't have access to the "private" side of the phone itself.

On both the legal and the technical side, it really depends.
posted by QuantumMeruit at 8:50 AM on October 6, 2016 [2 favorites]

i kept a combined phone for an org that i worked with for awhile, but i knew the people and there was a very strong culture of not going through user data unless explicitly asked to by management. i wouldn't do it again though.
posted by lescour at 9:50 AM on October 6, 2016 [1 favorite]

I have a work phone and a personal phone and my company installed their monitoring software as part of activating the account - no one ever physically had my phone.
posted by brilliantine at 10:15 AM on October 6, 2016

sparringnarwhal: "It looks like they will add me to their corporate account,"

They'll get (or can access without your permission) who you call, who calls you (and the same for texts) and how long a call lasted. So for example if you get a call from a recruiter they know how long you talked to them. Or if you talked to your wife for an hour during business hours. It can also reveal your rough location when making calls (EG: my cell bill shows what regional neighbourhood I'm in when a call is placed). The metadata of a DNR/Trap and Trace can reveal a lot of information about your activities if you are attempting to keep something private from your employer.
posted by Mitheral at 10:53 AM on October 6, 2016 [2 favorites]

Though your question sets it up as your company just paying for your phone, it sounds like you're consolidating your work and personal phone. If that's the case I would assume they have access to everything unless I got a very clear message to the contrary.
posted by craven_morhead at 11:20 AM on October 6, 2016 [1 favorite]

sparringnarwhal: "It looks like they will add me to their corporate account"

If they add your phone # to their account what is the policy for phone upgrades? Also, what happens when you leave, will they let you have your # back?
posted by zinon at 11:34 AM on October 6, 2016

My phone is paid for by me, and I get a monthly stipend to cover business use -- but when I connect my Android phone to our company Exchange email server, using the stock Android Email app, Exchange can push out security requirements to the Android phone. It requires me to have a passcode to unlock, and my phone can be wiped remotely. They can't read data off it (unless they snoop my wifi connection, so if you're worried/paranoid, don't be limited to the physical phone), but they do have a degree of control over my phone.
posted by AzraelBrown at 12:22 PM on October 6, 2016

A few years back, I moved my personal account into a business account, the business being my own LLC. I subsequently shut down the LLC and was told by the phone company that the phone number was now owned by the business so I had to jump through some hoops to get it from me the business owner back to me the person.

Personally, I would:

1) Get a dual-SIM phone so I could have one device handling both numbers, or
2) Transfer my personal number to Google Voice and forward it to my business number.
posted by rada at 2:24 PM on October 6, 2016

My former company offered to do this too but it made me really uncomfortable. I decided paying for a phone was a normal thing and chose to keep mine and carry a second phone. Bonus points for plausible deniability when my weird boss used to text me about work at 11pm on a long weekend Saturday- "oh were you messaging me? I left my work phone at home so I wouldn't risk losing it!"
posted by pseudostrabismus at 1:01 PM on October 8, 2016