Tumblr app on while Android phone logged onto work wifi

Question

I used the Tumblr app on my smartphone to access some adult Tumblr feeds while on my home network. I also used my phone's internet browser to view some adult content. While all this is completely legal, the Tumblr feed and websites definitely would run afoul of any company's Acceptable Usage Policy.

Later, I went to work where my smartphone automatically connects to my company's WiFi network. It wasn't until an hour after I'd arrived at work that I realized Tumblr and the web browser may still be running in the background on my phone. I'm not sure if the Tumblr app was automatically refreshing in the background, and I definitely did not actually open the app or refresh the site in my browser. However, I'm still worried that the background tasks may have violated my company's use policy by downloading adult content on their WiFi network.

I'm really worried that this activity might be detected and traced back to me. Is this something my company can do, if my phone did access offending content while on the corporate network? Does the Tumblr app or web browser even do any automatic refreshing in the background?

Answer 1

How the Tumblr site and/or app, or your phone's web browser, function in particular is beyond my ability to address.

The same more or less goes for your company's policies with regards to usage of personally-owned devices on the company-hosted WiFi network. However, I will note that I'm aware of an incident in my organization where someone recently had their hand slapped for inadvertently surfing for porn on their home computer while they were still connected to the corporate VPN. They were at home, on their own computer, using their own WiFi network, but the system was sending all Internet traffic, including their porn requests, through the corporate VPN at the time. No actual punishment was issued, as it was a first-time offense, but the individual was clearly advised not to do it again.

As for how traceable or identifiable you are while on the company network, the short answer is very. Given the cleartext traffic the typical smartphone sends under normal personal use conditions, it's fairly trivial for a network administrator to identify the user of a device. Even if not, with the proper sensing infrastructure in place and some additional hand-held tools, it's still fairly easy for your IT Security (or other technical) personnel to walk down your area and physically identify which device was sending the offending traffic.

So, everything comes down to how lenient your company is with "slip-ups" like this and how well-equipped and determined they are to trace offenders. To best avoid accidental offenses against company policy, I'll re-state what has been said several times in other answers to other questions on this site:

Keep all personal activity and devices on your own network, and off the company's hardware.

Answer 2

You should be okay

Tumblr defaults to HTTPS. As long as you didn't install the company's Malcolm in the Middle certificate (if they have one) on your cell phone, then you should be fine. They'll know you connected to tumblr, but won't see exactly what you visited, you degenerate.

---

But if you get "caught," just be honest

If I'm somehow wrong, or you installed their MITM certificate, and you are confronted about this in the future, you should simply tell the IT/security team the truth, assuming your current description is true.

Most places value honesty above most things. I've seen people get away with visiting an adult website simply because they told the truth. "I activated private browsing, and muscle memory defaulted to my usual adult website. I am SO sorry." It was a one-off freak incident that never happened before, or again, and the guy closed the tab immediately while /facedesking. We even caught his /facedesk on camera.

Having said that, I recommend everyone stops connecting their devices to corporate WiFi/networks, and this will never happen again. I would not bring my own devices onto a company's corporate network, ever. But I'm paranoid, so there's that.

Answer 3

EDIT: I missed the adult part of your question (I read this as you were concerned about Tumblr). However, I think the rest of this answer still applies.

I don't know specifically about the Tumblr app but I see this quite often on our wireless networks with other similar apps (Facebook, blogger, etc). I think the key to your answer is your companies attitude, rules, and how closely they monitor their web logs.

Personally my view is if they allow personal mobile devices on their wireless networks then it's a risk they have decided to accept. Most companies will block whatever sites they don't want allowed anyway. So as long as you are maliciously trying to circumvent the web filter (for example using a anonymizing/proxy) then no harm no foul in my book. I think you have a legitimate excuse here. In my experience it's pretty easy to tell the difference in someone surfing the net and background application traffic.

It's technically possible they could trace it to you but I can't imagine it's worth their effort (again I don't know where you work or the culture).