30

I bought the mobile phone myself, but my employer paid the mobile subscription.

What data can they see and what are potential privacy risks? As far as I know they see which numbers I called (only traditional calls, not via VoIP apps), but they don't see individual Internet traffic.

I also use the iPhone for the company Microsoft Exchange Server server.

  • 2
    This depends heavily on the kind of contract between your employer and the provider. Some providers allow tracking of certain(!) internet activities inside a web interface, others don't. – Tom K. Jul 28 '17 at 10:28
  • 14
    Just look up your mobile provider with your favorite search engine and check their available options for monitoring an account. :) – Tom K. Jul 28 '17 at 10:35
  • 2
    Is the account in your name, but they pay the bill / reimburse you? Or is the account in the company's name? – Andy Jul 29 '17 at 1:31
  • When rolling up for the Exchange Account you most likely enabled the MDM, this way the company can define some policies like enforcing a certain strength for the lock screen code. They can also initiate a remote wipe. The normal MDM products do not allow to inspect data - it would also be illegal. However I would not be sure that there isn't a way (like pushing a app). The chances are however smaller on iOS than Android. – eckes Jul 29 '17 at 14:19
  • Which country? What they can legally do varies greatly around the world... – Bakuriu Jul 29 '17 at 17:24
33

They will most likely be able to see an itemised bill showing who you called and when. They will also be able to see mobile data usage.

If the phone is enrolled in the organisations mobile management system, they may be able to monitor and control app usage as well as monitor and control internet traffic.

UPDATE: In a worst case scenario they could potentially install full monitoring and install things like key loggers, this is very unlikely however. Additionally, depending on what part of the world you live in, there are restrictions on what they can legally collect, especially without consent.

The best thing to do is ask your company what you can and can’t use the phone for. If it is a large organisation they should have a security policy and an acceptable use policy.

  • 2
    I might be wrong, but I think iPhone applications are sandboxed and a key logger cannot be installed except if the OS has been jailbroken/rooted, or an alternate on-screen keyboard has been installed (which the user can check). – jjmontes Jul 28 '17 at 13:56
  • 7
    could potentially install full monitoring and install things like key loggers Without physical access to the phone. How would they achieve this? OP only said they pay the phone bill – user1 Jul 28 '17 at 15:20
  • 2
    @users1 If they enrolled it in the orgs mobile management server. – TheJulyPlot Jul 28 '17 at 15:27
  • 3
    In any reasonable world, there wouldn't be any way to "enroll it in the mobile management server" without explicit consent from the owner of the device, unlocking it and selecting an option to enroll it. However I wouldn't put it past phone vendors to put carrier backdoors in that allow the carrier to enroll the device without the owner's consent... – R.. Jul 28 '17 at 17:34
  • 1
    The question didn't mention physical access, typically the enrolment will require the user to click a link in an email, scan a QR code or something similar. In my experiance in a byod situation the user will typically be required to complete the enrolment. If the phone is issued then it will be pre-enrolled. Not all orgs will require it to be enrolled, but if it is then all of what has been said is possible. If the org is paying the subscription, then they may require it to be enrolled. This would be a fairly standard and reasonable request, especially if corp data is ever on the device. – TheJulyPlot Jul 29 '17 at 8:11
5

In addition to the other points that have been made, many websites use an SMS message to your mobile phone as a form of two-factor authentication, even though the best practice nowadays is not to do that. So they could at any time divert messages to your number to themselves, and use that to take over your Internet accounts, even accounts that you never use with the phone.

5

My thoughts about having a company-managed phone or a company-paid contract, and your company Exchange. I include relevant information for iPhone devices (since the amount control varies across mobile platforms).

Phone

If you are using Exchange ActiveSync to access your company email/contact/calendar, note that ith ActiveSync, your company can:

  • Configure a Mobile Phone for Synchronization
  • Disable a Mobile Phone for Exchange ActiveSync
  • Enable a Device for Exchange ActiveSync
  • View a List of Devices for a User
  • Configure Device Password Locking
  • Recover a Device Password
  • Perform a Remote Wipe on a Mobile Phone
  • Install SSL Certificates on a Windows Mobile Phone
  • Configure Mobile Phones to Synchronize with Exchange Server

Apple and Google also have similar centralised management options. There may be other 3rd party services or software that perform similar tasks.

If your phone has been set up with Google G Suite, your company can:

  • Automatically synchronize email, calendars, and contacts with users’ devices.
  • Turn on or off features, such as lock screen widgets, Siri, My Photo Stream, Handoff, and iCloud Photo Sharing.
  • Protect your organization’s managed data by controlling which apps can be used to open documents and attachments.
  • Control Apple® iCloud® backup and sync, and turn on backup encryption. Apply device-management controls, such as account wipe, encryption, and screen lock.
  • Keep work data secure with G Suite apps, such as Gmail, Google Drive, and Calendar. For details, see Get mobile apps for iOS devices.

If your company was using Apple Device Enrolment, they can access, amongst other things:

  • Global network proxy for HTTP
  • Allow iMessage, Game Center, iBooks Store, AirDrop, Find My Friends
  • Allow removal of apps
  • Allow user-generated content in Siri
  • Allow manual installation of configuration files
  • Allow configuring restrictions
  • Allow pairing to computers for content sync
  • Allow account modification
  • Allow cellular data settings modification
  • Allow Erase All Content and Settings
  • Restrict AirPlay connections with whitelist and optional connection passcodes
  • Enable Siri Profanity Filter
  • Single App Mode
  • Accessibility settings

Note that a remote backup includes a lot of your phone information (installed apps, etc). I'm almost certain your company could access this information if they wanted to.

Contract

This depends on whether your employer simply pays for your contract or they are the contract owners and therefore have access to the mobile operator online tools.

If they own the contract, they can definitely access the detailed list of phone calls (including numbers, time and duration). They may also be able to access your Internet data pattern usage (which may reveal some of your habits).

I know of no provider (Europe / Spain) that allows customers to access a detailed list of websites visited, or IPs accessed, but I might be wrong here. I doubt this since it would require your phone provider to do deep packet inspection and maintain quite expensive log and data mining facilities... it is definitely doable but I never heard of this.

General info

Anyone using their phone to access their company resources (even simply checking mail via POP3/IMAP) is usually revealing their approximate geographic position to their company in a periodic fashion.

If you use your company proxy or VPN to access any of their resources, note that your Internet traffic or browser behavior may be being forwarded through your company servers, which would allow them to track which sites you visit (and the content if those sites don't use HTTPS).

If your company has installed custom certificates on your phone, they could potentially also view any HTTPS traffic if you are using their proxy.

TL;DR

In summary, I'd recommend you to:

  1. Find out if your phone has been enrolled to a remote management system.
  2. Check what kind of information your phone company provides to their (business) customers about their contracts.
  3. Check if your company has installed any extra software, proxy/vpn settings or certificates on your phone (in case you handed your phone to them at any time OR allowed them remote administration).
  • 3
    And 4, buy yourself a personal device, consider your already-purchased device a loss and a lesson if you can't get your employer to pay for the BYOD they already duped you into buying, and start keeping work and personal devices 100% separate and isolated. – R.. Jul 28 '17 at 17:36
  • 1
    WHAT?!? THEY CAN TURN ON SIRI PROFANITY FILTER!?!?!? (#&@ *(@#$@#( (*&(&$#...oh. Looks like...well...drat... – Bob Jarvis Jul 30 '17 at 17:24
2

The holder of a contract can almost always see the activity on that contract, that would be numbers called and very possibly the internet usage as well, that is the sites you visit and how much data you have used going to them. In most parts of the world your employer has the right to monitor your activities on business supplied services, and many use that right. Some industries are regulated and have an obligation to monitor what you do, and in these cases your calls may be recorded and your internet traffic actually saved so your actions can be reconstructed - this is a rare case.

If you control your actual device then they can't see what you are doing on it, however you cannot assume that anything you do on your company phone is private as the connections it makes will give them a great deal of information. You could use TOR, but personally if you do things you really want to keep private then you're better off getting your own contract for your phone.

  • I know of no mobile provider that allows the customer to view which Internet sites they accessed (which requires a proxied connection or deep packet inspection), not even which IP addresses traffic was sent to. Can you point at some example(s)? – jjmontes Jul 28 '17 at 14:00
  • 1
    I don't know of any that would do it for an end user account, but all the big EU providers offer these types of services to enterprise clients. Vodafone, EE, etc. – GdD Jul 28 '17 at 14:04
  • 1
    @GdG however I have searched and I couldn't find any web resource where Vodafone (or other operator) describes such facilities for business customers. And I'd really like to see it. – jjmontes Jul 28 '17 at 14:49
  • @GdD It would also seem to be a potential privacy regulations nightmare, even more so in light of the EU GDPR coming into effect next summer. A citation for your claim that "all the big EU providers offer [detailed traffic monitoring] services to enterprise clients" would much improve this answer. Even just a link to a single such provider's web site showing that such service is available in some location within the EU would be beneficial. – a CVn Jul 28 '17 at 14:56
  • I couldn't cite that without violating agreements @MichaelKjörling, and I'm not going to do that. Regarding the GDPR, an organization can perform surveillance on employees if it has a legal requirement. – GdD Jul 28 '17 at 15:04
1

There are two levels of access (okay, make it three), depending on the carrier-offered options (with "offered" meaning "offered to your employer").

  1. Certainly all billable traffic gets forwarded to your employer, so:

    • numbers called and, almost surely but not necessarily, calls received even when not actually billable.
    • SMS/MMS sent (but not their contents)
    • network traffic statistics (i.e., volume in gigabytes, but not its contents).
  2. The SIM could route your traffic to a private MPLS group and have it analysed/filtered. How much or how little, it depends on lots of factors. Potentially everything (except for HTTPS encryption, and even then, barring MitM attacks) could be accessible with you being none the wiser. This also includes SMS/MMS contents. Your employer must not simply pay your navigation, he must supply a tailored SIM.

  3. More simply, all the traffic could be routed through a dedicated VPN, no matter what the device settings are. So your navigation effectively happens from a device inside your employer's company. Same rules apply as for #2, but this situation might be apparent through tracerouting or simply checking your apparent source IP address and/or comparing the internal device IP address (e.g. 10.123.45.6) and what appears to a third-party site such as WhatIsMyIp.com (e.g. $IP_IN_YOUR_EMPLOYER_NETWORK). This can be done even with your own SIM inside.

I strongly agree with @TheJulyPlot's answer: ask your employer

a. What is permissible on that device,

b. Whether private (i.e. third-party VPN) navigation is allowed.

If the answer to (b.) is a NO, then you should purchase a second device or look into a dual-SIM device -- but, first, ask whether that is permissible. I had a position once where I was not allowed to bring my own phone - or any other kind of electronic gadget, including my non-networked PDA (!) - inside the premises. You don't want to shell out good money for a device you then can't use.

Final note (especially for case #3): in some circumstances you might be getting flak not just for something you did but for something that was sent to you. So consider who you give (or already gave) that phone number to. "Moving" your own SIM with number inside your employer's accounts could backfire spectacularly if they objected to some SMS sent by an Overly Attached Girlfriend or similar.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.