Should Your Municipality Have a Bring Your Own Device ( BYOD ) Policy? The Benefits and Burdens of BYOD in a Municipal Workforce

Transcription

1 Should Your Municipality Have a Bring Your Own Device ( BYOD ) Policy? The Benefits and Burdens of BYOD in a Municipal Workforce League of Wisconsin Municipalities Municipal Attorneys Institute June 18, 2015 Delevan, Wisconsin Alan R. Kesner City Attorney City of Wauwatosa 7725 West North Avenue Wauwatosa, WI (Voice) (Fax) akesner@wauwatosa.net 1. Introduction In most cases for government employees, the personal phone in our pocket or purse is much more capable than the one which is (or would be) provided for our use by the folks we work for. Touchscreens, Apps, Google at our fingertips, and text messaging in an instant, calendars, Word Document editing, FaceTime, turn-by-turn directions to anywhere. And yes, it can also make phone calls. Even with the huge budgets, hundreds of employees, and a full time staff of IT professionals, local governments have a tough time keeping up with the advent of new iphones and Androids and tablets and all of those other tricky things that our families are being provided free with a new two-year contract by the giant telecommunications companies. How can municipal employment appeal to the millennials and other early adopters of technology, the very creative and active new employees we need as we move into the future, when we give them flip phones and paper file folders to do their work? They ve never seen anybody work that way, and don t understand how it can be done efficiently. They would prefer to use their own phone rather than the antique their new employer might offer them for work purposes. But it s never quite that easy, is it?

2 BYOD Policies June 18, 2015 Page 2 of 7 2. Why do we need to consider BYOD? a. Widespread availability of smartphones and other devices b. Improved functionality of modern personal electronics provides for better capabilities, which continuously improve, usually faster than government procurement timelines. i. iphone 6 is smaller and more powerful than a 1985 Cray 2 Supercomputer (and uses a LOT less power...) ii. Increased use of OS-neutral mobile functionality does not require specific hardware and software iii. Mobile data network speed is no longer appreciably different from WiFi iv. Cloud-based applications provide needed functionality and security c. Employees asking for BYOD, for convenience and other reasons i. Carrying/charging/answering two or more phones is NOT fun ii. Learning how to effectively use multiple can be confusing, or worse iii. People LIKE their portable devices (they even become fashion accessories) d. Making internal applications mobile-friendly will speed adoption and comfort with mobile-friendly solutions for the public e. IT staff have enough to do already, without managing all of that other hardware and those data plans and calling minutes 3. The Benefits of BYOD a. Can provide significant cost savings and avoid maintenance/replacement headaches i. Unlimited calling minutes and unlimited data plans are largely unavailable for corporate customers, at least at affordable rates ii. Governments cannot get huge hardware discounts or a free phone with a new two-year contract iii. How do you get rid of hundreds of old devices when the latest new iphone comes out?

3 BYOD Policies June 18, 2015 Page 3 of 7 b. Users familiarity and comfort with their technology makes it easier for them to use i. less training and support needed internally ii. less likely to make costly or embarrassing mistakes c. Employee morale and convenience-no need to carry two or more phones i. Better technology makes employees more effective ii. Added flexibility improves employee satisfaction and productivity d. Employees more likely to be reachable when needed i. Won t leave work phone behind during personal activities ii. Will check messages to make sure nothing is being missed e. Eliminates need for hardware purchases, account maintenance and support of both 4. The Burdens of BYOD a. Data Leakage i. Unintended or inadvertent disclosure of sensitive information can create problems ii. Any access to data opens a hole in the network which must be addressed iii. Limit access if appropriate iv. Prevent access to sensitive data if necessary, or provide traceable security on items accessed b. Public records concerns i. Need to avoid having public records created and maintained on private devices outside the network ii. Maintaining archives of all work-related communications allows for assurance that records are available when needed iii. Using cloud-based applications keeps records off of personal devices, since all permanent records are kept in accessible locations

4 BYOD Policies June 18, 2015 Page 4 of 7 c. Electronic discovery/litigation issues i. If nothing original is kept or maintained on phone, may be able to avoid seizing and searching personal devices ii. Organizations which did NOT have sufficient archiving and recordkeeping policies have opened employees personal and family devices to search and forensic review iii. Formal, definitive impact of personal device use has not been fully litigated to the extent that 100% assurance can be given that individual devices will not be subject to discovery at some point d. Loss of control and visibility i. Must clarify ownership and control of sensitive information belonging to the organization ii. If a good policy is in place, problems can be avoided, but there are not technological solutions to every permutation iii. Comfort level with implementation of the policy requires at least some reliance on employees compliance with policies put in place e. Risks of device loss i. Small devices can also be lost or stolen easily ii. Sensitive data and information can end up in the wrong hands, as with any loss of portable devices and media iii. Tools are available to control device usage and wipe data clean iv. Sometimes a complete freeze of entire device may be required v. Newer tools allow partitioning devices and wiping only a part of the personal device vi. Security and policy compliance is the best weapon against problems, however f. Employee must maintain investment in personal technology i. Security and effectiveness requires reliance on ever-developing technology

5 BYOD Policies June 18, 2015 Page 5 of 7 ii. Employees must be willing and able to invest in the necessary personal technology, although some may not have the financial wherewithal or willingness to do so iii. Since the flexibility of upgrades is a selling point, employees need to commit to keeping up with the latest technologies as needed, including security and other software updates to protect the organization s interests iv. Malware may be allowed to enter network through these back doors if not properly managed 5. Considerations for BYOD Policies a. Limit BYOD applicability to appropriate employee classifications i. Consider hourly employees and overtime/on call issues ii. Security/data access may involve different levels of sensitivity iii. Specialized hardware/software needs may control scope-some field applications may only work on specific hardware/software configurations b. Device suitability/hardware trustworthiness (also: will necessary upgrades/updates occur?) i. Is the employee s hardware capable of handling the usage being required? Consider defining minimum capabilities ii. Will the employee upgrade and maintain the device in a secure manner such that it will continue being capable of handling the required workload and security into the future consider requiring upgrades and updates for continued participation in the program c. Data network needs/suitability i. Will the external and internal data networks be capable of handling data needs? ii. Is data secure on the network(s) being used (limit use on open networks by policy?) d. Can security policies be enforced technologically on the device i. MS Exchange provides for a requirement that standardized security policies can be enforced, such as PIN to unlock screens

6 BYOD Policies June 18, 2015 Page 6 of 7 ii. Cloud based file access/desktop virtualization can discourage download of documents to devices, while permitting docs to be viewed e. IT support capabilities less work, but wider variety of devices i. Standardized applications may work similarly at the headquarters end, but apply differently on each unique device ii. Even if policy says no device support the IT dept. cannot be blind to the end users needs (particularly for power users or organizational leadership) f. Software licenses i. Use of software on mobile may require different licensing ii. Use of personal accounts for business data may require users to have a different data account with their provider g. Cost/reimbursement issues define levels of reimbursement by job function or device usage i. Extensive use of voice and data may require more reimbursement than occasional voice calls ii. Reimbursement level should require supervisor approval (see attached policy from City of Wauwatosa) h. Applicability to other employee-owned technology, such as tablets and home computers i. Same concerns apply to employees accessing city networks from home computers or tablets ii. May be additional dangers from this type of access, including different methods of enforcing security policies

7 BYOD Policies June 18, 2015 Page 7 of 7 6. Conclusion It is important to recognize that satisfying the demand for BYOD may result in happier, more satisfied, and more effective employees. It may also provide significant cost and administrative savings over ownership and operation of a fleet of devices for employees. There are security and confidentiality concerns with a BYOD program. The concerns surrounding BYOD can be managed effectively with good policies in place, but will always require a large degree of policy compliance by the users in order to be 100% effective. BYOD may not be satisfactory for every organization or every employee. In those cases, it seems important to maintain the company-owned option for those who may need to take advantage of it, or for those who may not otherwise be able or willing to afford or obtain a personal device with the capabilities to perform the work being required.

8 CITY OF WAUWATOSA ADMINISTRATIVE POLICY AND PROCEDURE MANUAL Subject: Wireless Telecommunication Equipment and Data Access Date: September 2, 2010 Policy Overview Wireless phones and data access are provided for conducting official City business and eligibility is determined by job responsibilities as approved by the Department Director or City Administrator. Eligible employees may use a city-issued device or request a stipend and use their personal device. If data access is a requirement for their job duties, the City will only support the specified equipment noted in the policy or otherwise specifically approved by the IT Department. If voice is the only requirement for their job duties, any personal device can be used. All city-issued equipment must be returned to the Purchasing department if an employee chooses to use a personal device. City-Issued Wireless Telecommunications Equipment & Access Equipment and access is not private and is subject to the Wisconsin Open Records Law Usage is for business purpose only and is subject to audit Text message archiving by the City is not supported at this time, thus accounts for cityprovided devices will not provide text messaging service Personal use is not allowed on a city-issued device if the City incurs a net cost. City will provide standard components issued by the telecommunication vendor received in the initial packaging. No other accessories will be provided by the City without approval from their Department. Use of Personal Wireless Telecommunications Equipment & Access Supported equipment for data access includes o iphone o Windows Mobile o Android OS o Palm OS City assumes NO responsibility for repairs, replacements, troubleshooting, or carrier's reception quality of personal devices Messages/data transferred via a City server to a personal device are subject to the Wisconsin Public Records Law (all such data will be preserved and stored on City servers). NOTE: Text message archiving is not supported at this time, and text messaging may not be utilized for the conduct of City business A stipend will be provided to eligible employees, which is intended to reimburse employees for use of personal equipment, minutes, and data for City business only and is not intended for initial purchase

9 City of Wauwatosa Administrative Policy Wireless Telecommunication Equipment and Usage September 2010 Page 2 Stipend is reported as a taxable employee benefit and determined by Department Director based on needs of job duties: o $50-24/7 data access and availability AND particularly high voice usage (only with City Administrator approval) o $40 - More than 100 minutes of voice usage or unlimited data usage (including push ) for City business o $20 - More than 50 minutes of voice usage or limited data usage for City business o $10 - Discretion of Department Director for efficiencies gained; EOC availability Policy Details: Wireless Telecommunication Equipment & Access I. Purpose and General Guidelines The purpose of this policy is to specify the authorized use of City-issued wireless telecommunication equipment and access, as well as use of personal wireless telephones in the workplace. The City of Wauwatosa understands the Public's perception of how we should conduct the business of the City. As custodians of resources entrusted to us by our citizens, employees should always be mindful of the public trust; of the necessity for conducting ourselves with the highest ethical principles; and of avoiding any action that may be viewed as a violation of the public trust in the use of these resources. Wireless telecommunication access is provided for conducting the official business of the City. Eligibility is determined by job responsibilities. If eligible, an employee has the choice of requesting a city-issued device or utilizing a personal device. Policies for city issued wireless and personal wireless telecommunication equipment and access are outlined below. Rules and regulations set forth in this policy must be adhered. Employees are strongly discouraged from using handheld wireless telephones or data devices while driving or operating motorized equipment except in emergency situations. Instead, users are encouraged to use hands-free accessories or pull over to the side of the road and/or shut down machinery until the call is complete. Users should note that the Internal Revenue Service considers cellular telephones "listed property", which means City-provided cellular phones used for personal benefit may be considered taxable income. If the city-provided equipment is used exclusively for City business pursuant to this policy, such use may be excluded from taxable income, and will not be reported as income by the City. All City employees assigned wireless telecommunication equipment and access or who utilize personal equipment pursuant to this policy will be provided with a copy of the Wireless Telecommunication Equipment Administrative Policy and will be required to acknowledge receipt of the written policy and their understanding of the provisions outlined herein. II. City-issued Wireless Telecommunication Equipment and Data Access City-issued wireless telecommunication equipment may be assigned to an employee for the purpose of conducting official City business. Only standard components issued by the

10 City of Wauwatosa Administrative Policy Wireless Telecommunication Equipment and Usage September 2010 Page 3 telecommunication vendor and received in the initial packaging will be provided. Any additional accessories must be approved by the Department Director. City-issued wireless telecommunication equipment should not be assigned to any person other than the designated City of Wauwatosa employee unless in an emergency situation for public safety purposes. This does not apply to department on-call phones or devices. Assignment of wireless telecommunication equipment to an employee may be withdrawn at anytime at the discretion of the City Administrator, Department Director, or his/her designee. All City-issued wireless telecommunication equipment is the property of the City of Wauwatosa. Employees are hereby notified that their communications via City-issued wireless telecommunication equipment is not private and subject to the Wisconsin Open Records Law. Text messaging services will not be supported on City-issued equipment, as current technology does not support appropriate archiving of such messages. The use of City-issued wireless telecommunication equipment to transmit or receive inappropriate communication is strictly prohibited and may result in disciplinary action. Inappropriate communication includes, but is not limited to: discriminatory, hostile, suggestive, obscene, harassing, or otherwise unsuitable language and content. City-issued wireless telecommunication equipment is provided to employees who, by the nature of their jobs, have a routine and continuing business need for use on official City business as determined by their supervisor and Department Director. The purpose of this policy is to establish the requirements and general rules for use of City-issued wireless telecommunication equipment. A. Conditions for Wireless Assignment Employees are responsible for understanding and following all wireless telecommunication equipment policies and any additional restrictions imposed by their department. The use of City-issued wireless telecommunication equipment is for official use only and is subject to audit. City-issued wireless telecommunication equipment may not be used at any time in violation of federal and state laws, local ordinances, this policy or any departmental procedures. Users may be required to justify any or all calls on a City-issued wireless telecommunication equipment. 1. Wireless Telecommunication Equipment Assignment - Wireless telecommunications equipment is to be used when communication is necessary for City-related business after hours or away from a City facility. 2. Pager Assignment - Pagers are to be used as a means of communication when appropriate for business communication. 3. Data Connections -To be used as a means of communication when appropriate for business communication.

11 City of Wauwatosa Administrative Policy Wireless Telecommunication Equipment and Usage September 2010 Page 4 B. Requests for Wireless Telecommunications Service To initiate wireless telecommunication service, a written request for assignment of wireless service and City-issued equipment must be authorized and signed by the relevant Department Director and forwarded to the Purchasing Department, which coordinates City accounts. Use of City-issued wireless telecommunication equipment and service will be terminated when no longer justified by business requirements or when the employee has demonstrated disregard for this policy as determined by the user's Department Director. Service termination and equipment revocation may occur at any time at the discretion of the City. C. Equipment, Service, and Accountability The wireless telecommunication equipment is the property of the City of Wauwatosa. Equipment is the sole responsibility of the wireless user(s) registered with the Purchasing Department. The equipment must be secured and its whereabouts known at all times to the user and/or the user's supervisor. Upon leaving a City position, all wireless telecommunication equipment must be returned to the user's supervisor. The return must be reported to the Purchasing Department along with instructions to cancel, suspend, continue or transfer service. Employees violating the Wireless Telecommunication Policy will be subject to disciplinary action. Supervisors are responsible for ensuring responsible use of wireless telephones by their employees. D. Loss, Theft or Damage Notification Procedure Users will notify the Purchasing Department immediately of any problems with their cityowned wireless telecommunication equipment, including loss, theft or damage. A written report from the Department Director must accompany a replacement request due to loss. A copy of a police report maybe required with replacement request due to theft or loss. The user's Department Director must sign the replacement request and provide the account to which the replacement will be charged. Employees may be subject to disciplinary actions if found negligent, for example: 1. Equipment is lost or damaged while in the care of employee, as a result of the employee's gross negligence. 2. Equipment is not returned by the employee within in the specified period of time or is damaged upon its return. 3. Equipment is damaged due to failure to adhere to maintenance or operational policies. E. Personal Usage Users are not allowed to use City-issued devices for personal use if the City incurs an expense it otherwise would not have.

12 City of Wauwatosa Administrative Policy Wireless Telecommunication Equipment and Usage September 2010 Page 5 III. Use of Personal Wireless Telecommunication Equipment and Data Access If eligible for wireless telecommunication access, employees may use a personally owned device provided it is a device supported and approved by the IT Department, in place of a city issued device. Such employees may be eligible for a stipend for such usage pursuant to the parameters outlined below. A copy of approved equipment options can be found in the summary portion of this policy, as well as on the employee intranet and the Shared Folders drive on the City network. A. Requests for Wireless Data Telecommunications Service To initiate City-issued wireless telecommunication data access on a personal device, a written request for assignment of wireless access must be authorized and signed by the relevant Department Director and forwarded to the IT and HR Departments. A copy of the approved written request will be included in the payroll files. Wireless data access on a personal device will be terminated when no longer justified by business requirements or when the employee has demonstrated disregard for this policy as determined by the user's Department Director. Access termination may occur at any time at the discretion of the City. B. Equipment, Service, and Accountability Equipment is the sole responsibility of the wireless user(s); the City of Wauwatosa assumes NO responsibility for the user(s) personal device. Text message archiving is not currently supported by available technology, and thus text messaging may not be utilized for the conduct of City business on personal wireless telecommunications equipment. Employees violating the Wireless Telecommunication Policy will be subject to disciplinary action. Supervisors are responsible for ensuring employees have continued service available for stipend justification. C. Loss, Theft or Damage Notification Procedure The City assumes no responsibility for the loss, theft, or damage of a personal telecommunication device. Repair and replacement is at the sole expense and discretion of the user(s) for their personal device. D. Monthly Stipend for Cell Phones Eligible Employees required to use telecommunication equipment for City business may be authorized by their Department Director and the City Administrator to receive a monthly stipend to use personal devices and rate plans to conduct City business, in lieu of a city-provided device. This stipend may be taxable income to the employee, and will be reported annually on the employee s W-2 form. The stipend is intended to reimburse employees for use of their personal equipment and minutes for City business only.

13 City of Wauwatosa Administrative Policy Wireless Telecommunication Equipment and Usage September 2010 Page 6 1. Equipment Purchases and Service Employees must utilize IT approved equipment as outlined in this policy, purchased at their own expense. Neither the monthly stipends, nor any other City funds, are to be used to reimburse users for purchase of their personal device. The City will not be responsible for initiating or terminating personal cellular service, although the purchasing department may be authorized to arrange for certain group or other discounts which may be made available to users by service providers. 2. Conditions for Monthly Stipend Receiving a monthly stipend means the employee's personal cell phone number can be made available to city employees. The City is required to comply with the Public Information Act which includes electronic media. All messages/data that is transferred via a City server to a personal telephone device will be subject to open record requirements of the City. Such messages and data shall be archived by the City on its own internal servers. The employee must maintain continued service while receiving the stipend. Failure to do so could result in disciplinary action. All service and billing issues on personal devices are the sole responsibility of the employee. 3. Monthly Stipend levels The Department Director and City Administrator will assign the monthly stipend for eligible employees from the following levels. a. Level One - $50 per month- Employees who are required to be available 24 hours a day 7 days a week per job description, and who have particularly high voice usage, as approved by the Department Director or City Administrator. b. Level Two - $40 per month- Employees who are required to be on-call and available, or who use their personal phone for City business more than 100 minutes per month, or who are required to have access to City data, including , from the Microsoft Exchange server utilized by the City. c. Level Three - $20 per month- Employees who are required to occasionally use their personal phone in emergency situations, less than 50 minutes per month, and do not use the personal device for access to City . d. Level Four - $10 per month - At discretion of Department Director for efficiencies gained and EOC availability. Exclusions: Employees not required by their job duties to use telecommunication equipment for City business but requesting telecommunication access will NOT

14 City of Wauwatosa Administrative Policy Wireless Telecommunication Equipment and Usage September 2010 Page 7 be authorized to receive a monthly stipend. They will be provided data connections to access their City issued accounts only and must adhere to this policy. E. Excess Usage While at work, employees are to exercise discretion in using personal wireless telecommunication equipment. Excessive personal calls during the workday, regardless of the phone used, can interfere with employee's productivity and be distracting to others. Excessive use of cell phones may be subject to disciplinary action. The City encourages a reasonable standard of limiting personal calls during work time as needed. Employees are therefore asked to make most personal calls on non-work time where possible and to ensure that friends and family members are aware of the City's policy. Flexibility will be provided in circumstances demanding immediate attention. This policy will retroactively go into effect on July 1, James Archambo City Administrator Distribution: All Employees S: Drive (S: \ City Hall \ Public Folders \ Administration \ Administrative Policies The Employee Request Form for Wireless Telecommunications Equipment and Data Access Stipend must be filled out for an employee to receive a monthly stipend. This form will serve as the written request.