Is Microsoft's Remote-Wipe Effective?Is Microsoft's Remote-Wipe Effective?

Microsoft Exchange support for mobile devices such as the BlackBerry, iPhone, and Android phones has a remote-wipe feature that lets someone remotely reset the device to factory settings. One recent blogger calls it a terrible bug. If there is a bug, it's that remote wipe isn't foolproof.Remote wipe is intended to be used by an IT department to blank out a phone that had been lost, or kill a phone from someone who had been fired from the company. Users can initiate a remote wipe as well, using an option in Outlook Web Access. The next time the phone connects to the Exchange server, it will initiate the remote wipe, which will completely destroy any data on the phone.

There are a few technical issues that prevent remote wipe from being as effective as an IT department might like it to be. For one, the operation can take up to an hour to complete; if someone were to see that the phone was wiping itself, they might be able to turn it off and retrieve data from any flash cards that were on the device. The biggest issue, though is that the phone won't initiate a wipe until it can poll the server. Since it's customary for the IT department to immediately cut off corporate network access in these situations, the exiled phone will never be able to receive its suicide pill.

Not all of the issues are technical, though. If an employee uses a personal phone for accessing the corporate network, it may have personal files, apps, and data on it. Wiping the phone will destroy that information as well. That's what our intrepid blogger was upset about. This seems like more of a policy issue to me. As long as he was told that Exchange had a remote-wipe feature and that his company's IT department might use it, he could take precautions to avoid losing personal data. If, however, he was using it to circumvent company policies, then he doesn't have much to complain about.