The rise and fall of Bring Your Own Device

Are firms continuing to use BYOD despite regulatory fines?

The rise and fall of BYOD

Personal devices in an age of illicit communications

Bring Your Own Device (BYOD) policies present a plethora of advantages for organizations, not least with regard to considerable cost savings and improved employee accessibility. As with all technology, this reward is not without risk; according to Lookout, the initial move to BYOD in 2020 saw a sharp increase in phishing attacks, though it settled down as the year went on. As well as cybersecurity vulnerabilities, BYOD also presents the compliance team with recordkeeping challenges – how can firms capture, archive, and monitor business communications on a personal device?

BYOD remains the policy of choice … for now

Despite these challenges, respondents to our survey continue to use BYOD as their primary device offering, with more than 50% opting for a BYOD policy of some kind.

35.9% of respondents said that they are using BYOD and monitoring any business-related communications.

The challenge here lies in knowing which communications are business-related, and which are personal. When BYOD policies are in use, this line is often difficult to establish.

We encourage BYOD and do not ban certain channels. Employees regulate their own devices.

Anonymous, Government Department

As a means of establishing clear delineation between business and personal communication on BYOD, some compliance teams have opted for the use of a particular app, Microsoft Teams for instance, and direct employees to ensure that all business communication is carried out within that app.

15.4% of survey respondents have adopted this approach, in which BYOD is encouraged but certain channels are banned for business communication.

The difficulty with this approach is that individuals will have grown accustomed to communicating with customers on certain channels, and adherence to new single-app policies requires a behavioral shift. Limiting their business communications to one platform can therefore be restrictive and rules may soon be flouted.

Geographical approaches to BYOD

Looking deeper at the data, there appears to be a clear geographical split in attitudes to BYOD policies. It would appear that corporate devices are favored more by those in Europe than those in North America.

Of the 20 respondents that have enabled BYOD to varying degrees, 12 were from North American firms, two were from APAC, and six were from EMEA. The split here would suggest that North American firms are geared more towards enabling BYOD, while EMEA remains cautious and continues to offer corporate devices, as well as allowing personal phones.

Post-enforcement fallout for BYOD

In the wake of regulatory enforcement for off-channel communications, many firms have adjusted their appetite to risk. This is especially true of those on the receiving end of the SEC’s $125 million fines.

In conversation with a compliance officer at one such firm, they revealed that the organization has repealed its BYOD policy and returned to issuing corporate devices. This required a four-month roll-out and review, in which the organization was forced to take stock of all the communication devices in operation and swap them out for corporate-issued alternatives.

While the firm has now successfully transitioned away from personal devices, it continues to assess how best to monitor communications on corporate apps, and how to prevent employees from reverting to personal phones.

There are two simple reasons why organizations prefer BYOD to corporate devices: cost and choice.

Representatives don’t want to have two devices to manage, they like the simplicity of BYOD. They want their personal phone, but they want to keep their firm from seeing their private conversations.

The other part is cost. Imagine the cost of supplying a large investment bank or broker-dealers with corporate devices.

Chip Jones, Executive Vice President of Compliance, Global Relay