State using app that separates personal, work data on iPhones, Androids

West Virginia deploys tool that could lead to employees using personal devices on the job

Wireless devices are an important tool for business and government users. But security concerns have tended to restrict organizations to a limited set of approved handsets and vendors.

West Virginia is deploying a new software-based system that lets users securely access business-related information from any device loaded with the program. While the state is currently limiting user options to a broader selection of vetted devices, the technology could potentially allow government employees to safely use their personal handhelds for work.

Under the new program, state personnel can request iPhones, iPads and Android-based smart phones to use for personal and business purposes. All of the new devices are equipped with software from Good Technology that allows users to make secure government calls and messages from their devices.

Related coverage:

Can Android take BlackBerry’s government job?

iPad continues to get traction in government circles

For many years, West Virginia used BlackBerrys as its main wireless devices, said Kyle Schafer, the state’s chief technology officer. As new technologies such as Androids and iPhones became available, many state employees wanted to acquire them under state contract. In other cases, staff members wanted to use their own phones and mobile technology to conduct state business, he said.

However, when the state’s security team assessed the Androids and iPhones, it advised against their use because they did not have the same security features of the BlackBerry, such as a remote wipe capability and encryption. After some research by the state’s client services staff, Good Technology’ s Good For Enterprise mobile system was brought in on a trial basis. By using its software, the state found that it could adequately protect sensitive software and introduce those new technologies, Schafer said.

Good Technology uses a software “container” to segregate confidential business data from the personal information on a user’s mobile device. The containers have their own encryption and policy controls. It can be used on any personal or government-provided device, including those without built-in encryption, because of the software’s own inherent security.

The software-based system has been running on a test basis within the government for six months, and it has been actively promoted within the government for the last two months. Based on initial reactions, the software is extremely popular — when it is marketed in conjunction with the iPhone, Schafer said. He admitted that the iPhones are the more appealing part of the package to state employees, rather than the Good software itself. “We just didn’t feel comfortable marketing one without the other,” he said.

The state is also planning to release two Android devices by the end of the year that also will use the Good software, Schafer said. In addition to Android phones and devices, Schafer’s office is also looking at tablet computers such as the iPad. All of these devices would be loaded with Good Technology’s intermediate software.

The state isn’t moving away from BlackBerrys; the iPhone and Android systems are just an additional option for personnel. However, Schafer said, the new devices are popular and there is a significant swing in user preference toward them.

There are about 1,000 BlackBerry users in the state government. Schafer said that his office is beginning to see an increased demand for iPhones, based on the program’s results over the last few months. He expects a 15 to 20 percent decline in BlackBerry use over time, but said that will mostly result from new users opting for the iPhone. He does not expect current dedicated BlackBerry users to migrate away from their preferred platforms suddenly or in large numbers.

Although West Virginia is issuing a variety of wireless devices to its personnel, the state must work out legal issues before people can begin to use their own personal devices at work. Schafer said that every state has unique Freedom of Information Act laws. The question his office is working out with the state general council is, if a user brings his own device to conduct state business, do FOIA laws apply to that device?

The state also is working out costs and rules regarding reimbursing or providing stipends to employees wishing to use their personal wireless devices. “What are the rules around that? For example, is it taxable?” Schafer said. Another issue is whether FOIA requirements are affected if the state provides a taxable reimbursement.

When a ruling is presented, Schafer said that it is probable that many people who now carry two devices will opt to use their own devices and carry one handheld — as long as they know the rules. Good Technology’s system is helpful here because it keeps the business data separate from a user’s personal information. In the event of a remote data wipe, this would only affect the business information and not a user’s personal data and contacts.

However, Schafer said that the state has not yet made a final decision on allowing individuals to use their own devices. “We think that’s the direction we’re going" he said. "But right now, we’ve got a technology that positions us to do that if that’s the final direction we decide to go in.”

inside gcn

  • A framework for secure software

Reader Comments

Sat, Jul 16, 2011

Single device is the way to go for many employees and Good is a great way to do it. When you leave the organization and your email is turned off, it will no longer be available on your personal device. Good does not require configuration of personal devices by IT staff so the support requirement is minimul. If corporate can do it securely, so can government. Now is the pivotal time for change on this issue.

Thu, Jul 14, 2011

When you are doing personal business isn't it more likely you will download a malware app to your iPhone? How do you know this malware won't infect your work environment when you log on to work? Wireless devices are easily hacked as demonstrated by the Murdoch owned British paper. If you are handeling sensitive data, why would you want to be blamed for exposing this information to hackers, organized crime, terrorists, or enemy states? For a mild exposure example, look to government reports that affect the stock market. For a more extreme example look to weapons design plans. Its not just the data that's on the device its the fact someone can record the keys to access the remote sensitive data and then have the device forward that authentication information to an unauthorized person.

Fri, Jul 8, 2011

My agency has also been piloting Good for Enterprise, and installing on users' personal smartphones. The govt data is absolutely kept separate from the personal information and apps. Our ROI is apx a year and half, based on govt not having to pay monthly wireless service for everyone who claims to "need" a berry. Each user has been able to activate their own device without issues after IT provisions them on the Good server. Many berry users need IT intervention to activate.

Wed, Jun 22, 2011 JC

What is wrong with not allowing personal devices to be used for gov't work? It should not be allowed no matter how many people want it. Carrying two devices is the way it has been and should continue to be. There is no reason for gov't emails to be on a personal device. Managing personal devices on a gov't network is an added overhead at a time when reducing costs should be the focus. The hours that will be spent by IT workers configuring personal devices could be better spent protecting against the pending cyber-attacks on the gov't.

Tue, Jun 21, 2011

I work for the gov't. I carry two devices and will continue to carry two devices even if the option is available to have one device for gov't work and personal business. I wouldn't mix the two. I advise carry two devices. Keep gov't and personal business apart. I have seen too many times when someone has fallen out of favor and management looks to find reasons to sack you that they will look at misuse of the gov't device for personal use. It doesn't matter if they have a personal use policy. Management will look for justification of abuse of the policy as an add-on to your problems. This is especially true when your problems are brought about by a political appointee trying to shove his weight around on the career employee staff. Don't set yourself up.

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group