Legal concerns are just the latest in a series of questions that have arisen throughout government as a growing number of federal agencies tackle bring-your-own-device (BYOD) policies. The Federal Chief Information Officers Council drew up a 43-page document last year in an effort to help agencies navigate the challenges of moving toward BYOD.
"If I have that device and it's mine, what are my rights as a private individual, and what are my rights and responsibilities as an employee, and how does that play with the information, if you will, on a dual-use device?" acting VA CIO Stephen Warren said in a press call Wednesday. "We actually haven't gotten a clean read on that."
Warren said that the agency will be holding off on its BYOD plans until it has dealt with that question. "I would hate to lay out false expectations for the department as to what [information it] can get to, or to our employees in terms of privacy," Warren said.
[ BYOD concerns extend to businesses and agencies of all shapes, sizes and sectors. Is this The End Of BYOD As We Know It? ]
In detailing the agency's concerns, Warren pointed to questions about how personal devices and personal information would be handled in the case of investigations by the agency inspector general or general counsel.
For example, questions arose as to whether and to what extent investigators may confiscate personal devices and then investigate private, personal information on those devices, and whether any such investigation must take place pursuant to a subpoena of personal as well as VA information on the device.
The VA has been working through numerous concerns as it has inched toward a BYOD policy for the agency. Last year, the agency took a significant first step by issuing a contract for a mobile device management (MDM) system that Warren said has been delivered and is up and running. According to Warren, the MDM system is being used with a number of pilots, including iPads that VA caregivers use.
Warren said that the VA is also wading through questions about how to prevent mobile device sprawl. Since mobile devices require software licenses for enterprise software just as if they were desktop computers, costs could quickly add up if employees were issued or bringing into the office three or four devices per employee. "We're on this path of, you don't get three devices, you have to winnow it down and make a decision on what you're going to do from a care delivery or work delivery standpoint," Warren said. "We're just trying to make sure folk aren't running around with four different devices with four sets of licenses, because there is no value to the taxpayer with that."