Burner Phones: Building a Case for Corporate Use
Topics: Device Deployments Enterprise Mobility Management (EMM) Mobile Strategy
I’m sure for most individuals, the phrase “burner phone” would trigger thoughts of drug dealers, the mafia, or at least an episode of your favorite crime drama. So why would Vox Mobile, a global leader in Managed Mobility Services for corporations and government agencies, raise such a subject? Simply put, there are circumstances in which the “good guys” should use a variant of the burner phone. Specifically, when executives or individuals with sensitive information travel to international locations that would be deemed high risk for corporate espionage. In such a case, it may be prudent to physically change devices before and/or after the travel.
Are Burner Phones Risky Business?
To be clear, the perceived threat is that third-parties could compromise the device with malicious software, alternate firmware, key loggers, and other means. Their objective would typically be eavesdropping on voice and data communication. While it may seem far-fetched, for many large organizations and government agencies, such a threat is real and becoming increasingly severe. On January 29, 2019, the US Justice Department filed criminal charges against Huawei, the Chinese behemoth with annual revenue exceeding USD $92 billion. Among those charges were accusations that Huawei attempted to steal trade secrets from T-Mobile and that they have bonuses for employees who collect confidential information on competitors. Such a high profile accusation has shed light on these practices and emphasizes that perhaps they are not isolated.
Corporate Burner Phones for Data Security
I first came across the burner phone use-case during a consulting engagement with a large Oil & Gas company in 2013. At the time, international travelers to China or Russia were required to swap their basic cellphones for temporary devices, primarily due to concern around espionage within those two countries in particular. Due to the complexities at the time, such a procedure was not really feasible for smartphones such as iPhones, Android, or BlackBerry. As the years progressed, the feasibility actually decreased due to increasing use of mobile applications and personalized settings. Effectively, an individual’s mobile device became so customized and individual that rapid transition was no longer possible.
I would argue that in some organizations, with some segments of users, the practice of burner devices is now a necessity, regardless of logistical and technological difficulty. So, how can it be done?
Firstly, the applicable segment of users and the high-risk destinations need to be identified.
Next, if the segment is permitted to use a personal device for corporate communication, also known as Bring Your Own Device (BYOD), they must not be permitted to take that device with them when they travel. Such an action would entirely defeat the purpose of this endeavor.
How to Implement Enterprise Mobile Burner Program
Obviously an Enterprise Mobility Management (EMM) or Mobile Device Management (MDM) solution would be required. The solution would need robust implementation of advanced features such as automatic installation of corporate applications, WiFi/VPN/Certificate profiles, passcode/restriction profiles, per-app-VPN tunneling capability, and of course the email client and configuration. Preferably, the corporate data would be contained further within the device. However, since the devices are going to be corporate-owned, underlying containerization is not as critical.
The most critical part of the operation would be extremely robust depot/swap capabilities. SIM-unlocked cold standby devices will be required and rapid turnaround will be needed from the moment a travel request is made. The user’s permanent device could be maintained in-country and onsite which would allow for a rapid return to full productivity when they are back in country. When the user returns, the burner device will not necessarily be destroyed but could be “scrubbed” in compliance with top security standards such as those outlined by NIST Special Publication 800-124. Of course, details and processes would have to be precisely determined and service levels established. If this procedure can also be augmented with the swapping of regional SIM card or the addition of carrier “travel packs,” then this whole exercise would also have the added bonus of significantly reducing roaming changes.
Establish Standard Operating Procedures
Communication and training of the end-users will be essential. Fortunately, the designated user segment should be fairly small and will likely be equipped with specialized support personnel and perhaps executive assistants. This should allow for more consistent adherence to the new procedure.
Finally, auditability of the new procedure would be necessary. Again, the EMM solution could be an essential tool in this case. A geo-fence could be established for any travel outside of the country. If a device lands in a high-risk country unexpectedly, then remediating action can be taken.
Clearly the above is only a high-level overview of a particularly niche requirement, but it may still be a requirement nonetheless. As is the case with many of these use-cases, it can only be executed effectively with very high maturity across the breadth of your mobility program. EMM tools must be in place and configured effectively, mobility lifecycle management must be exceptional, and effective governance must be in place. No easy task but nothing about mobility in 2019 is easy.