Forrester: act now to stamp out BYOD risks.

• Position: BYOD - Bring your own device

If you can't beat them, join them." That adage fairly summarizes the results of a recent Forrester study of the legal implications related to a bring your own device (BYOD) policy, "Navigating the Legal and Compliance Applications of BYOD." According to a January 13 Forrester blog by David Johnson, a co-author of the study, technology attorneys participating in the study agreed that "once you learn that BYOD is happening in your organization, you have a legal obligation to do something about it, whether you have established industry guidance to draw on or not." In other words, you must take action to minimize the risk.

If only it were as easy as it sounds. As pointed out by Johnson:

* The more restrictions you put in place, the more incentive people will have to work around them and the more sophisticated and clandestine their efforts will be.

* There is no data leak prevention tool for the human brain, so arguably the most valuable and sensitive information walks around on two legs and leaves the building every night. Accepting this is important for keeping a healthy perspective about information risk on employee-owned devices.

Despite the challenges, organizations need to address the issue. Intellectual property misuse and accidental data loss are the top BYOD risks cited by Forrester. Patent, trademark, and copyright infringement may be very common, wrote Johnson, but they also are next to impossible to police with technical controls.

For example, Johnson wrote, if attorneys can prove that employees are using software that is not properly licensed for the organization's business purposes, it can be considered "willful and illegal misuse of someone else's property," and the organization can be held liable for past licensing fees and damages.

According to Charles F. Luce, Jr., partner at Moye White in Denver, it doesn't matter whether the employee or the organization owns the device on which the software is installed. Charles Gray, practice manager for Accuvant's risk and compliance business, added that any device used in a regulated business needs to adhere to the same regulations and industry standards as company-owned equipment.

...