Technology & Innovation

Citrix employees are free to choose

January 23, 2013

Global

January 23, 2013

Global
Our Editors

The Economist Intelligence Unit

_____________________

BYOD, or “bring your own device” policies gained traction several years ago. Employers and employees alike realized the potential efficiency gains to be had by workers using their own state-of-the-art laptops, tablets and smartphones for work purposes, not to mention the cost savings in reducing the need for providing and supporting company-owned devices. Software-maker Citrix was an early adopter of the trend. 

Through a program launched five years ago, Citrix encourages its employees to purchase their own computers for use at work. Qualifying employees are given a $2,100 stipend, which they can use along with their own funds to buy any laptop they choose directly from a store or manufacturer. The employees can keep the computers they purchase even after they leave the company, and can apply for a new stipend every three years to purchase new machines and otherwise stay up-to-date with the latest technologies. Employees must apply to take part in this "official" BYOD program, but today 40% of the Santa Clara, California-based company's roughly 7,000 employees participate. In addition to the stipend-based program, Citrix informally allows any of its employees to bring their own tablets and smartphones to work, although the company neither helps pay for their purchase nor provides technical support. According to company CIO Paul Martine, a total of 15,000 officially and unofficially supported employee-owned devices are in use at Citrix. 

Citrix aims to keep its support of BYOD simple, according to Mr. Martine. Any device that can run Citrix’s remote access, or virtualization, software is allowed and even “the tax guy” can download, install and set it up, he says. The software allows users to remotely access company data, applications and desktops over a secure network connection, but never actually downloads or saves corporate data onto the user’s device. If the device is lost or stolen--or the employee leaves the company--the IT department can simply withdraw access to prevent data theft or loss. Employees must also buy extended service contracts to cover future repairs, install and keep up to date anti-virus software and passwords and adhere to other basic corporate security measures. As part of the acceptance process, applicants must receive approval from their managers, ensuring that some accountability for data security is embedded into the administration process.

Soothing internal concerns

When Citrix decided to institute the policy in 2008, Mr. Martine and his team consulted company lawyers, human resources (HR) and IT security experts to understand and satisfy their doubts. The only misgivings came from HR, which fretted that employees using their own machines might be unaware that corporate policies governing intellectual property (IP) theft, inappropriate material and corporate governance were still in force. To mitigate these concerns, the IT department added a clickable box to the online application for the program, which explained that corporate policies were in effect on employee-owned machines. Now HR is a major supporter of the program—and the grant offered to those who participate. “[They] use it when they do college recruitments,” Mr. Martine says. “When you come to Citrix we're going to let you bring your own devices and give you a stipend so you can buy a laptop of your choice and use it for both work and personal life.”

The stipend-purchased, employee-owned machines save Citrix 18% of what it would spend to procure and support a pool of fully company-owned computers, according to Mr. Martine. He says the savings are derived mostly from reduced technical support, now restricted to troubleshooting wireless access, anti-virus and Citrix software help. Questions are answered via phone, blog and an online discussion board where employees can respond to each other’s inquiries. In fact, support is so hands off that the company has assigned only 10% of one employee’s time to support the entire program.

The program has been a boon for IT’s workload. “For us it relieve the burden of managing so many endpoint devices, which is a time-consuming and low-value task,” says Mr. Martine. As for employees, “I know they're happier. We've gotten a ton of accolades around this. I literally have people stop me in the parking lot and tell me they're just thrilled with it and this has been going on for years."

Why hesitate?

At many workplaces that have instituted BYOD policies but don’t use virtualization software, IT departments monitor user behavior and control their employees’ devices. This melding of work and personal life--and the surveillance it entails--is a threat to employee privacy, according to Peter Eckersley, technology projects director at the Electronic Freedom Foundation, a technology-focused civil-liberties organization. Yet he believes that remote-access software has adequately protected privacy. “It creates a fairly strong partition between what people do on their work computer and what they’re doing the rest of the time,” he says. “So corporate IT departments aren’t seeing into the rest of their employees’ lives.”

There are still thorny legal issues regardless of what software is used or policies enacted. For example, if an employee sends harassing emails or texts to another employee on his or her personal device, it’s a gray area, according to Michelle Dennedy, chief privacy officer at IT-security company McAfee and a board member of the International Association of Privacy Professionals. “How much of that information is corporate information and is available for forensic review?” she asks. “If you want to investigate that device after terminating an employee, you have to go through the police and get a warrant or sue if they don’t surrender it voluntarily.”

Unlike Citrix, many companies have not instituted a formal BYOD policy, perhaps due to these concerns. According to a 2012 report by the consulting firm McKinsey & Company, only 30% of large companies formally allow employees to use their own devices. At the same time, the firm has found that 80% of workers report that they are using their own smartphones for work-related tasks. “Whether you try to control it or not, people are going to find a way to bring in those personal devices," says Mr. Martine. “It's not something you can fight; you have to embrace it.”

Enjoy in-depth insights and expert analysis - subscribe to our Perspectives newsletter, delivered every week