Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Cybersecurity topic
No spam. Unsubscribe anytime.
Polk County officials defend ban on personal-device email access, offer county devices instead
Summary
County staff recounted a past phone compromise and told the board personal devices increase security and legal risks; supervisors asked for cost and privacy details and staff proposed issuing county phones/tablets as a safer alternative.
Polk County board members spent much of their January meeting reviewing the county’s approach to email on personal devices and heard staff recommend continuing a policy that prevents county email from being accessed on privately owned phones and tablets.
A county presenter recounted a previous incident when a compromised personal phone allowed an attacker access to a county Outlook account and nearly resulted in a fraudulent bank draft. Staff said the county’s IT director estimates the attack surface for personal devices is about "two to three times" greater than for county-issued devices, and that personal-device use complicates open-records compliance and discovery in litigation.
The presenter said the county’s current practice is to disallow personal-device access and offered two practical alternatives: issue county phones or tablets configured with security controls (staff cited an estimated monthly cost of about $40–$45 per device), or allow personal-device access only if the county’s security software is installed — a step staff said would let the county monitor and control the device and would raise privacy concerns for users.
County counsel and staff explained legal risks: if county business resides on a personal device, the device can become subject to discovery or seizure in litigation, creating exposure both for the individual and for the county. A supervisor asked whether a signed waiver making a user personally liable for losses would protect the county; counsel said a waiver would not remove county exposure.
Supervisors raised practical objections: the burden of carrying multiple devices, the need to use devices while traveling, and concern that county-managed devices might limit personal privacy or local browsing. Several asked staff to return with more precise cost comparisons and technical details about device management and open-records procedures. Staff said they would consult the IT director and return with follow-up information.
The board did not adopt a new formal policy during the meeting but heard and discussed staff’s preference to continue segregating county and personal communications and the practical option of providing county-managed phones or tablets for supervisors who want them.
