You may be surprised to discover that many WFH/remote jobs are BYOD!

I held a WFH and BYOD job in various roles for over 4 years. It began less than a month into the pandemic lockdowns. It would not have been WFH if not for COVID-19. In that regard, I was highly blessed.

The recruiting process was notably vague. I was asked if I had a computer that I could run software on. It turned out that they really wanted us to be running Windows (Apple Silicon was incompatible) but I was running Ubuntu and nobody really batted an eye, because I ensured it was interoperable.

We were never required to install MDM or any corporate software. They never spied on us or collected any data from our BYOD. Any metrics were collected server-side at their web apps. I felt highly trusted. But there was indeed no "work laptop" and we could either BYOD, or forget having a job at all.

This was also during a period of rapid, widespread MFA adoption. Our managers were keeping us in the loop whenever MFA was implemented for corporate systems. Late in the game, our 3rd-party payroll implemented MFA very poorly. I informed the management that they were on thin ice, because they had irrevocably encroached onto a device which was reserved for personal use only. I told them, it is unacceptable to require a smartphone for a role that neither provides a smartphone, nor notified us in advance that it's required for keeping our jobs.

I kept scrupulous separation of work-related data and activities. I had separate accounts on each device. For work, I logged out of my personal account and logged into a work-only account. Unix permissions handled the rest. Sometimes, it was darned inconvenient.

I came to understand that if my employer were ever sued or involved in criminal prosecution, my devices could've been subject to subpoena and confiscation. This was the really crazy part. I had often used personal devices, and accounts, and my phone, for volunteering at church. We had no choice there, either. But you can easily imagine church, or a publicly-traded company, to become embroiled in some legal action. And if my devices were deemed evidence, I'd forfeit them, possibly for good! Thankfully, this has not come to pass.

There is probably no guarantee, even if you're 100% using employer-dedicated hardware at home, that your personal devices wouldn't be swept up in a subpoena or search-and-seizure. But you should always consider long and hard, with any BYOD situation, that mingling your personal stuff with your employer's stuff is playing with fire. Don't get burned.

When COVID-19 hit, the only prep my employer had was that everyone had laptops and we had basic VPN infrastructure. The first week or two were chaotic. Everyone had to provide their own high-speed Internet. Eventually they let us come in small groups to the office to bring home monitors, keyboards, and mice.

Our company was never BYOD, but they were pretty loose about personal hardware. They didn't provide or require phones, but to get office mail, documents, etc. you had to have management software on your phone or tablet. You couldn't connect your own computer to the VPN.

We came back to work in mid-2021. In early 2022 we had a ransomware breach on a Sunday evening. If you happened to have your laptop with you (I did), you could eventually do some WFH stuff, after certain servers were certified clean (they never told us, but indications were someone succumbed to a phishing attack). Otherwise you were SOL until they either certified your machine had been turned off or was otherwise certified clean, or you got a brand new laptop.

Once we were back in the office (again), things were stricter...no USB drives allowed, for instance, and software installs were more tightly controlled. But the phone/tablet policy was the same -- even if you were on call, you had to provide your own phone. MFA could be on your phone or software on your laptop, and again you weren't required to have company software on your phone.

Fortunately all my employment contracts thus far have been "the company shall provide all necessary equipment for work" and prohibition of using personal devices, which I have cited a few times when asked to do otherwise. Few people seem to understand the legal implications or downplay them, but IMHO it's best to keep a strict "firewall" between company and personal.

The timing seems a little off - Apple Silicon was only announced 6 months after the COVID lockdowns started.

Overall the point stands: the separation of personal vs work devices must be absolute.