How should smartphones be managed during confidential meetings?
Smartphones should be managed according to the sensitivity of the information being discussed and the level of confidentiality required. Depending on the risk, security protocols can range from requiring devices to be switched off, to removing them from the meeting area or placing them within an appropriate isolation-management enclosure such as MuteCase.
Explanation
Smartphones combine microphones, cameras, wireless communications, local storage and sophisticated software in a single portable device. Their presence can therefore introduce several different risks to confidential conversations.
A device-management policy should begin by identifying which of those risks need to be controlled. For some meetings, preventing interruptions or accidental recording may be sufficient. More sensitive environments may require stronger assurance that smartphones cannot capture information or communicate with external networks.
The appropriate procedure can therefore vary considerably. What matters is that the controls are proportionate to the sensitivity of the discussion, and are applied consistently rather than relying on informal assumptions about individual smartphones.
Why it matters
Confidential meetings may involve commercially sensitive information, legal discussions, investigations, government matters, intellectual property, personnel issues or decisions that have not yet been made public.
Smartphones are routinely carried into professional environments, which can make their presence seem insignificant. From a security perspective, however, they are powerful and capable communication risks, and this risk needs to be understood and managed.
Having a defined protocol for managing smartphones helps organisations establish clear expectations for participants, and reduces reliance on individual behaviour or assumptions about how a particular device has been configured.
Practical considerations
Organisations should match their device-management protocol to the sensitivity of the meeting. Possible measures include requiring devices to be silenced or switched off, collecting them before entry, storing them outside the meeting room or using security measures such as placing all the smartphones in a secure isolation-management vault such as MuteCase.
The protocol should also consider other personal electronic devices with similar capabilities, including tablets, laptops, smartwatches and connected accessories.
For higher-security environments, wireless communication and local audio capture should be considered separately. A measure that prevents a device from connecting to a network does not necessarily prevent it from capturing information locally. Again, a comprehensive isolation-management vault such as MuteCase will address this also.
Whatever approach is selected, a clear and consistently applied policy can provide greater assurance than relying on participants to make individual decisions about their devices.