Microsoft Outlook iOS and Android App Security Alert Feb 3, 2015 16:30 – 16:45 PT

Microsoft recently acquired the mobile application Acompli and has rebranded it as “Microsoft Outlook” for iOS and Android. This is a concern for staff and faculty at UBC who choose to use the application, because it is not compliant with the Freedom of Information and Protection of Privacy Act (FIPPA) and UBC information security policies and standards.

After analyzing the app, several privacy concerns have been raised, including:
– The app stores a copy of the user’s credentials on servers outside of Canada
– Message content is stored on servers located outside of Canada (FIPPA violation)
– After an account is deleted, Microsoft’s servers continue to attempt to retrieve email
– The app does not enforce ActiveSync security policies (e.g. device passcode requirements, ability to wipe remotely, etc.)

On Feb 3rd, 2015 between 4:30pm and 4:45pm, UBC IT will be blocking the app from accessing FASmail and the Student & Alumni Email service. If you have already downloaded the app, we recommend that you immediately change your CWL password and remove the Outlook app.

More information about the application block can be found on this webpage: http://it.ubc.ca/services/email-voice-internet/ubc-faculty-staff-email-fasmail/fasmail-privacy-concerns