ESDC Cellular Services Directive

1. Effective Date and Annual Review

This Directive took effect upon its approval by the Employment and Social Development Canada (ESDC) Corporate Management Committee (CMC) on September 26, 2018, and was modified on November 25, 2019. It will be reviewed annually by the Innovation, Information and Technology Branch (IITB).

2. Audience

This Directive applies to anyone who requires or has been assigned an ESDC device to access cellular services.

ESDC includes Service Canada and the Labour Program, and is collectively referred to as “the Department” or “departmental".

3. Purpose

This Directive outlines the acceptable use of departmental cellular devices and services. It should be read in conjunction with the departmental Network Use Directive, Portable Storage Devices Directive, and Storage of Electronic Information Directive, as well as other policies and directives related to information management and security, access to information, and privacy (refer to References section).

4. Basic Requirement

4.1 Individuals who have been assigned a departmental cellular device to access cellular services must use the device and services in an acceptable and responsible manner, recognizing that:

  1. these devices are business tools to be used for carrying out departmental work;
  2. there are extra costs to the Department for usage over the base cellular plan (particularly from text attachments, excessive voice airtime, and roaming fees).

4.2 The devices that may be assigned, based on business requirements, include cellular phones, smartphones (such as Samsung, iPhone or BlackBerry), and cellular modems (such as MiFi).

5. Detailed Requirements

Individuals who have been assigned a device must adhere to the ESDC Code of Conduct, and to Treasury Board and departmental policies on network use, portable storage devices, information management and security, access to information, and privacy (refer to the References section).

5.1 Assignment of Cellular Devices

A device is assigned to an individual based on business requirements and job function in order to fulfill work responsibilities and further the departmental mandate.

  1. Cellular devices are corporate assets and must not be taken when an individual leaves the Department without first 1) receiving the approval of the Chief Information Officer (CIO), and 2) submitting proof of CIO approval when submitting a request to the National Service Desk to have the device processed (transfer of account, asset tracking, and to wipe the device of ESDC information). (Refer to the Separation Clearance Process.)
  2. An individual changing job function within the Department is not automatically authorized to bring the device with them to the new position. The requirement for a device for the new position must be reassessed by the new supervisor, and a new justification must be submitted based on requirements (refer to section 7 - Submitting a Request for Service.) The only exception is for devices assigned to an individual at the director level, or higher, who is remaining in the Department at that level or higher.
  3. An individual who will be away from the office for an extended period of time (more than three months) and who will not be in a position to perform the job function for which the device was provided and will not be required to remain in contact with the department, must return the device to the direct supervisor; the supervisor must return the device to Mobile Phone Support (refer to section 7 - Submitting a Request for Service). This includes individuals on career development leaves such as language training, or individuals on parental leave, long term sick leave or any other long term paid or unpaid leave. If the manager determines that the employee must be in constant contact with the office during an extended period of absence, this may be authorized at the discretion of the Director. If the individual is a manager or above, they must seek authorization from their direct supervisor.
  4. When an individual is no longer using the cellular device regularly to perform the job function for which the device was provided, they must return the device to their direct supervisor because there are ongoing costs for an unused device, and the device can be assigned to someone else. The supervisor must return the device to Mobile Phone Support (refer to section 7 - Submitting a Request for Service). IITB monitors for insufficient use.

5.2 Proper Use of Cellular Devices

  1. Information that is designated Protected A or B can only be transmitted over cellular devices or services using approved corporate applications, such as work email or BBM Enterprise (BBME). Information Protected B must be encrypted when emailing to recipients located outside the Department. Information designated Protected C or Classified must not be transmitted over cellular devices by any means (voice, email, or text message). If encryption functionality is required on the device, refer to the procedures for enabling encrypted emails on your mobile phone on iService.
  2. Only unclassified information can be sent via text messages because it is not encrypted.
  3. The authorized, secure application for device-to-device messaging is BBM Enterprise (BBME). PIN-to-PIN messaging is not authorized, and should not be used.
  4. Any information—including the content of emails and BBM Enterprise messages—that is of business value must be transferred from the device to an appropriate repository.
  5. Information stored on a mobile phone may be subject to examination under the requirements of a litigation hold or Access to Information and Privacy (ATIP) legislation.
  6. Individuals are responsible for understanding and minimizing the costs associated with cellular device usage. IITB monitors for excessive charges.
    • Always use landline or VoIP (Voice over IP) telephone instead of a mobile phone when there is a choice, to avoid airtime charges, regardless of work location.
    • Devices must not be used to call outside Canada when regular telephone service (landline or VoIP) is available.
    • Individuals who live or travel near the US border must be conscious that roaming charges could accumulate even while on the Canadian side of the border. To minimize charges, individuals should turn off data services while roaming when not required to carry out functions related to their job.
  7. When travelling outside of Canada, whether on official authorized business or on personal travel, an individual must have prior authorization from their DG, or higher, in order to take and use their device. These requirements have been adopted for security reasons and to avoid the high costs associated with roaming charges. Roaming charges are incurred the entire time that a device is turned on when out of the country, regardless of whether or not the device is being used. When traveling outside of Canada, data services while roaming should be disabled (enable airplane mode) and the device should only be used through a Wi-Fi connection, in order to minimize charges incurred whenever possible. IITB monitors and reports on unauthorized business and personal use outside of Canada.

  8. There are countries where it is forbidden to take devices, based on the risk and/or threat levels in those countries, while in some cases temporary equipment may be issued; refer to Security Briefings for International Travel on iService.

    If there is a legitimate business reason that requires an employee to use their device while on personal travel outside the country, the Authorization for use of departmental mobile phone while on personal travel form (DOCX, 334 KB) must be completed to request approval. IITB monitors and reports on unauthorized business and personal use outside of Canada.

  9. Devices must be safeguarded from damage, theft and improper use. If a device is misplaced, lost or stolen, the National Service Desk must be advised immediately to open a ticket so that service to the device can be suspended. Service can be restored if the device is found again.
  10. If the device has lockout features to restrict its use, these must be activated.
  11. Personal SD cards and personal SIM cards must not be connected to cellular phones or smartphones, or to the departmental electronic network, under any circumstances. Only departmentally-issued SD cards and SIM cards may be used. Refer to the Portable Storage Directive.
  12. If a device has a camera, it must not be used to capture sensitive documents (photos are not encrypted), or to photograph people without their consent (use the Personal Release and Consent Form (RTF, 123 KB) if appropriate).
  13. While operating a motor vehicle, mobile phones must only be used in accordance with local laws.

5.3 Permitted Personal Use of Cellular Devices

Examples of activities that may be carried out as needed for work-related purposes, but must be limited for personal use and conducted on personal time (refer also to the Network Use Directive):

  • Text messaging or personal emailing.
  • Social media (such as Facebook, Twitter, and Instagram).
  • Bluetooth, Wi-Fi, BBME.

5.4 Activities That Are Not Permitted

Individuals must adhere to the requirements of the Network Use Directive when using cellular services. In addition, the following activities are not permitted:

  1. Activities that incur any additional costs for the department, including:
    • downloading or streaming content, such as videos, music, movies or podcasts (work-related videos are permitted);
    • unauthorized roaming;
    • sending text messages with attachments or multimedia messages (MMS)
  2. Smartphones and cellular phones (whether ESDC-issued or personal) are blocked from connecting to the departmental electronic network through desktops, laptops, or tablets, in order to safeguard departmental information holdings. However, they may be plugged in to charge the battery.

6. Definitions

Cellular device
May be a cellular phone, a smartphone, or a connecting device such as a cellular modem.
Cellular phone (mobile phone)
A device which only provides access to voice and texting features.
Data services while roaming
Data roaming is a general term referring to the ability for a cellular or smartphone to automatically make and receive voice calls, send and receive data, or access other services, when travelling outside the geographical coverage area of the home network (i.e. Canada).
Smartphone (mobile phone)
A device which provides access to voice, text, tethering and data (access to the Internet) features, and possibly work email.
Tethering (hotspot)
Is a feature which allows a smartphone to be used as a wired or cellular modem to allow a computing device (usually a laptop or tablet) to connect to the Internet.
Cellular modem
A device which is plugged into a computing device and provides the ability to connect to the network and/or Internet.
Mobile Phone
Either a cellular phone or a smartphone.

7. Submitting a Request for Service

To submit a request, open a ticket with the National Service Desk.

8. Monitoring and Reporting

The Department monitors and reports on individuals’ use of departmental cellular devices and services on a monthly basis, in order to enforce acceptable use of departmental resources.

  1. When monitoring shows excessive charges for an account, the individuals’ excessive use will be referred to their supervisor, as will inappropriate or unauthorized use of voice, data, and texting services, including roaming fees incurred while traveling outside of Canada. See 5.2 f) and g).
  2. When monitoring reveals insufficient use of a cellular device over a three-month period to perform the job function for which the device was provided, IITB will suspend service to the device, and will contact the employee to recover the device. If there is no response, or a refusal to return the device, the supervisor will be advised. To reactivate service, the employee’s Director General (DG) will be required to submit a rational along with their approval. See 5.1 d).
  3. When an individual no longer needs the device to perform their job function, or is going to be away from the office for an extended period, they must return the device. See 5.1 c).
  4. If a cellular device is not returned when requested, IITB will suspend the account, lock the device remotely, and advise the employee’s supervisor.

9. Consequences

Individuals who have been assigned a cellular device have signed an agreement to comply with this Directive. Failure to comply may result in administrative and/or disciplinary measures being taken, up to and including termination of employment.

In addition, individuals may be required to reimburse ESDC for excessive costs incurred through personal use of cellular devices.

10. References

ESDC

Treasury Board