A new policy at my work is being drafted regarding email access on phones. A requirement will be that the phone must automatically have all data erased after a certain amount of failed login attempts. Let's ignore the fact that it's pretty silly to a.) be allowing work email access on personal phones when such stringent expectations are in place, and b.) expect to be able to enforce something like this across a variety of phone platforms. Is it possible to set this up in vanilla Android without any apps?
The problem is that wiping data requires to overwrite it. On todays devices with lots of in-device flash memory and large SD-cards this can take a while - up to several hours. This leaves a lot for the attacker to interrupt this process and try again. Therefore wiping triggered by false login attempts is only reasonable if your data is encrypted. Then you wipe the device by simply erase the key from memory that is required to read/write your data.
Since Android Honeycomb (3.0) you have the possibility to encrypt all your data and to erase the device if the wrong password/pin has been entered several times. Therefore what you want to achieve is only possible with android tablets at the moment. For smartphones you have to wait for Android (4.0) Ice Cream Sandwich.
Apparently, this might not be a built-in security option in the OS itself, but Exchange ActiveSync can enforce this requirement.