4 ms·

>The problem is that executives rarely have enough overview over what is happening at the lowest layers of a company to ensure that data leaks could not happen,

by setr 8y ago

>The problem is that executives rarely have enough overview over what is happening at the lowest layers of a company to ensure that data leaks could not happen, they might want to set the tone and environment but that by itself is absolutely no guarantee. But given the law and personal risk, they’re now incentivized to find a solution to that problem (in the same fashion that employee coming forward creates a PR risk). If this weren’t a possibility, and a viable one at that, then data leaks would be an inevitability, and it wouldn’t be sensible to fine the company (they can’t get insight into the matter, so they can’t do much to stop it from occurring; you’re going to fine them for succumbing to a natural disaster?) If you don’t expect top-down insight to be possible, then I’m not sure how your carrot would plug the leak. It would announce it and let people prepare for the damage, but not stop it fron occurring again (the only people with insight are middle and lower; the lower you go, the less affected by the fine). But ofc it is possible, and it is sensible to fine the company, and I don’t see why it wouldn’t be sensible to expect a c_o to have some insight into the matter. Ofc such a strong punishment as jailtime, on any data loss is too much, but data loss after not reaching some defined minimum standard of protection (essentially leaving it in a state where loss is expected) for the type of data? It seems reasonable to enforce larger punishments against the people in charge of ensuring that those minimums are met. Eg if security audits aren’t ever done, its negligence. If the data is important or even just large enough, its criminal negligence. tldr; your carrot has the same dependency as the stick: if one can hope to effect change, the other should too. (which is more fair/effective is a different matter)

jacquesm 8y ago
> But given the law and personal risk, they’re now incentivized to find a solution to that problem The only thing an executive can really do is issue a directive along the lines of 'we will do things this way', and then leave the interpretation of that directive to the lower ranks. Any mistakes in the implementation - even if all the interests are aligned - could lead to later accusations of mishandling of data. I think that by now we can conclude that security is a hard problem, and that even companies that do their best (not EquiFax) are at risk. Criminal negligence for executives is going to be very hard to prove, especially when a CEO could point to some directive that had the right intentions. Also great to see a 'defined minimum standard of protection', but that definition had better be ironclad if you expect people to serve jailtime when those standards are violated. I see another company every week and it is quite surprising how wide the range of security implementations is, from 'perfect' to 'incredibly sloppy', and I've yet to meet an executive that understood things well enough to know what risk exposure they had. Jailing such a CEO would just be petty revenge, and would not have the desired effect as an outcome. If you are going to enforce jailtime then punishing the CTO/CISO/CCO would be more effective, at least they have the relevant knowledge, and would be far better placed to effect meaningful change. We already have similar mechanisms for lower level employees violating various reporting laws regarding suspicious transactions (notaries, accountants, bank employees).
- jimnotgym 8y ago
  > The only thing an executive can really do is issue a directive along the lines of 'we will do things this way', and then leave the interpretation of that directive to the lower ranks. That is not really true. 1) Executives can allocate sufficient resources to data protection. 2) Executives can set up a data protection committee that has similar powers to the audit committee. In the UK this would normally be placed under the non-exec chairman's control. 3) Executives can insist on an external audit Corporate governance is complicated, but not impossible. Executives manage to keep control off the shareholders money, despite never touching it themselves. They can learn to do the same with data.
- setr 8y ago
  Again, if your belief is that the executive class can’t make meaningful change in this matter, (and I assume you accept that fines aren’t significantly felt by the lower ranks), then fining itself is unreasonable: the company itself can’t really do anything about it. We can let people know the data has been lost... but thats it. The fining is just petty revenge, for succumbing to natural forces. The PR hit too: why disclose the company? But obviously you do believe its possible for the company to change its data security practices. Obviously you believe theres a scale to protective efforts. Who better to enforce such efforts than the bosses? If not them, then who? What position is better to effect change.. than being in charge? I agree that on any data loss, severe punishment is too much, simply because it’ll eventually happen for even mundane reasons; but discovering as a result of loss that they never did anything proper to protect that data is a pretty damned good reason for larger punishment. I can agree that executives today have little to know insight on their data management practices, but I don’t at all see why they can’t have it tomorrow (or more likely, offloading that insight onto third party auditors, as you’d do for finances, gdpr compliance, and really anything you’re too busy to be personally involved in)

by setr 8y ago

jacquesm 8y ago

> But given the law and personal risk, they’re now incentivized to find a solution to that problem The only thing an executive can really do is issue a directive along the lines of 'we will do things this way', and then leave the interpretation of that directive to the lower ranks. Any mistakes in the implementation - even if all the interests are aligned - could lead to later accusations of mishandling of data. I think that by now we can conclude that security is a hard problem, and that even companies that do their best (not EquiFax) are at risk. Criminal negligence for executives is going to be very hard to prove, especially when a CEO could point to some directive that had the right intentions. Also great to see a 'defined minimum standard of protection', but that definition had better be ironclad if you expect people to serve jailtime when those standards are violated. I see another company every week and it is quite surprising how wide the range of security implementations is, from 'perfect' to 'incredibly sloppy', and I've yet to meet an executive that understood things well enough to know what risk exposure they had. Jailing such a CEO would just be petty revenge, and would not have the desired effect as an outcome. If you are going to enforce jailtime then punishing the CTO/CISO/CCO would be more effective, at least they have the relevant knowledge, and would be far better placed to effect meaningful change. We already have similar mechanisms for lower level employees violating various reporting laws regarding suspicious transactions (notaries, accountants, bank employees).

jimnotgym 8y ago
> The only thing an executive can really do is issue a directive along the lines of 'we will do things this way', and then leave the interpretation of that directive to the lower ranks. That is not really true. 1) Executives can allocate sufficient resources to data protection. 2) Executives can set up a data protection committee that has similar powers to the audit committee. In the UK this would normally be placed under the non-exec chairman's control. 3) Executives can insist on an external audit Corporate governance is complicated, but not impossible. Executives manage to keep control off the shareholders money, despite never touching it themselves. They can learn to do the same with data.
setr 8y ago
Again, if your belief is that the executive class can’t make meaningful change in this matter, (and I assume you accept that fines aren’t significantly felt by the lower ranks), then fining itself is unreasonable: the company itself can’t really do anything about it. We can let people know the data has been lost... but thats it. The fining is just petty revenge, for succumbing to natural forces. The PR hit too: why disclose the company? But obviously you do believe its possible for the company to change its data security practices. Obviously you believe theres a scale to protective efforts. Who better to enforce such efforts than the bosses? If not them, then who? What position is better to effect change.. than being in charge? I agree that on any data loss, severe punishment is too much, simply because it’ll eventually happen for even mundane reasons; but discovering as a result of loss that they never did anything proper to protect that data is a pretty damned good reason for larger punishment. I can agree that executives today have little to know insight on their data management practices, but I don’t at all see why they can’t have it tomorrow (or more likely, offloading that insight onto third party auditors, as you’d do for finances, gdpr compliance, and really anything you’re too busy to be personally involved in)