Opinion

Charting Ethical Waters

Ethics-based security policies will prevent you from being submarined by privacy problems.

By David H. Holtzman

November 08, 2002 — CSO — As the captain of security, the toughest decisions that you make are those that affect other people. The most problematic decisions lie in the murky and turbulent waters of privacy. Privacy considerations will weigh you down with requests for employee or customer information thrown by business units. The burden comes from the knowledge that each time you make one of these ad hoc decisions, you are encouraging activities that might sink the company some day.

The best way to avoid that is to have a culture that empowers employees at every level to be the first line of defense on privacy issues. The staff is likelier to have an instinctive understanding of what's acceptable if business practices are aligned with normal expectations of ethical behavior. Security policies based on ethics are also stronger than shortsighted guidelines designed to profit from legal ambiguities. They're less likely to spring a leak when they're jabbed, and there are lots of ways to get poked if you're running security in today's business climate.How would you react to the following scenarios?

• A customer service manager tells you that she thinks that an employee is hunting for another job, and she wants you to help her look through his e-mail.
• A junior marketing manager tells you that he has made a deal to provide customer information to a strategic partner, and he wants you to pull the necessary information and give it to him on a CD.
• You install a video surveillance system outside your building and realize that employees are fooling around in the parking lot after hours.

I've had to deal with each of those situations at different points in my career, and I did what I suspect most of you would doI asked the company lawyers. Let me save you the trouble and tell you that you won't get any real help from them on most privacy issues (caveat: I'm not a lawyer, I don't even play one on TV). It turns out that legally, you can pretty much do what you want. There's no law protecting employee e-mail or most kinds of customer information, and video surveillance is all too quickly becoming a fact of life. Look for guidance elsewhere.So if it's not illegal you can do it, right?That attitude has gotten several companies into trouble recently. Class-action lawsuits and government litigation can take root even in a legal wasteland. There have been numerous cases of privacy-related settlements negotiated by the Federal Trade Commission on behalf of several states.

• Email
• Print
• Comments
• Digg This
• SlashDot

• Corporate Ethics Programs and Security
• Ethics and Compliance Programs: What It Means to Comply
• Software Vulnerability Disclosure: The Chilling Effect