Java Zen:Thinking Out Loud Friday, 2024.03.29
People will do tomorrow what they are doing today because that is what they did yesterday.

2007.10.30

Project Valour-IT – 2007

It’s time again to contribute to Project Valour-IT (Voice-Activated Laptops for OUR Injured Troops). Like last year, I’ve kicked in $100 and joined the Marines (gotta support the boots on the ground) lead by Soldiers’ Angel – Holly Aho.

This is a good use of technology. The voice recognition software is quite impressive and continues to improve.

Please note:

Division among military teams is purely for the purpose of friendly competition. Any blogger may join any team and all money raised supports the wounded as needed, regardless of branch of service.

2007.10.09

Nothing Says “We Care!” To Your Customers Like A Good CYA Strategy

Saw this article on the front page of the September 7-13 dead tree edition of the Denver Business Journal: “Rising laptop thefts push prevention initiatives“.

It’s not enough simply to call in the IT people or have an expert run a “penetration test” of your company’s network, say lawyers who specialize in data security.

They insist that executives need legal as well as technical advice up front. They say companies face new data-security laws as well as evolving legal notions of what precautions they need to take.

That sounds really good. It’s a difficult task and requires a team effort. But hold on there…

[Bryan Cunningham, a principal of the Denver law firm Morgan & Cunningham] cites a key advantage to bringing in lawyers up front: “If you hire a law firm to supervise the process, even if there are technical engineers involved, then the process will be covered by attorney-client privilege.”

He noted that in a lawsuit following a data theft, plaintiffs usually seek a company’s records of “all the [data-security] recommendations that were made [before the breach] and whether or not you followed them. And if you go and hire technical consultants only, all that information gets turned over in discovery. [But] if you have it through a law firm, it’s generally not.”

So there you have it. Park the problem behind a lawyer straight away. But why stop there? Why not implement a corporate-wide strategy to shield all manner of mistakes, mishaps and negligence behind attorney-client privilege. Have attorneys supervise your employees and “consult” on safety issues. Cover the whole supply chain and service path while your at it. No more embarrassing or expensive issues falling out of discovery related to bad employee behavior, OSHA violations, service incompetence or product problems.

In actuality, this article is poorly titled. This isn’t a “prevention initiative” for data security, it’s a preemptive initiative for corporate irresponsibility.

This approach is a disincentive for businesses to provide adequate data security. It’s much more cost effective to pay a team of attorneys to “supervise” the data center than it is to implement and maintain a data security strategy (as the article notes, the threats are constantly changing and so must the security strategy.) What does a corporation care about 100,000 customer credit card records they let loose into the wild if they’re shielded by attorney-client privilege and not likely to be held accountable or responsible? Rather than caring about prevention, they will care more about squashing any news of such a loss. And this, I grant you, is a brilliant strategy for accomplishing just that.

[Edit History]

2008.05.26

Grammar fixes.


All content copyright © 1994 - Gregory Paul Engel, All Rights Reserved. The content or any portion thereof from this web site may not be reproduced in any form whatsoever without the written consent of Gregory Paul Engel. Queries may be sent to greg dot engel at javazen dot com.

No posts for this category or search criteria.