Monthly Archives: June 2017

June 22, 2017 · 2:29 pm

Who checks the checkers?

Compliance with law and compliance with policy and procedure are relatively easy to establish.  But compliance with ethics?

“Journal Reporter Fired Over Ethics,” The Wall Street Journal, June 22, 2017 A2.  A foreign affairs reporter at The Wall Street Journal was fired for something related to “his dealings with an aviation tycoon whom he had cultivated as a source.”  Further details weren’t provided.  It may have been the offer from the tycoon of a share in one of his companies.  Perhaps he wasn’t totally honest with the paper about something (but we don’t know what, yet).  A violation of journalistic ethics?

All this may have been revealed following a hack of email or text messages, or both.

Seems a bit squishy without more details as to what were the ethics and what was the violation.  Were I a reporter for the paper, I’d be curious what the lines were and how were they crossed.  This perhaps goes beyond the common stricture of “Don’t lie, cheat, or steal.”

Were this a corporate exec or a governmental official, would we get more detail?  Who checks the checkers?

Leave a comment

Filed under Compliance, Controls, Culture, Duty, Employees, Governance, Internal controls, IT, Oversight, Security

June 21, 2017 · 12:25 pm

There’s gold in them thar hills

What are you buying when you go to the grocery store?  Organic bananas?

Not if you’re Amazon.

“Big Prize for Amazon: Shopper Data,” The Wall Street Journal, June 21, 2017 B5. Amazon seeks to buy Whole Foods, but for what?  Its hard assets such as stores and locations? Its customer base?  Its purchasing and distribution network?  More likely: information on how shoppers shop.

If you’re the government agency in charge of approving or disapproving this deal, how do you analyze the impact on competition?  What is the “market” that needs to be analyzed?  Is this a vertical or horizontal deal?  Or something else?

Is most of the value (to Amazon) in this deal the information that it gets?  Where’s that on the Whole Foods balance sheet?

Leave a comment

Filed under Access, Analytics, Information, Operations, Use, Value

June 21, 2017 · 12:11 pm

Criminal charges for a CEO

Corporations get charged with criminal conduct from time to time.  But seldom does the CEO at the time also get charged.

“Barclays Hit With Fraud Charges,” The Wall Street Journal, June 21, 2017 B1.  Charges of fraud and illegal payments filed against the bank and its former CEO (and a few other executives) in the UK.

As usual, the shareholders get the bill for any fines (and any diminution in share value).  Curiously absent were any charges against the directors of the Bank’s Board at the time.  But maybe the failure of the Board to detect this level of criminal activity will result in civil suits against the directors for negligent supervision.

Maybe Shearman & Stirling can write another report. (See Wells Fargo posts, supra).  Willie Sutton wasn’t the only crook who knew where the money is/was.

Leave a comment

Filed under Board, Compliance, Compliance, Controls, Corporation, Directors, Duty, Duty of Care, Employees, Governance, Internal controls, Oversight, Oversight, Protect assets, Risk assessment, Supervision

June 21, 2017 · 11:55 am

Snitches get stitches

Apparently, keeping the identities of confidential informants secret poses some challenges.  Are there information governance lessons to be learned?

“Inmates Targeting Informants,” The Wall Street Journal, June 21, 2017 A3. “[C]lose to 700 witnesses and informants believed to have cooperated with the government have been threatened, wounded or killed” over three years.  One source of information: online court records that provide clues as to who cooperated with the prosecutors.  Some inmates may be posting their sentencing files to establish their bona fides.

Hard to classify this in this blog.  Does this pertain to

  • the value of accurate and complete information
  • the risk in making information widely available
  • the government’s duty to protect informants
  • the government’s duty to have a transparent criminal justice system
  • a defendant’s right to confront his/her accusers
  • the need for security and the difficulty in providing it
  • the proactive value of disclosure
  • the fact that information can be misused
  • the difficulty in creating effective controls
  • other?

 

Leave a comment

Filed under Access, Accuracy, Communications, Compliance, Controls, Data quality, Duty, Duty of Care, Governance, Government, Information, Internal controls, Oversight, Privacy, Protect assets, Risk, Third parties, Value

June 20, 2017 · 2:42 pm

Duty of Directors

One of my common themes is the duty of directors.  They get paid a lot of money to act as fiduciaries for the company’s shareholders.

“Warren Keeps Pressure on Wells,” The Wall Street Journal, June 20, 2017 B10.  Senator Elizabeth Warren (D. Mass.) is leaning on the Federal Reserve (arguably an independent body) to remove 12 directors who served on Wells Fargo’s Board when the account- cramming scandal was going on.  Other problems have emerged at Wells Fargo since then.

The shareholders didn’t/couldn’t vote them out in April, and so far (as I know) the directors haven’t been held personally liable for negligent oversight.  So it’s nice that someone is still pursuing the people in charge at the time that (some of the) bad things were happening.

Some executives got fired or their bonuses were docked.  The shareholders lost a bundle in fines and penalties paid by the company.  It would be nice if the directors were held responsible and accountable — not just to penalize them, but to put other directors on notice of what they are getting paid to do, and for whom.

Would be nice to have a poster child for the director’s duty.

Leave a comment

Filed under Board, Compliance, Compliance, Compliance Verification, Controls, Culture, Directors, Duty, Duty of Care, Governance, Inform shareholders, Internal controls, Oversight, Oversight, Protect assets, Risk Assessment, Risk assessment, Supervision

June 20, 2017 · 2:25 pm

Contractors and the Cloud

Do you have contractors who analyze your data for you?  Do they use cloud storage?  Do you know?  How secure it that?  Is that prohibited by your service contract?

“Data on 198 Million Votes Exposed Online,” The Wall Street Journal, June 20, 2017 A4. Deep Root Analytics, a Republican party consultant, used an online storage system that was reportedly open to the world for several days.  Most/some of the information exposed was publicly available information on voters.  A lot of voters.

Well, at least the Russians (or the DNC) didn’t hack it.  Or did they?

What controls do you have that protect information your consultants are using and the opinions you are paying them to provide you?  Do you care?  It’s not like it’s money or anything.

Leave a comment

Filed under Access, Board, Controls, Corporation, Duty, Governance, IT, Management, Oversight, Protect, Protect assets, Protect information assets, Security, Third parties, Vendors

June 19, 2017 · 10:51 am

Kidnapping v. stealing information

One unique aspect of information is that it can be stolen, yet remain in the owner’s possession.  Apparently, medical facilities are required to report if your medical information is stolen, but not if it is merely kidnapped and held for ransom.

“Some Cyberattacks Go Unreported,” The Wall Street Journal, June 19, 20127 B3.  Whether hospitals need to report a ransomware attack of their files as a data breach is a “gray area,” and the federal government doesn’t require such reports, even if the government knows about them.  Some hospitals don’t report ransomware attacks, so these attacks are not in the HHS statistics.

So, patients don’t know when hospitals have weak security protection.  What value, then, are the government statistics?  Do they need a big asterisk?

 

Leave a comment

Filed under Controls, Corporation, Data quality, Duty, Government, Information, Internal controls, IT, Legal, Requirements, Security, Third parties, To report, Value

June 16, 2017 · 1:43 pm

Weakest link

Where do you start if you want to pierce a corporation’s cybersecurity protections?  The CEO.

“Goldman, Citi Bosses Duped by Email Prankster,” The Wall Street Journal, June 13, 2017 B11.  Although nothing confidential was leaked, the CEOs bought into phishing emails.

Hard to blame the Chief Information Security Officer.  One assumes there’s a policy in place, but can you write a policy to protect against this?  Who else in the corporation isn’t following the existing policy?  How do you fix? Two-factor authentication for every email to/from a senior exec?  Encryption?

Leave a comment

Filed under Access, Compliance, Compliance, Controls, Corporation, Duty, Duty of Care, Employees, Governance, Internal controls, IT, Management, Policy, Security

June 16, 2017 · 1:30 pm

What will you (or they) need twenty years from now?

How do you forecast what information the company will need twenty years from now, long after your retirement?

“First Job of Dismantling Nuclear Plants: Find a Russian Speaker,” The Wall Street Journal, June 12, 2017 A1.  Dismantling engineers encounter problems when trying to decontaminate and tear down an old nuclear facility.  The engineering drawings are not necessarily accurate as-built diagrams, and a lot of the language is Russian.

An organization needs a lot of information.  One area is “What information will we need when it’s time to dismantle this great thing we just built?”  Is this information governance, records management, or knowledge management?  Does it matter?  Who owns this problem?  This same problem  came up in my prior life when looking at the information requirements to shut down and dismantle a North Sea oil platform – a lot of that information needs to be captured at the front end and during the life of the facility, and maintained until the facility is removed.

Leave a comment

Filed under Accuracy, Collect, Controls, Governance, Internal controls, Knowledge Management, Management, Oversight, Use

June 10, 2017 · 8:59 am

The Day that Information Governance Died, the Sequel

Last July, after the July 5 new conference, I wrote about the consequences of James Comey’s decision not to prosecute, https://infogovnuggets.com/2016/07/12/sounds-of-silence/.  I view that as The Day Information Governance Died.

This week, we had the sequel.

If you create a document in the normal course of your duties for your employer, about a conversation held in the course of your employer’s business, using the employer’s computer, then that document is the property of your employer.  It’s “proprietary.”  You can’t take that document with you when you’re fired and then give it to others.  Even if it doesn’t contain privileged information.  Or your purported recollections of a conversation in your official capacity with the President, subject to executive privilege.

But Mr. Comey seems to be above (or maybe beside) the Law, generally.  And he is (until the ethics people get a hold of this) a lawyer.

“The ‘Close Friend’ Behind Memo Leak,” The Wall Street Journal, June 9, 2017 A4.   Comey leaks a memo he wrote while a government employee to a friend, in order to leak it to the press.

And we wonder why we have a hard time getting traction on information governance.

1 Comment

Filed under Controls, Duty, Employees, Information, Internal controls, Lawyers, Ownership, Privilege, Third parties