I am preparing a talk for CIOs on the topic of ‘Social Media – Creating Collaborative Conversations’. I’d like to hear from people who have made the corporate leap into social media in their organisations or who have views or expertise to share on the subject. Questions you might consider include:

• What advice would you give to CIOs and their organisations in adopting social media?
• Can you point out good and bad examples of the use of social media?
• What, in your experience, has worked well and worked badly in the adoption by organisations of social media?
• What is the future for social media in the enterprise and what are the implications for CIOs and their organisations?
• What lessons have you learned from using social media in your organisation?
• What are the risks for organisations in adopting social media and making them available to employees?
• What are the specific challenges for business as workers engage in new conversational behaviours and have the ability to spread knowledge inside and outside the corporate firewall?
• How can CIOs work with other executives to ensure that the use of social media is well-managed?
• How can organisations create collaborative conversations that benefit the business?

If you have any views on these questions, or have additional information to add, I’d like to hear from you.

Please leave a comment or use the contact form to share your experience.

I had not intended this blog to become a security-related publication, or one dealing exclusively with theft of laptops and storage media. But there is certainly a trend developing; let’s hope it does not last.

Following on from yesterday’s post, and from my post of 24 August 2008, we learn today from a report on RTE, Ireland’s national broadcaster, that a laptop computer containing  the records of some 75,000 customers of Bord Gais Eireann (BGE – the Irish Gas Board) was was one of four stolen on 5 June 2009, although news of the theft was only released today, 17 June 2009. The records relate to customers who signed up for the BGE “Big Switch” campaign, which encouraged them to move their account for electricity supply from the Electricity Supply Board (ESB) to BGE. Like previous incidents, data on this laptop was reported not to have been encrypted.

This time it’s personal, as I have been potentially affected by this latest security failing.

It appears to me that many (I suspect a very, very large number) organisations that process personal information simply do not take the issue of electronic data security and data privacy seriously enough. Throughout the world, we learn regularly of significant breaches of customer confidentiality. As  I wrote in my August 2008 post, many of these incidents occur through the failure to manage portable devices and removable media effectively. But there is also a lack of appropriate polices, procedures, practices, guidelines and controls. Indeed, in many organisations, there appears to be little or no attention paid to security at all, except for template procedures and documents.

The 2008 Annual Report of the Irish Data Protection Commissioner provides information on the top ten threats to individual privacy as identified by his staff. The unscientific list represents perceptions of Commission staff of the major threats to privacy at the close of the year 2008, based on the queries and issues they deal with on a day to day basis. The top ten threats are identified as follows:

1. Failure of organisations to have even the most basic protocols in place to minimise the loss of customer and employee data.
2. Continued lack of proper procedures in public and private sector bodies to limit access by their employees to personal data on a ‘need to know’ basis.
3. Failure to take due account of the legitimate privacy expectations of members of the public when moving towards greater efficiency of public services.
4. The tendency of new legislation to seek ever more personal data from the public and the sharing of that data between organisations without (in many cases) any real business case to justify such sharing.
5. Criminals using increasingly sophisticated methods to part individuals from their personal data for criminal and fraudulent use.
6. The extended use of the Personal Public Service Number (PPSN). This is the number given to each citizen by the Government to identify them when they interact with public bodies. More and more services seek to use this identifying number, often without any credible justification.
7. Publication and availability of excessive personal data on the internet (sometimes placed there by the individuals themselves on social networking sites etc).
8. Continued lack of awareness among data controllers of their data protection obligations.
9. Indifference on the part of data controllers to the consequences of their actions when they deliberately and persistently refuse to respect the data protection rights of their customers.
10. Continued lack of awareness on the part of members of the general public (who, as a result, give away their personal information too easily, don’t ask why personal information is needed or fail to ‘tick the box’ to say that we don’t want to be contacted).

BGE issued a short press release advising that it had promptly informed the Irish Police and the Data Protection Commissionerof the theft and that it will be contacting all affected customers. However, since there has been almost a two-week lag between the occurrence of the theft and the issue of the press release today, it is possible that customers’ financial or other personal information could have already been compromised. This is simly not good enough. It is no good doing things right (if you can call a two week delay in advising affected customers “right”) after an incident has occurred; appropriate steps must be taken to ensure that such incidents do not occur in the first place and that, if they do, the risk to information security is minimised or removed entirely. Time will tell whether the “risk assessment” referred to in the BGE statement led them to a correct decision not to advise customers sooner; I hope they got that right.

Organisations must take serious steps to improve security now. Some of the steps they take might include:

• Raising security awareness among all staff and providing appropriate training.
• Assigning responsibility for information security to the right people, not just to the IT department.
• Implementing appropriate and effective security policies, procedures and practices.
• Implementing adequate and effective information security controls and risk management systems.
• Carrying out regular audits of information security practices.
• Encrypting data on laptops, portable devices, tapes, removable storage and other vulnerable media.
• Implementing appropriate controls over removable media and devices.
• Introducing strict penalties for staff who breach security requirements including, for serious breaches, dismissal.
• Revisiting my post of August 2008 for further information on information security.
• Visiting the web site of the Irish Data Protection Commissioner, which is full of good information on information security.
• Reading the 2008 Annual Report of the Data Protection Commissioner, which is an excellent document and gives an overview of the activities of the Commissioner and provides information on prosecutions, investigations, summary data, etc.

Organisations and individuals must realise and accept that information security is not an issue for the IT department alone; it is a business issue and needs to be treated as such. Staff who use laptops, portable devices and removable media must understand that it is their responsibility, not the IT department’s, to keep data safe. And basic security, like locking these devices away or securing them appropriately, as well as encrypting them, must become the norm, not the exception.

Under Irish Data Protection Legislation, penalties for breaches of the law can be severe and encompass both civil and criminal proceedings, fines and forefeiture and destruction of equipment. Bodies corporate and individuals are subject to the provisions of the legislation. Fines of up to 250,000 euros can be imposed. Maybe it is time that fines of this magnitude were imposed. Without tough enforcement, I fear that breaches of the law and loss of personal data will continue to occur.

Kevin Kehoe, who I thank for commenting on my previous post, mentioned that organisations need to assess their appetite for risk. Perhaps it is time to dampen that appetite dramatically and, when it comes to handling the personal private information of customers, staff, prisoners, benefit applicants, etc, accept that no appetite for risk at all is the desired attitude to have.

If you have been affected by the BGE failing and feel strongly enough about the matter to complain, you can get all the information you need to make a complaint from the Data Protection Commissioner’s website.

What do you think? Are you concerned at how easily and how often personal private information is stolen, disclosed or otherwise compromised? Have you been personally affected by a breach of your privacy? Have you lost money or suffered other negative consequences? Have you been responsible for a breach of data security?

Leave a comment and let me know.

johnlawlor.tel

.tel is a new top level domain (TLD), launched between December 2008 and March 2009. Operated by Telnic, a UK-based company, the TLD enables users (organisations and individuals) to publish contact information about themselves in a fairly simple, structured manner. While it is possible to access a .tel domain over the web, the suggested power of the system is that it can be accessed quickly and easily using mobile devices like phones, Blackberries and iPhones; it does not require a web site.

The basic idea behind .tel is that it will become an Internet-based directory, keeping all personal or organisation contact information in one place. For example, if a company changes phone number or address, it would only be necessary to change the entries in their .tel account and publish this information immediately to the Internet. With its “free text” feature, an organisation or individual can also post current information, say, about an upcoming sale or event, or a company profile.

The type of information that can be stored in a .tel account includes personal information such as name, address, hobbies and interests; phone numbers; websites; Flickr sites; Skype and Google accounts, and geolocation information. A user can decide what information to make public and what to show to selected people only (Telfriends), who must also be .tel account holders. Organisations can publish similar information as individuals and, using an internal directory structure, can add specific information, such as details of regional or branch offices. This makes it easier to navigate the .tel site.

Given the type of information that a .tel domain holds: contact information; web sites; identities; location information and searchable keywords, it is a little difficult to see how .tel is a lot different from an informational web page, blog, or OpenID profile. Indeed, I have stored all that type of information on many of my websites, blogs, social media sites, etc. I also set up a VeriSign Personal Information Portal (Beta) that provides much the same information as .tel, although it is web-based. It would also be very easy to set up a single web page on your existing domain with all of the information you want on it; by simply changing details on this page, you could, in theory, achieve the same end as a .tel account. However, Telnic say that the benefit of a .tel account is that a website is not needed and that a user’s account can be accessed easily over mobile devices, using very little bandwidth and low amounts of data transfer. They also suggest that there will be many new applications developed to exploit the features of .tel and that, for this reason, it is a useful service.

They offer ten reasons to use a .tel domain:

1. Controlling your information hub
2. Being part of a global online directory
3. Routing customers to your departments and locations
4. Increasing online discoverability
5. Connecting with customers from any device
6. Having an effective online presence
7. Performing live updates anytime from anywhere
8. Promoting premium rate numbers
9. Generating revenue from generic domain names
10. Driving traffic to e-commerce shops.

Before deciding whether to open a .tel account, I did a little research on the web and in discussion groups to see what the chatter in the community was. I found mixed views on the whole concept. Many companies who were selling domains or services were positive about .tel, while many individuals and IT professionals were more sceptical. Some people felt that it was just another over-hyped product. Concerns have also been expressed about privacy and identity theft.  I share, to a degree, the views of the sceptics and wonder how useful and secure this service will be. Nevertheless, I decided to get my own domains, johnlawlor.tel and lawlor.tel, to test their utility. All of the information I have added to my account (johnlawlor.tel only; lawlor.tel is not completed yet) is already publicly available on the Internet, so I am not too worried about publishing it in the one place. However, I have some concerns about the possibility of suffering an increase in spam or phishing attacks and will monitor my email, in particular, to see if there is an increase in these nuisances.

.tel domains cost from around 10 to 15 euros per year. There is no associated hosting cost, as all .tel accounts are hosted by Telnic as part of the domain registration. It’s very easy to register a domain and I registered mine with Blacknight Solutions in Ireland. If you’d like to have a look, check out http://johnlawlor.tel/.