Rational Survivability

I find this case extremely fascinating on many levels.  From eWeek:

You can see the original story from the International Association of Privacy Professionals (IAPP) here.

The implications of this are quite profound as you can imagine.  CEO's and CFO's can be held accountable for crimes committed under their watch, so it's not too far of a stretch to see how privacy officers like Fleischer will have their feet held to the fire when subject to international law that takes a different perspective on the responsibilities associated with privacy than we might. 

How many indictments have we had in the U.S. for the release of information in corporate breaches?  The U.K.?

I'm not making a judgment call on this particular case because I certainly don't have all of the details, but it sets a very interseting precedent.

Imagine if you were a Chief Privacy Officer or perhaps a Chief Information Officer subject to this sort of scrutiny outside of the due care and stewardship requirements of the job in general.  If something bad happens, generally the worst thing that might occur is you lose your job.

Imagine if you were personally liable for the posting of content from millions of users globally and could be sentenced to share a shower and a cell with an angry Italian man who can't get a decent cappuccino.  I can't imagine what that would be like.

This may be the first time a privacy professional has been charged on behalf of the company he/she is employed by, but I will bet this won't be the last time it happens, either.

Besides the impact this can have on employees of providers of service, Google suggests it calls into focus larger issues of Net Neutrality:

An interesting argument for sure and one I can see being debated vigorously.  It's clear Google operates globally, so they must understand this sort of thing could happen.  What about Facebook (sorry, Chris) or MySpace?  What happens when Amazon is used to host data that is mishandled by someone.  What then?

Imagine what fun it's going to be when we're all cloudified and the mash-up frenzy makes the cross-pollenization of information today look orderly; who's responsible then?

What do you think?  Should privacy officers be liable for events like this?  Should CSO's/CISO's and Compliance Managers be liable when a breach occurs exposing protected information?  Think about that answer very carefully.

/Hoff

*You can find Peter Fleischer's blog here.

Thanks to Mr. Stiennon, it seems that I have been labeled a threat to the People’s Party and access to this, my seditious and politically undermining little pile in cyberspace has been, gasp!, blocked by the eeeeeviill Chinese Firewall of Disinformation.  Well, that sucks.

I have to say that Richard really did me a favor by posting this.

Firstly, it reminded me that despite my many travels, I’ve become quite an American-centric little drone without much of an appreciation for the hardships experienced by those in many other countries as it relates to censorship and net neutrality.  We take a lot of things for granted over here and in many cases Americans seem to wield the hammer of nationalism a little to heavily, even if inadvertently.

I was reminded of this by a high-ranking member of a British Telecoms company recently when, despite all attempts to rectify my ill-timed transgressions, he suggested that my sense of humor needed a much better cultural filter applied to it should I not wish to piss people off with my "Americanism."  Ouch.  I find it odd typing this because I’m somewhat culturally conflicted
because whilst I was born in the U.S. and love it dearly, I moved to
New Zealand and grew up there for most of my early life.

It made me think, so I really do owe you both a renewed apology and a thanks, Ray. 

Secondly, I would really like to be able to use something like Google to compare natively a search using any one of their engines to determine where, what and how searches and click-throughs are allowed or blocked in the countries they serve.  I reckon that as we get closer to GooglePOPs around the world, this ought to be plausible.

At any rate, back to the post at hand.  I quoteth Richard:

On my recent travels in China I had an opportunity to experience first
hand China’s so called “Golden Wall”. In each hotel I would try to get to several sites.  For some reason  this security blog
is censored throughout China. How does that make you feel Mr. Hoff? And
a Google search on “Tibet” will have the usual results but you cannot
click through to any of the links on the first page of results. I did
not search on Falun Gong for
fear of really setting off the alarms and reprisals. Next time I think
I will set up GoToMyPC at home and use it as a poor man’s proxy.

To answer Richard’s question directly, I guess I’m flattered on two fronts; firstly that Richard bothered to try to get to my blog while surfing in China (bored much?) and secondly that some government other than my own considers me a threat to their sovereignty.

I could, of course, rant tirelessly about my opposition to widespread and targeted filtering of information and the impact on privacy, etc., but there are far more qualified people than I to do so.  At a much more basal level, I think it sucks, because now nobody in China will be able to follow along as Richard and I smack each other. ;(

In protest, no more General Tsao’s chicken for me.

{Posted @ 2:30am after I just got back from Blackhat/Defcon with no luggage.  Apologies for any perceived lack of sensitivity for the greater global political issue of censorship here, but I want my toothbrush back from United Airlines and it’s clouding my judgment}

/Hoff