Control & Legislation VS Awareness & Foresight

The recent comments made by Jennifer Stoddart , the Canadian Privacy Commissioner and her spokesperson Anne-Marie Haden, following the theft of customer information from the CIBC and Winners systems, drive to the heart of the Intelligence conundrum – Technology is uncertain and vulnerable to potential attack and cannot be defined until it happens. 

Stoddart’s comments indicate that despite the theft, both companies appeared to be in full compliance with the law. Haden added that “companies must abide by a set of principles outlined in PIPEDA, including identifying the purposes of collecting information, asking for consent of the individual, limiting the collection to what's necessary, and ensuring that the information is safe.”

I have found, as is perhaps the natural human tendency, that the majority of companies are loath to admit uncertainty into their operational planning. Current business values (e.g. the Sarbanes Oxley Act) demand and promise certainty via total compliance with security/privacy laws and a zero-tolerance approach to transgressors. The problem is if reputable organizations such as CIBC and TJX Cos., the U.S. parent firm of Canadian retailers Winners/HomeSense are not able to deliver certainty, then who can?

Much like terrorism, this approach can only close the stable door after the horse has bolted. Companies that factor the probable (what might happen) into their planning have a better chance of protecting their own and client information. Reliance solely on existing technology will erode the necessary vigilance of all the members of any organization. 

Corporate Intelligence Awareness vs. Competitive Intelligence

Pure Intelligence or Foreknowledge relies on ongoing people input - Their awareness of a series of seemingly random clues that if heeded, give rise to a theory, that if factored into a business equation (in time), will provide a distinct business advantage. A prediction as to what might happen on a balance of probability! Competitive Intelligence on the other hand is the loose term that refers to data management technology, which is an important and increasingly complex branch of the greater world of Business Intelligence.

As we have seen, information security technology is in its infancy and can at best only provide the illusion of certainty. The words of Marshall McLuhan to the effect that technology is an extension, not a replacement of human ability ring true. Organizations that download security solutions available to any prospective buyer automatically put information at risk. This is exacerbated by the tendency to purchase/download solutions that work or have worked for competitors.  The Air Canada/West Jet saga was a case in point. A competitor, familiar with the working of Air Canada’s information management system, was easily able to steal information despite state of the art technology.    

For the foreseeable future, acceptance of vulnerability, the fostering of an organization wide people awareness culture, coupled with evolving information/security technology customized to specific requirements (that include unique safeguards) will have the best shot at avoiding what happened to the CIBC and Winners/HomeSense. I believe it is not a stretch of the imagination to hope that, with the requisite awareness, the scores of IT and administrative personnel involved in both organizations might have foreseen and taken steps to avoid the possibility of information vulnerability.

A clear illustration of human error/carelessness leading to an information/security breach would be the recent exposure of a prison inmate who requested and received personal tax information of a former colleague from the Canadian Revenue Agency. Confidential information was provided despite set procedure designed to check discordant addresses and forged signatures!

People, their attitude and values at any point in time will shape the security effectiveness of any organization better than compliance with rigid legislation and reliance on developing technology. Our experience dictates a holistic solution/approach to the protection of information, with the emphasis on instilling an awareness of indicators that will always manifest themselves prior to potential security incidents.

The greater the capacity of an organization and its people to work with confidence in the dimension of potentials, possibilities and maybes, the greater the ability to realistically predict, recognize and prevent catastrophic breaches of security.