All Posts in Policies and Procedures

|In: Digital|Last Updated:

Every system IT deploys must be given a clean bill of health by your Compliance department. They’re the folks who make sure you don’t run afoul of the federal, state, county, and city statutes and regulations that establish boundaries and set requirements for organizations doing business within their jurisdictions.

If your company is multinational, multiply by the number of nations within which you do business.

And don’t complain … not because I want to convince you that regulation as public policy is a good thing.

Don’t complain because what good will it do you? As a leader, complaining will do you no good at all. Quite the opposite – it will cause harm by demoralizing the employees who have to make compliance happen.

So figure out the good idea that’s at the core of most compliance requirements, make sure everyone understands that underlying good idea, never mind the cumbersome implementation requirements, and move on.

Move on to what?

To Facebook, and its emerging status as an independent government, as intriguingly explained in “Facebook has declared sovereignty” (Molly Roberts, The Washington Post, 1/31/2019).

Is Facebook-as-nation real, or is it metaphor? That’s a surprisingly hard call.

If Rocket J. Squirrel lives in a private residence at 246 Freon Drive, Frostbite Falls, MN 56537, his home ownership and property rights and privileges are defined and protected by various U.S. governmental entities.

But Mr. Squirrel also has a virtual life. He goes online and it’s Facebook that provides the real estate in which he resides … his home page … and just as surely provides the foundations on which the social media society in which he lives has been built.

There’s more: Facebook must defend itself from intruders with malicious intent — it needs a department of defense — and also must help its citizens protect themselves from smaller-scale intruders: It needs a police force. Calling the two InfoSec doesn’t change their functions, only their names.

That isn’t the end of it: Many on-line businesses let you make use of your Facebook credentials instead of establishing a separate login ID and password. Facebook issues passports or, if you prefer, these other sites award visas to people who possess Facebook passports.

Facebook-as-nation leads to all sorts of questions, like, when its citizens are living their virtual, as opposed to their physical lives, does Facebook have a role to play when the governing entity for its citizen’s physical location wants to independently impose rules restricting their on-line behavior?

Some countries, for example, recognize sedition as a felony, unlike the U.S., which long ago declared such laws unconstitutional. So …

A Dutch national posts content that insults King Willem-Alexander Claus George Ferdinand, which can be and is read by various and sundry citizens of the Netherlands.

This is, in Holland, a crime (who knew?). The Dutch government, reasonably enough, would probably like (not Like) Facebook to enforce its laws when functioning in the Netherlands — to take down offending posts and reveal the criminals’ identities to the proper authorities.

But … the criminal responsible for posting this content might not, as it turns out, post it while in the Netherlands. J-walking might be a misdemeanor in New York City but that doesn’t mean I’ve violated New York City law when I J-walk in Minneapolis.

It was, the miscreant might argue, posted in Facebookland, not the Netherlands.

And … it gets even more complicated from there.

All things considered, a declaration of national sovereignty on Facebook’s part might actually simplify things. Its offices become embassies, and all of the complexities of enforcing local laws in Facebookland are dealt with by negotiated treaties.

Interesting or not, this might not appear to be relevant to you in your role in corporate life.

Except for this: Your business undoubtedly has its own social media presence — on Facebook, and Twitter, and Instagram, and all the rest. That means your business is a citizen of Facebook, subject to its laws and regulations just as it’s subject to the laws and regulations of every governing entity within which it does business.

I suspect that right now, responsibility for complying with this new regulatory landscape isn’t clearly defined.

Which leads to this week’s suggestions for Things You Can Do Right Now to Protect Yourself from Harm:

1: For any project you’re involved in that might be affected by social media laws and regulations — especially but not limited to Facebook — make sure someone is responsible for defining these constraints.

2: Make sure that person isn’t you.

3: Suggest to whoever is responsible that the Compliance Department might be a good place to start.

4: Duck.

Comments

|In: Industry Commentary|Last Updated:

Travel is supposed to broaden the mind. Regrettably, after more than 21 years of writing this column, my mental ruts seem to resist travel’s broadening impacts: Everything I see turns into guidance for running businesses, IT organizations, and all points in between.

And so, following a couple of weeks touring in Rome and exploring bits and pieces of Sicily …

> The Romans built the Colosseum in eight years, with no project management or CAD software to help them. It’s about 2,000 years old and still standing. That should worry us.

> The Colosseum’s construction depended on two innovations: concrete, and interchangeable parts built to standard specifications. If any Roman architects, artists, or engineers suffered from change resistance, those who embraced the innovations apparently drowned them out.

> The Colosseum’s standard program was executions in the morning, followed by slaughtering exotic animals, followed in turn by gladiators trying to hack each other to bits.

I think this means we have to give the Romans credit for inventing standing meetings with standard agendas.

It also suggests they were early victims of the consequences of bad metrics. Because every day started out with executions, the Roman courts had to convict enough suspects of capital crimes to fill out the program, whether or not a sufficient number of capital crimes had been committed. I presume the parallels are obvious.

In any event, combining the morning executions and gladiators who got the old thumbs down, a million corpses exited the Colosseum’s fabled arches during the years it was in session, although the pace slowed a bit when Rome became Christian and did away with the gladiators.

I guess that was progress. Speaking of which, for the Roman Empire, conquest was what you did if you could. Now, it’s frowned upon. That’s progress, too, I guess.

> While walking through the Pantheon our guide pointed out a row of headless statues. They weren’t, he assured us, early examples of Dr. Guillotine’s work products.

It was due to Roman parsimony. Coming from a practical society, Roman artists figured out the average statue would greatly outlive the person it had been carved to honor. And so, they designed their statues to have replaceable heads.

In IT we call this “modular design.”

> We didn’t spend all of our time in the Colosseum (and Pantheon and Forum). We also toured the Vatican, where, in the Basilica, we saw evidence of St. Peter’s tribulations. As it happens, visitors rub St. Peter’s feet for luck. No, not St. Peter himself but a bronze statue thereof. Bad luck for St. Peter. After centuries of this his feet are being rubbed right off, toes first.

I’m pretty sure we in IT have parallels to muster. If not, elsewhere in technology land I’ve read we’re running out of helium, one birthday balloon at a time.

Sicily has been more relaxing, at least from the perspective of spotting IT parallels. I’m hopeful this might mean I haven’t completely lost my ability to disconnect from the world of information technology. But there is Mount Etna, an awesome and awe-inspiring site.

> On the not-a-parallel-at-all front, shortly before its recent eruption, data integrated from a variety of sensors reported a 10 centimeter increase in the mountain’s elevation (about 3 inches if the metric system isn’t your bag; also about 3 inches if it is your bag only you don’t need me to handle the conversion for you).

Where was I? Oh, that’s right, 10 centimeters, and I hope you aren’t so blasé that you aren’t awed by our ability as a species to measure such things with such precision — a precision that allowed geologists to warn everyone potentially in harm’s way so they could get out of harm’s way.

> On the back-to-parallels front, Mount Etna doesn’t have just one crater, although the main caldera is enormous.

It has hundreds of craters. That’s because, when pressure increases and the old eruption paths are plugged, the magma doesn’t metaphorically say to itself, oh, gee, I guess I’d better calm down and head back to the earth’s mantle.

Nope. The pressure is there, the result of physical forces that can’t be eliminated and physical laws that can’t be repealed.

The result: The magma has to go somewhere, and where it goes is the path of least resistance, culminating in it pushing through the side of the mountain, resulting in a new eruption and new crater from which it spews out.

The business/IT parallel is, I trust, clear: Good luck trying to stamp out shadow IT, which is also the result of pressures that won’t go away just because you want them to.

It’s time for me to head back to the beach. The IT parallel? None.

Ahhhhhhh.

Comments