One reader commented on my post and asked if I would balance the conversation by creating a corollary list that identifies what leaders (and executives) do to create toxic working environments that contribute to the development of rogue employees.
So, I penned the following list of seven caustic categories of leaders that I feel help to create these environments:
The reluctant leader: They really didn’t want to be in-charge of people, through words or behaviors, they give you the feeling that they’d rather be back doing “real-work” than being a leader. They will care very little about training and development, innovation, or accountability, and will shun any activities that will cause them to act as a leader.
How this develops rogue behavior: Without leadership support, people will begin to act on their own, circumventing security policy and controls to get the job done. In the absence of real leadership many will take the lead, making decisions that are not necessarily in the best interests of the organization.
The self-centeredleader: They are more concerned about their own achievements, and are always worrying about how bad you will make THEM look if you don’t perform well. You’ll hear them talk about the job they want rather than working the one they have. They will have no time for staff that isn’t helping them to look good.
How this develops rogue behavior: This demoralizes staff and may lead them to sabotage organizational efforts, especially if senior managers don’t intervene on behalf of the staff. This can result in lost productivity, lost loyalty for the organization, and ultimately loss of good employees.
The gloom and doomleader: They are negative about everything – we don’t have enough money, our company/agency sucks, management is worthless, just be glad you get a paycheck. They are also the ones who poo-poo on any ideas their staff may offer – “don’t rock the boat, we don’t have the time, we already tried that” – rather than being supportive, they do their best maintain the status quo.
How this develops rogue behavior: This too demoralizes the staff and may lead them to hurt the organization. Disheartened staff might also seek external interactions and opportunities that could be exploited by others who want to hurt the organization.
The sociopath leader: They are quick to tell you how “lucky” you are to have a job, and how important they are to YOUR success. Rarely will they apologize for being wrong, nor will they be concerned about the consequences of their actions, and they will be also the ones to take personal credit for staff accomplishments. They will also be the ones to force polices and rules on their staff that they won’t apply to themselves.
How this develops rogue behavior: People working for this type of leader may take on characteristics of the sociopath. In an effort to “win over” the boss, they will take shortcuts, bend the rules, and abuse or hurt other people in the organization. They too will have little regard for security policies, especially ones that they perceive will prevent them from making the boss happy.
The absent leader: They seem to be busy all the time; with what, no one knows. They are never in their office and never seem to have time for their staff. When they are cornered, they defer you to someone else: “Got a pay problem? Go see HR” or “Looking for advice? Talk to (fill in the blank); just don’t bother me” – no one can nail them down for anything.
How this develops rogue behavior: Working under the absent leader is very frustrating, and over time, can lead to people in the organization to simply no longer care. People may try to do their best, but even with best effort, mistakes will be made, and eventually people will get fed up and either leave or take revenge against the leader. Either way, the organization will suffer.
The interferingleader: They are the micromanagers, distrusting of the abilities of their staff. They love to control every aspect of their organization, believing that they their staff cannot perform as well as they do. If they do delegate work, they will in your knickers every day, questioning staff actions and decisions. Rather than developing their staff, they are more likely to move or remove staff that don’t perform up to their standards.
How this develops rogue behavior: Opposite of the absent leader, this one just loves being in control. However, the results will be the same. After a while, people will just give-in to the leader, try to effect revenge on his/her actions, or will pack up and leave, possibly taking organizational information with them.
The minimalistleader: They just want to do the “absolute minimum” that needs to be done to “check the boxes.” Most likely they have been there for a long time and are quick to warn you not to stick your neck out as it will get cut-off. They will be the ones to tell you “we’re not responsible for that” or “just go back to your cubicle and do your job.” They stomp on any creative or innovative ideas, and suck the life out of their staff.
How this develops rogue behavior: Similar to the absent leader, this one actually prevents people from doing the right thing. Over time, this can lead to the same results as many of the other types of leaders described above.
I honestly don’t think that preventing ‘rogue” employees is rocket-science. If you take the time to be genuinely interested in your people’s lives, give them opportunities to grow and be creative, along with the opportunity to contribute to higher organizational goals, and thank them once in a while, they will be much less likely to want to go “rogue” and hurt you or your organization.
But, do the opposite – treat them like furniture, ignore their needs, stomp on their personal goals for growth and development, and yes, they will be pissed off. And, if you piss them off long enough they will:
Leave your organization (with your proprietary/sensitive information); or
Do something to sabotage your organization’s success; or even worse
They may just stay-on, get promoted, and be there to piss off everyone else you place beneath them.
Day Two at IACP and straight in early on Sunday morning to attend the Cyber Threats and Attacks Facing Law Enforcement Agencies session. Having attended the last two Cyber Threat Summits in Dublin, Ireland, I am well aware of the challenges we are all facing everyday in trying to protect our technology.
Mark Gage opened with a very worrisome statement, saying that we spend so much money trying to protect everything else in our lives, but not enough care is given to protecting our information and identity networks. We are at risk every single day, just by viewing Facebook or opening up an untrusted email attachment our phones/laptops can become infected, and spread malware.
We should all know better, in-fact we do know better, we know the risks associated with all these things, but yet we are all capable of making silly mistakes and suffering the consequences.
Mark says the most important thing is to educate your staff, consult with those you share systems with, do not use the same password for everything, and make your password changes a minimum of 90 days. It’s also critical that we keep all software up to date, particularly anti-virus software, and implement back up procedures. For companies, he suggests paying money to employ IT staff or contractors.
George Arruda spoke next of the worst day for him in Sept 2013, whilst driving on holiday in Florida, he received a phone call, which gave him the news he dreaded – a virus had locked down ALL of Swansea Police Department’s files thanks to a vicious virus called Cryptolocker!
The only way to get the files back was to pay a ransom of bitcoins, to some criminals out there in cyberspace. He didn’t know who there were, or where they originated from, but he gave the order to pay and get the files back.
A cyber security expert was called in and he advised against this, but they eventually began the transactions of transferring bitcoins and they started to get data back. The main problem here was that they did not have back up, so they were indeed in a vulnerable position.
Having amassed a very large amount of data, this incident shook the Swansea PD. On the back of this, George gave advice to everyone – Back Up Everything and teach your staff NOT to open anything suspicious, and only have ONE administrator access with a password.
Steve Sambar warned of the dangers of terrorist cyber attacks, and the worry of, if they attack, what do we do? Who will be responsible for handling it? How long will it take to cover? We face so many threats every day, human error, insider threats, external threats. Many big corporations have suffered already. For example, Target had 40 million accounts hacked in Dec. 2013, and Ebay’s database with 233m users was hacked in Feb. 2014.
Jim Emerson had the last word, delivering a fast paced description of the emerging threats and challenges. Everything is happening faster, he said, and we have to understand the reality of what cyber security is.
He showed two short videos from IACP about cyber security, these are available on the IACP website. Jim wants us to:
Check carefully where is the suspicious email coming from.
Be aware of who you connected to.
Jim also stressed the importance of this being a day to day footrace, and it never ends. He is right, and we do not want to be sorry when it is too late.
Bradley Manning, US Army soldier who released 750,000 documents to wikileaks
Jacob Tyler Roberts, another young man who shot up an Oregon mall
Adam Lanza, young man who killed 26 at a Newtown, CT school
Marijana Bego, NYC art gallery owner who jumped to her death yesterday
The answer? One or more people knew something was wrong BEFOREHAND.
I am now convinced that EVERY incident, whether it is a tragic shooting, a terrorist act, espionage, or a sole suicide, there were signs ahead of time that something was not quite right with the individual(s) involved.
So what can we do? We have to take better care of each other. When we see signs that someone isn’t quite the way they used to be, call them on it. Ask questions. Take action BEFORE something bad happens.
Scared that you’ll embarrass them? scared you’ll embarrass yourself? If so, just think how you will feel if you don’t take action and something even worse happens…how will you feel then?
In Bradley’s case, the Army knew there were reasons NOT to put him in a position of trust, and they did anyway!
In Jacob’s case, his own roommate said he acted weird and talked about moving and selling his possessions!
In Adam’s case, the school district security officer knew he had disabilities!
And, in Marijana’s case, many people around her knew she was erratic and not happy.
I would hate to be in any of those person’s shoes…
so, for 2013, let’s try and take better care of each other, and vow to intervene early, maybe we can save a life.
“When Johnny reports to work for you on Day 1, they DO NOT intend to do you or your organization’s information systems any harm; something happens to them, either in their personal or work life that changes this – the CEO’s or Agency Head must be held responsible for making sure they know what’s going on with all of the Johnnys (and Janes) in their organization to prevent the good people they hired from becoming insider threats.”
While most of the world is focusing on “technology” as a solution to preventing insider threat attacks to organization/agency information and systems, hardly anyone is focused on leadership’s responsibility to create and sustain a work environment that minimizes the chance for an employee to turn into an insider threat.
On October 21, 2012, I had the chance to speak on this issue at the 2012 International Cyber Threat Task Force(ICTTF) Cyber Threat Summit in Dublin, Ireland a few weeks ago; here is a video recording of my presentation, I hope you find it informative and useful.
Get on a plane and join me at International Cyber Threat Task Force (ICTTF) Cyber Threat Summit in Dublin, Ireland 20/21 September 2012, be my guest by using the registration code: nowheretohideguest – http://www.cyberthreatsummit.com/
The British Standards Institute (BSI) issued ISO/IEC 27001:2005 Lead Auditor (TPECS) certificate to Chuck Georgo today. ISO/IEC 27001
ISO/IEC 27001 is an Information Security Management System (ISMS) standard published in October 2005 by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).
ISO/IEC 27001 formally specifies a management system that is intended to bring information security under explicit management control. Being a formal specification means that it mandates specific requirements. Organizations that claim to have adopted ISO/IEC 27001 can therefore be formally audited and certified compliant with the standard.
NOWHERETOHIDE will be publishing a series of blog posts over the next few weeks to help educate organizations about the standard, its criteria, and strategies for achieving compliance.
It is important to understand that ISO/IEC certification is not a one-off exercise. To maintain the certificate the organization will need to both review and monitor the information security management system on an on-going basis.
Warhas been defined as “a state of organized, armed and often prolonged conflict carried on between states, nations, or other parties typified by extreme aggression, societal disruption, and usually high mortality.[Wikipedia]” Cyber Warfarehas been defined as “politically motivated hacking to conduct sabotage and espionage. [DOD]”
While some of what we’ve recently can be construed as Cyber Warfare (including the recent hacktivism), the bulk of what’s really going (largely beneath the surface) is a) efforts by organized criminal elements using new technologies and capabilities to do what they have always done—steal money, or b) continued acts by nation states to steal military secrets (espionage) or corporate secrets (economic espionage).
While the latter (b) get the big press, I am worried that that the former (a) is actually the bigger problem of the two. I was personally hit by identity theft a few years ago when a group got access to my credit card details from a retailer I had done business with. This group proceeded to charge 250 rubles (about $9US) twice a month to one of my credit cards. While not a significant amount of money for me, I would guess that they had thousands of victims like me, and together, the monthly booty would add up quite quickly. Two hypotheses…
More of this type of cyber-crime is occurring today than the stuff showing up on the front page of any newspaper; and
What we mean when we say “Cyber Warfare” is really just the 21st century version of crime; criminals using cyber means.
I’m also afraid that our law enforcement forces (internationally) are nowhere near being prepared to dealing with crime using cyber technologies—two points from a National Criminal Justice Association (NCJA) Forum I recently attended:
One of the sessions I participated in was entitled “Why Does the Crime Rate Continue to Decline?” The speaker (a well-respected professor) informed us that crime in America is actually down to the levels it was in 1964—this represents a significant drop. I asked the question “Did crime really drop or have criminals begun to use technology to steal rather than a pistol?” His response was “criminals aren’t smart enough to use computers.” I found this very hard to believe. Criminals have always adapted to stay a step ahead of law enforcement, and I fear that they now have a significant upper-hand, especially if law enforcement feels the way the speaker did and they fail to re-tool their ranks to detect, deter, and dismantle the new cyber-oriented criminal threats.
Another session I attended was entitled “A Clear and Present Threat: A Look at Cybercrime.” In this session, one of the speakers spoke of the growing problem of crime in virtual worlds—people with avatars in virtual worlds are stealing other peoples virtual property and assets, and real lawsuits are being tried in real courts by real people. If you don’t believe me, read this article – Virtual add-ons draw real-world lawsuits – that I found in researching this further. I would submit that today’s criminals are more tech/cyber-savvy and have realized that there are safer (cyber) ways to steal money and property without having to physically point a gun at someone’s face.
Now ask yourself, how many law enforcement officers are prepare to investigate this type of crime, let alone basic identity theft, software piracy, child pornography, and cyber-extortion? And what about their readiness to preserve digital evidence in computers, laptops, routers, firewalls, servers, and handheld devices?
Today these skill sets are confined to special divisions within a police department, segregated from the bulk of the force. I would like to offer that just like the weapon, handcuffs, and radio on their utility belt,it’s time to equip many more, if not all law enforcement officers with the training and tools to understand, detect, and investigate cyber-crime…we’ll never get fully ahead of the problem, but maybe we can catch-up a bit.
So it’s no great revelation that public safety has benefited greatly from public private partnerships, and I’m cool with that, especially when we are dealing with technology that saves lives. However, a press release hit my email inbox today that made me think of the risks to security and privacy when we implement innovative technologies.
Before I get into the story it, let me be v-e-r-y clear…I am NOT here to debate the effectiveness or morality of red-light/speed enforcement systems, nor am I here to cast dispersions on any of the organizations involved in the press release…this blog posting is strictly about using the Gatso press release to emphasize a point about security and privacy – when we engage in innovative law enforcement technology solutions, we need to take extra care to adequately address the security and privacy of personally identifiable information.
Here’s the press release from Gatso-USA:
GATSO USA Forms Unique, Strategic Partnership with Nlets
Earlier this month, GATSO USA was approved as a strategic partner by the Board of Directors of the National Law Enforcement Telecommunications System (Nlets). Nlets is….general narrative about NLETS was deleted. The approval of GATSO is an exciting first for the photo-enforcement industry.
Nlets will be hosting GATSO’s back office and server operations within the Nlets infrastructure. GATSO will have access to registered owner information for all 50 states plus additional provinces in Canada. The strategic relationship has been described as a “win-win” for both organizations.
From Nlets’ perspective, there are key benefits to providing GATSO with hosted service. Most importantly, it virtually guarantees personal data security. Due to this extra step of storing personal data behind the DMV walls of Nlets, the public can be assured that security breaches — such as the recent incident with PlayStation users — are avoided.
From GATSO’s perspective, hosting the system with Nlets will provide a ruggedized, robust connection to comprehensive registered owner information — without the security issues faced by other vendors in this industry. Nlets was created over 40 years ago…more stuff about NLETS was deleted).
The main points I took away from this press release were:
Nlets is going to host the back-end server technology that GATSO needs to look up vehicle registration information of red-light runners;
Gatso is going to have access to vehicle registration information for all vehicles/owners in ALL 50 states in the U.S. and (some) provinces in Canada; and
And, because it’s behind Nlets firewalls, security is not an issue.
Again, please don’t call me a party-pooper as I am a huge advocate for finding innovative ways to use technology to make law enforcement’s job easier. However, I am also painfully aware (as many of you are) of the many security and privacy related missteps that have happened over the last few years with technology efforts that meant well, but didn’t do enough to make sure that they covered the bases for security and privacy matters. These efforts either had accidental leakage of personal information, left holes in their security posture that enables direct attacks, or created opportunities for nefarious evil-doers with legitimate access to use that access to sensitive information for other than honorable purposes.
After I read the press release, I thought that it would be a good case-study for the topic of this blog – it involved innovative use of technolgy for law enforcement, a psuedo-government agency (Nlets), two foreign-owned private companies, and LOTS of PII sharing – some might even say it had all the makings of a Will Smith movie.
To help set the stage, here are a few facts I found online:
Gatso-USA is a foreign company, registered in New York State, operating out of Delaware; its parent company is a Dutch company, GATSOmeter BVGatso.
Gatso does not appear to vet all of the red-light/speed violations itself; it uses another company – Redflex Traffic Systems to help with that (Redflex is not mentioned in the press release).
Redflex seems to be a U.S. company, but it has a (foreign) parent company based in South Melbourne, Australia.
Finally, there are no-sworn officers involved in violation processing. Red-light/speed enforcement cameras are not operated by law enforcement agencies; they outsource that to Gatso, who installs and operates the systems for local jurisdictions (with Redflex) for free, (Gatso/Redflex is given a piece of the fine for each violation).
There are no real surprises here either; there are many foreign companies that provide good law enforcement technologies to jurisdications across the U.S., and outsourcing traffic violations is not new…BUT what is new here is that a sort-of-government agency (Nlets), has now provided two civilian companies (with foreign connections) access to Personally Identifiable Information (PII) (vehicle registrations) for the entire U.S. and parts of Canada…should we be worried?
Maybe; maybe not. Here are nine questions I would ask:
Personnel Security: Will Nlets have a documented process to vet the U.S. and overseas Gatso and Redflex staff who will have access to this information through direct or VPN access to Nlets systems?
Data Security: Will Gatso or Redflex maintain working/test copies of any of the registration information outside of the Nlets firewall? If so, are there documented ways to make sure this information is protected outside the firewall?
Data Access: Will Gatso/Redflex have access to the entire registration record? or, will access be limited to certain fields?
Code Security: Will any of the code development or code maintenance be done overseas in the Netherlands or Australia? If so, will all developers be vetted?
Network Security: Will overseas developers/site suport staff have access to the data behind Nlets firewalls? What extra precautions will be taken to protect Nltes systems/networks from abuse/attack?
Code Security: Will Nlets conduct any security testing on code loaded on the servers behind their firewalls?
Stakeholder Support: Have all 50 U.S. states, and provinces in Canada, been made aware of this new information sharing relationship? Do they understand all of the nuances of the relationship? And, are they satisfied that their constituents personal information will be protected?
Audit/Logging: Will all queries to vehicle registration information logged? Is someone checking the logs? How will Nlets know if abuses of authorized access are taking place?
Public Acceptance: How do states inform their constituents that their personal vehicle registration information is being made available to foreign owned company? Will they care?
How these questions are answered will determine whether or not we should worry…
Did I miss any other important questions?
Beyond this particular press release and blog posting, I suggest that you consider asking these kinds of questions whenever your agency is considering opening/connecting its data systems to outside organizations or private companies—it may just prevent your agency from becoming a headline on tonights news, like St. Louis –> St. Louis Police Department computer hacked in cyber-attack .
The bottom-line is that whenever you take advantage of opportunities to apply innovative technologies to public safety, make sure that you cover ALL the bases to protect your sensitve data and PII from leakage, direct attacks, or misuse and abuse.
As always, your thoughts and comments are welcome.