datachicane
06-02-15, 03:50 PM
I'd be interested in the take of others in the field (and outside, for that matter).
For those who haven't heard the sordid story of our former governor and his email woes:
http://www.wweek.com/portland/article-24792-the_whistleblower.html
Full disclosure: I also work in IT for the State of Oregon. I know Michael, although I've never worked directly with him. He's a good guy, makes a mean salsa. I want to be sympathetic to him, and I'm more than willing to give him the benefit of the doubt.
That said- this leaves a very, very bad taste in my mouth. Information security is something we take very seriously. We all go through mandatory retraining on our IT security policies and procedures at least once a year. This is not a subject that's an afterthought, or something that gets lip service.
Improper deletion of data is a serious offense, but no more serious than a data breach. I have no doubt that I would share Michael's concerns about the possibility that the emails would, in fact, be deleted. I strongly suspect that he's not the only one who made an extra copy after seeing that request. While the deletion was, in fact, never carried out, we'll never know whether the leak itself changed that. Given that the request was almost certainly illegal, and given the fact that the Feds had already begun their own investigation, the prudent thing would seem to be to sit on the copy until there was actually a legal framework to disclose them. Turning them over to a reporter before it's even clear that the deletion request will end up being carried out? Unconscionable.
A data breach does not 'cure' improper data deletion, and it's not as if those were the only two options. If the deletion had actually been executed, and if all of the various investigations had petered out, that would present a different scenario- with no possible legal framework left, what he did would become something most professionals in a similar position would at least consider, myself included.
I don't care whether it's someone's email at the top or the bottom of the food chain, mental health records, financial data, criminal records, etc., etc., we have clear and established standards for handling data. Sadly, when politics are involved confirmation bias rules. I think Michael was under a colossal amount of stress and made a mistake, a big one. As someone who knows him, I'm relieved that the new gov has said that she'd prefer he not see prosecution. As a professional? I dunno.
For those who haven't heard the sordid story of our former governor and his email woes:
http://www.wweek.com/portland/article-24792-the_whistleblower.html
Full disclosure: I also work in IT for the State of Oregon. I know Michael, although I've never worked directly with him. He's a good guy, makes a mean salsa. I want to be sympathetic to him, and I'm more than willing to give him the benefit of the doubt.
That said- this leaves a very, very bad taste in my mouth. Information security is something we take very seriously. We all go through mandatory retraining on our IT security policies and procedures at least once a year. This is not a subject that's an afterthought, or something that gets lip service.
Improper deletion of data is a serious offense, but no more serious than a data breach. I have no doubt that I would share Michael's concerns about the possibility that the emails would, in fact, be deleted. I strongly suspect that he's not the only one who made an extra copy after seeing that request. While the deletion was, in fact, never carried out, we'll never know whether the leak itself changed that. Given that the request was almost certainly illegal, and given the fact that the Feds had already begun their own investigation, the prudent thing would seem to be to sit on the copy until there was actually a legal framework to disclose them. Turning them over to a reporter before it's even clear that the deletion request will end up being carried out? Unconscionable.
A data breach does not 'cure' improper data deletion, and it's not as if those were the only two options. If the deletion had actually been executed, and if all of the various investigations had petered out, that would present a different scenario- with no possible legal framework left, what he did would become something most professionals in a similar position would at least consider, myself included.
I don't care whether it's someone's email at the top or the bottom of the food chain, mental health records, financial data, criminal records, etc., etc., we have clear and established standards for handling data. Sadly, when politics are involved confirmation bias rules. I think Michael was under a colossal amount of stress and made a mistake, a big one. As someone who knows him, I'm relieved that the new gov has said that she'd prefer he not see prosecution. As a professional? I dunno.