In a post-WikiLeaks world, has the concept of confidential information become redundant? Serge Debrebant examines the issues facing companies whose secrets could become public knowledge at any moment
In July 2009, when Iceland was in the midst of a financial crisis, local television reporters discovered a cache of potentially explosive documents. The paperwork suggested that major shareholders of Kaupthing, the country’s biggest bank, had borrowed large sums of money unsecured by any significant assets shortly before the bank collapsed. Although the records did not indicate any wrongdoing, they revealed a potential conflict of interest.
The reporters worked intensively on a feature for the evening news, but five minutes before the start of the show, the authorities intervened and forbade the station to air the report. The station complied, but, by way of protest, the anchorman advised viewers to take a look at the documents themselves. For several minutes of live airtime, he showed the name of the website on which they could be found: wikileaks.org
The information will come out, it seems. But, as businesses are quickly learning, WikiLeaks speeds upthat process — and often skirts the old obstacles that companies used to be able to throw up.
Founded by Julian Assange and other activists in 2006, the website states that its purpose is to uncoverunethical behavior in governments and corporations. It does so by enabling whistle-blowers to send it internal documents anonymously and without fear of being detected. The most widely read scoops to result from this enterprise have been about international affairs — notably the Afghanistan files and us diplomatic cables — but the goings-on of the business world have also been a focus. In recent years, WikiLeaks has targeted large companies, with a particular focus on the banking sector.
Last November, Assange told Forbes magazine that about half of the documents that WikiLeaks possesses relate to the private sector. in the same interview, he announced that the next target would be “a big us bank.”
WHISTLE BLOWING MADE EASY
Whistle-blowing is neither a new phenomenon, nor is it restricted to WikiLeaks. However, the website has made it easier for disgruntled employees to reveal company data. In addition, the digitization of theworkplace plays into the hands of those with a mind to steal sensitive data and share it online.
For companies, the probability that internal documents might show up in the public domain has increased exponentially in the space of a decade. “Every company is a potential target,” says David Chamberlin, Director of issues & Crisis management at us public relations agency MSLGROUP.
Those who don’t recognize this learn it the hard way.
In 2008, Swiss bank Julius Baer discovered that Rudolf Elmer, a former employee, had published on WikiLeaks internal documents from a subsidiary based in the Cayman islands. Elmer worked there from 1994 to 2002, when he was fired. There ensued a long fight with his former employer. He accused Julius Baer of helping wealthy clients to avoid taxes by transferring money offshore. The bank quickly tried to obtain an injunction, and a judge in California complied, ordering that WikiLeaks’ domain name be shut down. it was — but, almost instantly, mirror sites appeared, and with them the very material Julius baer had wanted to suppress. Two weeks later, the judge vacated the injunction.
Julius Baer’s decision to take legal action had backfired. Not only were the documents still accessible, but the injunction had also raised the profile of the case at a time when American and European governments were trying to crack down on tax evasion. The US media published the numeric address of WikiLeaks, allowing readers to access it directly, and several press and civil rights organizations defended the website in the name of freedom of speech. Without Julius Baer’s intervention, the spat with Elmer might have gone unnoticed. Instead, it became the victim of one of WikiLeaks’ first big scoops.
The bank had experienced what technology journalist mike masnick christened the “streisand effect.” in 2003, actress barbra streisand tried to suppress the publication of photographs of her house in California, only to discover that the public outrage over her legal intervention led half a million viewers to the website on which they were posted. As Philip Gawith, managing Partner at the London-based communications agency Stockwell Group, puts it: “There will always be a place for a legal response,
but in a digital world, you need to be more careful.”
STOPPING THE LEAK
How, then, are companies supposed to deal with WikiLeaks? The most obvious step is to try to prevent the leak in the first place. A survey conducted for the software company SailPoint in 2009 showed that only 14% of organizations felt they had adequate controls in place to prevent leaks. Grady summers, who leads Information Security Program Management Services at Ernst & Young, observes that many companies do not pay enough attention to data security. He lists inappropriate access control, understaffing and outdated crisis response plans as the main issues — issues that are getting an ever-higher profile. “WikiLeaks has made IT security a boardroom issue,” he says.
When Summers advises companies, he outlines a four-step plan. First, he helps the company to identify sensitive data. Then, he helps it to come up with a data governance policy with appropriate access control and proper training of employees. Data loss prevention tools that control data movements help to enforce the policy. Finally, a crisis response plan empowers executives to react quickly in case a data breach occurs.
But proper IT security doesn’t rule out leaks. “Nothing is secure,” says Chamberlin, and a look at the data WikiLeaks has published so far confirms this view. It includes not only highly sensitive data such as customer details or secret reports, but also emails, phone transcripts and other material that would not necessarily be considered highly confidential, yet could still embarrass a company or government.
In Chamberlin’s view, it is important to tackle the root causes of unethical behavior and think about the values of a company and the way they play out in what executives do and say. “If there isn’t a level of integrity and consistency, it’s likely to lead to significant problems, because everybody’s watching,” he says.
RESPONSE STRATEGIES
All the professionals interviewed for this article agree that when a leak occurs, the response has be to swift and precise. Companies such as Ernst & Young offer exercises to test how well a crisis plan works. “It has to involve all relevant departments: iT and legal, but also human resources and public relations,” says Summers.
Although often overlooked, PR plays a key role. “You need to get your version of events out,” says Gawith. Even if a company is still trying to verify the accuracy of the leaked documents, it should quickly start communicating. “When people think you live in denial, they respond badly,” he adds. “Sometimes, the mere act of communication matters more than precisely what you say.”
A close look at the documents might also lead to a response strategy. In the case of Julius Baer, the bank was able to show that Elmer had forged a few of the published documents, which helped the bank to question his credibility.
If the leaked documents turn out to be real, and point to real problems, it is better to acknowledge the revelations and explain how the company wants to improve its operations, than to blame WikiLeaks or smear the whistle-blower. “You have to explain how to fix things so that they don’t happen again,” Chamberlin says. And of course, in the aftermath, a company has to turn words into actions in order to rebuild trust.
HELPING THE MARKETS FUNCTION
Such an outcome would be exactly what Assange and his collaborators hoped for when they founded WikiLeaks. In the Forbes interview in November 2010, he explained that he “loves markets” and that “in order for there to be a market, there has to be information.” From his point of view, WikiLeaks acts as a beneficial corrective to company secrecy and enables markets to function properly. Transparency enables stakeholders and consumers to make an informed decision that ultimately leads to more ethical business practices than before. “WikiLeaks means it’s easier to run a good business and harder to run a bad business,” he said.
In the long run, the work of WikiLeaks and other whistle-blower websites may prompt companies to communicate more openly with the public, shareholders and customers. “It‘s a tendency that i had observed before WikiLeaks,” says Gawith. “People take a greater interest in how businesses are run than they did 10 years ago.”
Ethical consumerism is the most prominent example of this trend. Fair trade certification systems guarantee transparent supply chains, while NGOs such as the environmental investigation Agency, with its investigations into illegal logging, have forced companies to change their behavior. in that respect, WikiLeaks is just one of a number of factors that are contributing to a trend toward greater transparency in business.
