Balancing Good And Evil

Physical crime may not pay, but cybercrime certainly does--and it pays big for those with the know how to take advantage of it. Moreover, in some countries where technology is still in its infancy and laws don't exist or are only vaguely defined, it's even semi-legal.

On one level, this should come as no surprise. Laws often take years to catch up to technology. In places where technology is still developing, it will take even longer. But even in established economies it takes time to comprehend all of the ramifications of new technology and to figure out how that technology is actually used and misused.

Yet there's another level. Because the Internet is an open highway for data moving in all directions, it means criminals can work in one or more geographies, individually or in gangs. It also means they can reach across international boundaries and grab whatever they can through a variety of means--phishing, pharming or spear-phishing--without ever stepping foot in the country where the crime is committed.

Bad people with bad intentions do exist and, when they can get away with it, they often do bad things. For corporations, that poses both philosophical and legal problems--both of which fall squarely on the chief information officer's shoulders.

On the philosophical side, the biggest question is just how open should a company be? The free exchange of ideas is vital to an innovative company. In fact, the more the better, even if most of them aren't useful, and that generally requires interaction with the outside world. Locking down a corporate enterprise to keep out the bad guys is roughly the equivalent of air travel after 9/11. Prior to that, it was an acceptable mode of transportation. Now it's time-consuming, inconvenient and often just plain miserable.

Most people don't want to work in an ultra-secure environment, so it's up to the CIO to find a happy medium between the open, free flow of ideas and the legal problems that can ensue if company data gets out. That includes everything from intellectual property, which can be used by a competitor, as well as customer data that can create havoc if it falls into the wrong hands.

Corporations are entrusted with keeping personal information private. Adhering to minimum industry standards is no guarantee data won't get stolen or the company won't get sued. Even if a company ultimately wins in court, lawsuits are expensive to defend and can chip away at a company's well-earned image.