Legal Brief: When The Unthinkable Becomes A Reality
InformationWeek.com's informal poll shows that 51% of respondents' companies don't have policies regarding child pornography.
Child-pornography images are showing up in the most unlikely places--the desktops of professors and senior executives, lawyers, teachers, and others you would never have suspected, even your trusted employees. What would you do if the police heard about this before you did, directly from another one of your employees?
Suddenly, your carefully crafted Internet-use policy doesn't give you the coverage you expected. How should you deal with the contraband you discover on your company's computers? How should you handle the police, the employee who is implicated, and the employee who called the police?
The time to think about these questions is now. Being prepared, and preparing your employees, can make the difference between a difficult situation and a public-relations and legal disaster. To do that, you need to have a policy in place and procedures that implement that policy. Then you need to make sure that those policies and procedures are communicated to your employees.
First, review your existing Internet-use policy. Does it contain a provision dealing with criminal activities? What about pirated software and music? Have you created a procedure through which people can report abuses of the policy?
Next comes the hard part. You need to decide whether to report criminal activity to authorities or handle it as an internal matter. Many companies elect not to report employees' criminal activities to law enforcement. They handle these activities as a violation of company policy. Should your decision for handling discovered criminal activity depend on the type of activity involved? Are you more likely to forgive music pirating than child pornography? You need to work out these issues in advance and consult with your legal advisers. Failure to take action when you discover criminal activity may result in the company itself facing criminal charges.
Once the parameters are decided, create written policies and procedures that deal with criminal activities that are found on your computer system. They should include a description of the kinds of actions that are illegal, as well as a statement that they are only some examples. They should also include to whom and how violations should be reported. Make sure employees know that ignoring procedures is a violation of company policy and can be disciplined as such. Make sure the policy is signed by everyone.
Then you need to establish methods of investigation. Investigating child pornography is especially tricky. It doesn't take much for the investigator to violate the law. Possession, downloading, printing, or saving child-pornography images, in any format, or delivering it to anyone else is illegal, even when you intend to report it to legal authorities. When child pornography is suspected, law enforcement or private consultants trained in this area should be called, and the computer isolated immediately.
How Enterprises Are Attacking the IT Security EnterpriseTo learn more about what organizations are doing to tackle attacks and threats we surveyed a group of 300 IT and infosec professionals to find out what their biggest IT security challenges are and what they're doing to defend against today's threats. Download the report to see what they're saying.
Infographic: The State of DevOps in 2017Is DevOps helping organizations reduce costs and time-to-market for software releases? What's getting in the way of DevOps adoption? Find out in this InformationWeek and Interop ITX infographic on the state of DevOps in 2017.
2017 State of IT ReportIn today's technology-driven world, "innovation" has become a basic expectation. IT leaders are tasked with making technical magic, improving customer experience, and boosting the bottom line -- yet often without any increase to the IT budget. How are organizations striking the balance between new initiatives and cost control? Download our report to learn about the biggest challenges and how savvy IT executives are overcoming them.