It’s not your information

While this blog entry refers to No­vartis policy, the real­ity is that this policy and per­spect­ive is in place at the vast ma­jor­ity of com­pan­ies. This one hit a nerve in No­vartis when I pos­ted it - it was for­war­ded all over - so I’m put­ting it on this blog for ref­er­en­ce else­where when I need to men­tion it.

I’ll note that, as men­tioned in my de­scrip­tion about these No­vartis-re­lated blog entries, I had per­mis­sion to take the blogs I wrote while at No­vartis with me when I left, so in some weird meta way, these blogs are an ex­ample of ex­pli­citly hand­ling this kind of in­form­a­tion own­er­ship situ­ation.

For the last few weeks, quite a few people in IT have been con­sumed with help­ing the leg­al de­part­ment pre­pare for a com­plex leg­al case.

I can’t go in­to the de­tails, ob­vi­ously. But in es­sence, it’s what hap­pens in any court case like this: we, No­vartis, need to be able to demon­strate that, at some point in the past, we knew (or per­haps didn’t know) some­thing about some­thing.

Maybe we need to show that we were the first with the crit­ic­al idea for a pat­ent. Maybe we need to show that we had no idea some­thing was go­ing on. Maybe we need to show that we ac­ted cor­rectly in a cer­tain kind of situ­ation. Whatever the ex­act situ­ation, we need to be able to use our doc­u­mented his­tory to demon­strate our po­s­i­tion.

Of course, that his­tory is nearly all in the form of elec­tron­ic re­cords - both form­al re­cords and in­form­al. And they are com­plic­ated. And they are big. And, even in our com­pany, which has a fairly strong sense of cent­ral­iz­a­tion, they are dis­trib­uted all over the place. On serv­ers. On the in­tranet. On laptops. On backups. On your phone. In email archives.

It turns out that our abil­ity to search through all this to an­swer these leg­al ques­tions is… well… not as good as we would like. Giv­en the likely fu­ture of the world (more elec­tron­ic, more dis­trib­uted, and more li­ti­gi­ous), we’ll prob­ably have to im­prove that. (We AL­WAYS need to im­prove our tools. :-)

But, for those of us in­volved in this work, the most starkly clear thing com­ing through dur­ing this search is this: when the rub­ber hits the road… when the com­pany is really ser­i­ous… when it really mat­ters… there is no ques­tion: that data, those laptops, that email - THAT IS NOT YOURS. That stuff is owned by No­vartis, and we WILL use it for the be­ne­fit of the com­pany.

We all know this, in­tel­lec­tu­ally. It’s com­pany prop­erty. The laptops and devices are tools provided by No­vartis for us to do the work. The in­form­a­tion we gen­er­ate at work is com­pany stuff. No­vartis has the right to ac­cess any­thing on that com­puter. (In fact, No­vartis is RE­SPONS­IBLE for what is on that com­puter.)

And yet, I think most of us - es­pe­cially the di­git­al gen­er­a­tion - live in a world where we tend to think of all these devices as per­son­al com­mu­nic­a­tion tools and pro­ductiv­ity aug­ment­a­tion devices. Be­cause that’s what they are. Sure, my Mac is a No­vartis Mac. But I also use it as my place for everything else di­git­al… edit­ing fam­ily pic­tures, plan­ning bike trips, hand­ling per­son­al email.

Why? Be­cause I can do it se­curely, I can do it without harm­ing No­vartis in­terests or mis­us­ing No­vartis prop­erty, and it’s MUCH more ef­fi­cient for me if I do so. I used to carry two laptops around - one for work, one for per­son­al. That was just in­sane. Heavy. Com­plic­ated. Prone to er­rors.

I do have my own per­son­ally-owned Mac at home, which is the place I keep the of­fi­cial “real ver­sion” of all this info, but the real­ity is that most of the time I spend hand­ling my per­son­al Gmail hap­pens on my No­vartis Mac, be­cause that’s the com­puter I have with me – when I’m at work, when I’m at cof­fee shops, when I’m on air­planes, when I’m on travel.

The same is true for my iPhone. And while many people may keep their per­son­al stuff off of their No­vartis PC, I’ll bet that the ma­jor­ity of people with a use­ful No­vartis mo­bile device merge work and per­son­al stuff onto that device without really even think­ing about it. Haul­ing two phones around is also really an­noy­ing. I know that SOME people have two phones, spe­cific­ally for this pur­pose.

But most people don’t… And even then, those worlds tend to bleed to­geth­er. Which device has which con­tacts? Which device did you use to take that quick snap­shot? Which one did you read the morn­ing news on, and save a link to a use­ful art­icle? Which one does your spouse text you on when it’s an emer­gency?

This is an in­ter­est­ing and com­plic­ated situ­ation. In the old world, when com­puters were heavy and clouds were white things in the sky, the sep­ar­a­tion between work and per­son­al tech­no­logy was pretty ob­vi­ous… but these days, with mo­bile sys­tems, data every­where, work­ing on the road, bring-your-own-device… it’s really hard to keep them sep­ar­ate.

I’m pre­pared to ar­gue that No­vartis should pro­mote this kind of mer­ging of sys­tems in a se­cure and com­pli­ant way, be­cause it’s more pro­duct­ive for our as­so­ci­ates at the end of the day, both at work and at home. I’m really in­ter­ested in fig­ur­ing out ways we can do this more ef­fect­ively.

Here’s the deal: even if our policies and sys­tems con­tin­ue to make this easi­er, do not for­get that, at any time, No­vartis has the right to seize any No­vartis-provided device and do any­thing with it. Search everything. Copy everything. De­lete everything. And, just to re­it­er­ate: we are do­ing ex­actly that kind of copy­ing and search­ing on the devices of a num­ber of NIBR as­so­ci­ates quite lit­er­ally right now. Not be­cause we want to, but be­cause we need to for the good of the com­pany.

As someone who does use a work com­puter for per­son­al pur­poses, watch­ing this search play out is a stark re­mind­er to me of the un­der­ly­ing real­ity of who owns what and who has ac­cess to what. Sorry, we’re really not in­ter­ested in your fam­ily re­union pic­tures… but they were on there, and we had to run that search across everything on the hard drive.

So… if you do hap­pen to use your No­vartis sys­tem for per­son­al pur­poses:

  • Make sure you’re do­ing so in a way that meets com­pany se­cur­ity and sys­tem us­age policies.
  • Make sure you don’t put any­thing on it, EVER, that you wouldn’t want the com­pany read­ing.
  • Make sure you have a strategy for re­cov­er­ing whatever per­son­al in­form­a­tion you have on there should it be nuked.

I’m curi­ous how many people think about this and have a strategy for mak­ing this situ­ation work in their lives. If you have spe­cif­ic sug­ges­tions, or strategies, let me know or leave a com­ment.

[And, as a side com­ment: thanks to the many folks in IT who have been bur­ied with this par­tic­u­lar search… and for car­ry­ing out this work with as much re­spect for per­son­al stuff we’ve run in­to as pos­sible.]