Government organizations have to deal with whistleblowers - it's a fact of life. It's also against the law to discriminate against whistleblowers due to the Whistleblower Protection Act. But the act only prevents retaliation or threats of retaliation. Is additional surveillance allowed? Maybe - don't take legal advice from me, I am not a lawyer.
But the VA lawyers may soon have to answer this question. The VA was caught "diverting" mail sent from certain employees - those identified as whistleblowers. Members of Congress now want answers about this. The VA responded that the mail was not actually being "diverted" but rather was being given special priority so that known whistleblowers could have their mail to senior executives answered as quickly as possible. Um, right. I was born at night but it wasn't last night.
Regardless of your stance on the political issues surrounding the VA fiasco, there are some lessons to be learned here. Left to their own devices, systems administrators often take unilateral actions they believe will help the organization. These often take the form of surveillance. Unfortunately, not all of these actions are in keeping with the law and/or corporate policy.
At Rendition Infosec, we recommend that organizations get help from their internal legal counsel to review their information security policies. A quick chat with lawyers today can save you real headaches later if there is confusion about what is and isn't legal. I strongly suspect that the VA didn't take this step. Once policies are approved by legal, it's a good time to communicate the policies back to rank and file workers. When mistakes happen (and they will), don't cover them up - use them as case studies to educate the workforce.
On a personal note, as a service connected disabled veteran, I applaud VA whistleblowers. The VA has gone far too long with actions nearly unchecked by the legislature. It's high time for a change. Even if extra special monitoring for whistleblowers is strictly legal, it stinks to high heavens and I expect heads to roll.
But the VA lawyers may soon have to answer this question. The VA was caught "diverting" mail sent from certain employees - those identified as whistleblowers. Members of Congress now want answers about this. The VA responded that the mail was not actually being "diverted" but rather was being given special priority so that known whistleblowers could have their mail to senior executives answered as quickly as possible. Um, right. I was born at night but it wasn't last night.
Regardless of your stance on the political issues surrounding the VA fiasco, there are some lessons to be learned here. Left to their own devices, systems administrators often take unilateral actions they believe will help the organization. These often take the form of surveillance. Unfortunately, not all of these actions are in keeping with the law and/or corporate policy.
At Rendition Infosec, we recommend that organizations get help from their internal legal counsel to review their information security policies. A quick chat with lawyers today can save you real headaches later if there is confusion about what is and isn't legal. I strongly suspect that the VA didn't take this step. Once policies are approved by legal, it's a good time to communicate the policies back to rank and file workers. When mistakes happen (and they will), don't cover them up - use them as case studies to educate the workforce.
On a personal note, as a service connected disabled veteran, I applaud VA whistleblowers. The VA has gone far too long with actions nearly unchecked by the legislature. It's high time for a change. Even if extra special monitoring for whistleblowers is strictly legal, it stinks to high heavens and I expect heads to roll.
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.