June 2009 Blog Archive

President Obama today outlined his long-anticipated proposal for massive reform of the financial markets regulatory structure.  Some changes, like the abolishment of the Office of Thrift Supervision and increased powers for the Fed, were well telegraphed and surprised no one; others, like the extent to which Treasury would be able to seize large, “systemically important” companies and the fact that Fannie Mae and Freddie Mac are not part of the initial plan, raised a few eyebrows although none were truly shocking to most.  More than a few pundits and industry experts have noted that the proposal made no mention of the role of government policy in creating and exacerbating the current economic crisis; alas, such analysis is well beyond the purview of this blog anyway.  And we have a long way to go on this topic, as Congress has yet to truly weigh in – which you know they will do early and often before all is said and done.

For our purposes, this proposal is highly relevant to the matter of information risk management (IRM) for several reasons.  First, as we have been saying for almost a year now the breadth of industries covered by the proposed regulations is huge, and includes not just the “obvious” targets like hedge funds and credit card companies but any institution – including foreign affiliates – that has a banking charter known as an “industrial loan company”, which would include heretofore unregulated entities like Target, Harley-Davidson, BMW, GE and any venture capital or private equity firm with assets over $30 million (which is essentially all of them).  Second and more fundamentally, any increased regulatory oversight is by definition likely to result in more investigations, prosecutions and fines – especially when such outcomes are being overtly mandated by the administration.  As we have repeatedly noted, this process has already begun.  Add these elements together and you have a recipe for a significant spike in information risk. 

Stay tuned – this is one story which will only get more interesting as it unfolds. 

Earlier this year, we predicted that 2009 would bring an increase in government regulation and oversight.  It appears that a major wave of this increased regulation has just hit.  Yesterday, The Washington Post reported that the Department of Justice had begun investigating whether some of the nation’s largest technology companies violated antitrust laws by negotiating the recruiting and hiring of one another’s employees.

The Post cites two sources familiar with the situation. According to the Post, the review is in its preliminary stages and includes some major players in the technology sector, among them Apple, Google and Yahoo. The allegations seem to focus on agreements between companies not to hire away top talent. If true, these alleged activities could violate antitrust laws. Even if the allegations prove false, the target companies will likely need to gear up to respond to various DOJ information requests for many months to come. Based on the preliminary report about the nature of the allegations, the investigation will involve numerous enterprise data sources containing potentially relevant information that the DOJ would pressure to review.  Beyond the obvious e-mail systems, the target companies’ human resources, recruiting and training systems may be especially interesting to the DOJ. 

We will now see how well these companies have prepared for litigation and regulatory inquiries. Namely, have they implemented effective technology, process and people to allow them to review data in place, initiate preservation of potentially relevant data, collect the data and conduct a review and analysis in-house and/or with their outside counsel?  Even if they have taken steps to implement these activities, these recent investigations may be the first time that the tools, process and people are stress tested. We will be closely monitoring how these investigations play out over the coming months.

This recently announced wave of inquiries has prompted Recommind to issue an Information Risk Alert (#2009-5) which can be found at Recommind’s Risk Monitoring Center: http://www.recommind.com/knowledge_resources/rmc