In common parlance, governance is the responsibility to take care of things – the ownership of which lies elsewhere. It is all about taking care of other people’s stuff.

So when an employee’s responsibilities include protecting a city’s computer system and its data – to whom does  that employee owe the duty of trust?

According to the San Francisco Chronicle – this was the issue confronting a computer engineer, Terry Childs, in June of 2008. Mr. Childs fully understood that San Francisco’s data was sensitive. He was well versed in system security and knew the need to protect the network from viruses, hacking and corruption. Unfortunately, Mr. Childs had grown to believe that the biggest risk to the network was his co-workers.

There were no established policies in place and Childs believed that no one other than himself was capable of running and maintaining the system. He felt that his colleagues and supervisors had introduced viruses and in other ways damaged the system or shown disregard for its well-being. His solution was to protect the network by denying access. He held the passwords hostage.

There is of course, more to the story. Perhaps Mr. Childs was delusional or was merely disgruntled and intent on mischief. But let’s assume that Mr. Childs did indeed believe that the entire IT department and other administrators were a danger to the system. It doesn’t matter whether he was right, only that he believed it is true. Given that belief, can he ethically allow others access – or must he protect the system and by extension, the city?

So, what should a systems administrator do if he or she believes that fellow employees are a threat to the system’s integrity? I suspect that many IT departments see the rest of the employees as a huge threat to the network. We, the non-IT folk, disregard policies on safe computing. We receive emails from friends and family complete with attachments; we visit gaming sites; download programs and attempt to install unauthorized software. We leave laptops in restaurants and allow our children to do homework on office equipment. We share our passwords with each other, try to tweak our bios and attempt to bypass network security when it interferes with what we want to do.

I’m pretty sure that many IT departments spend an inordinate amount of time trying to protect the system from its authorized users. As a friend of mine said, “If there is a way for a user to screw it up – they will.”

It’s no wonder that tech support always asks, “what did you do?” The IT department spends hours, days, years creating a system that meets the organization’s constantly changing needs. IT respond to our demands, requests and cries for help. Many management information systems have grown in response to need and are poorly documented. This means that a few people, like Terry Childs, have a lot of information in their head.

The pressure is enormous. I rather like the idea that somewhere a computer engineer cracked a little under the strain and said “No more! If I can’t impose good practices on users then I will do what I can to protect the system. I will lock the gates and bar intruders .”

Regardless of how they resolved the case in the golden gate city there is a common lesson here. Data contained in computer systems is a valuable asset and it must be safeguarded. It must be protected from those who would damage it deliberately or through neglect and lack of care. And it must be protected from those who would try to protect it by holding it hostage.  A trusted employee has certain privileges.  With the privilege comes vulnerability.

Good governance requires that an organization recognizes the vulnerability and takes steps to mitigate potential damage. The solution to San Francisco’s near crisis took the form of personal intervention by the mayor. According to the Chronicle, the mayor had a chat with Mr. Childs  and convinced him to release the pass codes. I’m glad it worked out but it seems a rather risky fail safe. Am I alone in wondering what other unidentified vulnerabilities lurk in the city’s administration?

Whatever you think of Mr. Childs – he proved, at least in part, that there was a problem.  His actions clearly said: “I told you the city’s data was at risk – see how easily I denied everyone access! Any questions?”

Makes you think, doesn’t it? Who holds the keys to your data and just how much pressure are they under?