Because I am Here » Uncategorized http://www.aarontitus.net/blog Aaron Titus' Personal Blog Tue, 13 Jul 2010 20:45:30 +0000 http://wordpress.org/?v=2.8.3 en hourly 1 Letter to VA Board of Bar Examiners http://www.aarontitus.net/blog/2010/03/23/letter-to-va-board-of-bar-examiners/ http://www.aarontitus.net/blog/2010/03/23/letter-to-va-board-of-bar-examiners/#comments Tue, 23 Mar 2010 12:55:51 +0000 Titus http://www.aarontitus.net/blog/?p=190 I mailed the following letter to the Virginia Board of Bar Examiners on March 22, 2010, after receiving a letter with all of my sensitive information printed on a single sheet of paper.

Robert E. Glenn, President
Virginia Board of Bar Examiners
c/o Julie O’Kelly
2201 W. Broad Street, Suite 101
Richmond, VA 23220

Mr. Glenn:
I recently took the Virginia Bar Exam. I received a letter dated January 27, 2010 which contained instructions for the February exam. To my horror, I saw that the letter contained my full name, date of birth, social security number, school, MPRE score, results of my Character and Fitness Questionnaire, address, and email address on the form. This single piece of paper contains enough information for someone to impersonate me and commit identity theft. I count myself lucky that someone else didn’t check my mailbox the day this letter arrived.

I was sure that such an oversight was an isolated error, so I called the Board of Bar Examiners’ office to find out how a mistake like this could happen, to ask for a copy of the board’s privacy policy, and asked who changed my authorization to put my identity at such substantial risk.

I was informed that the mailing of my sensitive personal information in a single letter was deliberate, the Board has no privacy policy, and that the Board authorized this reckless use of my personal information, against my wishes and authorization.

This letter is to object to some of the Board’s more dangerous privacy practices as I currently understand them, and request additional information.
Please send a copy of the Board’s privacy policy. If one does not exist, please send the following information:

  • How long will the Board keep my personal information on file, and for what purposes?
  • Does the Board store my personal information on encrypted hard drives?
  • On how many computers does the Board store copies of my personal information, and where do the hard drives go when the computers are retired or replaced?
  • With what entities does the Board share my personal information, and under what conditions?
  • What security measures, if any, does the Board use to detect intrusion or improper use by employees?

I understand that the Board needs to verify personal information with examinees. However, even minor common-sense steps would substantially increase security. These may include:

  • Sending separate mailings, each of which lacks a full set of personal information.
  • Omit digits of the social security number.
  • Write and disseminate a Privacy Policy, and update your organization’s privacy practices.

I hope that the Board takes these matters seriously, and updates its privacy policies and practices immediately. The Board of Bar Examiners has violated my trust, and I fear that the Board will continue to put me at risk of identity theft and other harms.

I look forward to answers on these most pressing issues. I also stand ready to assist in your effort to improve your privacy practices.

Sincerely,
Aaron Titus

]]> http://www.aarontitus.net/blog/2010/03/23/letter-to-va-board-of-bar-examiners/feed/ 1 The Three Elements of Action http://www.aarontitus.net/blog/2010/02/12/the-three-elements-of-action/ http://www.aarontitus.net/blog/2010/02/12/the-three-elements-of-action/#comments Fri, 12 Feb 2010 08:30:05 +0000 Titus http://www.aarontitus.net/blog/?p=170 Yawn Note: This article was originally published on the Security Catalyst Blog.

Your meeting was supposed to last just 45 minutes, but the first 35 have been devoted to the first agenda item. Most eyes have glazed over and you are the only one speaking. Just as tired as everyone else you say, “OK, so we all agree that we’re going to do that?” Hearing no objection, you move on to the next subject.

You are relieved to move on, but don’t be surprised when you have to rehash the same subject at the next meeting. Do not mistake movement for progress; your discussion was an utter failure because it lacked the fundamental element to any progress: An Action Item.

Every action item is comprised of three things:

  • A Person
  • A Deliverable
  • A Date

Absent one of these three things, a decision is not an action item. It is a wish. All would-be “action items,” “goals,” or “decisions” which fail to include one or more of these components were a waste of your breath and their time. Action items must be clear, measurable, and have accountability. Unless you want to rehash the same issue at the next meeting, never walk away without identifying a person, a deliverable and a date for each action item, regardless of the subject matter. Let’s analyze some would-be “action items” from actual meetings:

Assignment 1: “Development of a power point presentation to train staff.”

Person None.
Deliverable A powerpoint presentation. However, the subject matter of the presentation is not clear in this context.
Date None. This presentation will never be late, because it’s never due.
Outcome Inaction. This is a wish, not an action item.
Assignment 2: “Staff will take decisive action aimed within the next 30 days at having the new privacy policy ready to be trained upon.”

Person Nobody, or more specifically, everybody. Note the excessive use of passive voice. An action assigned to everybody is nobody’s responsibility.
Deliverable None. If you can tease a deliverable out of this, you deserve a raise. What exactly does “decisive action” and “ready to be trained upon” mean?
Date 30 Days. However, this date doesn’t mean much because there’s no deliverable or assignment.
Outcome Inaction. This is a wish, not an action item.
Assignment 3: “Jane Davis should work with the Communications Department to discuss the issue of posting the entire training program on the website for free downloading to all visitors.”

Person Jane Davis.
Deliverable Hold a discussion with the Communications Department. Although they probably intend for Jane to post the training program, her only assignment is to have a discussion. It might have been written better, “coordinate with the Communications department to post the training program in by the end of the month.”
Date None.
Outcome Inaction. This is a wish, not an action item.
Assignment 4: “Kevin Jones will identify key end-users, such as educational and other relevant organizations, and develop a database of end-users, by the end of January.”

Person Kevin Jones.
Deliverable Database of end-users. Of course, with this responsibility, Kevin must also have the authority and resources to execute the assignment.
Date January 31st.
Outcome Action. This is an action item.

The three components of action are a person, a deliverable, and a date. Here’s your assignment: Next time you lead a meeting, don’t rest until you identify the three elements of action for every assignment. It’s the single most effective thing you can do to shorten meetings and avoid rehashing the same issue again in the future.

So let’s evaluate my assignment:

Person You.
Deliverable Require a person, deliverable, and a date for every assignment you make.
Date Your next meeting.
Outcome Shorter, more effective meetings, happier employees, and real action. This is an action item.
]]> http://www.aarontitus.net/blog/2010/02/12/the-three-elements-of-action/feed/ 0