One Direction for Data Security

Data security is an ever expanding nightmare. You are liable. Yes you. For everything. Or rather you are if you are the nominated data controller for your company. Soon there will also be a defined board responsibility too. We are months away from someone getting thrown in the clink because Mavis in accounts thought she was checking her Twitter account and ended up posting the database to North Korea by mistake.

Do you remember the good, old fashioned western? The sort of film where the sheriff, in an effort to clean up his town, made all the cowboys leave their guns at the jailhouse. Our offices will be like that one day...mobile phones left in lockers until the end of the day...rather like school. Because a Smartphone is a data breach waiting to happen, and companies will only want their staff using company owned (and regulated/controlled) kit on the wifi.

Which will drive their employees mad, and cause them to break the rules and sneak their beloved phones in anyway. It is all a recipe for disaster, not to mention dissatisfaction and angst.

However, we need to remember why this is all such a concern, and then apply it to all areas of the IT minefield, including asset disposal at end of life. It’s all about the data, and the harm that can be done if that data falls into the wrong hands. It could be data about you and me as consumers, as patients or pupils. It could be bank details, and therefore access to our worldly goods, or it could be medical records, criminal records, confidential information we would not like anyone else to see. In law, this data is enshrined and protected, so the person who loses it, or negligently lets it get lost, is liable to do twenty years in Pentonville.

But oh how blasé we all are about data! Come on, admit it, you know it’s true. I am a salesman and have been for over thirty years. I have been adding information to database’s throughout that time I suppose, starting with a pen and a rolodex and ending up with salesforce.com and all manner of other CRM systems. So I know what it is like, and although I no doubt tried to enter the right information at the time, we all know there is a lot of garbage in there. And of course if it isn’t all used on a regular basis, even good information turns to garbage. B2B data decays at the rate of about 30% a year, as companies close, move or merge, and people leave. And yet, lose that pile of old misspelt names and bounce back email addresses and you will feel the long arm of the law on your shoulder in next to no time.

I suspect that the latest plans to make a director of any company or organisation directly responsible for data security will wake a few people up. I have been a director of a limited company, and signed all the forms for Companies House, and I remember reading through the responsibilities. It was hard not to take them seriously. I sincerely hope that will be the case.

Because the current situation really is a bit of a worry. The penalties are there and the regulations are there but there is a lack of understanding and appreciation not only of the risks but of the solutions. We start with subject knowledge at ground zero, so there really is only one direction to go and that is up!

We need to educate. I know it is a fairly dry subject but just think about it. Do you search your staff when they leave the building for a USB memory stick? Do you make sure every printer has it’s memory dealt with when you get rid of it? What do you do with the company mobile phone handsets when you upgrade? It’s not just all about computers and hard drives anymore.

We are going to have to change. Data has got bigger but you can now steal it on a stick which you can hide in the smallest of orifice’s. You can attach a file to an email and post it out. Or you can let that nice man take those 5 broken desk tops and find your database on eBay the next day.

Ruminating on Waste Rules and Angel De Maria

Having watched the mighty Arsenal bravely overcome the diving, moaning and blatant cheating of Manchester United the other night, I find myself ruminating on rules. Everyone has to live by the rules to a certain extent, but equally everyone bends them once in a while. You get a touch in the box and you go down, or so some people say. It is the professional thing to do.

No Angel De Maria, it isn’t. No Adnan Januzaj it isn’t clever, it marks you down as a cheat and people will hate you for it. But maybe for once football is not the best example. Most of us don’t bend the rules to gain a conspicuous unfair advantage, we do it because it is easier. Much easier. And this brings me to the subject of when is waste waste, and when is it not waste.

Fascinating huh? Even as a pleasant five minute read to help digest your tuna and mayo wrap, this blog is heading for a new low. But actually it is quite important. 

Take a look at this little link and you will see what I mean. Business Waste

If you cannot be bothered to read that scintillating government offering let me summarise. You need a license to move your waste. You need to know whether it is hazardous or not. If you get someone else to move it, you have a duty of care to make sure they deal with it legally. And you need waste transfer notes to record the whole process.

If you ignore all this and get caught you will be hung drawn and quartered. Your head will then be displayed on a spike outside the town hall to warn off other criminals. Or you will be fined. One or the other.

But when is it waste? EReco MD Jane Taylor and I discussed this on a train yesterday. I have man flu so some of the details are a little hazy but we came to the conclusion that our approach to life here in eReco land is belt and braces stuff. If a client asks us to remove something it is treated as waste because we do not, at that stage, know whether the kit has any life left in it. We have all the relevant licenses and we produce waste transfer notes. We ask what we are collecting and make sure we have listed all the different classifications, so the hazardous box is ticked off. No fines here, move along now, nothing to see.

Businesses in general do not like getting fined. It’s embarrassing and bosses tend to get grumpy because their boss gets grumpy. Now I am not sure if there are waste transfer patrols out there all ready to catch the unaware, but it is another thing to bear in mind. This really is not a subject to be casual about, right from the get go.

And hazardous waste includes laptops and monitors. Yes really. Every sales rep is technically lugging around a hazardous backpack. And as soon as you deem it redundant, you need a license to transport it.

I know. My head aches too. But this is why we are here. Stop worrying about it and call 01342-777550 and let me worry for you. I am good at it. Even whilst shouting at Angel De Maria and calling Louis Van Gaal names, I was reminding myself to check the paperwork for today’s collections.

To Dither or not to Dither

Dithering is not productive. If you have a decision to make, make it, clearly having given it due consideration first, but it cannot take forever. And seek empowerment for goodness sake. It is an overused word in business these days, but we have to be allowed to use our commonsense. Most issues concern finding the right balance between risk and reward, and with clear guidelines most of us are able to see the wood for the trees.

Now you may be thinking that poor old Hugh has been plagued by ditherers in recent days. Well yes and no, really. I usually am one way or another because I have a sales function to perform and the time between offering my wares and getting a yes or no is often a frustrating one. I don’t get why it takes so long sometimes because it is not...it really is not...rocket science.

However, the customer is always right. You take as long as you like. But actually what caused me to put finger to keyboard right now is the idea of risk and reward being at the crux of the matter with every business decision.

The risk can be the cost. This is going to cost me £100 and the reward is that pile in the corner of the office is going to disappear. Sustainability will have been supported and my data will have been dealt with, leaving me with the paperwork to prove it and a warm feeling of indescribable joy.

It’s often the cost that causes the dithering of course. Oh the boss won’t like that at all, having to pay £100 to get rid of 3 old PC’s, that broken kettle and those two old phone handsets. There is no budget for that and if head office finds out, heads will roll for sure. In my experience there is much more dithering over £100 than there ever is over £1,000.

£100 is a decent meal out for you and the other half, with wine. It’s a trip to the cinema and a take away after. No popcorn though, popcorn is ruinously expensive in my experience. It’s almost two thirds of two adult tickets to see the mighty Arsenal lose to Monaco. It’s a year’s subscription to Netflix. It is not a fortune.

Quite often we get asked to take away some broken desks, or chairs, or cupboards along with our usual. And we charge for it. No one seems to mind about that too much, because we are doing them a favour. It is obvious waste and there is no perceived value. But for some unknown reason just because something has a plug people dither.

Oh do you know what? I am always quite excited when I see that someone has a pile of non-WEEE rubbish that they would absolutely love us to take as well as their WEEE, because it means instant gratitude. They could have found someone else to get the real rubbish but it would have cost them in time and hassle as well as cost, so all of a sudden we are the good guys.

But suggest that the aforementioned broken kettle, clapped out PC and old phone handsets are rubbish as well and will be charged for accordingly and there is a sharp intake of breath. The boss won’t like that.

Well the boss won’t like being fined when your database gets stolen either. He won’t like it if he gets caught trying to slip business waste into the local council tip either. There are lots of things he won’t like that £100 prevents him from suffering these days. So surprise the boss. Tell him you have saved the company database from breach, tell him that you have operated within WEEE regulations and the data protection act and have the paperwork to prove it. And tell him that it only cost £100. He will be dead chuffed. Promise.

Stop Hiding and Talk!

Modern sales techniques have to deal with modern technology. Mainly because we hide behind it most of the time, apparently afraid of saying no, not interested at the moment. It never ceases to amaze me that we are afraid of talking to each other.

I do not like blind cold-calling. Unless you are working a very good list and your product or service is an obvious fit, you are largely wasting your time. Especially in business to business. I like to identify a potential prospect, find out what they do and understand why they would want to talk to me. Then I try and find a contact.

You can find this in all sorts of places. LinkedIn is great for getting a name, as are some websites. It is much easier to research it than to talk to that most dreaded of demons, the gatekeeper. I hate unnecessary barriers. How do these ferocious guardians know that I will be wasting their precious minion’s time? Who made them the decision-maker?

Anywho, once I have a name, I can normally conjure up an email too. And there I set out my stall to entice, interest and intrigue my lucky contact. I do not just fire off a sales message. I lovingly craft it, personalise it and try and hit the buttons.

But the thing that interests me the most is the line where I say ‘and could you let me know when would be a convenient time to call?’ I like adding that, because as a buyer I like to arrange to talk to people, so that I am prepared and they are prepared, and I offer my victims...oops I mean lovely prospects...the same courtesy.

Of course, it is also a warning. It should tell the receiver that I intend to call them. 

It is a gentle encouragement to respond. If the prospect responds, they take control. They can decline my kind offer to empty their wallet, giving me a good reason, and telling me to leave them alone. Or they can send me back an order (this happens, my emails are that good! Really!). Or they can ask me some questions and say by all means call me after 4 on Thursday week.

One of these things happens about one out of five times. The rarest thing is a time to call, but in any case direct communication is achieved and let the games really begin. A soft approach has turned into a general love in and we shall be friends forevermore.

What worries me are the ones who do not respond. I am persistent. I will keep calling unless I get told not to, so the average contact will spend more time listening to voicemails from me than it would take to call or write to me to say sod off you annoying little man. No one is that busy.

There is an old cliché about people doing business with people. It is a cliché because it is largely true of course. You build rapport and then working together is so much easier all round. Therefore avoiding talking to people is crazily counter-productive. I mean, I am offering you ethical IT recycling not PPI for goodness sake!

The reality is that email, voice mail, receptionists and electronic answering systems are all great ways to stop business getting done. I cut my young sales teeth in a world before computers, when telephones got answered and people talked to each other. Really. In those days (the eighties) if a message was taken, the person would call you back. Really. No mobiles at the start, I did get a car phone in about 87 but that was largely for talking to my colleagues.

You may think that I am looking back through rose-coloured spectacles, and that may well be true. I just feel that we all spend far too much time hiding from ‘sales’ calls, when we should all be looking at them as an opportunity. If I take a call and someone starts reading a script at me, I stop them and ask exactly what they are selling. If it is not for me, I say no as politely as possible. If they then call me back, I will avoid them or be quite grumpy.

But I always try to remember something the late Peter Coyne told me. Peter was quite well known in Ireland because he was a master networker. He could work out a relationship to just about anyone through his network, and over a little glass of something in Dublin he reminded me that every single business relationship had to start somewhere. Ergo many have to start with a cold call, the first time company A has talked to company B.

So, especially if you receive a soft, polite, well tailored first approach, play nicely. It may be the start of a mutually beneficial thing. It may not, but you will have left another person in this world thinking well of you.

Another old cliché, treat others as you would be treated.

A Marketing Interlude

Content marketing is all the rage. In fact we are, you and me, engaged in it right now. This blog is designed to tell the world about eReco, drive traffic to our website and hopefully make the phones light up with business enquiries. We are active on Twitter (@erecorecycling), Facebook and LinkedIn for the same reasons.

I would be more active on Google + if I understood it a bit more. One of my new year’s resolutions is to master that one!

In line with all this activity we are constantly tweaking our website. It is our shop window on the world and in this day and age it is the most important marketing tool we have. We are pushing as hard as we can, but like most small businesses we are trying to pull people in too...attracting them to us like moths to a flame.

I have a dozen statistical reports in my inbox every day telling me about hits, views, mention reach and likes, but what I want to do is turn that into enquiries. Because this is a lot of effort for a small business to take on and do well if there is no tangible return. In larger companies, in a previous life, I have agonised about budgets and spend, but this is the sharp end. Every penny counts.

This blog is into the sixties in posts. I took the time between Christmas and the New Year off, but I have only missed one working day in terms of posts, and that is a record I plan to continue, because I think our strategy is working. EReco will probably have topped 1000 followers on Twitter by the time you read this. Readership of this blog is going up. Our website stats are on a steep upwards curve and we are getting our name out there.

We are also reaching out through other Channels. I have written an article for industry voice on www.channelweb.com and there will be another article in March in the green issue of Independent Education Today www.ie-today.com as well. Also in the last month we have been appointed as the IT Recycling Partner to the Eco Schools programme and received DIPCOG approval to operate in the MoD space.

All this has happened since mid October. And the lesson I think I have learned is that there is a lot you can do quite cheaply that will make a difference, as long as you have some patience. In what is only 3 months, we have gone from doing very little marketing to being very active. Seeing the results of that will take time, but when this blog reaches 100 posts, I hope to be able to report back on even more progress.

Thanks for reading.

Big Sticks and No Carrots

IT recycling is a business niche. For want of a better word, I suppose. Everyone needs to do it sooner or later, some more regularly than others, and the suppliers within the niche, or sector, or whatever you want to call it, battle it out for their fair market share. Same as any other sector.

The trouble about being in a niche is that awareness varies. Really big businesses get rid of a lot of kit all the time. They have a constant refresh process going on by the very nature of employing lots of people and running big systems. In these businesses they tend to take their responsibilities very seriously and their chosen suppliers have to be up to scratch.

As in any niche, suppliers and interested parties organise and get together to form an accreditation body, an industry promotion club. For ITAD (IT Asset Disposition for the uninitiated, we have ADISA (Asset Disposal and Information Security Alliance) and other than eReco’s own MD, Jane Taylor, the ADISA council includes executives from Dell and Microsoft, as well as many other businesses like us around the country.

It is about best practise and accreditation essentially. Any company certified to meet the ADISA standard has the knowledge, processes and tools to provide a professional ITAD service. They do spot checks and an annual audit – these are no low hurdles. And when tendering for any large business it is more or less a requirement to get a seat at the table, or at least it should be. Take a look at the website and see for yourself ( www.adisa.org.uk ). For the record, we are certified to distinction level.

But let’s get back to the trouble about being in a niche. 98% of businesses, employing over half the people in this country, are classified as SME’s. Most of those do not have a regular ITAD process and thus only use a supplier on a needs basis.

In this area the awareness levels drop away quite alarmingly. If you are a regular, loyal reader of this blog you will have some understanding of this. In short, it amounts to ignorance (of the regulations), apathy (I won’t get caught, I am too small) and fear or suspicion (I am a bit nervous of throwing my hard drives away because I don’t trust anyone to do it properly, and they are probably ripping me off anyway).

The good people tasked with disposing of old equipment in these organisations do not know about ADISA and they do not really get too excited about best practise. They are much more concerned with the cost of disposal. They are also far more susceptible to the temptations of the ‘we can do that for free’ brigade.

It is unfair to criticise ADISA for any of this. They perform an important role and promoting the body effectively to every business in this country would cost a small fortune. But they could and should lobby both the government and the regulators to help them do so. We are the knights in shining armour doing the dirty work for the ICO and his hordes and we could do with some help getting the message across.

Many regulators toy with the issue of data security. The FCA recommends the use of an ITAD partner and decapitates any members who lose client data – a fairly weak suggestion backed up with a blooming great big stick!

The Bar Council goes a little further, and I quote ‘there are a number of companies which offer the services of the secure destruction or safe recycling of computers and devices. However, be aware that some of these companies are less reputable than others, and have been known to provide documents purportedly evidencing destruction or secure erasure prior to resale. Actually, they have not provided the service at all. Ultimately responsibility for the failure by such a company to fulfil its contractual obligation to destroy or securely erase rests with you, as exemplified by a recent case decision of the ICO relating to an NHS Trust.’

My frustration is that the regulators go so far but don’t actually mention accreditation. What the Bar Council and the FCA should be saying is use an ADISA accredited ITAD supplier. It’s that simple. They are happy to highlight the problems, but not to promote the solutions.