An Uncertainty about ESG

No, not that one.

The Environmental, Social and corporate Governance initiative is a trend or collection of trends that has been building in Western economies for around two decades. There are several questions about it. The obvious one is whether or not it would be divisive in workplaces due to political disagreement over the choice to follow government or local activity policies or not. I'm not interested in that one.

I'm interested in the sources of ESG's specific recommendations.

There are several points at which the movement appears to have begun. First, Wikipedia mentions a UN advocacy report of 2004. Second, a tendency of mutual funds and banks to group "responsible investments" together started at about the same time. Third, legal actions as to the composition of corporate boards have been filed at various times for around twenty years in some of the developed nations. And fourth, there have been measurement projects regarding contributions to greenhouse gases. And so on. My question regards the DIY (do it yourself) appearance of the combination of all these sources.

Those responsible for corporate identity are naturally attracted to the opportunity to become associated with popular trends. I simply wonder how controllable such associations in fact are. How could the sources of ESG initiative change? How would one even list these new stakeholders? Could they even BE known in the short run? Are the initiatives even now something that is media-driven? And how is the company exposed to not only new problems, but new uncertainties?

I predict the rise of two possible developments... OK, three:

1. Some companies will retreat from the uncertainty of ESG by adopting the strategy of "We don't get into politics".
2. Some companies will adopt only ESG initiatives that directly address their corporate identity and product/services rationale, shrinking from involvement in more general concerns (and possibly reducing the income of charities and other nonprofits that rely on donations).
3. Companies will consider the above alternatives not only due to verification questions as to the nature of popular ESG trends, but due to the tendency of advocacy groups to change over time, and in directions very hard to predict. There's also the nature of the next advocacy issue - and the next. There's no way to tell what the next popular bandwagon will be.
4. Surprise! Unknowns abound. Apparently non-controversial causes can become controversial later. Should the company contribute to the American Red Cross? Or overseas sister organizations? There was a moderate outcry several years ago about how much the head of the ARC got paid relative to other charity groups. That complicated the positions of those companies that contributed for motives as simple as tornado or hurricane relief.

I don't know how all this will wash out - but that's my point. I don't know how one COULD know. It could be that involvement in some specific ESG concern would be completely necessary to corporate identity. But I think many ESG concerns are not relevant to corporate identity and are optional. This option may be destabilizing to productivity and competitiveness. Then again, involvement in some trend could CONTRIBUTE to productivity and competitiveness, depending upon the product, the industry, the organization. Also, there's the further complication that an ESG concern could be raised tactically against a company by one of its competitors, openly or through surrogates.

What's certain is that business now has a new ongoing debate with which to deal. There existed quite a few already; now here's one more.

EDIT: To approach the issue from a positive direction, though, it would seem possible to do popular cause support at minimal risk to an organization by sticking close to one or more of the following conditions:

1) Is the issue something that much of the group can get behind, from board room to mail room, rather than just a few interested parties?
2) Is the issue something that has a crucial connection with the company's core activity?
3) Is the issue a matter geographically or personally connected with the immediate community in which the company is located? After all, support could have "political" benefits and all politics is local.

Helpful Site

There's a page that's not recent news but has proven interesting to me when I needed to know a few things quickly. The long legal documents that one is expected to read when signing up for many services (pay or free) are daunting. Fortunately there's something called

Terms Of Service - Didn't Read

It offers short, categorized summaries of the gist of TOS documents from all sorts of businesses, concerns and outlets. It doesn't cover every last organization you'll search for, but the big players are well-represented. What's usually found in searches within TOSDR's data are social media forums and large search engine companies, the entities most often viewed suspiciously regarding PII use (personally identifiable information).

This one may dig into the billable hours of the law profession a bit...

Eleven Good Things To Assume

In matters of cyber safety, cyber propriety or cyber not-doing-dumb-things, I'll propose these eleven assumptions from which one could proceed:

1. The network might not be secure.
Network maintenance and patching is a round-the-clock job and the safety level of your electronic environment may fluctuate between maintenance periods.

2. It might not be good to have only one copy of that file.
Any backup idea is better than no backup idea.

3. It might not be good to get sued.
Certain kinds of phone or computer use can create copyright problems, police issues, work misinterpretations or even more spam than other channels. Limiting use or having multiple phones or laptops for different purposes could mitigate risk.

4. It will not be good to lose your phone.
Do you depend on apps to do things you haven't documented or set up in some other way? How would you get by with no phone, or during a period of switching phones?

5. Things break.
Beer spilled in keyboard? Phone dropped down porta-potty? SD card had a really acidic soft drink spilled on it? Device run over by car? Memory nonfunctional due to cracking? Backup or duplicate plans are in order.

6. Settings break.
Reinstalling a browser or app can cause "forgetting" of settings needed for the thing to work. Even writing settings down on paper is better than nothing.

7. Don't forget how good desktops and laptops can be at certain things.
The most insecure thing about a phone is that it gets to the 'net through a phone company that sells your information and may not make security a priority. The "older" ways may have more tools you know or tools that work better.

8. Earphones or headphones can be distracting and even dangerous.
You need to pay attention to traffic, possible muggers and even other pedestrians when on the sidewalk.

9. Touch or proximity radiation from cell phones can be an issue.
Guys: the regular pocket? Girls: phones in the cleavage? Repeated storage of a phone in skin contact or close might cause radar-like burns over long periods of time. Consider a holster or some sort of shielding.

10. It's not good to improperly dispose of cell phones or other data-carrying objects.
I've been finding old user files on replacement or refurbished drives for almost 20 years. They were supposedly wiped clean. Nope.

11. It might be good to turn things off sometimes.
The OFF switch! There it is. In an always-on, always-connected world, disconnection or power-down situations can head off many problems, and possibly stretch battery life.

Adventures In Cyber Hygiene Or Whatever They're Calling It Now

We've all seen users that are certain no one would ever want to break into their account, device or life, since they don't have anything anyone would possibly want - so why worry about security? 

You and I have no doubt answered such users like so:

1. You should follow best practices to protect your boss or other users for whom you are responsible.

2. You should bear in mind that your LOCATION is valuable as a midpoint for attack use, even if your data is uninteresting and

3. Suppose, JUST SUPPOSE that there's something you don't know about.  If there's an unknown threat out somewhere, best practices (like updates, not doing stupid stuff and so on) would be in order, eh?  Maybe. Yeah.  Sure.

But that's silly, paranoid, the-sky-is-falling nonsense.

However, let's say that overnight you develop a sudden Really Urgent Need for a tight security stance where one never existed before.  People buy fire insurance for houses and business locations, right?  (I wonder why they do that...)  Well, imagine that we establish a Business Continuity Plan for this responsible person.  But why?  What could possibly go wrong?  Obviously nothing, but stick with me awhile on this.

What if somebody with a very similar name to our subject gets into the news as a result of being a leader at a Ku Klux Klan rally?  All sorts of activist groups may spring into action to doxx (publish documents regarding someone's location, identity, assets, relatives, known associates etc.) our subject in the mistaken impression that he's a dangerous, racist, anarchistic crackpot.  If our subject found himself in that position, he'd have been well advised to avoid having no-password accounts, avoid leaving apps at default settings, and certainly well advised to do All The Things we security program speakers have been telling people to do for years.

Oh, but that's highly unlikely.  Ok, how about another?

What if our subject's daughter or son at school becomes a victim of cyberbullies?  They get into a TwitBook argument about politics or hairstyles or something and the bullies pull out all the stops and the attack follows the kid back to the (parent) subject's home router - in order to hit the kid, of course, not the parents who're not party to the argument.  But the bullies don't care, so here come the free DDOS tools into play (that's Distributed Denial Of Service so's you can't get to the 'net). Couldn't possibly happen, right?  Naturally.  Ok, how about another?

What if our subject decides to run for public off --- no, wait.  Strike that.

What if our subject is the victim of a data leak at an insurance company or email provider or government agency or his own employer or his credit card company or his model train enthusiast club or his gym or his ONLINE DATING SERVICE?  But of course, all of those entities may already have been hacked over recent months or years, the information combined into super-lists, that information provided to dark web marketplaces and sold.  So the erstwhile hacker didn't actually have to hack anything to mess with our subject - he/she/it only had to pay $100 or so for X gigs of leads to script some attack toward.

And what if the jerks out there got some information entirely legally, due to a cell provider selling it?  Sure, PII (Personally Identifiable Information) may not be in there but what about combining it with some of the dark source stuff?  Better resolution?  No; couldn't possibly happen.

I think we could sell this sort of reasoning to users like insurance.  The house usually doesn't burn down.  But fire insurance sells anyway, and for a reason.

When The Buffalo Chips Hit The Windmill

As I write, the Russian invasion of Ukraine is in its third day and certain topics in disaster preparation come to mind. How would one prepare? I don't mean in the sense of in-country preparation for invasion by a power next door. It's prudent to consider preparations for companies, nonprofits or individuals in a NATO country, France or some other nation not aligned with Moscow interests. Countries and territories unrelated to local fighting could be affected far away from events in this ever-more-connected world.

1. DOS/DDOS: do you have Cloudflare or some similar service? Do you have an in-house equivalent?
2. Have you done backups? Are your backups airgapped from all relevant networks?
3. Have you done infrastructure backups (virtual nodes, switches, snapshots etc.)?
4. Email strategy: if applicable, what if your IP is banned for spamming and you didn't do that?
5. Has patching been regular?
6. Is there a communications tree established for phone contact?
7. Are there alternatives thought out if cell service is unavailable?
8. Are there alternatives thought out if internet service is unavailable?

And an entirely separate post would be nice for cell phones alone. Think of all the things many of us rely on a phone app to control or store. From phone number and contact lists to secure sign-on passcodes to garage door openers, has anyone thought of a plan B for all that? First, a backup locally available is needed for every phone, plus a strategy as to how to do every separate job currently handled by that Android, iPhone or whatever. And since VOIP is computer-operated, suppose servers for "landline" phones become intermittent (some organizations could need a radio alternative)?

An earlier post of mine speculated on cyberwarfare directed at electronic and computer services of individuals, ignoring the armed services protecting them physically and attempting to outflank old-fashioned protection. I don't think the NATO-aligned countries are in significant danger from this sort of thing, but components of such an approach could appear in the strategies of ambitious military powers or desperate advocacy groups.

So it makes as much sense to what-if these potential matters just as in the case of what the insurance agent wants you to think about: fire, flood, tornado, typhoon/hurricane or earthquake.

Data Comalgulation-vergence

I maintain an account at one of those background search sites in order to keep track of certain things, plus check out new situations that come up. I'd been having to maintain contact information on an old business partner for over 15 years now and nothing much had been changing. But lately a thing or two DID change - at least with respect to my ability to be aware of what went with whom.

I suspect that many adjustments have been made to the ability to mine the data important to me since I became associated with this person. Tools have gotten better, data sets/lakes/blobs have been purchased or combined... heck, even leaked. However it happened, all this would naturally suggest security problems but there's also a kind of service improvement. Where I had been confused about the relationships between data "items", some of those mysteries are now solved.

The person I followed after the business relationship ended (and follow to this day for compliance and legal reasons) had a fairly common name, altuhough there were identically named people that I could tell bore no resemblance to the person I knew. But there were other issues apparently unrelated that did appear to lead back to the same person, same address, same region, same zip code, same potential email addresses, same potential social media accounts, same approximate age and so on. But there wasn't enough data or similar potential data (or whatever a better database term would be) to nail down a connection.

That was then; this is now.

However my search site is doing it, I'm now able to see totally contradictory claims that lead back to the SAME EXACT INDIVIDUAL. If you'd looked up info on someone in the past, you might try it again for some surprises. Better ability to correlate matters like past businesses owned, previous potential relatives and neighbors, whatever legal info doesn't require a trip to the courthouse, sex offender registrations... All this material could even be historical - out there already - but previous search methods and tools couldn't establish good connections. But now that's much improved from, say, a decade ago. I'm now able to see that the person I used to trust makes Nixon look like Rebecca of Sunnybrook Farm.

There you are - actual positive and upbeat information from me for a change. Or at least more upbeat than usual.

Old Box Refurbishment and possibly comedy

Here's the latest stage in my Frankenstein-like assembly of a new system (not a phone but a traditional computer that does not connect to stuff through a telephone company). This box offered by a refurbisher was new enough to be expandable to a reasonable degree but old enough to have connectivity to some stuff I had laying around and thought it would be interesting/odd/funny to use.

This is a four to five year old Win10 box with a fast but not-recent 3.2ghz processor, however maxed out on RAM. The HDD option chosen was the cheapest conventional drive offered, since I had to take Windows and couldn't get the thing with no OS. If I didn't need another Windows box, why did I choose the worst 250-gigger of the seven available drives? Should I not get a big, fast one and wipe it?

I usually wipe them but elected to get it this way so as to have a backup Windows option, but the ability to use slot 2 to add another drive later - not as secondary storage but as another primary. The future second drive will have some Linux or other on it, perhaps be a platform for virtual images, and will be bigger and faster than the original one. Simply pop the cover, change the power and data connectors from drive to drive and PRESTO, the box becomes another computer. But wait. That's not all.

The thing has PS/2 connections I used to attach an IBM-style clickety keyboard that was old enough to vote several years ago. PLUS it's using an adapter to convert to PS/2 from the earlier AT connection that's about as big as those huge German DIN plugs seen on reel-to-reel stereo decks back in the day. The outboard HDD enclosure has a not so amazing 30g of storage in an ATA unit the origin of which I've forgotten. And the VGA monitor has at least 10 years on it. All peripherals were just laying around, and referring to the refurb box price as its only outlay, I'll call it The Amazing $89 Computer. Or maybe the Ratbag 3000. Or The Box With Two Brains, or The Incredible Two Headed Transplant. I did upgrade the memory so as to spend a little more on it. But in coming up with a backup Linux platform, I decided to offend as many of my tech buddies as possible.

Next step: maybe a 900g SSD and MX Linux or something.