What Google vs. China Says About Security and Offshore Outsourcing

There’s plenty to talk about when considering the disturbing Google mail hacking incident in China. Clearly, the event has sparked international concern and even prompted a response from U.S. Secretary of State Hillary Clinton (in a speech on Internet freedom and security last week, she urged China to investigate the attacks.) Chinese government officials have said it has had no involvement in the cyber attacks; Google continues to stand behind its concern over censorship and the hacking of Chinese dissidents Google e-mail accounts.

The purpose of this blog isn’t to rehash what has been fully reported in the media. Nor is it to debate who’s right and who’s wrong. Instead, it’s to look at the somber truth, lest we had forgotten, that cyber attacks are still a serious threat. That knowledge must be applied to offshore outsourcing, and should serve to reiterate just how important IT security, data privacy, cultural awareness, and the socio-economic and political climates of the countries to which you may send your business is to offshore outsourcing.

Any company that is considering outsourcing, or has already outsourced, IT work to an offshore company better have nailed data security. After all, offshoring work requires companies give access to their computer systems to engineers in faraway lands. Security policies must be specific and comprehensive, access control systems must be thorough and up-to-date, on-going security monitoring must be in place.

Make sure you cover the basics when inking those offshore outsourcing deals. Check out the outsourcer’s ISO security certifications (ISO 27001 certification, for example, indicates that a company documents and follows information security practices and controls). It’s also important to require the service provider understand and follow your industry's best practices and the compliance guidelines, such as U.S. HIPAA and credit card data regulations?

Take time to consider which projects can withstand the kinds of risk exposure that exists in offshore outsourcing. To be fair, the risks are the same: there are security risks from internal threats, from intruders, exposure by error or loss, and even risks from corporate

espionage and cyber hackers. But with offshore outsourcing, there’s distance, different laws and government philosophies that can impact security.

Companies also need to understand the data privacy regulations and implications not only in the United States, but also in the country in which they’ve offshored their IT work. While privacy laws for electronic data exist here, in some foreign countries they are nonexistent. If a breach occurs and data is stolen, what kind of law enforcement might you get? If the thieves are caught, what will the prosecutorial options be?

Most regions in which companies currently offshore are relatively stable. But companies do need to consider—and follow closely—the political climates and socio-economic concerns of the country and region in which they are offshoring. It’s pretty apparent that the politics and ideology are a big part of the troubles now brewing between Google and China.

There’s surely lots more to say. I’m interested… what do you think the cyber attacks spotlighted in Google vs. China say about offshore outsourcing? Is it much ado about nothing, or should we all be a little higher on our toes?