Are you in compliance?

Don't miss out! Sign up today for our weekly newsletters and stay abreast of important GRC-related information and news.

Compliance and conduct in the age of outrage

Bill Coffin | August 14, 2017

It says a lot about the state of the country when you spend a few days trying to figure out how one moment of widespread social discussion could inform a larger discussion relevant to the compliance community, only to have that blown out of the water by a far larger version of the same issue a few days later. It’s like we aren’t living with the threat of black swans anymore. Just a massive flock of black geese that honks and knocks everything over and leaves you battered, bruised, and wondering what the heck just happened…so it can happen all over again the following week. Interesting times.

About a week ago, an anti-diversity memo went viral within Google. Google is an interesting place. Like a lot of Silicon Valley, it’s a company with a bold vision, a raft of incredible products (I mean, seriously, when your primary product becomes a verb, you’ve hit upon something), and a Code of Conduct that for years has been fairly inspirational: Do no evil. It is also in the midst of a Department of Labor investigation into wage discrimination because the brutal truth of Silicon Valley is a lot of places treat women terribly, from unequal pay to discriminatory conditions and behavior, to overt and covert efforts to promote a men-first culture. So the last thing Google needed while under all kinds of scrutiny is for an employee to write a 10-page screed that lays out a specious biological argument for justifying sexism within the tech industry. But that’s what happened, and it spread like wildfire as a topic of conversation within the company, and soon it leaked to the public and the media was on it like white on rice and within a few days, Google went from “Well, we try to respect everybody’s opinion, even if we don’t agree with it” to “This employee violated Google’s Code of Conduct.” The guy who wrote the screed was out of a job within the week. Expect some kind of legal action to follow.

Now, the original point of this column was to use this incident as a touchstone for the use and rule and power of Codes of Conduct. For all organizations, they are meant to be a set of rules for all who work under their structures, but not everyone is always diligent about enforcing them. In some organizations, the Code of Conduct becomes less of a rulebook and more of a vision statement that technically has teeth that nobody ever feels because nobody ever strays far enough to. And in light of the Google anti-diversity memo situation, we would have enough cause to give the very idea of Codes of Conduct a fresh consideration.

And then Charlottesville happened.

Over the weekend of August 12-13, a collection of white supremacists and neo-Nazis gathered in Charlottesville, VA for a “Unite the Right” rally/march that predictably, turned chaotic and violent. Anti-fascist protesters showed up to confront a crowd of people who already had folks wearing MOLLE vests and carrying ARs on them, so this was a situation that was not going to end well. What it ended with was with one of the Unite the Right marchers –who has a history of infatuation with Nazism—driving his car down a narrow street and into a thick crowd of antifascist protesters. At the time of this writing, three people are dead, and dozens more injured from the vehicular attack.

Even before the violence, social media was already cranking up into high gear, with people taking media photos of Unite the Right marchers, matching them with social profiles, and sending that information to the marchers’ employers. More than a few of the most visible marchers have already lost their jobs over it. Not many companies are that comfortable being known as the hirer of a guy who wears swastikas in his spare time. But when the car attack happened, things really intensified. Even web hosting company GoDaddy gave The Daily Stormer, a prominent white supremacist publication 24 hours to find new hosting, for having violated its terms of service.

Now, The Daily Stormer had already been in violation of GoDaddy’s TOS well before the Charlottesville event. Just as some of the employees who lost their jobs once identified as white supremacists and Nazi sympathizers had been employed by companies that surely knew of these individuals’ leanings. One does not believe in Nazism so much that they go to a march to support it and not let a few choice thoughts slip at the water cooler. And yet, when plausible deniability evaporated, the Code of Conduct, or anti-harassment policies, or similar rulesets became the first line of defense to justify getting rid of people who had become a reputational risk.

We are living in supercharged times. The speed with which social media can magnify the impact of public outrage is simply mind-boggling. And anyone or anything even peripherally touched by a source of outrage, real or imagined, must go into swift crisis mode to deal with it. Case in point: the Unite the Right marchers carried Tiki torches while marching. Tiki felt it important to make a public statement that it did not support the march or the marchers. Tiki obviously had nothing to do with the march. And yet, had they failed to act, they could have found themselves trying to back out of a social media gravity well of bad publicity.

With that in mind, compliance professionals really need to reiterate their organization’s Code of Conduct to all staff, to update it if necessary, and to be clear internally and externally if need be about when and where the Code will be enforced. No organization can tell any more when it might find itself in the middle of a social media pariah situation, and may find the internet shame of a suddenly high-profile employee to be a risk worthy of swift action. It might be attending a neo-Nazi rally. It might just be somebody caught on video doing something that looked much worse than it really was, like treating an animal roughly. Whatever it is, the risk for extreme public outcry is real. It can come from any direction and at any time. And it is the kind of acid test for your Code of Conduct that demands advance consideration and enterprise-wide discussion. During a crisis is not the time to figure out one’s way through this.