Welcome to The Director’s Dilemma. These case studies, created by Julie Garland McLellan, are based on real events together with three sample solutions from governance practitioners.
Faizan is an early stage investor in tech companies and sits on the board of a company that makes software which tracks people in crowds. Fears about potential future misuse of the software have reached him, ahead of a board discussion about the newly-drawn up draft contract with Government. What would you do?
The Dilemma
Faizan is an early stage investor in tech companies and has accepted a seat on the board of a company that makes software which can track people in crowds. He has made a large (for him) investment in the company and is happy because the market for the software has been boosted recently by building managers who want to ensure that staff contacts can be accurately traced.
The company has been approached by the government, with a request to install the software in some transport hubs and a popular town square. The CEO is delighted and very excited about developing a new capability to identify people, who are not on a database of employees, and to track their movements from one software location to another, enabling the government to make better transport-related decisions.
Some of the staff are not happy with this. They fear it could be used in future to allow spying and breaches of civil rights, especially if it is later sold to other governments.
Concern has also been raised that it might cause the company GDPR issues even though the software has not been connected with any government database of names or images. Their dissent has reached Faizan and he is aware that they are thinking of refusing to develop the software with this more extensive capability. Some of the best engineers could leave and join rival firms; others could simply flatly refuse to complete the project. The contract has been drawn up and is scheduled for board discussion in a couple of weeks.
Faizan has asked the CEO and the chair to meet with him, privately, to discuss a concern. The meeting is set for tomorrow. Faizan isn’t sure how to best communicate his apprehension. His fears are not yet truly formed. What should he say?
What should Faizan do?
Answers
Brian’s Answer
Brian Barnier is a senior advisor/advisory board member to multiple growth companies. He advises and trains public company board members in AI-ML, cybersecurity, risk, and finance.
To resolve this dilemma, it helps to gain three broad types of knowledge:
First, understanding the commercial viability of the solution the government is requesting. Will the interest turn into a purchase order? How many other governments will purchase? What’s the company’s return on investment? Will it distract from opportunities with a higher return?
Second, internally with team members, understanding the real problem through conversations and questions. For example, in the minds of the employees, how does virtual tracking compare to physical tracking? How does virtual tracking on one website compare to tracking across websites? How easily can people opt out of or avoid being tracked? What is the cost or benefit to a person from being tracked or not? How does physical tracking at one building or space compare to tracking across locations? How easily can a person opt out of or avoid being tracked? What do government employees and elected officials know that we don’t know? After conversation, education and understanding the real problem, it will become clearer who objects to what and why.
Third, how much of a financial loss would arise from replacing that employee(s)?
Answers enable considering options for the path forward.
Julie’s Answer
Julie Garland McLellan is a non-executive director and board consultant.
Faizan is right to speak with the Chair and CEO while his ‘fears are still not fully formed’, it sets the stage for building a shared understanding of the problem, followed (hopefully) by an agreed solution. Having the courage to raise an uncomfortable question when you don’t yet have your own answer prepared is a great trait for a company director.
Approaching the issue with a values-based judgement might cause friction, especially if the CEO and Chair have already made up their minds. It is important that Faizan keeps an open mind whilst contributing insights to help navigate towards the best solution.
I would recommend sharing the facts and asking the Chair and CEO to help evaluate the potential business impact of each of several different scenarios.
Faizan should consider:
• How this new development aligns with GDPR, privacy and other laws
• The size of the potential market for this software
• Data security and accuracy of the software
• The depth of staff feeling and if this will be assuaged by inclusion in the process
• Availability of skills to replace current staff if they leave
• Potential safeguards, such as an agreement to licence the software on a site by site basis or to not sell the software to non-democratic governments, etc.
Whatever the outcome in this case, matters have progressed to a point where the board is reacting to, rather than pre-empting developments.
Faizan’s board should develop a policy rather than respond on a case by case basis. In future, the strategic implications of any major new product development should be discussed with the board as they arise, when the directors can contribute, rather than at a late stage when the contract is ready for signing and just needs board approval.
Tony’s Answer
Tony Leng is the Chair of VaultBank and Managing Director and Practice Leader at Diversified Search Group / AltoPartners.
Faizan should:
Take a long-term view of the Company and its market positioning and formulate a strategy with the CEO to take account of ESG considerations as well as the reputational impact.
Make a judgement which balances ethical and financial considerations; the board cannot be seen as trading its espoused values for money.
Remove the emotional aspect (fear of not making money and anger that may be felt by the CEO and Chair towards the employees) and factually outline the ethical concerns of the employees and threats to leave or stop development. Feedback should be in an anonymous manner to protect employees from possible future retaliation / targeting.
Seek to understand if and how concerns over privacy/ethics, and potential departure of key employees might be addressed internally, and with Government.
With the CEO and Chair, determine if the software will also subject the organisation to regulation and how might that impact the organisation.
Suggest forming a Task Team including a government representative and the company legal council to discuss the matter and develop contingency plans.
Recommend the development of a Stakeholder Engagement Strategy to actively communicate with media, key stakeholders, regulatory bodies etc to mitigate the risks should this leak.
Develop a clear and detailed action plan to address concerns – this will look at impact of employees leaving, steps taken to tweak development of the software to address ethical concerns while still fulfilling government mandates, government regulation, and media scrutiny.
Set out the above concerns, request more information, and widen the debate if necessary to include other board members.