WHAT I LEARNED FROM STEVE BRILL #2,145

Steve Brill, now the head of Clear, founded American Lawyer Media, and was my boss for just about a decade. He's brilliant and difficult (a combination that can be challenging but fun) — and what I always appreciated the most (and try to emulate) is that with Steve, what you see is what you get. You always know exactly where you stand.

The rumors about his management style were pretty much true. Tact was never in his briefcase, but fortunately humor usually was. When I was at The Recorder, in San Francisco, he got pissed off because we were splitting too many infinitives in our stories — so he sent us a memo promising that he would fire the next one of us who blew that grammar rule. A few hours later, when he cooled down, he sent us a memo with four split infinitives calling off the threat.

And yes, he really did return edited stories with razor words, such as "Is English your first language?" But when he praised a story, you could trust and truly enjoy the accolades. I loved working for him.

And did he ever teach us to be good journalists — lessons I have preached to my Law Technology News staff for the last 10 years. Above all, be honest and be fair, and admit your mistakes, he insisted. There's no failure in a mistake, he would tell us, but you'll be fired if you don't bring mistakes quickly to your boss' attention. Corrections under Brill's regime always went on page 1 of our newspaper. Always, and with the name of the person who made the mistake. No hiding under a short hidden paragraph buried in the back. People's lives are affected by what we write -- and when we screw up, we must announce it boldly. You stand up and take the consequences. It's only fair. It's always the right thing to do.

He practices what he preaches. When our Court TV was covering the O.J. Simpson trial, one of the cameras accidently caught, for about 1/8th of a second, one of the alternate jurors. Court TV didn't just hope nobody noticed. They went straight to Judge Ito, who shut down the cameras for that first day. But it was the right thing to do.

And on July 26, 2008, when a company laptop containing unencrypted data about 33,000 pending applications went missing from Clear's (Verified Identity Pass Inc.) San Francisco airport offices, Brill's team went straight to authorities. With the assumption that the laptop was stolen, TSA immediately suspended new enrollments into Clear, a "fast-pass" service that pre-screens members, who then get expedited clearance through airport security. (Disclosure: I am a very enthusiastic member of Clear.)

Fortunately, the laptop was found by Clear on August 5, and Clear determined that it had not been accessed. (Further forensics investigation is being conducted by law enforcement.)

"We apologize for the confusion, but in an abundance of caution, we treated this unaccounted-for laptop as a serious potential breach," said Brill. "We're glad to confirm that a preliminary investigation shows no personal information was compromised."

Clear was in the process of notifying the applicants when the laptop was found, and it is suspending enrollment until the information is encrypted (the data was already protected with two layers of password controls, but they are now adding encryption as well.)

No credit information, or social security numbers, or biometric information was on the laptop, however, there was a limited amount of the applicants' personal information, says Clear. According to CBS5, that information included "names, address, and  birth dates, and in some cases driver's licenses, passport or green card numbers," citing Clear.

It can't have been an easy experience for Brill and his team, and they certainly should have had the data encrypted from the beginning. (Maybe I should sent Steve a complimentary subscription to LTN :) But I think it speaks volumes that — as usual — Brill and his Clear team went straight to the authorities when bad news hit.

Here's a news report on the incident from CBS, including a video report. Here's ABC's report.
And a NetworkWorld story. And on BoingBoing.

You can find Clear's press release at its home page and you can download it here: Download verified_identity_pass_announces_laptop_has_been_found.pdf

Hat tip to Babs Deacon & Donna Payne for forwarding the news stories.

Update 8/15: Clear is again taking enrollments.

Here's the latest letter from Brill:

We re-opened Clear enrollment on Tuesday, which had been temporarily unavailable after a laptop containing a small part of some applicants' enrollment data was taken from a locked office at the San Francisco Airport (though, as you know, the Clear lanes continued to operate normally nationwide). The laptop was recovered, and preliminary investigations revealed that no unauthorized person gained access to any of the information stored on that laptop. The data was protected with two levels of passwords, but was not encrypted, and it should have been.

Update on Security Enhancements to the Clear System
Clear has encrypted every enrollment kiosk and laptop computer containing personally identifiable applicant and member data. Ernst & Young independently performed an inspection and filed an audit report with the Transportation Security Administration (TSA) stating that all enrollment kiosks and all mobile devices are encrypted up to government standards. TSA also conducted its own on-site verification of encryption on all enrollment kiosks and mobile devices at randomly selected locations.

Beyond the encryption of these devices, Clear has also installed other security updates, including physical security enhancements. And, Clear will continue to enhance the security of our system with the latest technology and software security advancements as they become available.

Finally, Clear's privacy ombudsman wrote in a letter posted on Clear's website that he is conducting an independent review of Clear's security processes on behalf of Clear members. He will post those results online once he has concluded his investigation.

Please call Clear Support with any questions, comments, or concerns at (866) 848-2415.

Sincerely,
Steven Brill
Clear CEO