In this commentary, the speaker outlines a serious reputational crisis at Carta after a customer, Kari Särinen, accused the company of misusing confidential client data without permission. The breach, acknowledged by CEO Henry Ward, has sparked widespread criticism on social media and in the press, threatening client confidence and exposing Carta to potential liability. The speaker argues that merely verbal assurances are insufficient and proposes a comprehensive remediation plan: overhaul privacy policies and contracts, involve legal, CISO, and privacy officers, seek external advisory for compliance controls, create a public digital ethics policy with an internal ethics board reporting to the board of directors, and engage reputable external experts to communicate changes. Specific experts—Reid Blackman, Michelle Dennedy, and Andrei Senzarski—are recommended, and the speaker offers his own mentorship services. The overall message is that decisive, transparent actions and external oversight are essential for Carta to restore trust and avoid losing customers.
Chapters
Carta has a reputation crisis it must address. They were recently called out by a customer for using confidential customer data to stealthily act in ways not approved by the customers. And this is a major problem. Now, trust is earned in drips and lost in buckets. And the issue raised by Kari Särinen, a Carta customer, is an obvious breach of trust. Carta's CEO has admitted to the violation and privately spoke to Särinen, but the affected customer is not convinced. In fact, it apparently is not an isolated incident for Carta either. TechCrunch ran a front-page story with a great overview of the situation. I highly recommend reading it. Put the link in the comments. After Saarinen reported the issue on social media, hundreds of critical comments flooded in, adding flames to the fire. With reputation suffering with every post, tweet, comment, and article, the situation is rapidly spiraling out of control for Carta. Verbal guarantees from executives who have a financial incentive to kind of sweep this under the rug is next to worthless. This is a grave breach of trust, impacting reputation, creating doubts in current clients, and may open up liability issues. But all is not lost. If the company acts in a meaningful and ethical way, it can recover. We all know talk is cheap, and therefore the board and senior executives need to actually act with clear operational changes and assurances of accountability. So here is how I think that they should do it. First, it sounds like they need a full revamp of Carta's privacy policy and customer contracts, in this order, right? To clearly specify how data will be shared and protected. HARTA's legal, CISO, and chief privacy officer should be all over this. Supporting internal procedures and guidelines will need to be created and woven into the culture as well. Now, second, I would also recommend that their CISO and chief privacy officer seek external advisement in how best to institute preventative and detective controls for policy compliance. This incident obviously went unnoticed, and it could be just the tip of a much bigger iceberg. Now, third, Carta should also work with a legitimate ethics consultancy to develop and institute a public digital ethics policy. This would include the creation of an internal ethics board to monitor and reinforce such activities, and that board needs have a line to the board of directors, as the board needs to be aware and have confidence in what's going on internally. The best thing the CEO, Henry Ward, can do is to bring in outside help. Attempting to make changes from within an organization that created the situation is not going to make any meaningful headway. I sincerely hope Carta will right their ship, as so many startups use their services. If not, then I hope those customers cut bait quickly and move to other providers that have these types of controls in place. And as a side note to those Carta people on the crisis team probably right now, I assume people at Carta would never intentionally undermine their customers. This is why bringing in external experts is key, as the current executive team didn't see the misaligned structure that allowed the issue to become a reality and, well, explode. It is unreasonable to expect the current administration to be able to quickly recognize the nuanced issues develop well-balanced correcting controls and implement them in a way to minimize disruption for something that surprised them to begin with. Bring in the experts to assist. And specifically for the marketing and revenue officers, there's nothing an internal executive or board member can say that will fix this. Saying nothing is horrible, but at this point, having a corporate representative speak publicly, that could be disastrous. If you bring in highly reputable people to assist, they can advocate how the culture and operations are changing. Then you have credible messages that will resonate. But just remember, Real experts won't simply whitewash the situation for a quick buck. They have a reputation for a reason, and they will make sure that effective changes aligned to both customer expectations and corporate goals are implemented properly before they publicly stand up for your company. And for any other companies worried they may be in the same boat in the future, I work with some of the best digital ethics, privacy, and CISO and board mentors in the business that can, they can help. For AI and digital ethics, I've enjoyed working with Reid Blackman, the owner of Virtue Consulting. He's one of the most recognized authors and advisors in the digital ethics space. For privacy, I highly recommend Michelle Dennedy, the founder of Privacy Code, the former chief privacy officer at McAfee and Cisco. We were colleagues back in the day at Intel when she was an outstanding advisor. For CISO and board mentors, I do this work myself, but I also recommend Andrei Senzarski, founder of the Cyber Nation Central and creator of the Executive Cybersecurity Blueprint. I'm happy to make introductions if you want, and I can recommend many others if needed. So just reach out to me. It takes teamwork to address really big issues like this. Thanks for joining me. Please click like and subscribe to the Cybersecurity Insights channel for more news, rants, and industry best practices.
