The Deutsche Welle reports that security staff are accused of breaching privacy laws:

Security staff at telecoms giant Deutsche Telekom are suspected of breaching German data privacy laws during a secret attempt to identify the sources of high-level leaks to the media, the company said Saturday, May 24.

Using the company’s own records of millions of numbers dialed, the dates and the durations, the internal-security unit had hunted for possible matches between news reporters and Telekom directors.

Bad news for security staff when they abuse the trust they need to perform their duties effectively. The fallout from this scandal will be interesting to watch. Security has apparently not only breached privacy laws meant to protect customers, but has done so in a direct conflict with senior management.

The BBC story seems more interested in the fact that the SocGen trader was not acting alone, but I find this part the most revealing:

The bank’s management was accused of being “negligent” in not identifying the problem, the report said.

It also found that Mr Kerviel’s direct supervisor was inexperienced, with insufficient support to do his job properly.

“The fraud was facilitated, or its detection delayed, by supervisory weaknesses over the trader and the market activities checking,” it said.

“The trader’s hierarchy, which constituted the first control level, showed itself negligent in the supervision of his activities.”

Mr Kerviel’s supervisor “showed inappropriate tolerance to the positions taken”, it added.

Blaming this on his immediate supervisor is a lot like blaming it all on the perpetrator himself. Surely the controls for this kind of error should be visible at the highest levels. The consequences have been devastating, which suggests security information and event management at SocGen were not integrated into an executive’s view.