Case Study: After a Crisis, Who Should Take the Fall?

by?亞娜·賽吉斯（Jana Seijts）

The four weeks since hackers had attacked his company had been the most stressful of Jake Santini’s career. Sitting at his kitchen table after another long day of meetings and interviews, the CEO read the e-mail from his board chair again, this time out loud to his wife, Fleura:

“It’s the strong feeling of the board that someone needs to be held publicly responsible for what happened. While we’re confident that the issue has been handled, we feel this is a critical step in making amends with our customers and restoring our image in the public eye.”

公司遭到黑客攻擊后的四個星期，是CEO杰克·圣蒂尼職業(yè)生涯中最難熬的一段日子。又一個被會議和訪談塞滿的漫長工作日過去，杰克坐在廚房桌旁，又一次讀起公司董事會主席寫來的電子郵件，這次他是大聲讀給妻子弗洛拉聽的：“董事會強烈感到須有人出面公開表示為此事負(fù)責(zé)。我們相信問題已得到解決，但我們認(rèn)為，為彌補與客戶的關(guān)系、重建公眾形象，公開表態(tài)十分必要。”

The board chair, Carly Elliot, had been a director at SimplePay, an Austin-based mobile-payment processor, since its days as a start-up. She and Jake had always worked well together, so he was a little taken aback that she was sending an e-mail about something so sensitive rather than calling him.

SimplePay公司位于美國奧斯丁市，經(jīng)營手機付款業(yè)務(wù)。公司現(xiàn)任董事會主席卡莉·埃利奧特自初創(chuàng)之日起便擔(dān)任董事，已與杰克共事多年，合作愉快。這次她選擇發(fā)電子郵件而非打電話討論這樣敏感的事，令杰克有些吃驚。

Fleura shook her head. “When she says, ‘someone,’ does she mean you?”

弗洛拉搖搖頭：“她說‘須有人出面’是指你嗎？

“I don’t know. When the hack first happened, she made it clear that she didn’t want me to resign,” Jake said.

“She just wants?someone?to,” Fleura said, yawning. He felt bad about keeping her up—she had to catch a plane early the next morning—but she’d insisted on staying up a few more minutes and talking it through.

“她就是想找個人辭職頂罪而已?！备ヂ謇蛄藗€呵欠。杰克有些愧疚：弗洛拉明天要早起趕飛機，不該耽擱她休息的。但她堅持要把當(dāng)下的問題討論清楚再去睡覺。

“Whether or not you have a job next week matters to me,” she said, only half joking. “Seriously, why is Carly blowing this out of proportion? This isn’t a Target situation.”

“下星期你失沒失業(yè)，對我來說很重要，”弗洛拉半開玩笑地說，“說認(rèn)真的，卡莉干嘛這么大動干戈，又不像Target那次那么嚴(yán)重？”（2013年12月，美國大型連鎖零售商Target數(shù)據(jù)庫安全漏洞被黑客利用，導(dǎo)致眾多用戶銀行卡及其他個人信息泄露，受影響用戶逾7000萬人——譯者注）

She was right. Although SimplePay processed millions of credit card transactions a day through an app that enabled merchants to accept payments by tablet or phone, the hackers had infiltrated just one database, which held only consumers’ e-mail addresses. They hadn’t gotten financial details or any other identifiers.

弗洛拉說得沒錯。SimplePay應(yīng)用軟件讓商家在手機或平板電腦上接受付款，每天處理上百萬筆信用卡轉(zhuǎn)賬；黑客入侵的只是一個保存用戶電子郵箱地址的數(shù)據(jù)庫，財務(wù)及其他認(rèn)證信息并未泄露。

Still, it had been an alarming security breach.

盡管如此，這次事件依然暴露了一個令人擔(dān)憂的安全漏洞。

The company had been forced to take its system down for 42 hours, notify all 10 million affected consumers, and issue a public apology. Tech bloggers had jumped all over the story; many speculated that SimplePay had begun to slow its hiring and scrimp on security investments in an effort to spiff up its balance sheet for a potential IPO. Some of that was true. The plan was to go public next year, and Jake and his CFO had been trying to cut costs, but they had mostly spared the IT group. They knew that technology (and the staff to support it) was the company’s bread and butter. His head of PR, Michelle Perez, had issued statements to that effect but had trouble controlling the story.

公司被迫將系統(tǒng)關(guān)閉42小時，向1000萬受影響用戶發(fā)布通知，并且公開道歉。技術(shù)行業(yè)博主紛紛就此事大做文章，不少人推測SimplePay開始放緩招聘速度、縮減安全開支，借此粉飾資產(chǎn)負(fù)債表，準(zhǔn)備上市。這種猜測并不全錯。公司計劃明年上市，這段時間杰克與首席財務(wù)官一直致力于縮減開支，可是并未壓縮IT部門預(yù)算。他們深知技術(shù)及相關(guān)支持人員乃是公司命脈。公司公關(guān)主管米歇爾·佩雷斯已發(fā)表聲明表達(dá)了這樣的意思，卻難以力挽輿論狂瀾。

Twitter trolls had piled on, mocking SimplePay for taking nearly two days to recover from a simple hack, but Jake’s CIO, Jesse Gladstone, insisted that his team needed that much time to fully patch the vulnerability and close any access the hackers had. The IT group had been working around the clock ever since to locate and fix any other potential holes and implement new security measures.

推特上炸開了花，群嘲SimplePay居然花了快兩天才從一次小小的黑客攻擊中緩過勁來，但公司首席信息官（CIO）杰西·格拉德斯通堅持表示，他的團隊就是需要這么長時間來關(guān)閉黑客持有的所有權(quán)限，并對安全漏洞進(jìn)行全面修復(fù)。IT部門自遭受攻擊以來便加班加點，尋找并逐一消除隱患，實施新的安全措施。

“She’s making a big deal of it because it was serious,” Jake said.

“她把這事看得很大，因為情況很嚴(yán)重?！苯芸苏f。

“I know that,” Fleura said. “But insisting on a scapegoat seems over the top. If she doesn’t want you out, who is she talking about then? Jesse?”

“我知道，”弗洛拉說，“但非要找個替罪羊好像也過分了吧。要是她不想讓你走，那她說的是誰？杰西？”

Jake cringed. The idea of asking his CIO to leave under these circumstances was untenable. Besides, he was proud of how Jesse and everyone else at SimplePay had handled the situation. Perhaps the response had been a bit slow, but they’d all done the best they could with the team they had and the money available.

杰克無言以對。在這種情況下，讓CIO辭職謝罪是說不通的。況且這次杰西和公司其他人對事故的處理頗令他感到驕傲。響應(yīng)速度也許是有點慢，但他們在現(xiàn)有人力物力條件下竭盡全力做到了最好。

“Chances are that Carly’s just the designated messenger for the rest of the board. I’m sure someone else is behind this,” Jake said.

“可能卡莉只是替其他董事傳個話。這肯定是別人的意思。”杰克說。

“Like Theo,” Fleura said, getting up from the table. Ever since Theo Conrad, a prominent tech investor, had joined the board, he’d been a thorn in Jake’s side, challenging him on all but the most routine decisions. At the most recent emergency board meeting, he wouldn’t stop harping on the fact that 30% of SimplePay’s customers hadn’t used the app since the hack.

“比如特奧?！备ヂ謇f著，從桌邊站起身。特奧·康拉德是一位杰出的技術(shù)投資人，自從加入董事會以來就一直跟杰克作對，幾乎時時質(zhì)疑杰克身為CEO做出的決定。上次董事會緊急開會的時候，特奧反復(fù)嘮叨著有30%的用戶自黑客事件后便不再使用SimplePay應(yīng)用這一事實。

“They simply don’t trust us anymore,” he’d said. “And Wall Street won’t either unless we’re completely clear about what we’re changing to make sure this never happens again.”

“他們不再信任我們了，”特奧在會上說，“華爾街證交所也不會相信我們了，除非我們徹底搞清楚要采取什么措施才能保證以后永遠(yuǎn)不再發(fā)生這種事?！?/p>

Jake turned from his laptop to watch Fleura as she headed upstairs. “Say something else,” he called after her. “Theo’s name can’t be the last thing I hear tonight.”

“Try to get some rest, honey,” she said from the stairs.

杰克將目光從筆記本電腦屏幕上移開，看看弗洛拉，她要上樓去了?！罢f點兒別的，”他在她身后叫道，“我可不高興今晚聽到的最后一句話是特奧的名字?！薄氨M量休息一下吧，親愛的?！彼跇翘萆险f。

Jake smiled but knew he probably wouldn't.

杰克笑了笑，心里卻知道自己休息不了。

It's All Under Control Now

回歸正軌？

The next morning, Jake met Michelle and Jesse at Bouldin Creek Cafe at 7:30 am.

次日清晨，杰克在博丁溪咖啡店同杰西和米歇爾會面，時值7點30分。

“You don’t look good, Jake,” Michelle said when she sat down. “It’s time to start sleeping again. The worst is behind us.”

“你臉色不太好，杰克，”米歇爾落座時說，“別熬了，該睡一覺了。最糟的已經(jīng)過去了?！?/p>

“I'm afraid that might not be the case,” he said, stirring two packs of sugar into his double caffè macchiato. “We’re not yet back to our prehack transaction numbers, and new customer acquisitions have all but halted. I know it’s only been a month, and things were slow before the breach, but we need to get things back on track soon.”

“恐怕還沒有，”杰克邊說邊往自己的雙份咖啡瑪奇朵里加了兩包糖，“我們的交易量還沒有回到黑客事件前的水平，新用戶數(shù)也停滯了。我知道現(xiàn)在才不過一個月，而且為了修補漏洞，其他事務(wù)都暫且放緩。但我們得盡快回到正軌?！?/p>

“As far as PR goes, we've got it under control now,” Michelle said. She ticked off all the things the company had done right since the breach: immediately contacting people whose information had been compromised and presenting a clear, consistent message to customers, social media, and the press. Michelle had recommended that the company apologize but focus on the hackers as the ones responsible. Within the organization, she'd also started to downplay the severity of the breach, but Jake had told her to stop. He worried that the sentiment was leaking into her external messaging. “We just can't forget that this was a big deal, Michelle,” he said.

“就公關(guān)而言，現(xiàn)在我們已經(jīng)掌控了局面?！泵仔獱栒f。她簡單講了公司對黑客事件的妥善應(yīng)對：迅速與信息安全受損的用戶取得聯(lián)系，并向用戶、社交媒體和評論界傳達(dá)清晰一致的信息。此前米歇爾建議公司道歉，但要著重強調(diào)責(zé)任方是黑客。在公司內(nèi)部，她也試圖淡化事件的嚴(yán)重程度，不過被杰克叫停，因為杰克擔(dān)心那種輕描淡寫的態(tài)度會反應(yīng)在她對外傳達(dá)的信息中?！拔覀儾荒芡诉@是件大事，米歇爾?！彼f。

“Of course, it was,” Michelle responded. “But I really think it’s almost over. My phone isn’t constantly beeping at me anymore. And Kara Swisher told me yesterday that, in one sense, we should think of the hack as a badge of honor. We’re now big enough to be considered an attractive target.”

“當(dāng)然是大事，”米歇爾答道，“可我真的覺得這件事差不多已經(jīng)過去了。我的電話不會再響個不停。昨天卡拉·斯威舍還跟我說，從某種意義上講，我們應(yīng)該把被黑看作一種榮譽?，F(xiàn)如今我們公司已經(jīng)大到能被黑客當(dāng)作攻擊目標(biāo)了。”

She smiled; Jake and Jesse didn't.

米歇爾笑了，杰克和杰西卻沒有笑。

“And Jesse's on top of security,” she continued. “We've got the 'latest, and most comprehensive, data security measures.’ Right?”

“而且有杰西主持安全事宜，”米歇爾接著說，“我們就能得到‘最新、最全面的數(shù)據(jù)安全保障’，對吧？”

“We're getting there,” the CIO answered, staring into his coffee. Jesse had been sleeping at the office. He was a perfectionist, which made him good at his job, but in the wake of this crisis, his insistence on getting everything just right was stalling their response. While Jake and Michelle were chomping at the bit to promote the new security upgrades—a hasty yet significant and necessary investment—Jesse was still in testing mode.

“我們在為此努力?！苯芪鞫⒅约旱目Х然卮?。這幾天他都睡在辦公室。他是個完美主義者，工作出類拔萃，但在這次危機中，他對完美的執(zhí)著拖慢了反應(yīng)速度。杰克與米歇爾急著推動新的安全措施升級，在這方面投資雖操之過急但實屬必要，而杰西卻仍在做測試。

“When will the new features be up and running?” Jake asked.

“We need another day or two,” Jesse answered.

“新性能要等到什么時候才能正式推出？”杰克問。

“我們還需要一到兩天?！苯芪骰卮?。

“Perfect,” Michelle said, a forced cheerfulness in her voice. “We can issue the release by the end of the week and include an update on the FBI investigation, too. And then our sales team can start to work their magic, and we can get back to business as usual. We’ve got an IPO to prepare for, after all.”

“很好，”米歇爾的聲音強作歡喜，“我們可以在本周末發(fā)布新版本，還能順帶給FBI調(diào)查提供新信息。然后就看銷售團隊大顯神通，我們馬上就能回歸正軌。畢竟還要準(zhǔn)備上市呢。”

Jake wondered if that was why the board was pushing so hard for a resignation: Wall Street needed a pat ending to SimplePay’s hacking story before the company could embark on a road show.

杰克想，這大概就是董事會急著逼人辭職頂罪的原因：在SimplePay上市亮相前，這次黑客事件要有個利落的結(jié)尾給證交所看。

Heads Must Roll

必須要有人謝罪？

“I'm sorry that so much of this is playing out over e-mail,” Carly said to Jake when they met at her office later that afternoon. “I know this isn't easy.” She explained that a significant majority of the board members felt that a public gesture was necessary to demonstrate how seriously SimplePay took the breach.

“真是抱歉，這次很多事都用郵件說，”當(dāng)天下午杰克去卡莉的辦公室，卡莉如此說道，“我知道很不容易。”她解釋說，絕大多數(shù)董事認(rèn)為有必要公開表態(tài)，表現(xiàn)出SimplePay對待安全漏洞問題的嚴(yán)肅態(tài)度。

“But we've done that. We explained exactly what happened and how we/re responding.”

“但我們已經(jīng)做到了。我們清楚解釋了黑客事件始末以及我們的應(yīng)對措施?！?/p>

“It's that last part that the board is concerned about. What changes are we making to ensure that our customers trust us completely again? At Target, the CIO and then the CEO resigned. When TJX had its breach in 2007, it was a director and an SVP. They've set the precedent. We need to do something similar so that we can put this episode behind us. SimplePay is—was—the market leader in the mobile-pay space because of its reputation for being reliable and secure. Our success is based on trust. This incident has completely eroded that.”

“董事會關(guān)心的不是解釋，而是我們要做出怎樣的改變才能保證重新贏得用戶全然的信任。Target那次，CIO和CEO都辭職了。2007年TJX公司爆出安全漏洞，也有一名高管和一位高級副總裁引咎辭職。有這些先例在前，我們就得采取相似的措施才能了結(jié)這件事。SimplePay一直是手機支付領(lǐng)域的佼佼者，迄今為止這份成功全是靠著我們安全可靠的聲譽得來的。我們成功的根基是信任，而這次事故毀了這份信任?！?/p>

She wasn't wrong. The customer service department had been flooded with questions about security, and although the company had expected some level of merchant attrition, defections had been much greater than expected. And they weren't tapering off.

卡莉說的沒錯。對安全問題的質(zhì)疑已經(jīng)淹沒了客服部門。公司預(yù)料到會有一部分商家退出，但實際損失的用戶早已大大超出預(yù)想，而且仍然在繼續(xù)流失。

Carly pulled out her phone. “Did you see?the study from this group, Interactions, that Theo sent around last night? ‘Twelve percent of customers say they would stop shopping at a retailer that had a security breach; about 36% say they would be less frequent patrons. About 85% of shoppers who have had their personal information stolen say they tell others about the incident; 34% complain on social media, and 20% comment directly on the company’s website.’”

卡莉拿起手機：“你看到交互團隊做的調(diào)研結(jié)果了嗎？特奧昨晚發(fā)的?！?2%的用戶說他們會停止在有安全漏洞的零售商處購物，約36%的人表示他們會減少去購物的次數(shù)。在個人信息被盜的購物者中，約85%的人說他們把這件事告訴了別人，34%的人會在社交媒體上抱怨，20%的人直接在公司網(wǎng)頁上發(fā)表評論?！?/p>

“And all that goes away if we fire someone?” Jake asked, getting annoyed. “That’s not what happened with Target. Their stock dropped 3% the week that Steinhafel resigned.”

“那炒掉個把人就能把這些問題都解決了？”杰克開始不耐煩了，“Target炒了人也沒解決，他們的股票在斯坦海佛辭職的那個星期下跌了3%?！?/p>

“They acted too late. He should've left much sooner. Besides, the shares have now jumped 30% under the new CEO, to all-time highs. Everyone loves a fresh start after a disaster—analysts, pundits, customers,” Carly responded.

“他們動作太慢了。斯坦海佛應(yīng)該早點走。而且現(xiàn)在他們的股票在新CEO帶領(lǐng)下飆升了30%，創(chuàng)歷史新高。經(jīng)歷過一場災(zāi)難后，分析家、評論人、客戶等等都想有個全新的開始，大家都這么覺得。”卡莉說。

“But that's not always necessary. Look at Zendesk, LivingSocial. They survived hacks without firing anyone.”

“但也不一定總得這樣吧。瞧瞧Zendesk和LivingSocial，他們沒炒人，照樣度過了黑客風(fēng)波。”

“But our business isn’t recovering. We need to make a statement—not just new technology, new people.”

“但眼下我們的情況沒有好轉(zhuǎn)。我們需要公開表態(tài)，只是啟用新技術(shù)、新人員還不夠?！?/p>

“So heads must roll?” Jake asked.

“Just one head.”

“所以必須有人犧牲？”杰克問。

“一個就夠了。”

“Well, then, it should be me,” Jake said, unsure that he believed what he was saying. “We’ve got a strong team in place. I leave, the statement is made, loud and clear, and then you all can get things back in order in time for the IPO.”

“好吧，那理應(yīng)是我，”杰克并不確定真的相信自己所說的話，“我們已經(jīng)有了強大的團隊，只要我一走，公司態(tài)度明明白白擺出來，你們就能重新回到正軌，趕上公司上市的時間?！?/p>

“It doesn’t have to be you,” Carly responded.

“If not me, then who?” Jake asked.

“不一定非得是你?！笨ɡ蛘f。

“不是我，那還有誰？”杰克問。

She told him that Jesse's name had come up first; after all, it was his systems that had been breached and his team that had been so slow to get the service back online. As a leader, Jesse had been a bit shaky under all the pressure. But a few board members had also pointed to Michelle; had she immediately grasped the severity of the situation and gotten out well ahead of the story, trust in SimplePay might not have dipped so low.

卡莉說，第一人選是杰西，畢竟是他做的系統(tǒng)有漏洞、他的團隊修復(fù)速度太慢。身為領(lǐng)導(dǎo)者，杰西在面臨壓力時不夠沉穩(wěn)。也有一些董事提出，米歇爾應(yīng)當(dāng)負(fù)責(zé)，假如當(dāng)初她能迅速意識到事態(tài)嚴(yán)重性，趕在起風(fēng)波前迅速采取措施，SimplePay也許就不會遭遇如此嚴(yán)重的信任危機。

“How would firing Michelle help fix anything? She may have not handled this perfectly, but letting her go won't allay any customer concerns. And you know as well as I do that Jesse isn't fully to blame for the situation. No IT team can predict every vulnerability or patch every hole. He did his job as best he could.”

“解雇米歇爾能解決什么問題？她可能是處理得不夠妥當(dāng)，但讓她離職根本于事無補。至于杰西，你我都清楚，現(xiàn)在的情況不能怪他。IT團隊不可能預(yù)先把系統(tǒng)做得滴水不漏。他為工作盡職盡責(zé)了?！?/p>

“Listen, you've been a great leader, sticking up for them all along, even when they didn't deserve it,” Carly said. “But the board has made up its mind. Someone's got to go.”

“聽我說，你是一位非常杰出的領(lǐng)導(dǎo)者，始終如一地維護(hù)他們，無論他們是否值得你這么做，”卡莉說，“可是董事會已經(jīng)做了決定。必須有人離職?！?/p>

Take One For the Team?

注定要犧牲？

Jake typed the letter out on his phone:

Please rest assured that this decision was not easy, but in light of recent events, I have decided that my stepping down is in the best interest of SimplePay and its customers.

杰克在手機上寫了這封郵件：

這個決定并非輕率之舉，請各位放心。鑒于最近事態(tài)發(fā)展，為維護(hù)SimplePay公司及客戶的利益起見，我已決定離職。

While I cannot take any personal responsibility for this incident, it happened on my watch. As the company's CEO, I am ultimately responsible and thus resign from my position, effective immediately—mostly because the board is making me do it.

我誠然無法為此次事故負(fù)任何個人責(zé)任，但此事乃是在我任職期間發(fā)生。身為CEO，我理應(yīng)為此負(fù)責(zé)，并就此辭去職務(wù)，即時生效——當(dāng)然我這么做主要是屈從于董事會的意思。

He pressed send, and 20 seconds later his phone rang. It was Fleura, calling from her hotel room in San Francisco.

杰克按下發(fā)送鍵，過了20秒，手機響了。遠(yuǎn)在舊金山的弗洛拉從酒店房間打來電話。

“Why in the world are you up at midnight writing a fake resignation letter?” she asked. “I do love the last line, though. If only every shamed CEO admitted that the board made him do it. But seriously, honey, you're not resigning, are you? You love your job.”

“大半夜的你搞這么一封假惺惺的辭職信干嘛？”她質(zhì)問道，“雖然我很喜歡你寫的最后一句，要是所有顏面掃地的CEO都承認(rèn)是被董事會逼迫辭職的就好了。不過說真的，親愛的，你不會辭職，對吧？你熱愛你的工作?！?/p>

This was true. At the helm of SimplePay, Jake was happier than he'd ever been, and he certainly didn't want to give up the opportunity to lead his first IPO. But he couldn’t imagine making anyone else the scapegoat.

是的。領(lǐng)導(dǎo)SimplePay為杰克帶來前所未有的愉悅，而且他當(dāng)然不想放棄第一次帶領(lǐng)公司上市的大好機會。可是他無法想象讓其他任何人做替罪羔羊。

“How did it feel typing it out?”

“Terrible,” he admitted. “I’m not ready to go, but maybe I have to take one for the team.”

“這么寫出來感覺怎么樣？”

“糟透了，”杰克坦言，“我不想離開，但為了整個團隊，我大概不得不讓某個人離開?！?/p>