On that hacking scandal -- and the state's bumbling response

Crisis management media tip: You never want your bumbling handling of the crisis to become the story rather than the crisis itself.

I've been a bit busy this week with editorials on the upcoming election, but I did want to weigh in at least briefly on the massive hacking scandal that's hit the state. As frustrating and disturbing as it is, the response by Gov. Haley and others in charge seems to have only made it worse, and it's been a frustrating and inept debacle from the beginning.

To start with, the governor announced this, a massive story that affects every South Carolinian, after lunch on a Friday, a time journalists have always been suspicious of, as it's traditionally reserved for dumping bad news in the hope that reporters won't have time to follow up on it before the weekend. This scheduling wasn't because the state had just noticed the problem and were rushing to get the information out as soon as possible. No, the governor waited a whole 16 days to let everybody in the state know that their sensitive information could be in the hands of a foreign hacker. That delay has already prompted at least one lawsuit.

But don't worry, we were told. You can immediately sign up for free credit monitoring. Only problem: Whoever set up that system apparently had no idea that hundreds of thousands of us would actually be interested in it. The phone lines immediately jammed Friday afternoon, putting thousands on hold while others couldn't get through at all. What's worse is that much of that frustration could have been avoided with a simple addition to the press release. The only reason most of us wanted to call the hotline was to get the activation code for the ID theft website. Common sense would tell us that publicizing that code (SCDOR123) from the beginning could have routed many of us straight to the website rather than tying up phone lines just waiting to learn it.

It was particularly galling for Haley to turn around a couple of days later and blame the media for tying up those phone lines. First of all, we're citizens of this state too, and have just as much concern about our identies being stolen. Second of all, I'd hazard a guess that there were a couple of dozen reporters statewide calling the hotline for stories. If the system (which is supposed to help 3.6 million affected residents) isn't set up to handle that small number, something was seriously miscalculated.

As for the credit monitoring itself, state senators asked a good question earlier this week. Why are we even requiring residents to sign up for monitoring on their own? Many seniors (who can be particularly vulnerable) may not have Internet access or feel comfortable now giving their information out online. Why not just have the state automatically sign up everybody who was affected? The current solution seems to favor those who are Internet savvy and leave out in the cold anybody who hasn't paid attention to the news in the past week or doesn't have a computer.

There also seems to be either a lack of communication or miscommunication by those responding to the breach. After first saying that businesses weren't affected, we were told this week that yes, in fact more than 600,000 of them were affected. And we found out days later that the hacker used agency credentials to gain access. All of this information is coming out in drips, day by day, which doesn't inspire much confidence.

Also not inspiring much confidence has been Haley's unfortunately unprofessional demeanor throughout. I can understand that she's frustrated, but c'mon, we want reassurance and calm leadership, not angry calls to "brutalize" the hacker and "slam him into the wall." As for her reason that all of our tax info wasn't already encrypted -- "It's very cumbersome. There's a lot of numbers involved with it." -- really?

I hesitate to cast too much blame Haley's way. After all, an issue of this size is pretty unprecedented, and just as in any investigation, new information surfaces periodically. That's just a reality. If this were combat, I'd call it the fog of war. But at least when it comes to communicating the current situation to residents, the whole thing has been handled spectacularly badly. When our confidence in the state to safeguard our information has already been knocked on its heels, fumbling and bumbling the response certainly doesn't help restore that confidence anytime sooner.

To start with, the governor announced this, a massive story that affects every South Carolinian, after lunch on a Friday, a time journalists have always been suspicious of, as it's traditionally reserved for dumping bad news in the hope that reporters won't have time to follow up on it before the weekend. This scheduling wasn't because the state had just noticed the problem and were rushing to get the information out as soon as possible. No, the governor waited a whole 16 days to let everybody in the state know that their sensitive information could be in the hands of a foreign hacker. That delay has already prompted at least one lawsuit.

But don't worry, we were told. You can immediately sign up for free credit monitoring. Only problem: Whoever set up that system apparently had no idea that hundreds of thousands of us would actually be interested in it. The phone lines immediately jammed Friday afternoon, putting thousands on hold while others couldn't get through at all. What's worse is that much of that frustration could have been avoided with a simple addition to the press release. The only reason most of us wanted to call the hotline was to get the activation code for the ID theft website. Common sense would tell us that publicizing that code (SCDOR123) from the beginning could have routed many of us straight to the website rather than tying up phone lines just waiting to learn it.

It was particularly galling for Haley to turn around a couple of days later and blame the media for tying up those phone lines. First of all, we're citizens of this state too, and have just as much concern about our identies being stolen. Second of all, I'd hazard a guess that there were a couple of dozen reporters statewide calling the hotline for stories. If the system (which is supposed to help 3.6 million affected residents) isn't set up to handle that small number, something was seriously miscalculated.

As for the credit monitoring itself, state senators asked a good question earlier this week. Why are we even requiring residents to sign up for monitoring on their own? Many seniors (who can be particularly vulnerable) may not have Internet access or feel comfortable now giving their information out online. Why not just have the state automatically sign up everybody who was affected? The current solution seems to favor those who are Internet savvy and leave out in the cold anybody who hasn't paid attention to the news in the past week or doesn't have a computer.

There also seems to be either a lack of communication or miscommunication by those responding to the breach. After first saying that businesses weren't affected, we were told this week that yes, in fact more than 600,000 of them were affected. And we found out days later that the hacker used agency credentials to gain access. All of this information is coming out in drips, day by day, which doesn't inspire much confidence.

Also not inspiring much confidence has been Haley's unfortunately unprofessional demeanor throughout. I can understand that she's frustrated, but c'mon, we want reassurance and calm leadership, not angry calls to "brutalize" the hacker and "slam him into the wall." As for her reason that all of our tax info wasn't already encrypted -- "It's very cumbersome. There's a lot of numbers involved with it." -- really?

I hesitate to cast too much blame Haley's way. After all, an issue of this size is pretty unprecedented, and just as in any investigation, new information surfaces periodically. That's just a reality. If this were combat, I'd call it the fog of war. But at least when it comes to communicating the current situation to residents, the whole thing has been handled spectacularly badly. When our confidence in the state to safeguard our information has already been knocked on its heels, fumbling and bumbling the response certainly doesn't help restore that confidence anytime sooner.