On the front line: family offices and online security

The challenges social networking sites pose to wealthy families puts the role that family offices can play firmly in the spotlight, writes Katie Barker.

Trenchant criticism over its attitude to privacy forced Facebook to simplify its privacy settings in May in order to make them more user-friendly. The social networking giant had admitted that it shared up to six pieces of information about its users with various third parties.

Security experts say it takes as few as three pieces of personal information such as full name, date of birth and parents names to commit identity theft. This has clear implications for both the personal and professional security of families and the family offices that serve them.

The kind of activities these sites encourage, such as sharing personal information, photos, holiday plans and opinions, all create their own risks to ultra high net worth families. It is for this reason that monitoring and managing what family members choose to share on these sites can come under the remit of the family office. Although family members may feel there is little harm in sharing such information on social networking sites, Jill Shipley, director of next generation education at the US-based multifamily office GenSpring Family Offices, highlights four main risk areas:

• Personal security: there is a risk of a criminal obtaining an individual's information and using this information to harm the individual/commit a crime.
• Financial security: the information people share on social networking sites can open them up to identity theft and fraud.
• Professional risk: individual job prospects and even their ability to enter higher education can be impacted by negative or inappropriate material found on the internet.
• Damaging family name/reputation: this has always been a consideration for business owning and ultra high net worth families but becomes even more immediate with the instant nature of online publishing.

Louise Adams, managing director of the London branch of single family office Anthos, highlights security as one of her concerns because the consequences are so serious. Revealing addresses, even school addresses, and details of the family's whereabouts increases the risk of the family being targeted for anything from kidnap to identity theft. "Kidnap is less of a risk in the UK, but it could be of concern in other countries where this problem is rife such as South America and even some parts of Europe. Here we are concerned about being opened up to fraud, extortion and blackmail," she says.

While sharing holiday plans may seem innocent enough, Jim Grubman, principal of FamilyWealth Consulting, an advisory firm to ultra high net worth families, has seen this prove disastrous for one family he worked with: "A breach of security can have significant consequences," he says. "I know of a particular incident where a family member, a college aged person, had been bragging about going on a trip to Barcelona and throughout Europe on Twitter.

"While the family was out of town someone who was monitoring their sites broke into their home and they were robbed. It was an advertisement that the family would be away," he says.

But it is not just thieves who use social networking sites to gather information, according to a study commissioned by Microsoft, published in February 2010, 79% of HR experts scan the web in search of personal information for recruiting purposes and 70% of HR professionals have refused a potential employee based on data found online. Shipley is careful to stress these risks to the next gens she works with. "Posting of questionable language and/or pictures can impact one's future job prospects and ability to be admitted to college, as college recruiters also scan these sites for new applicants," she says.

Andre Rickardsson, founder of IT security firm Bitsec, agrees that the future impact of posting inappropriate material is a risk that is often overlooked by those using social networking sites. "It is a huge problem; people just post things on the internet without thinking that maybe their employers will see this or this information could be held against them in a later situation," he explains.

However, it is not just the security and privacy of the family that is jeopardised by over sharing on social networking sites, it is also the reputation of both the family and the individual that can be compromised. As GenSpring's Shipley succinctly puts it: "One family member's poor choices can significantly impact the overall identity of the family. Others' perception does become reality and for families of wealth, their reputation is a major asset that needs to be protected."

So what can family offices do to mitigate the multiple risks? Firstly it is important that the family office is monitoring the family's output. For Adams, this happens through their central IT department in Amsterdam; if they are concerned about a specific family member, they will relay their concerns to the family office in that country.

If family offices do not have the personnel to do this, they can outsource to companies like the one founded by Rickardsson. "They should try to keep it in the family, but if they don't have the time or the expertise or they don't want to do it, it's better to hire people to do the monitoring. This is especially important if it's a high profile customer," he says.

Secondly, the family office can play a role in educating family members on the risks that social networking sites can pose. Security breaches are rarely intentional, so once the family become aware of the dangers, they are often more than willing to cooperate with the rules.

"We constantly refer to it and try to educate both parents and children," says Adams. "It can be more difficult to illustrate the potential dangers being based in the UK because it is generally perceived as being lower risk, so there is no fear factor. The family members can think 'so what?'

"Generally we don't have a problem though because the family knows that the family office is available to them but its quid pro quo and they need acknowledge the importance of towing the line," Adams explains.

Shipley believes the most effective way to educate families is through sharing the first-hand experiences of other families: "Providing examples of families that have had to experience harsh realities such as kidnappings, stalking, identity theft and other terrible crimes to individuals being turned down for job opportunities, losing political campaigns and damaging family relationships are very powerful. 

"It has most impact when individuals share their own personal horror stories with others as it makes it more real and can change the mentality that 'this cannot happen to someone like me,'" she says.

Grubman sees the educational role as part of the wider governance responsibilities of the family in conjunction with the family office. "The family office has a role in educating the family that along with the benefits of social networking sites there are some risks as well.

"This needs to happen in combination with the family and its governance structures," says Grubman. "These are very important in the creation of a shared community ethic of behaving appropriately on social networking sites."

Thirdly, Rickardsson has some simple advice for families and family offices that want to eliminate the risks entirely: "The most obvious is not to use these sites. But if they do they should not share any personal or private information. Use maximum privacy settings and be very careful of your contact list.

"There are many monitoring systems you can use, but by far the best way to lessen the risks is to educate the users so you prevent things from happening in the first place," he says.

If the family is intent on using social networking sites, a set of clear rules concerning acceptable and safe use can reinforce the educational role played by the family office. Adams believes those set up at Anthos are based on common sense. "Our rules state no home addresses, no captions, no photographs of family members if they can be identified, no public access to profiles and events, and so on. All the normal, sensible things," she says.

However, Shipley explains at GenSpring they play a facilitative role as opposed to an enforcing one. "We believe it is our responsibility to provide ongoing education and support for our family members, but we do not and cannot make the ultimate decision for them," she says. "We advise our families on setting policies for how the family feels about information sharing online and facilitate discussions where families can craft governance language both on usage and implications for violation of the policy.

"We support our families in defining the rules family members will follow and provide information that helps the family make an informed decision through consideration of the risks and upsides to utilising these online websites."

While Grubman agrees with Adams on the need for rules, he is more insistent that breaking the rules must have clear consequences for the offending family member. "There is often a sense of helplessness about enforcing discipline and consequences in affluent families which then leads to some of the behaviour that can be problematic," he explains.

"I know one family in particular who dealt with a daughter who was repeatedly breaking the rules in social networking postings and also in substance abuse, and she was taken by surprise when her family did not take her along on a wonderful family holiday to the Pacific.

"People may laugh that oh well she didn't get to go on holiday, but the reality is that she had been looking forward to this for a long time, many people in the family went and she didn't believe that the family was going to enforce any consequences on her. Although she was quite angry and hurt, it was a wake-up call that the family was serious about what she was doing," he explains.

But these consequences can only be enforced when the family works with the family office to develop the rules and consequences. Problems arise when the family office is set up as the enforcer or the bad guy, especially to the next generation. "A family office can seem overbearing because enforcement or policy development is not being shared by the family," Grubman says.

"It should not be just the family office's role or position to either set policy or do monitoring because it can set the family office up for tremendous frustration, difficulty and hassle with the family and with the kids. I think the most appropriate venue for this is within the governance structures of the family itself," he says.

For Adams, this is generally not a problem as the family office not only has the support of the family, but it is also close to all the family members who use its services. "There is nobody who is remote from us," she says. "If we have a problem we can just pick up the phone. And generally if we go to the parents and explain why we think something is unacceptable, they agree and are sometimes quite concerned at what we have found."

The process is made easier for Adams and her colleagues because there are clear structures in place to deal with issues as they arise, and security is a core consideration of both the family and the office. "Overall we are hot on security. We have our security committee, which includes an ex-senior member of the Kidnap Unit at the Metropolitan Police as one of our consultants, and this issue is a standing item on our UK security committee agenda," she explains.

For Shipley, the role of a multifamily office is different than that of a single family office, and she is very aware of not becoming overbearing. "In my opinion there are downsides to multifamily offices becoming too involved in monitoring and controlling individuals' behaviour. Multifamily offices can and should ensure family members have all of the needed information to make wise, responsible decisions but I do not believe we can police our family members," she says.

Although it would be easy to assume this is a problem limited to next gens, senior family members use social networking sites too and actually prove even more difficult to manage. "I have heard of and seen gross misconduct by some of the adults on their social networking postings and sites, ranging from sexually explicit material to breaches of security around vacations and travel and, how shall I say it, bad manners," says Grubman.

"There are many adults within families who you really have very little capacity to enforce consequences on. Where they don't want restrictions on their behaviour they can be quite strong in pushing back on attempts to change their behaviour. So I think some of the more difficult instances of social networking breaches can be with the adults in the family not the kids," he says.

Another serious challenge for the family office is that, while you can educate the family on the appropriate and safe use of these sites, you cannot control what others choose to share about the family. Shipley believes one way to mitigate this risk is for the family to consider their actions closely. "Protecting yourself must include reflecting on one's behaviour," she says. "We recommend family members think about their actions through the lens that their activity or discussion could end up online without their knowledge or permission."

The very nature of social networking is also a concern for family offices, as Shipley explains: "Information is stored indefinitely. As a reputation consultant who spoke to our clients said, 'what comes up does not come down.'" Grubman echoes Shipley's concerns on the nature of the internet. "One of the issues is that the information travels at the speed of light now ? it can show up online almost instantly," he says.

Despite the many challenges posed by the family's use of social networking sites, there is much a family office can do to try and diminish the more serious risks. And, as family office heads and families the world over understand, while the internet is relatively new, the problems it showcases are not. "The behaviour has always been there, it is the speed at which it can spread that poses new challenges," Grubman says.

If the family office incorporates internet security into its wider security agenda, makes a concerted effort to educate the family on the real risks and is quick to address problems when they arise, there is no reason for social networking sites to have a serious negative impact on the security, privacy or reputation of the family.

Top tips for family offices

• Make web security part of your wider security agenda immediately
• Be strict when enforcing consequences ? this can have a positive effect on the behaviour of the individual and their peers who see breaches of security being taken seriously
• Address issues as soon as they arise
• Work with the family as far as possible ? communicate with them throughout the development and implementation process
• Involve the next generation in policy development ? the teenage years are about rebellion but if you include them in the decision-making process they will feel empowered and they are less likely to feel alienated
• Encourage the use of a secure family website as opposed to open social networking sites
• As far as possible have systems in place to deal with breaches of the rules
• Each family office must assess the specific risk to their family/families ? is it kidnapping, extortion etc ? then create a policy around that.