84 karma · joined October 27, 2010
1) Tell everyone (don't single him out) that by the request of a client, you're double-downing on internal security and implementing a set of policies and procedures (P&P) for minimizing risk (I personally used HITRUST as the P&P standard).
2) Part of the P&P entails an audit by the designated Security Officer (in this case, me), in which I personally oversaw the deletion of all production data from every personal and non-personal machine. No one individual suspected I was singling him/her out, as I was doing this across the board, but admittedly, my intention was to go of one individual who had his hands on very sensitive data.
3) Make him and every employee sign-off on the P&P Handbook, in which there's a clear clause that in case any personally identifiable data is on his/her machine, he/she is fully liable for the implications of that data getting leaked. Any such employee will be complicit in any criminal proceedings.
4) Fire him.
"Would you sell it for $20 million?" There are so many variables for consideration in answering this question that can result in anything from a symbiotic relationship with a bigger player to augmenting the market using the buyer party's core competencies to just forfeiting the rights to the other party (which is the only viewpoint factored into the author's answer- "find a new idea"). Don't need to necessarily find a new idea as much as be a master of the idea's fate.
Nonetheless, I heartily agree with the last section- mastery of a domain of knowledge. Advice needs to be slapped as a layer on top of hardcore expertise. I've made this mistake in the past of letting the allure of a tech lead me to an area where I didn't have the necessary expertise and idea dissipated quickly. Now I'm focused on an area that my partner and I have deep-seated expertise in and the advice is very easy to cut through to take only the nuggets that apply.