I’ve lost count at the number of times I’ve heard someone invoke Chatham House Rule in a meeting where they plan to discuss their intellectual property, the business plan for their still-in-stealth startup, or just want to rant about something privately.
They clearly mean TLP:RED and I correct them, but I often think about how badly a situation like this could go. Everyone in cybersecurity and the business world in general, needs to understand the difference to avoid calamity.
Chatham House Rule
Straight from the creators of the rule:
When a meeting, or part thereof, is held under the Chatham House Rule, participants are free to use the information received, but neither the identity nor the affiliation of the speaker(s), nor that of any other participant, may be revealed.
You CAN
talk about the information discussed
You CANNOT
mention who shared the information
or what organization they’re associated with
TLP:RED
If you want everything you talk about to stay private, most people in cybersecurity will understand TLP:RED, which is defined as:
Not for disclosure, restricted to participants only.
Practically, this means you can discuss the information with other people who were present, but no one outside the meeting. You can’t publish any of it or speak of it publicly, no matter how much you anonymize it.
There are other TLP levels in the Traffic Light Protocol, but they’re rarely used. The differences between Amber, Amber+Strict, Green, and Clear get too confusing for people to remember, so I rarely see them in casual conversation. They’re more useful for classifying documents though.
Different levels of privacy for different needs
If you really need something to stay quiet, use an NDA. Your expectations are clear, in writing, and are legally binding. An NDA is appropriate when you’re sharing information that isn’t yours to share - something proprietary or confidential to your employer. NDAs can be abused, however.
Back when I was doing cybersecurity product testing, I’d resist signing a vendor NDAs. The whole point is to share my experiences using a product, I don’t want to lose editorial control over what I can say because of an NDA. Most were satisfied if I promised to let them review the writeup before I published. The first rule of product testing is don’t get sued.
Similarly, it is easy to understand “FrieNDA”. When I hear this, it’s clear that it means, “I expect you to keep this quiet, but I have neither the time nor patience to go through a formal NDA.” As the name suggests, a FrieNDA is worth as much as the trust you have in this relationship.
Chatham House Rule is a great option when you want the information you share to be useful to others, but don’t want your name or your company attached to it. Chatham House Rule is a great tool for ‘fire-side chats’ at conferences. No cameras or microphones allowed, but because everyone feels free to speak, the discussion can be very honest and high quality.
This is one of the reasons people don’t ask questions at the end of talks, while cameras are rolling, but instead swarm the speaker as they step down from the stage.
DFIU
Do NOT say “Chatham House Rule” if you want the contents of your meeting or discussion to remain private.
Chatham House Rule: share freely but don’t mention me/us
TLP:RED: keep everything a secret