A lot of stuff I read about privacy incidents leaves me scratching my head in wonder. In thinking about the staggering number of privacy breaches coming out of governments (Canadian, US, UK, etc.), I wonder:
- Are we hearing about all these incidents because employees who handle personal information for governments are idiots?
- Are we hearing about all these incidents because governments are more likely to come clean when bad things happen?
- Are we hearing about all these incidents because citizens are more likely to go to the media?
- Are we hearing about all these incidents because governments handle such vast quantities of personal information, but statistically are no more likely -- per capita / per employee / per whatever -- to mishandle personal information?
I am thinking that it probably isn't #2.
The latest is from the UK. An employee of the Revenue & Customs sent CDs of unencrypted personal information about almost every child and parent in the UK via regular internal mail. The CDs never reached their destination. The minister responsible has admitted that this has occurred on multiple occasions. When are governments going to learn?
See: Taxman loses sensitive personal data on 25m people - Times Online, via UK tax-man repeatedly hemorrhages personal financial info of 25 MILLION Brits - Boing Boing.
While I think that goverments are more likely to disclose breaches (it's harded to replace your government than your bank), I think that we've seen that most breach disclosures don't lead to the sky falling, and so we're seeing more of them.
ReplyDeleteI talk about this regularly over at http://www.emergentchaos.com. Take a look at the breach analysis archives.
Adam
Possibility #5 - private industry takes privacy more seriously.
ReplyDeleteNo, really, I mean it.
I'll admit my sample size is lousy - I work in private industry with a terrible privacy track record, but I have no relevant experience in the public sector.
In my business, confidential data often also has commercial applications. If you lose this data, not only are there privacy and reputational issues, but there may also be a genuine profit hit: competitors may steal your clients, employees may be taking money to which they are not entitled.
As a result, the people who have access to confidential data are a defined number of people, with well-defined responsibilities. Other people are in charge of making sure those people are doing their jobs correctly.
The Economist says something very similar (albeit in a much more erudite way) in its Nov. 22editorial dealing with the loss of the HMRC data (http://www.economist.com/opinion/displaystory.cfm?story_id=10177106)
"Large databases have their uses, doing away with paperwork and speeding things up. But the centralisation of so much data also has drawbacks, as this week's mess shows. In its enthusiasm for huge technology projects, such as its plan for a national identity card, the British government has failed to take such dangers sufficiently seriously. And why should it, when its departments face no penalties for ignoring procedures and losing data? If organisations were confronted by the risks of building large databases and forced to balance them against the benefits they provide, they would design them differently and monitor their use more closely. "
The private sector is, to a greater extent, confronted with the risks of building (and running) large databases, and so does design and monitor them more closely. Not perfectly, not constantly, but more closely.