A few weeks ago we discussed the Tao of IT and our first lesson was about distinguishing between what is wanted and what is needed, and how these issues are often confused. We suggested that you let go of ownership (for example, stop being “server huggers”), think about what infrastructure you really need, and look to hosting and software-as-a-service as the way to optimize costs and flexibility.
Now, there are many lessons in the Tao of IT, and if you were at the CTO Forum in Santa Monica last week you heard me discuss four more (thanks to Oded and everyone who was at the meeting – it was very stimulating).
Today, we will discuss Lesson 1,266: Power corrupts and being the government means never having to say you’re sorry. We rather hope you’ll have a few comments on this lesson; the guys at the Santa Monica meeting did.
When it comes to responsibility and taking care of our data, you would think that our government would be leading the way. They gave us Sarbanes-Oxley. They gave us Gramm-Leach-Bliley. They gave us HIPAA. You’d think they would hold themselves to high standards. Unfortunately if you think that, my friend, you are deluded.
You all know who the IRS is, right? Load of really happy, friendly guys who are there to “help you” with fun things like audits.
A report published in early April this year by the Treasury Department’s Inspector General for Tax Administration found that between Jan. 2, 2003 and June 13, 2006, the IRS lost 490 laptops … 490! Now let’s put this into perspective: The IRS currently has 47,000 laptops, which means in just over three years they lost 1% of their laptops. That doesn’t sound that bad except …
Of the 490 laptops, 111 were stolen from IRS facilities, while the other 379 were stolen from employees’ cars and homes. It gets better. The Treasury Department’s Inspector General for Tax Administration stated that reporting procedures for stolen laptops were often not followed so the “number might be wrong.”
What was so important about these laptops? They contained your tax records! Not only that, much of the data was unencrypted. The auditors’ report stated “We conducted a separate test on 100 laptop computers currently in use by employees and determined 44 laptop computers contained unencrypted sensitive data, including taxpayer data and employee personnel data. As a result, we believe it is very likely a large number of the lost or stolen IRS computers contained similar unencrypted data.”
Any moron who could switch on a PC could fire up one of the unprotected wandering laptops and get at your personal information. Armed with that kind of data, identity theft is about as easy as it gets!
So, what will happen? Probably not much. Sure, there will be a lot of waving and wringing of hands and maybe some people low down the totem pole will get fired, but I’ll bet not much will change (though I may get audited for writing this column).
Why? Because the government doesn’t care. As individuals they might, and politically they might seem to, but there’s no real accountability in areas like this. This is not something that Joe Public can get worked up about so there’s no place for the buck to stop and everyone is acting as if there’s no real buck anyway.
Until we make the government accountable for its IT strategies and policies on the same basis as the governed, we will get the government that the lobbyists (naming no names) pay for.
The Tao of IT asks: What do you think? Can – not should – we expect the government to uphold high standards where our private data is concerned? Given that private industry’s record of handling personal data is so astoundingly poor, is that a reflection of the government’s laxity or is it the other way around? In IT does the public lead and the government follow?
