Source: The Economist
Companies must adapt to a world where no secret is safe
THE digital archive of a big bank contains many secrets. So when WikiLeaks, a whistle-blowing website, promised to publish five gigabytes of files from an unnamed financial institution early next year, bankers everywhere started quaking in their hand-made shoes. And businesses were struck by an alarming thought: even if this threat proves empty, commercial secrets are no longer safe.
Smaller leaks are nothing new in the corporate world. WikiLeaks itself has already been the conduit for a few. In September 2009, for instance, it posted a leaked internal report from Trafigura, a commodities giant, discussing a hazardous waste spill in Côte d’Ivoire. In January 2008 the site released stolen documents from Julius Baer, a Swiss bank, including bank records of about 1,600 clients with accounts at a subsidiary in the Cayman Islands. The bank sued to stop WikiLeaks publishing the documents, but then dropped the suit.
WikiLeaks is currently drip-feeding a huge stash of American diplomatic cables to the world. These have revealed a few corporate secrets, but so far nothing startling. Intel, a giant maker of microchips, apparently managed to export to Russia 1,000 computers containing software to protect the firm’s intellectual property, without getting ensnared by Russia’s stringent regulations on encryption products. If Intel had been obliged to wait months until the gear had passed muster, its bosses told the country’s president, Dmitry Medvedev, it would have had to fire 200 Russian engineers.
The cables will doubtless yield more such anecdotes. The biggest worry for companies, however, is not that diplomats have been gossiping about them. It is that their own files are insecure. Constantly improving technology has led to an explosion of corporate data. It has also made it more vulnerable, says Tracey Stretton, a legal adviser at Kroll Ontrack, a data-security consultancy. Employees increasingly bring their own devices to work. Even the simplest can store the equivalent of several tonnes of paper. And more and more people use social networks at work, which thrive on exchanging information.
Worse, many firms do not have the right policies in place to deal with these changes. More than half in America and Britain do not have a “data map”, a document describing what information is being stored and who has access to it, according to a new study by Kroll Ontrack. Few have implemented rules about how to deal with new technologies. Social networks are not the only risk. Companies are increasingly storing proprietary data offsite, in a scattered “cloud” of data centres.
The State Department has learned what the music and film industries learned long ago: that digital files are easy to copy and distribute, says Bruce Schneier, a security expert. Companies are about to make that discovery, too. There will be more leaks, and they will be embarrassing