Opinion
CSO Disclosure Series | Reporter's Notebook: The United States of TMI
Lead paint in toys. Brain-eating amoeba. Identity theft. Drowning in sand. We know more than ever about the risks all around us. Do we know what disclosing them all is doing to us?
By Scott Berinato
e from the world in your basement--provided of course you’ve tested it for excessive levels of radon.
IN MANY WAYS, 2007 was The Year of Disclosure.
When this idea first came to me, I wasn’t thinking about the sand. I was thinking about information security, as I was writing a reasonably disheartening story about serious malware threats while also researching dozens of the thousands of data breach disclosure letters that were issued this year now that 38 states have disclosure laws.
But then, throughout the fall, I started to notice that risk disclosure was becoming one of those news phenomena that eventually earns its own graphic and theme music on cable news. It earned landing pages on Web sites with provocative names like “Tainted Food, Tainted Products.”
It feels like there’s more risk disclosure than ever before--an endless stream of letters about identity theft, disclaimers in drug commercials, warnings on product labels, recalls and, of course, news stories.
But it’s not just the volume of disclosure but also its changing nature that’s wearing me down. Disclosure is more pre-emptive than ever. We know about risks before they’re even significant. Many of the state data breach disclosure laws, for example, mandate notification at the mere possibility your private information has been compromised.
Even more bizarre and stressful, disclosure is becoming presumptive. The cough medicine recall, for example, involved a product that a consumer advocate said was safe when used as directed. (ConAgra’s pot pie shut down also involved a product that company officials declared posed no health risk if cooked as directed). The risk that forced cough syrup off the shelves was that if you give a child too much medicine, it could lead to an overdose, which seems reflexively obvious. Essentially the disclosures amounted to: Not following directions is dangerous.
Perhaps the most insidious change is with the rare but spectacular risks. The sensational tales of brain-eaters and sand killers. Such stories have always existed, of course, but something is different now, and that’s the Internet. Ubiquitous access combined with the bazaar potential publishers means the freakiest event can be shared by millions of people. Anyone can read about it, blog about it, link to it, forward it in e-mail, and post it as a Flash video, but there’s no impetus for them to disclose the risk responsibly or reasonably. Their agenda may even call for them to twist the truth, make the risk seem more or
$firstKeyword
Security Directions: A Virtual Conference
Available On Demand Sept. 30 - Dec. 30
Join us for a virtual event with candid, expert information on top security challenges and issues - all from the comfort of your desktop.
Protecting PII: How to Work with IT to Manage Risk
Understand the critical nature of the test data privacy problem and get tips on how to work with IT to implement a test data privacy program.



