Fallon: stolen computer had members' information

*Sigh* Why do people put these databases on laptops in the first place? For what possible purpose? Shouldn't that kind of data be on a server?

It's because sometimes you're doing work on developing a new tool or what have you and you need the dataset to make it work.

Of course when we did the corporate database where I formerly worked I wouldn't let them have actual data. I exported the table structures with no data in them and then populated it with dummy data.

That is the only sensible approach. There ought to be huge penalties for anybody who puts actual identity theft data onto a laptop.

That's not always feasable: the prime directive of computer programming is the same as the prime law of medicine - "First, do no harm".

In order to make sure that program changes don't break existing code, a programmer _must_ test his changes against a "corpus" of existing data, in order to find the (sometimes subtle) interactions which plague old "spaghetti code" programs and break them in hard-to-find ways at the worst possible time.

In theory, it's possible to create a corpus of test data that accurately reflects the larger database. Theory and practice don't mix well in production environments, and there's never enough time to maintain test databases properly or to create new test cases for each program change.

Managers know that theft is a remote possibility, and their bosses ire at a missed deadline is real, in-your-face, and right now. They usually make the obvious choice.

Bill Horne Temporary Moderator

That's where the legal penalties kick in, to provide the proper incentives to take care of private information.

That may be so, but bureaucracies don't work in a way that reinforce such events, so the end result is "no change". Bruce "Secrets and Lies" Schnier has pointed out repeatedly that security will only become routine when insurance companies impose it as a condition of underwriting the associated risks. I agree.

YMMV.

Bill Horne Temporary Moderator