In the digital world it is very easy to create data, very difficult to get rid of it
Like us all, government agencies are creating huge amounts of information. Lots of it is classified either to protect privacy or for national security. This is what should happen, classification is an important aspect of information security.
What is data classification?
It is the process of assigning a business impact level to a piece of data or a system. This then governs how many resources are directly devoted to their protection. By classifying documents and systems an organisation makes risk managed decisions on how information is protected.
Graphic by Mark Smiciklas, Flickr.com/photos/intersectionconsulting
Digital data wants to be free and it is expensive to ensure confidentiality if you also want to maintain data integrity and availability.
However over-classification of information can be as bad for an organisation as under classification. This is particularly true of large government organisations.
In addition, Government agencies tend to be risk averse places anyway – which on balance is a good thing!
So how could governments shift the classification balance, improve security and improve efficiency in agencies?
The problem is that the person who classifies data or systems does not have to pay for the cost of their actions in classifying. In fact, the individual avoids personal risk if a piece of data is over-classified. However their agency has to wear the added expense.
Gentle readers, we have a problem of incentive imbalance!
Suppose it costs $100 to store a Secret document for its lifetime and $10 to store an everyday unclassified document. If governments placed a nominal value on document creation relative to the whole of life costs, it might be possible to stem the tide of increasing amounts of classified data.
If under this scheme a government employee wishes to create a secret classified document, they would need to find $100 in their budget to do so. In this case the employee might consider producing an unclassified document or one that was slightly classified. I argue that this market based approach to declassification would have far more effect than more rules.
A plan for implementation
So how might the plan be implemented in the tight fiscal environment that government agencies currently face, even though it is likely to save money long term?
- Survey government agencies to see how many classified pieces of data they produce each year by type. eg, there might be 500 top secret data pieces and 1000 secret.
- Assign a dollar value to each document according to the level of protection it receives. This bit would require a bit of research or possibly a pilot scheme.
- Based on the previous year’s classified information output, each agency is given a declassification budget. It might be considered that as this task was one that the agency should have been doing previously, that there is no requirement for central funding.
- Require each agency to report the numbers of classified data produced.
- Agencies that produced too many classified documents would need to pay the treasury a fine equivalent to the cost of storing the extra documents in archives.
- Agencies that produced fewer pieces of data than the previous year would receive a windfall.
That’s it in a nutshell. As governments produce more data, they will need to store it. Balancing the incentives to overclassify and underclassify data will help ensure that information is properly protected.
I’d love to hear your ideas, please make a comment
Alex
I challenge the notion that over-classification is as dangerous as under-classification; national security is not a general market good and indeed it thrives on the asymmetries that information economics seeks to break apart.
But your suggestion is fascinating. The one complication I can see is the command-set target for declassification is prone to rorting in the gifting phase – see also, the carbon tax – but trying to float a declassification target sounds unworkable.
If the issue is ultimately the scarcity of storage, why not also an auction market for information storage to improve its supply? With any number of facilities rated to store information at middling classifications, and the existing culture of gold standard you have alluded to presumedly resulting in inefficent underuse of those facilities, let them bid in a storage price into the market.
Thanks for the comment. I think an auction market could work as it results in the market determining a value of the stored information. I certainly could see it working for cloud providers. I have heard that there are some progressive government agencies in the Australian states which are going somewhat down this path.
However, I also think that in some cases, governments will want to subsidise the price of storage, because they have a low tolerance to the risk of loss of information. As an example policymakers might determine a price for storage of open source information that was only slightly less than for sensitive privacy information, even though the real cost would be higher. This might also be the case within an agency. The executive could tweak the price of different levels of classified information to influence the quantity of classified information being produced at different levels.
My point is that governments are struggling with this because there is a disconnect between the classic ISO31000 approach (where the owner of the risk determines the tolerance and as a consequence the controls), and the information classification approach. This is a way of fixing it – based on sound economic principles.
🙂