Last night I was at a corporate dinner and met a CISCO rep. He assured me that the value was in the network. I replied that from my perspective the value is in the data. I proceeded to give him a little thought experiment: Suppose my social security number is on a hard drive and the computer is disconnected from the network. There are plenty of security issues that now surround the hard drive because my social security number has value even though the network is “gone”.
On the heels of this conversation, a service provider turned to me and asked me that if I lost my PDA cell phone (and hence the data on the phone), wouldn’t I then surely suffer a huge loss (as per the example above). I thought about it for a moment and replied, “Not really. It’s my personal phone. I do not keep sensitive data on my smart phone and I back it up almost every night. The loss here would be mostly in the hardware.”
This led me to ask, “How valuable is data, ultimately?”
When I was growing up, the secret formula to Coca-Cola was the holy grail of valuable sensitive data. Imagine what Pepsi would pay for that! Well we now have an answer to that: Pepsi will tell Coke. They’ll pay nothing and you’ll go to jail! Huh? Definitely not what we assumed to be the case long ago.
This led me to think, if I stole data, what could I really do with it? How would this data benefit me? What would the data be worth?
Answering these questions led me to realize that data has utility. By that I mean that if one cannot do anything with the data there is no value to it.
The classic example of data theft is the salesperson who finds a new job and walks out the door with the prior company’s customer list. But it’s mostly valuable to salespeople (and perhaps marketing people). I do not work in sales. I do not have relationships with clients. If I were to steal a corporate client list, what good would it really do me? Could I sell it? Perhaps, perhaps not. Look at the Coke/Pepsi example. Just to press this point as much as possible, the stolen corporate client list would most likely not be valuable to physicist Stephen Hawking. See?
Are there cases that demonstrate where data has enormous value? Absolutely. What if I am bidding for a project? If I know the competitor’s bids, that is really advantageous and worth something. (It’s interesting to note that in this example the monetary value of the data would be in relation to the dollar value of project contract. Think about this point: the value can be quantified.)
When thinking about data, data loss and information security mechanisms, to say that data is valuable is not enough: “To whom?” and “How would it be used?” should also be answered.
I’m beginning to suspect that most data — data that cannot be utilized directly or data that has not been synthesized and aggregated from various sources in such a way as to provide utility after being mined — may be much less valuable than assumed.