Many years ago one of my dad’s friend’s house got burgled. He was single and didn’t have a lot of possessions. After rummaging through the place, they ended up only taking an old radio.
My dad, being a natural optimist comforted his friend by encouragingly remarking how that old radio was probably worth next to nothing.
His friend pointed out that while the radio itself may have had little value, it would cost him a lot of money to replace it with a new one.
It’s not always as easy or straightforward to establish the value of items, and data in particular is particularly difficult to value. One of the main reasons is that the value is hardly ever static, rather it changes on an ongoing basis.
For example, timing can change the value of data. A press release announcing a new product is highly confidential and valuable information – until the day that it is made public. After which, the objective shifts from keeping the data secret, to getting it in front of as many eyes as possible.
Different audiences will also perceive data to have different value, even within the same organization. Recently in Austria, an 18-year-old sued her parents for posting over 500 baby images of her on Facebook.
Many times, when someone becomes famous, or a celebrity, they will go through and scrub their history. This isn’t necessarily because there’s anything illegal, but because coming into the limelight puts a different perspective on things. Ex-partners, favorite vacation spots, embarrassing events, all can play into the hands of media, or more unsavory characters.
When it comes to a business, they need to exercise the same vigilance across its data. Examining the value of the data, not just in that point in time, but across a timeline that takes into account various events that may occur.
Minutes from meetings may seem uninteresting, or even boring, but that doesn’t diminish their value. Internal emails that include in-jokes, may be seen as friendly banter, but in different context could be seen as harassment.
Companies need to evaluate how conclusions could be inferred from indirect sources. A prime example is the Washington Pizza Index. The bigger the crisis and the more time that government staffers hole up in their offices, the more pizza they eat.
Finally, one needs to be mindful of the ‘chemistry of data’ whereby seemingly inert elements of data can be pieced together to form something more valuable than the sum of its parts.
Organizations need to be aware of what data is hazardous to them and under what circumstances. Where possible, this should be imparted into the risk appetite of the organization and described independently of the technology stack. If this can be done, companies will be closer to understanding the value of their data, protect the most vital aspects, and minimise the chances of being held to ransom.
