Regarding the apparent data theft, Belmont Club proprietor Wretchard reminds readers of the existence and intent of best practices that prevent or greatly reduce the likelihood of such events:

Professional database administrators know about things like granting permissions on tables and putting audit scripts in, the kind that send pager messages or emails to warn, for example, when somebody wants 26.5 million keys and related records. Normally one tries to restrict direct query access to a database to a chosen few; it being better to provide data access to users through an application front end. And you can control the living daylights out of a front end. It is good practice to provide select access through stored procedures or some similar mechanism where execute permissions can be assigned and where at least one can count the rowset requested before returning it. You want twenty six thousand records? Maybe and you'd log it. But somebody asking for twenty five million records and change -- the whole dataset -- would make you wonder.

Commentary

What I see in this story and in Wretchard's commentary is a partial explanation as to why information technology and organizational performance are not and can not ever be perfectly correlated. Empirical research, especially that couched at the firm level, that uses large data sets, and that defines IT with expenditure-based measures (e.g. IT budget per employee) has noted the existence of a strongy positive correlation. Similarly, stock market returns to firm's announcements of major IT initiatives are, on average, not only positive, but statistically significantly so.

But despite positive average performance associated with IT there are many firms that achieve below average results. A handful experience drastic failures attributable to their use or investment of IT. Certainly the presence or absence of best practices like those Wretchard outlined can explain some of the sub-par performance.

Another class of explanations focuses on the distinction between performance benefits attendant to the automation and those due to the infomation of organizational processes. In the former, human judgement, involvement, and decision-making is greatly reduced or altogether eliminated. Through automation organizations save costs because of reduced headcount and improved operational efficiency, especially from reduced error rates and faster data processing. The Department of Veterans Affairs has undoubtedly benefitted from the use of IT in this manner.

With "infomation", a term first termed by retired Harvard Business School professor Shoshana Zuboff, organizational peformance is enhanced by increasing the role of human judgment, discretion, and decision-making; by increasing access to and the ability to analyze data; and by relaxing constraints and decentralizing authority to those performing vital tasks. Such an approach has definite rewards. For example, it can allow organizations to develop the valuable, rare, difficult to imitate resources which strategically differentiate them from their competitors and thereby gain competitive advantage. But it also has enormous attendant risks; it can produce the most serious of organizational failures, the kind that would rarely happen in more tightly controlled and highly automated environments.

Were I a betting man, I'd predict that one result of the investigation into this theft will be the creation of additional controls or rules, plus technical barriers like Wretchard discussed, to prevent this kind of problem from occurring again. The offending employee and some of his supervisors will also likely be fired. I understand why this has to be: errors like this are not only highly embarrassing, they undermine public confidence and can have very negative effects for the veterans whose identities may have been stolen. Someone has to be held accountable.

But is overly simplistic to think that technical fixes or more rules, particularly those imposed from on high and from the outside, will be the ultimate guarantor of the desired end. Tightening the DVA's screws and reducing degrees of freedom for key employees will actually be counter-productive if auditors fail to recognize that somewhere in there, more rather than less authority may need to be devolved. Somehow I don't feel confident betting that this last suggestion of my will be heeded.

Links: Belmont Club