Bruce Schneier recently wrote a wonderful explanation of why the dichotomy between security and privacy is artificial. I recommend it to the privacy officials who must confront security as the rationale for poor privacy practices and to security officials who must find ways to integrate privacy into their thinking and program planning.

So how does FedWorld see this topic? With no subtlety at all, of course.

Privacy equals privacy plans, privacy officials, privacy impact statements, and mandatory disclosure of certain security events that might or might not involve personal information – in other words, as a matter of compliance. Because information security is also mostly treated as a compliance matter, few inside FedWorld bother to worry about the distinctions between security and privacy. Privacy officials worry about their compliance requirements; security officials worry about theirs and seldom do the twain meet … except in various Office of Management and Budget compliance reports, where the fundamental flaw in government security thinking (all Gaul is divided into Major Applications and General Support Systems) means that privacy (along with strategic planning, enterprise architecture, and all other compliance-without-substance matters) is shoehorned into the one-size-fits-all world of OMB compliance orthography.

As I have opined elsewhere, information about people is just one type of information that deserves protection (and not necessarily the most important for most agencies). Personal information deserves protection against unauthorized or inadvertent disclosure (the concern of most privacy advocates), protection against inaccuracy (data integrity is a security concern but seldom a privacy issue), and protection against unauthorized destruction (conceivably applauded by some with privacy concerns).

The central problem I see with “security vs. privacy” in FedWorld is the focus on computerized official (mission-related) records. Do the guards in your building need to have access to personal information about you and your visitors? How long do the security camera tapes or files that record your coming and going need to be maintained? How do you know the memo you received about your performance was the same as the one in your official personnel file?

If one were to develop a privacy program unfettered by OMB and congressional reporting strictures and FISMA (Federal Information Security Management Act) categories, the result would probably be very like the Internal Revenue Service privacy office, as originally created. I suspect the IRS office has become bogged down with compliance paperwork, but its original focus on protection of taxpayer and employee information from unnecessary or unauthorized disclosure has served us taxpayers well.