The story of corporate data breaches is nothing new. A study by Redemtech claims that "off-network security is the source of 75% of all data breaches". In other words the true enemy is not an outside hacker, but the careless employee within. The report goes on to blame companies for not setting clear and concise data handling policies and claims that off-network is a security "blind spot".

If this study can be corroborated further I can see two problems developing from the results. First companies are going to knee jerk and clamp down on all forms of data retention devices in an effort to keep sensitive files from walking out the door. This includes, but is not limited to, laptops, PDAs, flash memory sticks, personal music devices, etc. Friends on the inside of the large corporate firewall claim that this is already the case, however I believe it will become the norm for all businesses especially in the wake of more scrutiny by privacy watchdog groups.

The second problem is the theoretical possibility that since an employee is usually responsible for the data leaving the building then that person could potentially be liable for the data breach. Mishandling of data could be construed as negligence and furthermore could cause that person to be liable if the fact can be proven. Companies may try to defend the guilty party but more likely they will simply scapegoat the offender and try to distance themselves at least publicly.

Could this be a new form of white collar crime? I'm no lawyer but I do know that the potential for lawsuit is always a possibility. Whether that case has merit and is actionable is left to the court to decide.