Encryption and Data Loss

Fast-paced IT advances have made it increasingly possible and useful for firms to collect data on their customers on an unprecedented scale. One downside of this is that firms can experience negative publicity and financial damage if their data is breached. Encrypting customer data is often presented as a potential solution, because encryption acts as a disincentive for potential malicious hackers, and can minimize the risk of breached data being put to malicious use. However, we find evidence that when organizations adopt encryption software, there is no evidence of a decrease in publicized instances of data loss. Instead, there are actually increases in the cases of publicized data loss due to internal fraud or loss of computer equipment. This brings into question the current emphasis of government policy on encryption as a primary tool for ensuring the security of data within organizations. ∗Amalia Miller is Assistant Professor of Economics, University of Virginia, Charlottesville, VA. Email: [email protected]. Catherine Tucker is Douglas Drane Career Development Professor in IT and Management, MIT Sloan School of Business, 1 Amherst St., E40-167, Cambridge, MA. Tel. 617-252-1499. Email: [email protected].