From filing cabinets to databases
Before computers, personal and business information lived on paper: ledgers, files, index cards and letters. Protecting it meant locks, guards and the practical difficulty of copying it. Stealing a million records would have taken trucks. Searching them took clerks.
Computers changed both the value and the vulnerability of information. Records stored in digital form can be searched in seconds, combined with other records, copied in bulk and moved across the world on a network. That makes the information far more useful to the organizations that hold it, and also far more attractive to anyone who might misuse it. This tension, between usefulness and exposure, runs through the whole history of the field.
New risks
Several risks grew with the technology, each linked to a stage in computing history.
- Concentration. Large databases, which began to appear in government and business in the 1960s and 1970s, gathered information about many people in one place. A single failure could affect all of them.
- Remote access. Once computers were connected to telephone lines and then networks, an intruder no longer had to be in the building. The shift is described in the overview of computer security.
- Copying at scale. Digital data can be duplicated without a trace, so a breach may go unnoticed for a long time.
- Software flaws. Programs are written by people, and mistakes in them can be exploited. The spread of self-copying code, such as the worms and viruses of the 1980s and 1990s, showed how quickly flaws could be used.
- Human factors. Many incidents begin with phishing, reused passwords or simple errors, such as sending a file to the wrong recipient or losing a laptop or storage disk.
- Data about behavior. Online services, mobile phones and connected devices record where people go, what they read and whom they contact. The information can be sold, analyzed or leaked, even when no one is trying to attack anyone.
New protections
Computing also provided better tools than paper ever offered.
Encryption. Mathematical scrambling of data makes information unreadable without a key. Public-key methods, published in the mid-1970s, allowed strangers to set up secure channels, and became the basis of secure web browsing, online banking and many messaging apps. Encryption does not solve every problem, since keys can be stolen and devices can be compromised, but it is a major reason that routine online transactions are possible at all.
Access control and logging. Systems can limit who may open a file, record who did, and flag unusual behavior. Paper files could be consulted by anyone who got into the room, usually without a record.
Backups. Digital copies can be made cheaply and stored in several places, which helps with accidents, disasters and ransomware, provided the backups themselves are kept safe and tested.
Updates. Software makers can fix flaws and send corrections over the network, a feature that connects to the history of operating systems. Automatic updates have become one of the most effective everyday protections, though they depend on users and organizations accepting them.
Authentication improvements. Beyond simple passwords, methods such as one-time codes, hardware keys and biometric checks aim to make stolen passwords less useful. Each has its own weaknesses and costs.
Rules for personal data
Technology alone does not decide how information is used, so laws and norms developed too. Concerns about large government and corporate databases led, in the early 1970s, to some of the first data protection laws, such as the one adopted by the German state of Hesse in 1970 and a national law in Sweden in 1973. The United States passed the Privacy Act of 1974, which regulates how federal agencies handle records about individuals. International guidelines followed, including ones from the Organisation for Economic Co-operation and Development in 1980 and a Council of Europe convention in 1981.
Many of these frameworks share a set of ideas, known as fair information practices: collect only what is needed, use it for stated purposes, keep it accurate, protect it, and let people see and correct records about themselves. Sector-specific laws followed, such as the 1996 United States law on health information (HIPAA), which relates to electronic health records. In the European Union, the General Data Protection Regulation, applying from 2018, set broad rules, including requirements to report certain breaches and to give individuals rights over their data. Other regions have adopted their own laws, and the details and enforcement differ widely.
Trade-offs and unresolved questions
None of this settles the matter. Some of the hardest questions involve balancing competing goods.
- Security versus convenience. Stronger protections often add steps, and users sometimes work around them.
- Privacy versus usefulness. Sharing health or location data can improve services and research, but it also widens exposure. How much to share is a choice with no universal answer.
- Encryption versus investigation. Strong encryption protects ordinary people and also makes it harder for authorities to read data, which has led to continuing public debates.
- Compliance versus real safety. Meeting a legal checklist does not guarantee that a system is safe, and organizations that follow the rules have still suffered breaches.
- Responsibility. It is unsettled how much users, companies and governments should each be expected to do.
What the history suggests
The computer made information easier to store, share and misuse at the same time. Each wave of technology, from shared mainframes to personal computers, the internet and the Internet of Things, has widened the range of what needs protecting. Defenses have improved, but so have attackers and the amount at stake. A sensible conclusion is not that data is safe or hopeless, but that protection is ongoing work, resting on technology, rules and ordinary human habits together, and that outcomes can never be guaranteed.