Schneier on Security

aeschylus • December 18, 2007 2:05 PM

John W,

I agree it’s understood, in the way a lot of bad writing is understood, but it makes attentive people cringe. As you suggest, “disclosure” is better in most cases. In others, the thing breached may be suitably modified, e.g. “data protection breaches”. And “compromise” is still a fine word.

There is also a point at which using “breach”, even correctly, misplaces credit. What breach occurs when unencrypted CDs are lost in the unsecured mail? There was no boundary to be violated–or if there was, it was the postal service’s boundary, not HMRC’s.

It would be nice to see some thought go into word choice where these matters are concerned. Writing about data security has been devolving further and further into meaningless jargon. The horror started with “identity theft”, moved on to “spills” [shudder] and “data breaches”, and then we have the Prince of Nonsense, “personally identifiable information”–what in the world does that mean?

aeschylus • December 19, 2007 3:33 AM

sacundim: “Do you think that when somebody commits a traffic violation, they literally violate traffic?”

“Traffic violation”, as with many similar constructions, can be regarded either as elliptical (e.g. traffic-law violation, merited-by-excellence award), or a case where a noun has become a qualifier rather than the actor or patient–as with ellipsis, a transformation made for the speaker’s convenience rather than out of grammatical principle. In such cases, yes, our knowledge of the world enables us to understand the speaker despite the literal meaning of his words, often simply because repetition has established the meaning idiomatically. That doesn’t mean the speech is a good model, especially where a new jargon is being developed and the speaker may use existing language we readily comprehend, rather than attempting to establish new grammatical precedent through repetition of gobbledygook we manage to understand in spite of itself.

sacundim: “The correct reaction… ”

That depends on a lot of things, including who the speaker is, the context, the regularity (this case is not yet regular by any means), and how jarring the speech is to the native ear. How does “treasure breach” sound to you? I find it hard to believe you think “data breach” is a much more natural-sounding phrase; minimally, it sets a new usage precedent for “data”. I think this is a case where writers simply do not know the traditional use of the relatively uncommon word “breach”, and therefore a case worthy of correction, although I imagine it’s too late, what with all the apologists accusing people of being Nazis.

Or to put it another way, that prescription, i.e. the “correct” reaction, is not a moral imperative that you get to impose on us. Thank you, though, for the thoughtful, if graceless, response.