We introduced a four-level classification scheme with the usual care. Definitions agreed with legal, a training module, a mandatory prompt on save, examples for each level. Eighteen months later, eighty-two percent of everything created carried the second-highest label, including lunch menus, meeting agendas and a document containing the office wifi password for guests.
The instinct in my department was to treat this as a training failure and run the module again. It was not a training failure. It was people responding sensibly to the incentives we had built.
Consider what we asked of them. Several times a day, with no context about who might need the document later, choose a label whose definitions run to a page and turn on words like material and adverse. Choose too high and nothing whatsoever happens to you. Choose too low and, in the worst case, you are the subject of an investigation. Every rational person in that position picks the safe answer, and the safe answer is always up.
The consequences arrived slowly and all pointed the same way. Our data loss rules keyed off the label, so ordinary documents could not be sent to the customers they were written for, and people started using personal mail to get work done. External sharing needed an exception, so exceptions became routine and stopped being read. Encryption applied at the top two levels broke search, so nobody could find anything and duplicated it instead. And retention schedules were keyed to classification, which meant the office lunch menus are on a seven year hold.
What we do now is put the sensitivity on the container rather than on the document. A system, a site or a folder is classified once, by somebody who genuinely understands what is in it, and everything inside inherits that. Individuals choose a label only when they move something out of its home, which is the moment the decision actually matters and the only moment they have the context to make it. Known patterns are detected automatically. There are two levels and a safe default, because the difference between the middle two never once changed what a system did.
We had asked nine hundred people to make a legal judgement every afternoon, at speed, and then blamed them for being cautious.
– Serguey Shinder
