Dr. John W. Coffey holds a B.S. in Psychology from the College of William and Mary (1971), a B.S. in Systems Science (1989), an M.S. in Computer Science/Software Engineering (1992), and an Ed.D. with an emphasis in Computer Science (2000) from the University of West Florida (UWF). He was one of the first members of the Institute for Human and Machine Cognition (IHMC) and he has worked with that organization for many years. He has been in the Department of Computer Science at the University of West Florida since 1992, starting as a Lecturer and working his way up to his current rank of Professor. He has published a total of more than 100 refereed journal articles, book chapters, technical reports, and conference proceedings. His research interests include knowledge elicitation and representation, web services, and Service Oriented Architecture, advanced technology for education, and computer science education.
This talk addresses the high level of uncertainty that exists in the assessment of damage caused by data breaches. I first create context by characterizing data security and data breach impact analysis as so-called "wicked problems." Such problems are inherently complex, multifaceted, not finally solvable, and involve competing concerns among various constituencies. In the talk, I address best estimates of costs to both organizations and individuals of data breaches and elucidate the uncertainty in making such assessments. The competing concerns of organizations versus individuals when data breaches occur are described. For instance, organizations have strong incentives to disclose as little as possible regarding data breaches they incur, whereas individuals want to know as much as possible about the data breach and its implications. The talk addresses inherent difficulties in digital forensics, which are exacerbated by the rapidly evolving field of digital anti-forensics. It elucidates the lack of standardized federal data breach reporting requirements in the United States and contrasts this state of affairs with the impacts of the European Union's "General Data Protection Regulation," (GDPR). The talk concludes with the viewpoint that organizations cannot provide assurances that individuals' data will be kept safe and with a discussion of various safeguards individuals may employ to protect themselves.
