That seems oversimplified. If an individual or organisation collects or creates "information", they could/should consider not only what a thief might do with th

That seems oversimplified. If an individual or organisation collects or creates "information", they could/should consider not only what a thief might do with the information, but what they're collecting it in the first place and why. If they know potential dangers, they share at least some responsibility for future damage. If they haven't considered the dangers, this is negligent (mitigated by the act of sincere consideration, not by what dangers were discovered). Intention exists separately from information (in this context) but they are not independent, they're connected. A silly example: Let's say someone at Facebook realises they could predict with high confidence the chance of a user voting in favour of extremist political candidates. This is new information, and Facebook has decided to create it. Once created, it could do harm. At this point, saying "information doesn't kill people, people kill people" is a useless abstraction. Sure, it might be "true" in a limited interpretation, but that interpretation doesn't help anyone. (From an excess of caution, I've constrained the definition of "information" above as something like "information created or collected by humans and our systems". This is to exclude exotic-but-true consideration of literally anything in the universe as "information" e.g. tumours, magnetars, etc etc.)