This article takes a rather fatalist perspective. Seems to me companies/government should have a strict need-to-know policy and some liability for failures. If

This article takes a rather fatalist perspective. Seems to me companies/government should have a strict need-to-know policy and some liability for failures. If you can't keep information secure, you shouldn't have it. Acting as though it is secure while it is regularly compromised is reckless wishful thinking. I realize that perfect security is fantasy, but the practices of many of these organizations don't pass the laugh test. We'd be vastly better off if they would hire a security professional and listen to her.