{I'll post the full article on my site sometime in the next several days.}

I love doing these little human experiments, and I've done similar lost and found experiments at grocery stores, bookstores and restaurants. Each time the staff helping me were more than happy to show me their lost and found box and let me take whatever I told them was mine, no questions asked.

Which got me to thinking about any type of organization's lost and found policies...

What is your organization's lost and found policy?

What would your organization do if someone turned in a laptop, cell phone, USB drive, or any other type of computer or storage device? Would the Information Security area be notified?

Have you worked with the area that handles lost and found...typically in the Facilities Management area, but sometimes the Physical Security area...to establish tighter controls around computers and electronic storage devices?

What would happen if someone went to your organization's lost and found, said they lost something, and wanted to look through the lost and found box to find it? Would the folks set the box in front of them to look through and take whatever they wanted?

Or, if the folks asked the person what they lost, and the person said something vague like, "my computer," "my data storage device," or something similar, would the folks give them any of the objects that came close to that description?

Just think about the types of information that could be walking our your door via your lost and found box...and lack of proper policies and/or procedures.

Do an experiment; go to your lost and found area and ask this similar question. Or, if the folks there know you, get someone they don't know to go ask the question. What do they do?

You could find a way in which information is walking out your door...security lost and...and later privacy breaches found...probably by somebody outside your organization!