Thinking
forward.
Staying human.

What the LinkedIn breach taught us about the information we can never take back

I remember when creating an account on a website was a relatively simple decision. You provided an email address, created a password, and perhaps answered a few questions about yourself. In exchange, you gained access to something useful, whether that was an online store, a professional network, or one of the many services that emerged as the internet became part of everyday life.

Most of us didn't give much thought to what happened to our information after we provided it. We assumed the companies operating these services had a responsibility to protect it, and we generally trusted that they would. There was little reason for the average person to understand how passwords were stored, how databases were secured, or what might happen if someone gained unauthorized access to the systems holding their information.

I was already working in technology during those years, and even among people who understood the risks, the emphasis was often on protecting systems rather than questioning how much information we were collecting in the first place. Businesses needed customer information to operate, websites needed accounts to identify their users, and the internet was expanding too quickly for many of us to spend much time reconsidering the assumptions behind those arrangements.

Looking back, I think we were participating in an enormous experiment without fully appreciating what we were creating. We were building a digital world in which organizations accumulated increasingly detailed information about people, while those same people had remarkably little understanding of where their information was going or what might eventually happen to it.

The 2012 LinkedIn data breach provides an interesting illustration of how those decisions could produce consequences that extended far beyond the original incident.

At the time, LinkedIn had become an important part of professional life. People used it to maintain business relationships, search for employment, establish credibility, and remain connected with colleagues. Unlike many other social networks, its purpose encouraged users to associate their accounts with their real identities and professional histories.

That made the service useful, but it also meant that the information associated with an account could have significance well beyond the website itself.

In June 2012, LinkedIn acknowledged that approximately 6.5 million passwords had been stolen. The company responded by disabling passwords it believed were at risk and strengthening its security measures. For people following the incident, it was another reminder that even large technology companies could experience serious security failures.

The story might have ended there, at least in the minds of most users, if not for something that happened four years later.

In May 2016, information stolen during the original breach resurfaced online. This time, the scale appeared substantially larger. Reports described approximately 117 million accounts with associated password information, and LinkedIn confirmed that the newly surfaced records came from the 2012 incident rather than a new intrusion.

Four years had passed, but the consequences of the original theft were still unfolding.

I find that timeline particularly revealing because it challenges the way we usually think about security incidents. When a company announces a breach, we tend to imagine an event with a beginning and an end. Someone gains unauthorized access, information is stolen, the vulnerability is addressed, and affected customers are notified. We change our passwords, perhaps monitor our accounts for suspicious activity, and eventually move on.

From an operational perspective, that sequence makes sense. The organization needs to identify what happened, prevent further unauthorized access, and restore confidence in its systems.

But the information that was stolen doesn't necessarily disappear when the security problem is resolved.

It may be copied, exchanged, stored, combined with other information, or rediscovered years later. The organization can repair its systems, but it cannot reliably retrieve every copy of information that has already escaped its control.

This is one of the fundamental differences between protecting a physical asset and protecting information.

If someone steals a vehicle, the owner loses possession of it. The vehicle may eventually be recovered, and while the experience can be expensive and disruptive, the boundaries of the loss are relatively understandable.

Information behaves differently. Someone can steal a copy of a database without removing the original. The organization may continue operating normally, and the people whose information was copied may have no immediate indication that anything has changed.

The loss isn't necessarily the information itself. It's the ability to control who possesses it and how it might be used.

That distinction becomes even more important when we consider the nature of the information involved in the LinkedIn breach.

Passwords were the most obvious concern because they could potentially allow unauthorized access to accounts. LinkedIn had stored the passwords as hashes, which means they weren't simply saved as readable text. However, the protections used at the time were weaker than modern recommended password-storage practices, making many passwords vulnerable to being recovered through automated guessing.

The company subsequently strengthened those protections, but the stolen information remained outside its control.

The problem also extended beyond LinkedIn because people frequently reused passwords across multiple services. Someone who used the same password for a professional networking account and a personal email account could potentially face consequences involving both, even though only one organization had experienced the breach.

In that situation, the relationship between two otherwise unrelated accounts becomes important. The person creating the accounts may never have considered that connection, but someone possessing the stolen information could exploit it.

I've always found password reuse to be an interesting example of how ordinary human behavior can create risks that aren't obvious when we consider each decision independently. Most people weren't reusing passwords because they wanted to compromise their security. They were trying to manage an increasingly complicated digital life in which every new service demanded another set of credentials.

The convenience made sense in isolation. The cumulative consequences were harder to recognize.

But there's another aspect of the LinkedIn breach that interests me even more than the passwords.

A professional networking account represents part of a person's identity. It connects a name to an email address, employment history, professional relationships, and other information that can help establish credibility. Much of that information is intentionally shared because the purpose of the service is to make professional connections.

That doesn't mean every piece of information on a LinkedIn profile was stolen in the 2012 breach. LinkedIn's notification identified email addresses, hashed passwords, and internal member identifiers as the affected data. The broader professional information associated with the service matters for a different reason: it illustrates how a seemingly limited set of stolen records can exist within a much larger digital identity.

An email address may appear relatively harmless because we routinely share it with businesses, colleagues, and acquaintances. But when that address is connected to other records, it can help establish relationships between information collected in completely different circumstances.

Someone might use the same email address for professional networking, shopping, travel reservations, and numerous other services. Each organization sees only the portion of the person's life relevant to its business, but those fragments can potentially be connected when information is combined.

This is where I believe our early assumptions about digital privacy began to create problems that we're still trying to understand.

We approached online services as separate relationships. We provided information to a particular company because we wanted access to something that company offered. We might have understood that the company would retain our information, but we rarely considered how that information could become useful to someone operating entirely outside the original relationship.

The internet made it remarkably easy to create these connections, and over time we became accustomed to treating the information required to establish them as a routine cost of participation.

We were exchanging pieces of our identities for convenience, often without recognizing that the exchange could be difficult or impossible to reverse.

I don't mean that every company collecting information was behaving irresponsibly or that every person creating an account was making a mistake. Many of these services provided genuine value, and the information they collected was necessary to deliver it.

The problem was that our understanding of the long-term consequences hadn't kept pace with the speed at which we were creating digital relationships.

A company might have viewed an email address as a customer identifier. The customer might have viewed it as a convenient way to sign in. Someone obtaining a large collection of stolen records could view the same information as a means of connecting identities across unrelated services.

The information hadn't changed, but its potential uses had.

This brings me back to the idea that everything is an asset.

When we recognize information as an asset, we begin to appreciate that its value depends partly on the circumstances surrounding it. An email address, considered by itself, may not appear particularly valuable. But the relationships between that address and other information can make it considerably more significant.

Those relationships can create value for legitimate purposes, such as helping a business recognize an existing customer or allowing someone to recover access to an account. They can also create opportunities for misuse when information moves beyond the boundaries of the relationship in which it was originally provided.

What makes this particularly challenging is that people often have little practical ability to separate those relationships after they've been established.

We can change a password, and doing so is an important way to reduce the risk associated with stolen credentials. We can sometimes change an email address, although that may require updating years of accounts and correspondence.

But we cannot easily change our employment history, erase every association between our identity and an old account, or ensure that information already copied by someone else will never be used again.

Some digital assets can be replaced. Others are inseparable from the history of the people they describe.

The 2012 LinkedIn breach demonstrated this problem in a relatively straightforward way. Information stolen during one event remained relevant years later, and the people affected had limited control over what happened to copies of that information in the meantime.

Now consider how much more complicated our digital lives have become since then.

We use online services to manage finances, communicate with family, store photographs, maintain medical records, and organize nearly every aspect of our professional lives. Many of these services are connected through shared accounts, third-party applications, and automated systems that exchange information on our behalf.

Each connection may provide a legitimate benefit, but it also creates another relationship involving information that could become valuable outside its original purpose.

Artificial intelligence introduces an additional dimension because it can make those relationships easier to discover and interpret.

A collection of records that once required substantial human effort to examine may become easier to organize, compare, and analyze. Information from different sources can potentially be connected through patterns that aren't immediately obvious, allowing systems to develop a more detailed understanding of the people represented in those records.

This capability has tremendous potential for legitimate uses. It could help individuals organize their information, identify inconsistencies, and understand relationships that would otherwise remain hidden.

But the same underlying capability can also increase the usefulness of information that has already escaped its original boundaries.

A stolen email address doesn't suddenly reveal someone's entire life simply because artificial intelligence exists. However, when combined with other accessible information, it may become one element in a much larger picture. AI can reduce the effort required to identify connections, evaluate patterns, and produce conclusions from collections of records.

And those conclusions don't necessarily have to be correct to cause harm.

Imagine someone assembling information about a person from several unrelated sources. One record contains an outdated address, another references a former employer, and a third includes information about a business relationship that ended years earlier.

An AI system might connect those records and produce an explanation that appears coherent, even though some of the relationships are no longer relevant. If that explanation is subsequently treated as reliable, the person represented in the records may face consequences from information they never intended to combine and conclusions they never had an opportunity to challenge.

This possibility concerns me because we've spent years discussing the importance of protecting information from unauthorized access, while paying considerably less attention to what happens when information is interpreted outside the circumstances that originally gave it meaning.

A data breach can expose information, but the consequences of that exposure depend upon how the information is subsequently used.

The original theft may be only the beginning of the story.

I think there's a tendency to look back at incidents like the LinkedIn breach and conclude that the lesson is simply to use stronger passwords and enable additional security protections. Those are sensible measures, and I would encourage people to use them. Unique passwords, password managers, and multifactor authentication can substantially reduce the likelihood that stolen credentials will compromise additional accounts.

But if we stop there, I think we miss something more important.

The broader lesson is that information can continue creating consequences long after we've forgotten why we provided it.

This is especially relevant as we enter an era in which AI assistants may become responsible for managing increasingly large portions of our digital lives. We may give these systems access to correspondence, documents, calendars, financial information, and personal histories because doing so allows them to provide more useful assistance.

In many cases, that access will be entirely reasonable. An assistant that understands our circumstances can potentially help us make better decisions and accomplish tasks that would otherwise require considerable time and effort.

But I wonder whether we're approaching these new relationships with some of the same assumptions that shaped our early experiences with the internet.

We see the immediate benefit of sharing information and assume that the organization or system receiving it will use it appropriately. We may examine a privacy policy, review a permission request, or decide that a service has earned our confidence.

What we often cannot know is how the value of that information might change over time, what new capabilities may eventually become available, or how information collected for one purpose might be used in circumstances nobody originally anticipated.

The LinkedIn breach didn't involve artificial intelligence in the way we understand it today, but it illustrates the importance of considering the future life of information beyond the moment we surrender control of it.

The information stolen in 2012 became the subject of renewed concern in 2016 because copies remained available and useful. The original incident hadn't changed, but our understanding of its scope had.

I suspect the same principle will apply to many of the decisions we're making about AI today.

We may be comfortable allowing an assistant to examine personal information because the immediate purpose seems harmless. We may trust a service to retain records because it offers a useful capability. And we may assume that deleting an account or withdrawing permission will restore the control we previously possessed.

Sometimes those assumptions will be justified. Other times, copies, retained records, legal obligations, or information already shared with other systems may limit what can actually be reversed.

The difficulty is that we often discover those limitations only after circumstances change.

I don't believe the answer is to withdraw from the digital world or become suspicious of every technology that asks us to share information. The internet has created extraordinary opportunities, and I expect artificial intelligence to expand those opportunities in ways we're only beginning to imagine.

But I do believe we need to develop a more mature understanding of the assets we're placing into these systems.

That begins with recognizing that information has a life beyond the application in which we created it. Its value can change, its relationships can expand, and its potential consequences can persist even when the original purpose has disappeared.

It also requires us to consider whether the organizations and technologies we depend upon are designed to respect those realities. Protecting information while it's stored is essential, but so is understanding how it moves, who is permitted to use it, and what happens when the relationship that justified its collection comes to an end.

For much of the internet's history, we treated the creation of a digital account as a small transaction. We gave a company some information, received a service in return, and rarely thought about the exchange again.

The LinkedIn breach reminds us that the transaction may have been much more consequential than it appeared.

Four years after the original incident, information that users had entrusted to a professional networking service was still creating new security concerns. The company had taken steps to improve its protections, and affected users could change their passwords, but neither action could guarantee that every stolen copy had disappeared.

The event was in the past. The information wasn't.

As we begin entrusting artificial intelligence with increasingly detailed knowledge of our lives, I think that's a distinction worth remembering. We're not simply deciding whether a service is useful today. We're making decisions about information that may retain its significance long after the technology, the company, or even our reasons for sharing it have changed.

And if the history of the internet has taught us anything, it's that we haven't always been very good at anticipating what our information might become valuable for tomorrow.

Read & share this note →

How artificial intelligence is changing the way we establish trust

I've spent much of my career working with technology that people depend upon without necessarily understanding how it works. Most of us don't think about the systems responsible for delivering our email, protecting our financial information, or keeping our businesses connected to the outside world. We expect those systems to function reliably, and when they do, we gradually develop confidence in them.

That confidence is important because modern life would become exhausting if we had to independently verify every system and every piece of information we encounter. We rely on banks to maintain accurate account balances, doctors to interpret medical information, and countless organizations to provide services that depend upon knowledge we don't personally possess.

In many cases, our confidence isn't based on understanding the underlying technology or independently confirming every detail. It develops through experience, reputation, and the belief that someone is responsible when something goes wrong.

I've been thinking about how artificial intelligence may change this relationship, particularly as we begin relying on systems that can interpret information, make recommendations, and eventually take actions on our behalf.

What interests me isn't simply whether AI can provide accurate answers. It's how we decide that those answers deserve our confidence, especially when the information used to produce them comes from sources we may never see.

Consider something as ordinary as asking a friend for a restaurant recommendation. If that friend has consistently recommended places you've enjoyed, you're likely to give their next suggestion considerable weight. You understand something about their preferences, you have experience with their judgment, and you know how their tastes compare with your own.

If the recommendation turns out to be disappointing, you can reconsider how much weight to give their advice in the future. You might even ask why they recommended the restaurant and discover that they had a completely different experience or were looking for something you don't particularly enjoy.

The recommendation itself is only part of what makes the information useful. Your relationship with the person providing it supplies much of the context necessary to evaluate it.

Now imagine asking an AI assistant the same question.

The assistant might examine hundreds of reviews, consider your previous preferences, compare menus, and recommend a restaurant that appears to be an excellent match. In some respects, it could make a more informed recommendation than your friend because it has access to far more information.

But the number of sources contributing to an answer doesn't necessarily tell us how much confidence we should place in the conclusion.

Perhaps many of the reviews came from people whose preferences differ substantially from yours. Some might have been written years ago, before the restaurant changed ownership. Others could be promotional material disguised as independent opinions. The assistant might also rely on an incorrect assumption about what you enjoy.

The resulting recommendation could be perfectly reasonable given the information available, yet still be poorly suited to you.

This is a relatively harmless example, but I think it reveals something important about how we evaluate information. We don't simply want an answer supported by a large collection of facts. We want to understand whether those facts are relevant, reliable, and appropriate for the decision we're making.

People have always struggled with this distinction, but we've developed ways of navigating it through relationships, experience, and institutions that establish expectations of accountability.

When a doctor recommends a treatment, we generally trust that the recommendation reflects professional training, an understanding of our circumstances, and a responsibility to act in our interests. That trust isn't absolute, and we may seek another opinion when the consequences are significant. Nevertheless, the relationship provides a framework for understanding why the recommendation deserves consideration.

Artificial intelligence complicates this framework because it can produce recommendations that resemble professional judgment without necessarily participating in the relationships that make such judgment accountable.

An AI system might accurately summarize medical research while lacking important information about a particular patient. It might identify a legal precedent without recognizing that the circumstances of a case differ in a critical way. It could recommend a financial decision based on historical patterns without understanding the personal consequences of being wrong.

These limitations don't make AI inherently untrustworthy. They remind us that the ability to produce a convincing recommendation is different from the responsibility associated with making one.

I've noticed that we often treat trust as though it were a characteristic of the person or system providing information. We describe a source as trustworthy, a website as reputable, or a technology as secure. These descriptions are useful, but they can obscure the fact that trust is usually conditional.

I might trust my accountant to interpret a financial statement while having little reason to rely on that same person for medical advice. I might trust a longtime employee's understanding of customer relationships without assuming they're qualified to make decisions about cybersecurity.

The trust I've developed isn't necessarily transferable to every subject or situation.

This distinction becomes particularly important when we begin connecting AI systems to the information and services we use every day.

Imagine a business that relies on an AI assistant to help employees locate information across its internal systems. The assistant has permission to examine documents, search correspondence, and retrieve records from several applications. Over time, employees discover that it saves considerable effort and generally provides useful answers.

Their confidence grows, which is exactly what we'd hope would happen when a technology proves valuable.

Eventually, someone asks the assistant a question that requires information from several different sources. The system combines what it finds, produces a clear explanation, and recommends a course of action.

The employee may have no practical way to determine whether every source was current, whether conflicting information was overlooked, or whether the assistant made assumptions while connecting the records.

Yet because the system has performed reliably in the past, the employee may accept its recommendation without further examination.

This is where I believe an interesting shift begins to occur.

The employee's confidence in the assistant can gradually become confidence in the information the assistant provides, even when that information originated somewhere else entirely.

We already experience versions of this phenomenon with search engines. People frequently assume that information appearing prominently in search results deserves greater consideration, even though ranking is influenced by factors that aren't necessarily related to accuracy. The familiarity and perceived reliability of the service can influence how we evaluate the information it presents.

AI may intensify this tendency because it doesn't merely display sources. It can combine them into a single explanation that sounds as though it came from one knowledgeable authority.

The distinction between the system providing the answer and the sources supporting it becomes less visible.

I think this creates a new responsibility for anyone developing or deploying AI systems. We need to consider not only whether an assistant can access information, but also how it establishes confidence in what it finds and communicates the limitations of that confidence to the people relying upon it.

A system that retrieves information from an organization's official policy library might reasonably treat those documents differently from an informal conversation between employees. But even an official document can be outdated, and an informal conversation may contain information that explains why a policy was changed.

Determining which source deserves greater weight may require understanding who created it, when it was created, what authority that person possessed, and whether subsequent events changed its relevance.

These are questions about relationships and accountability as much as they are questions about data.

They also reveal why I believe the future of AI will require us to think differently about the information we accumulate.

For decades, we've focused heavily on making information easier to store, retrieve, and share. Search engines made enormous collections of public information accessible. Cloud services allowed businesses and individuals to work with records from almost anywhere. Artificial intelligence is now making it possible to examine information in ways that previously required considerable human effort.

Each development has expanded what we can accomplish, but access to information doesn't automatically establish the conditions under which it should be trusted.

A document may have been created by someone with considerable expertise, but that doesn't mean every statement within it is correct. A record may be authentic without being complete. Information may come from a reputable institution while being inappropriate for the particular question we're trying to answer.

As AI systems become more capable of interpreting these records, I suspect we'll need better ways of preserving the circumstances that make them meaningful.

This brings me back to the concept of Asset Value.

If information is an asset, its usefulness depends on more than its contents. The relationships surrounding it, the authority of the people who created it, and the circumstances under which it can be used all influence its value.

A business might possess a customer database containing accurate contact information, purchasing history, and correspondence. The records may be valuable because they help employees understand customer needs and maintain relationships.

But the fact that the business possesses those records doesn't mean every employee should have access to them or that every AI system should be permitted to use them for any purpose.

The value of the information and the authority to use it are separate considerations.

This distinction becomes especially important when an AI assistant operates across multiple systems. An employee may have permission to view certain customer information in one application and financial records in another. If an AI assistant can access both, it may be capable of combining information in ways that neither application was originally designed to support.

That combination could produce valuable insights, but it might also reveal sensitive relationships or create conclusions that the organization never intended to make available.

The fact that information can be connected doesn't necessarily mean it should be.

I've begun thinking about how trust might need to operate in an environment where AI systems routinely exchange information and perform tasks on behalf of people and organizations.

Imagine an assistant receiving information from another assistant. The first system may have no direct knowledge of the original source, the circumstances under which the information was collected, or the permissions associated with it. It might simply receive a well-structured response that appears suitable for the task at hand.

If the receiving assistant accepts that information without understanding its origin or limitations, the original assumptions may travel through several systems before reaching the person who ultimately relies upon the result.

Each system might perform its assigned function correctly while contributing to a conclusion that nobody has independently evaluated.

This possibility interests me because it challenges a familiar assumption about technology. We often believe that if each component of a system operates correctly, the overall result should be reliable.

But when intelligent systems interpret information and make decisions, correctness becomes more complicated. A system can accurately process information that was never appropriate for its purpose. It can follow authorized instructions while relying on assumptions that nobody intended. It can communicate a conclusion faithfully while leaving out uncertainty that would have changed someone's decision.

The individual steps may appear reasonable, yet the outcome can still be wrong.

I don't think this problem can be solved simply by making AI models more intelligent. Greater intelligence may improve their ability to recognize inconsistencies and evaluate competing explanations, but it doesn't automatically provide knowledge of every relationship, agreement, or circumstance that determines whether information should be trusted.

Nor does it establish who should be responsible when something goes wrong.

In human relationships, accountability plays an important role in how trust develops. We can question someone's reasoning, challenge a decision, or reconsider whether we should continue relying on their judgment.

With AI, accountability may need to extend beyond the system producing the final answer. We may need to understand which information contributed to a conclusion, which permissions allowed that information to be used, and which assumptions influenced the result.

This doesn't mean every person should be required to examine a detailed technical explanation before accepting an AI recommendation. That would undermine much of the convenience that makes these systems valuable.

Instead, I believe trustworthy AI should make it possible to investigate those questions when they matter, while remaining understandable and useful in ordinary situations.

A person asking for a restaurant recommendation probably doesn't need an extensive record of every review considered. Someone authorizing a significant financial transaction or making a decision that affects another person's livelihood may reasonably expect considerably more transparency.

Trust should reflect the consequences of being wrong.

The more responsibility we delegate to artificial intelligence, the more important it becomes to understand the boundaries of that responsibility.

I've been struck by how frequently conversations about AI focus on whether people will eventually trust these systems enough to let them operate independently. We discuss improvements in reasoning, reductions in errors, and the growing ability of AI agents to complete complicated tasks.

Those developments are important, but I wonder whether we're approaching the question from the wrong direction.

Perhaps the challenge isn't simply getting people to trust AI more.

Perhaps it's developing AI systems that understand when trust is justified, when it should be limited, and when a decision requires the involvement of someone who possesses authority or knowledge the system doesn't have.

That would represent a meaningful change in how we think about intelligent technology.

Instead of treating trust as something a system earns through consistently useful answers, we could begin treating it as a relationship that must be established for particular purposes, supported by reliable information, and bounded by clear responsibilities.

The same assistant might deserve considerable confidence when organizing a calendar, more limited confidence when interpreting a complicated contract, and no independent authority to make certain decisions regardless of how capable it becomes.

Those distinctions aren't necessarily signs of technological weakness. They reflect the reality that different actions carry different consequences and that intelligence alone doesn't establish the right to act.

I believe AI will become an increasingly valuable participant in our personal and professional lives. It may help us understand information that would otherwise remain inaccessible, recognize connections we would never have discovered, and make better decisions by considering perspectives beyond our own experience.

But as these capabilities develop, I think we'll need to become more deliberate about how confidence moves between people, information, and intelligent systems.

When an AI assistant tells us something, we may eventually need to consider more than whether the answer sounds reasonable or whether the system has been reliable in the past. We may need to understand what the assistant is relying upon, why those sources deserve consideration, and whether the circumstances justify the confidence being expressed.

That doesn't mean abandoning trust in technology. It means recognizing that trust has always involved more than receiving a correct answer.

We've spent generations developing institutions, relationships, and practices that help us decide whom to believe and when to question what we're told. AI is introducing a new participant into that process, one capable of working with information at a scale no individual could hope to match.

The opportunity is extraordinary, but it doesn't eliminate the human responsibility to determine what deserves our confidence.

As we build systems that can increasingly think and act on our behalf, I suspect one of the most important questions won't be whether AI is intelligent enough to earn our trust.

It will be whether we've become thoughtful enough about trust to recognize when that confidence is warranted.

Read & share this note →

Why preserving information isn't the same as preserving its meaning

I've spent much of my professional life helping businesses protect their information. Over the years, the technology has changed considerably, but the underlying objective has remained relatively consistent. We want to prevent important information from being lost, stolen, or made unavailable when someone needs it. We create backups, implement security measures, and develop procedures intended to ensure that organizations can continue operating when something goes wrong.

These are important responsibilities, and I've seen firsthand how disruptive it can be when information suddenly becomes inaccessible. But as I've spent more time thinking about the relationship between information and artificial intelligence, I've begun questioning an assumption that has quietly influenced much of our approach to protecting data.

We tend to believe that if information survives, we've successfully preserved it.

I'm no longer convinced that's always true.

Consider a business that has maintained its records for thirty years. Its documents have been backed up, its databases carefully protected, and its correspondence retained according to established procedures. From a traditional information technology perspective, the organization might have done nearly everything right. Yet imagine that many of the employees responsible for creating those records have retired, the circumstances surrounding important decisions have been forgotten, and the meaning of certain documents is no longer entirely clear.

The information still exists, but the organization may no longer understand what it possesses.

This distinction becomes particularly interesting when we consider how information acquires meaning in the first place. A document doesn't necessarily explain everything about the circumstances that produced it. An email may contain a decision without recording the conversations that led to it. A financial report can accurately describe what happened while revealing very little about why it happened.

For the people involved at the time, these limitations may not matter. They remember the circumstances, understand the relationships, and recognize which details were considered important. Years later, someone examining the same information may reach an entirely different conclusion, not because the original record was inaccurate, but because the knowledge needed to interpret it has disappeared.

I've encountered versions of this problem in business more often than I can count. An organization may have a procedure that everyone follows without anyone remembering why it was established. Sometimes the procedure remains necessary because it addresses a problem that could still occur. Other times, the circumstances have changed so significantly that the procedure no longer serves its original purpose.

The written instructions might be perfectly accurate, yet their continued application could produce the wrong result.

What makes this difficult is that the document itself provides no obvious warning. It doesn't announce that the assumptions behind it are outdated or that the person who wrote it expected the reader to possess knowledge that is no longer available.

Until recently, interpreting these records depended almost entirely upon people. Someone had to recognize that something didn't make sense, investigate the circumstances, and determine whether the information could still be trusted.

Artificial intelligence is beginning to change that process.

We're developing systems capable of examining enormous collections of documents, identifying relationships between records, and producing explanations that appear to reflect an understanding of the information they've encountered. This creates tremendous opportunities for organizations that have accumulated years of knowledge without having practical ways to use it.

But it also introduces a problem that I think deserves more attention.

An AI system can become very good at explaining information without necessarily knowing whether that information deserves to be believed.

Imagine a company that uses AI to help employees answer questions about its internal procedures. The system searches the organization's documents, finds what appears to be a relevant policy, and provides a clear explanation of the steps employees should follow. It might even identify the document it used, allowing the employee to verify that the explanation accurately reflects the written instructions.

Everything appears to be working correctly.

But what happens if the document was created fifteen years earlier, the policy was informally abandoned five years ago, and nobody ever updated the original record?

The AI may have accurately represented the information it found while providing advice that is no longer appropriate.

This isn't necessarily a failure of the AI's ability to understand language. The problem is that the system may have no reliable way to distinguish between information that exists and information that remains authoritative.

I find that distinction important because we often use the word truth as though it describes a permanent characteristic of information. In reality, many things we consider true depend upon circumstances that can change.

A customer's mailing address might be correct today and incorrect tomorrow. A medical instruction may be appropriate for one person but dangerous for another. A business policy may be valid for a particular department while being completely irrelevant to someone working elsewhere.

Even historical information, which we might expect to remain unchanged, can become misleading when separated from the circumstances in which it was created.

An old photograph provides a familiar example. Suppose you discover a photograph of several people standing outside a building. Someone has written a date and a few names on the back, and the photograph has been carefully preserved for decades.

You might reasonably assume that the information accompanying it is accurate. But perhaps one of the names was written incorrectly, or the date reflects when the photograph was developed rather than when it was taken. Maybe the building belonged to a different organization at the time, or the people pictured were attending an event unrelated to what a family member later assumed.

None of these possibilities changes the photograph itself. Yet each could substantially change the story someone tells about it.

Now imagine that an AI system uses the photograph and its accompanying description to help construct a family history. It identifies connections with other records, produces a compelling narrative, and presents the result in language that sounds authoritative.

If the original description contained an error, that error may become part of a much larger explanation. And because the explanation connects multiple pieces of information, it may appear more convincing than the original record ever did.

This is one reason I believe artificial intelligence will force us to reconsider what it means to preserve information responsibly.

Historically, much of our attention has focused on ensuring that information remains available and hasn't been improperly altered. We want to know that a document is authentic, that a database hasn't been corrupted, and that a backup can restore what was lost.

Those concerns remain essential, but they address only part of the problem.

A document can be authentic and still be wrong. It can be accurate when created and misleading years later. It can faithfully record someone's words without preserving what that person meant.

And perhaps most importantly, it can be technically available to an AI system without being appropriate for that system to use.

This brings me back to the idea that everything is an asset.

When we think about the value of an asset, we usually consider more than whether it physically exists. A house may still be standing, but its condition, location, and legal status influence what someone can reasonably do with it. A vehicle may be perfectly functional while lacking the documentation necessary to establish ownership.

Information has similar characteristics, although we've rarely treated them with the same attention.

Its value depends partly on whether it's accurate, but also on where it came from, when it was created, what it describes, and whether the circumstances surrounding it remain relevant. It may also depend on who is permitted to access it and whether the person or system using it understands the limitations associated with it.

A business might possess a detailed customer record that is entirely accurate but was collected for a specific purpose. That doesn't automatically mean the business should use the information for every new application it develops. The record's accuracy doesn't eliminate the responsibilities associated with how it was obtained or the expectations of the person who provided it.

Similarly, an organization might have access to an employee's historical performance evaluations. Those records may accurately describe particular events, but they might not provide a fair representation of the employee's current abilities or circumstances. Using them without understanding their limitations could produce conclusions that are technically supported by documentation but fundamentally misleading.

These examples suggest that the quality of information involves considerably more than the absence of errors.

I think about this in terms of the difference between possessing information and understanding the conditions under which it remains useful.

People make these distinctions constantly, often without realizing it. When a friend tells us something surprising, we consider what we know about that person, the circumstances surrounding the conversation, and whether there might be another explanation. When a longtime employee questions a procedure, we may give their concern additional weight because we understand their experience and judgment.

We don't evaluate information solely by examining the words or numbers in front of us. We draw upon relationships, history, and context that help us decide how much confidence to place in what we're being told.

Artificial intelligence can potentially help us make similar evaluations, particularly when it has access to reliable information about where records originated and how they've changed over time. But there's a danger in assuming that an AI system possesses the same understanding simply because it can produce a convincing explanation.

The system may identify relationships that humans would never have noticed, yet still fail to recognize a missing piece of context that someone familiar with the situation would consider obvious.

As AI becomes more capable of taking action, these limitations become more consequential.

An incorrect answer to a question may cause confusion or inconvenience. An automated system acting upon incorrect information could make decisions, alter records, or communicate with people before anyone recognizes the underlying mistake.

Consider an AI assistant responsible for helping a business maintain customer relationships. It might examine historical correspondence to understand customer preferences and identify opportunities to provide better service. Used carefully, this could be extremely valuable.

But suppose an old email contains a complaint that was later resolved through a telephone conversation that was never documented. The assistant might conclude that the customer remains dissatisfied and begin taking actions based upon a situation that no longer exists.

The problem isn't necessarily that the AI misunderstood the email. It may have understood the available information perfectly. What it lacked was the information necessary to understand the relationship.

This is where I believe the concept of information quality becomes inseparable from human judgment.

We can develop increasingly sophisticated systems for organizing records, tracking changes, identifying sources, and determining who has authority to access particular information. These capabilities will become essential as AI systems take on greater responsibility.

But we also need to recognize that no collection of technical controls can guarantee that every relevant circumstance has been recorded.

Human lives and organizations are too complicated for that.

People change their minds. Relationships evolve. Decisions are reconsidered. Circumstances shift in ways that may never be formally documented, and sometimes the most important information is something nobody thought to record.

I don't believe this means we should avoid using AI to understand our information. I believe it means we should become more thoughtful about the difference between what a system knows and what it has reason to believe.

An AI assistant that identifies uncertainty, recognizes conflicting records, and asks for clarification may ultimately be more valuable than one that confidently produces an answer to every question.

That might seem counterintuitive in a world where we're increasingly impressed by systems that can accomplish complex tasks without human intervention. Yet the ability to recognize when information is insufficient could become one of the most important characteristics of trustworthy artificial intelligence.

I've begun thinking about how different our approach to information might become if we treated its history and limitations as part of the asset itself.

Instead of simply preserving a document, we might preserve enough information to understand who created it, why it was created, and whether it has been replaced or challenged. Rather than assuming that a record remains valid indefinitely, we might develop ways to recognize when its usefulness depends upon circumstances that should be reconsidered.

For individuals, this could mean preserving the stories behind important photographs, documents, and family decisions. For businesses, it could mean retaining more of the reasoning behind procedures and recognizing that institutional knowledge is often distributed among people rather than contained within formal records.

These aren't entirely new ideas. Organizations have long used version histories, audit trails, and recordkeeping practices to establish accountability. What changes with artificial intelligence is the potential importance of those details to systems that may interpret and act upon information at enormous scale.

The better these systems become at using information, the more consequential our assumptions about that information are likely to become.

There's an irony in this that I find particularly interesting.

For years, we've been concerned about losing information because technology failed to preserve it. Now we're approaching a future in which technology may preserve more information than any previous generation could have imagined, while making it increasingly difficult to distinguish between what was recorded, what was inferred, and what was actually understood.

We may eventually find ourselves surrounded by information that is readily available, carefully protected, and convincingly explained, yet still struggle to determine which conclusions deserve our confidence.

I don't think the solution is simply to collect more data or build more powerful AI models. Those developments may help, but they don't eliminate the need to understand the origins, relationships, and limitations of the information being used.

If anything, they make that understanding more important.

When I consider the future of artificial intelligence, I'm increasingly interested in systems that can preserve not only what we know, but also why we believe it, how we came to understand it, and the circumstances under which that understanding might need to change.

That strikes me as a more meaningful ambition than simply making every piece of information searchable or every question answerable.

We've become remarkably good at keeping information alive. The next challenge may be learning how to preserve enough of its meaning that future generations, and the intelligent systems assisting them, can recognize when it deserves to be trusted.

Because the fact that information survived doesn't necessarily mean the truth survived with it.

Read & share this note →