As the eyes of the U.S., and perhaps of the world, collectively turn to Ferguson, MO, following the shooting death of unarmed teenager Michael Brown, there are any number of issues that have been the subject of heated conversation: the U.S.'s continuing racial inequality; the ever-widening income gap; the role of a free press in the U.S. (two journalists have been seemingly indiscriminately arrested); the militarization of local police forces; the efficacy of the “wars” on terror and drugs and poverty (remember that one?).

Here at the IAPP, however, we also have been struck by the role of personally identifying information (PII) in what are alternately being called riots and protests.

Most notably, the online “hacktivist” group Anonymous has waded prominently into the fray, releasing an ominous video threatening digital repercussions for physical abuse against Ferguson protestors.

Watch it here:

As police officers employ varying weapons—tear gas, rubber bullets, barking dogs—in their attempts at what might be called controlling the riots (or, alternately, intimidating the protestors), Anonymous has responded by threatening to retaliate with a different sort of weapon altogether: PII.

Per the video, “If you abuse, harass or harm in any the protestors … we will take every web-based asset of your departments and governments offline. That is not a threat. It is a promise. Attacking the protestors will result in the release of personal information on every single member of the Ferguson Police Department, as well as any other jurisdiction that participates in the abuse of this state’s own law. We will seize all your databases and email pools and dump them on the Internet.”

Regardless of your views of the situation in Ferguson, the threat of the use of PII in this way is striking for anyone in the profession of protecting and caring for it. Perhaps it shines new light on the value of personal information in the first place.

Three days following the release of the video, Anonymous has made good on its threats, at least in part.

Yesterday, the St. Louis Dispatch reported, “The Internet crashed at City Hall here on Tuesday morning. Ferguson’s website went dark. The phones died.”

Further, on Tuesday, “someone posted the home address and phone number of Jon Belmar, the relatively new chief of St. Louis County police.” They posted pictures of his family. They made intimidating remarks about a picture featuring his wife. They threatened to release information about his daughter if he didn’t release the name of the officer who shot Michael Brown.

And then they recanted. “We recognize that Jon Belmar has had enough damage done to him,” Anonymous posted on Twitter.

Instead, they reportedly changed tacks and hacked into the dispatch center of the police department and grabbed the recordings of the dispatch log for the day of Brown’s shooting, then released them for public consumption. There’s some question as to the tapes’ veracity, but, again, it’s clear that digital information is being used as a “weapon” in the “battle” between the protestors and the police and other authorities.

Even as we post this blog, Anonymous threatens to release the name (and other PII) of the officer who allegedly shot Brown.

What does this tell us about information’s value? Surely, there is no question about how digital information is valued after the high-profile leaks by the likes of Julian Assange, Chelsea (nee Bradley) Manning and Edward Snowden. And there can be no doubt that “cyber-attacks” will be amongst the salvos of any armed dispute in the future, just as they are becoming amongst the highest-profile risks considered in the boardroom.

For many of you, maybe those leaks didn’t really resonate, though. You’re not exactly holding state secrets there at Acme, Inc. Maybe, however, Ferguson will resonate more closely to home. All of you hold personal data of some sort—names, addresses, email addresses, social security numbers, histories of medical issues and more. What damage could be done via their loss? Via their inappropriate use?

In Ferguson, an address, phone number and family photos are being used as retaliatory measures for tear gas and rubber bullets. That should be at least cause for reflection.

EDIT: Emphasizing how seriously Twitter takes PII, the social media platform has suspended the account Anonymous account @TheAnonMessage in the minutes after this was posted. Per the company's terms of service, or "The Twitter Rules," "You may not publish or post other people's private and confidential information, such as credit card numbers, street address or Social Security/National Identity numbers, without their express authorization and permission."

photo credit: mr.smashy via photopin cc