California eventually created a state law that required the public disclosure of data breaches (quickly followed by most other states). But ironically, at the time of Quinlan's contractor incident, the state was still trying to figure out the right internal policies to protect data across its many agencies.

After her experience, Quinlan decided she could not wait for that final internal policy, so she directed her staff to encrypt all data on the field force's 2,000 laptops within 30 days, which they did using GuardianEdge's software. California's law exempts encrypted data from requiring public disclosure, since the data would be inaccessible to thieves. Quinlan gambled that the statewide policy direction under discussion would ultimately be approved, and that even if she had to throw out her agency's specific system, the cost was justified because she was reducing so much risk by adding encryption.

As it turns out, the encryption effort proved less difficult than she'd feared, thanks to systems and infrastructure already in place. The agency had recently updated its laptops to support Windows XP, providing sufficient computing and storage capabilities as well as an operating system to support enterprise-class encryption software. And the agency had a client management system in place to update users' laptops with new software and enforce encryption and other security policies automatically.

CIOs should take Quinlan's experience to heart, says Paul Kocher, president and chief scientist of consulting firm Cryptography Research. "Anyone not doing it has no excuses anymore," Kocher says: Encryption technology is now widely available and proven.