Two years ago, I considered the “permanent record” we create online when we least expect it. In keeping with the security theme, let’s look at some other unintended consequences of easy econtent creation.

Say you have a blog as well as a day job. You’re smart enough to know that you don’t casually forward internal email concerning projects and products that aren’t ready for release. You’re smart enough to avoid saying anything in internal email that could come back to haunt you later. And you’re smart enough to avoid saying things on your blog that could get you or your company in trouble.

Or are you?

It’s easy to be enthusiastic about a project or product. You see that neat new thing that’s just about ready to wow the world, and you want to post about it. I’ve seen it happen. I’ve come close to doing it myself. A colleague sent me a link to something they were working on, thinking I’d find it interesting. I did—so interesting that I really, truly wanted to post about it. Luckily, I’m slow to blog. By the time I was ready, I realized that nothing had been said publicly about this neat new thing and the link I’d received was within the intraweb. It was, in other words, still confidential.

Would any harm have been done if I had blogged about it? Probably not, at least not to my organization. It wasn’t a high-security situation or case of competitive threat. But it would have been unfortunate for two reasons: The new service could have been delayed or abandoned, and I would have made both myself and the firm look bad. In any case, new services need to be announced first by the company itself. Two weeks later, the service became public, was formally announced, and I wrote a post extolling its virtues.

If it’s that easy for me to nearly violate confidentiality, how much easier is it for a newcomer who’s used to MySpace and other services that encourage openness? Is the “digital generation” possessed of a naïveté that will make casual security breaches more common? I suspect it is and that is a problem.

There’s also the issue of pseudonymity in blogs and anonymity in comments. Both have some positive value. However, both can also function as ways to try to avoid responsibility for your actions and make it easier to bend confidentiality and security. Worse, both pseudonymity and anonymity turn out to be tricky and failure-prone.

Some bloggers use pseudonyms and many comments arrive unsigned or with pseudonyms. Most of the time, that’s not a problem: Posters just want to maintain a separation between blogging and everyday life.

I have seen more than one case, though, where a pseudonym has gone bad. I’ve seen the retroactive addition of a real-world signature to every post in a blog, including those that might never have been written were they signed originally. Identity revelation can happen because a blogger has a book or article published and is proud of it, referring to it in a manner that makes the blogger’s name obvious. It can happen because the blogger triangulates his identity too narrowly over time. It can happen because the blogger sees a sensational new web toy that (for example) “spells your name in lights,” tries it out, and links to the results without remembering that it was really his name in lights, not a pseudonym.

I’ve also seen something else, though fortunately rarely. Some bloggers don’t allow anonymous comments (I’m one of them). Those who do—or who require email addresses but specifically say “this will never be published”—typically offer at least an implicit promise that the blogger won’t “out” the commenter. In one case, an anonymous commenter said something fairly harsh and was foolish enough to blog from work. The blogger, upset by what was said, added a response that identified the anonymous commenter’s place of business based on a reverse DNS lookup on the IP address the comment came from.

To my mind, that was an outrageous breach of ethics on the part of the blogger. It’s OK to delete an offensive comment. It’s not OK to expose the identity of an anonymous commenter. Of course, it wasn’t OK for the anonymous commenter to comment from a work computer either—but that was more stupidity than unethical behavior.

My own take is that it’s usually a bad idea to blog pseudonymously or comment anonymously. If you must, you need to be exceptionally careful what you say. Otherwise, it can and will come back to haunt you.