Agreed ... too often the stupidity is coming from the organization rather than its employees. Earlier today I read about a VA data HD with 10 million records being sent for repair unencrypted. http://www.wired.com/threatlevel/2009/10/probe-targets-archi...

As with the UK ($2 billion) 'mistake' sent unencrypted and unregistered, the institution is dumb, not its 'component parts'.