ears, we developed three principles for managing confi- dential information: I. Secrecy must be planned. Project code names and blackout lists of people authorized to have information cannot guarantee security by themselves, but they heighten awareness of the need for vigi- lance. 2. Confidential information must be closely held. Insiders should be lim- ited to those who need to know the information in order to do their job. Even then, information should be compartmentalized SO that people know only what they need to know. Outside consultants and suppliers should be limited to those whose loyalty is unquestioned and whose personal agendas are clear. Even then, they should be required to sign a nondisclosure agreement for each project. 3. Confidentiality should not be limited to critical projects. Employees should be periodically reminded that they should not discuss com- pany business in public places and should always keep company material under lock and key. Enforcing these basic rules-with periodic audits-will reinforce the seriousness of your intentions. Tough Calls One Person's "Leak" Is Another's "Right to Know" If these techniques are less than foolproof, it is because many people don't understand how a good reporter does his job. AT&T used to be in the exclusive club of companies that have full-time reporters dedi- cated to following their every move. The Wall Street Journal's John Keller majored in AT&T. He probably had more sources inside and outside the company than any other single person in the history of the company. Keller consciously positioned himself to capitalize on carelessness, disaffection, and ego gratification. He operated like a detective, talking to dozens of people a week, at all hours, nearly every evening and most weekends. He cultivated "friends" at all levels in AT&T and within the industry, keeping in regular touch with dozens of contacts and learn- ing about their families, jobs, and interests. He would call them- often at home-seemingly just to chat, then test incomplete theories