The issue was not political, at least not in my mind. It was all about security. In the national hoopla over whether a foreign government or those under its control should run operations at major U.S. ports, I heard lots of misplaced xenophobia. I wanted to understand the security implications as they might apply to networks in a similar situation, and that took me back to 1999.

At a classified counterterrorism briefing, speaking to a room full of Pentagon brass, I opened with, "Generals, you have lost command authority of your armies." I described the implications of the military using foreign nationals to operate unclassified aspects of their global networks. The idea had been that using local individuals in overseas bases was good politics, and because the networks and information were all unclassified, what's the harm?

The first harm is that unclassified networks that supply meals and travel orders, for example, support military readiness. That is why U-boats targeted the shipping lanes during the Battle of the Atlantic. A severe compromise of a portion of our unclassified networks could be just as devastating as a breach of classified security. The Pentagon got the message and the policy was changed quickly.

What do you think? Discuss Schwartau on outsourcing.

The second harm is that if you take a bunch of unclassified data and piece it together in the right way, like a jigsaw puzzle, the resulting information could be immensely valuable to a potential adversary. This is why so many organizations are sensitive to dumpster diving and other techniques that can divulge seemingly innocuous information to the public domain. Most of us try to protect company phone books, employee rosters and so on.

The question is, how much of your infrastructure operations and security-relevant processes do you want to outsource? While thinking about the United Arab Emirates/Dubai national security parallel and the natural follow-up - "Is our network protection any less important?" - these questions come to mind:

Do you want to outsource any of your critical IT operations? If so, how do you make the distinction between mission-critical and non-critical day-to-day operations?

If you outsource, how quickly can you bring full operations back to an internal function?