Yeah. What's more, you can have all the physical security you want (biometrics, encryption, armed guards at the check points, background checks, urine samples, etc) but all that data is just sitting on a server somewhere guarded by a couple of admin passwords.