American high-voltage electro-shock stun shields turned up in Turkey, stun guns in Indonesia, and electro-shock batons and shields, and dart-firing taser guns in torture-prone Saudi Arabia. American firms are dominant manufacturers of stun belts. Explains Dennis Kaufman, President of Stun Tech Inc, a US manufacturer of this innovation: ''Electricity speaks every language known to man. No translation necessary. Everybody is afraid of electricity, and rightfully so.'' (Quoted by Amnesty International).

The Omega Foundation and Amnesty claim that 49 US companies are also major suppliers of mechanical restraints, including leg-irons and thumbcuffs. But they are not alone. Other suppliers are found in Germany (8), France (5), China (3), Taiwan (3), South Africa (2), Spain (2), UK (2) and South Korea (1).

Not surprisingly, Commerce Department doesn't keep tab on this category of exports.

Nor is money sloshing around negligible. Records kept under export control commodity number A985 show that Saudi Arabia alone spent in United States more than $1 million a year between 1997-2000 merely on stun guns. Venezuela's bill for shock batons and such reached $3.7 million in same period. Other clients included Hong Kong, Taiwan, Mexico and - surprisingly - Bulgaria. Egypt's notoriously brutal services - already well-equipped - spent a mere $40,000.

The United States is not only culprit. The European Commission, according to an Amnesty International report titled "Stopping Torture Trade" and published in 2001:

"Gave a quality award to a Taiwanese electro-shock baton, but when challenged could not cite evidence as to independent safety tests for such a baton or whether member states of European Union (EU) had been consulted. Most EU states have banned use of such weapons at home, but French and German companies are still allowed to supply them to other countries."

Torture expertise is widely proffered by former soldiers, agents of security services made redundant, retired policemen and even rogue medical doctors. China, Israel, South Africa, France, Russia, United kingdom and United States are founts of such useful knowledge and its propagators.

How rooted torture is was revealed in September 1996 when US Department of Defense admitted that ''intelligence training manuals'' were used in Federally sponsored School of Americas - one of 150 such facilities - between 1982 and 1991.The manuals, written in Spanish and used to train thousands of Latin American security agents, "advocated execution, torture, beatings and blackmail", says Amnesty International.

Where there is demand there is supply. Rather than ignore discomfiting subject, governments would do well to legalize and supervise it. Alan Dershowitz, a prominent American criminal defense attorney, proposed, in an op-ed article in Los Angeles Times, published November 8, 2001, to legalize torture in extreme cases and to have judges issue "torture warrants". This may be a radical departure from human rights tradition of civilized world. But dispensing export carefully reviewed licenses for dual-use implements is a different matter altogether - and long overdue.

Management must not only support security measures, they must also provide a written and enforced policy statement. These written policies should be developed with assistance from I.T., human resource and legal departments. Written policies should be a part of employee’s introduction to company and should be reviewed at least twice a year. It is also critical that employee sign off on document indicating that they received, read, and understood its contents. Firms that ignore these practices do so at their own risk.

Enforcement is an important partner to training. A policy that is not enforced is far worse than no policy at all. In fact, haphazard enforcement or lack of enforcement can increase a company’s liability in many legal actions. To work, a policy must have “teeth”. There should be a range of consequences for lapses whether it is a single event, multiple or flagrant incidents. This can range from a verbal warning to termination or even notification of law enforcement.

In summary, passwords can be kept more secure by recognizing human factor. Through management initiative, communication and training, as well as written, enforced policies and procedures, companies can have more control over their information assets and keep their clients and partners much safer.