4 ms·

Here is a section from the article I found interesting: "Some worry that any insight into what could be the world’s largest repository of securities transactio

Here is a section from the article I found interesting: "Some worry that any insight into what could be the world’s largest repository of securities transactions will provide ways for either company to profit beyond cloud services....It’s also specified in the CAT proposal that whoever wins the bid must ensure the security and confidentiality of the data, and agree to use it only for appropriate surveillance and regulatory activities." How will they actually enforce such clauses? Who is going to monitor what goes on inside these big corporations? And why not initiate a sort of private-public partnership to form an independent entity dedicated solely for this purpose if there is such a desperate need? If Wall Street was too big to fail during the last recession, does it not mean that now Amazon and Google are also going to be conferred with the same blessing once they become the repository of such information, especially if there really isn't any simple way to enforce these clauses? So two of the biggest tech companies are now becoming candidates for bailouts - so the threat they pose with the data they already possess is not enough for people? Would love to hear thoughts from the folks who are already working in fintech who might be more familiar with the enforcement of such clauses.

danblick 10y ago
I don't have direct experience to answer your question, but I think perhaps audits are part of the answer. Really, you can go a long way by asking "who has access to the system storing the data", "what is the policy for granting and revoking that access", "what are the policies for handling the data (to avoid leaking it)"? I've worked at big tech companies but never come across a customer credit card number because there are policies for handling that data and audits to make sure they are obeyed. I think basic checks will go a long way. (Granted, you're talking about a situation in which a company would have an incentive to subvert the controls on data; that's not really the case for credit card data.)
- thr0waway1239 10y ago
  I would expect as much. But in these cases, would the auditors be expected to make their findings public? My understanding is, the typical audit is stakeholder driven. For an audit of Google and Amazon's data handling policies in these kind of scenarios, who is the stakeholder?

danblick 10y ago

I don't have direct experience to answer your question, but I think perhaps audits are part of the answer. Really, you can go a long way by asking "who has access to the system storing the data", "what is the policy for granting and revoking that access", "what are the policies for handling the data (to avoid leaking it)"? I've worked at big tech companies but never come across a customer credit card number because there are policies for handling that data and audits to make sure they are obeyed. I think basic checks will go a long way. (Granted, you're talking about a situation in which a company would have an incentive to subvert the controls on data; that's not really the case for credit card data.)

thr0waway1239 10y ago
I would expect as much. But in these cases, would the auditors be expected to make their findings public? My understanding is, the typical audit is stakeholder driven. For an audit of Google and Amazon's data handling policies in these kind of scenarios, who is the stakeholder?