7 ms·

I am sick of seeing headlines about teenager hacker being put in jail. It's not because they are geniuses it's because of poor IT defense. The companies should

by vfxGer 10y ago

I am sick of seeing headlines about teenager hacker being put in jail. It's not because they are geniuses it's because of poor IT defense. The companies should be severely fined for criminal negligence.

mtgx 10y ago
And I get downvoted for saying self-driving car companies should be fined signficant amounts of money for both car accidents due to poor self-driving software capabilities but also for security breaches. What if it's "cheaper" for the car companies to let the cars crash than adopt stronger security? You may think that there's no way a recall would be worth it, but we're already seeing companies such as Tesla "fix" the issue over the air, and chances are most of the new self-driving cars will be fixed the same way, if not all. The only thing that would be left is the "bad PR", which may be much smaller in the future, because there won't be any recalls. If only 2 people die, and then all cars are fixed, the outrage just won't be as big as when 100 people die due to a brake malfunction, and then 5 million cars have to be recalled, impacting 5 million people (as opposed to only the families of those two in the former example) that would then personally spread the bad news. Also the "bad PR" doesn't seem to affect tech companies, or even retailers, or banks, all that much, so I doubt it would affect car companies that much more in the future (for the reasons I mentioned above).
- nickpsecurity 10y ago
  You looked at PR and outrage but not a major cost: class-action lawsuits. It's what made Pinto risk assessment so wrong.
raverbashing 10y ago
Which teenager hackers? Yes, if the IT defenses are poor and they get in fair enough, another one is if they get the password list and shop around You're saying like it's ok to rob the house with only one lock as opposed to the one with several locks and security cameras
- codedokode 10y ago
  Hacking is not the same as robbing. Hacker doesn't take anything away from you, except some reputation.
  - coldcode 10y ago
    Money, lost business, customer data are valuable things and hardly nothing.
  - raverbashing 10y ago
    If they're taking password from users (and maybe even other data like Credit Card numbers - regardless of the security failures of the site), they are taking something from you Blaming the victim is easy.
  - jazzyb 10y ago
    I don't understand the point your trying to make. In most recent high-profile hacking cases, hackers stole customer information (including credit card numbers) from the businesses. The financial fall-out for those customers could be much worse than a physical robbery.
    - codedokode 10y ago
      Stealing money can be robbing, I agree. But (this is unrelated matter) why is it possible to steal someone's money just by copying several short numbers? We have all kinds of advanced cryptography today but some payment systems still rely on transistor era technologies. And even worse, companies can track customers using CC numbers. That is wrong too. The shop should not get your name or other unique identifier when you just buy something with a card.
      - M_Grey 10y ago
        They didn't steal money, they stole information which could be used to get money. What you're saying is equivalent to, "They stole the design for our car's master ignition key, but since they didn't steal an actual key or a car, no harm no foul." It's not the same as stealing a car, but it's also clearly about stealing cars.
saiya-jin 10y ago
I get what you mean, but poor defense ain't no excuse to hack the hell out of company, neither legally nor morally. plus i don't buy the notion that some teenager had no clue what he was doing would harm other's livehood (if yes, then he should go through psychiatric evaluation). if I don't put 3m electric fence with automatic sentry guns around my whole hypothetical house and land, does it mean everybody is automatically invited to freely try to break in, do damage, steal my stuff or post my private and legal data online for others? state should have better use for these guys, but there should definitely be punishment, not reward in any way. that's how all countries run these days
- arobertson 10y ago
  I don't think the house analogy works. You don't keep other peoples stuff at your house. If you ran a storage warehouse, I'm pretty sure your customers would expect you to have adequate security. If a customer came in through the back door of my warehouse, and told me the lock doesn't work, I wouldn't punish him. I would fix the lock.
  - ctrl-j 10y ago
    > If a customer came in through the back door of my warehouse, and told me the lock doesn't work, I wouldn't punish him. I would fix the lock. And if that same customer smashed a bunch of stuff, vandalized the walls, and stole product that was being stored in the warehouse - you'd prosecute the hell out of him... and then fix the lock.
- cmdrfred 10y ago
  Indeed but if you don't build a fence around your swimming pool and a child wanders over and drowns that is often on you. I'd like to see some fines for negligence in examples like this. Both the attacker and the victim are at fault in my opinion.
- thr0waway1239 10y ago
  I am not sure the analogy is very accurate. You do not advertise your house as a place where other people can come and freely store their valuables and then take it out as they please. If you did, there is a name for what you have built: a bank. And you can be pretty sure people then will not have any issues with whatever security measures you take. Most of all, your cost of security installation is now covered by other people's money, which effectively gives you very precise calculations on what exactly you can and cannot spend. You are more than free to return the money and shut down shop if you feel you are in a completely unsafe neighborhood which makes your bank impossible to run at a profit. To stretch this point a little further, imagine you did have a bank, and your customer comes and demands to take their money out, and you say "Oops. I had just left it out here on this desk, and when I went to pee, a kid just came in and ran out with all your money. I feel bad for you, but the cost of moving the stuff back and forth between front desk and the vault would make the service unprofitable. Its not my fault, its all these children in the neighborhood who keep pranking me". The lowered barriers to hacking, combined with an ever moving target for what constitutes good security, are genuine concerns. But as a company, you are expected to shoulder the burden of security as a precondition of making the claim that you provide a good service. One way or another, people actually pay you to take care of their data as part of the service.
SCdF 10y ago
Why not both?
M_Grey 10y ago
All that needs to happen is for a court to define poor IT security as an "Attractive Nuisance", and just generally make companies liable for their customer's information (and more broadly if possible).
- TheCoelacanth 10y ago
  Doesn't the attractive nuisance doctrine only apply to children?
  - M_Grey 10y ago
    Yes, but then, the discussion was about "teenage hackers". More broadly though, I was just trying to get the idea across using an existing bit of common law.
taneq 10y ago
You wouldn't say the same about a deadbeat teenager who smashes a car window and grabs someone's purse. "It's not because they're criminal masterminds, it's because of poor car defense." Locks, physical and mathematical, are for the deterrence and convenience of the generally honest. Law enforcement, as an active defense, is for the deterrence of the actively attacking. At some point you're always going to have to stop turtling and build an army.
wil421 10y ago
It's not illegal to have crappy IT but it is illegal to hack or exploit a companies computer systems. Just because there isn't a fense around an area that says no trespassing doesn't make it legal to walk through. "But they didn't have a fense and it was easy to walk into the area."
a3n 10y ago
An uncovered and unlocked hot tub in the back yard can be seen as an "attractive nuisance." Sure, the kid trespassed by climbing over the fence, but he wouldn't have drowned if the thing had been secured. Sure, the hacker broke the law by hacking in, but I wouldn't have had my PII stolen if the thing had been secured.

by vfxGer 10y ago

mtgx 10y ago

And I get downvoted for saying self-driving car companies should be fined signficant amounts of money for both car accidents due to poor self-driving software capabilities but also for security breaches. What if it's "cheaper" for the car companies to let the cars crash than adopt stronger security? You may think that there's no way a recall would be worth it, but we're already seeing companies such as Tesla "fix" the issue over the air, and chances are most of the new self-driving cars will be fixed the same way, if not all. The only thing that would be left is the "bad PR", which may be much smaller in the future, because there won't be any recalls. If only 2 people die, and then all cars are fixed, the outrage just won't be as big as when 100 people die due to a brake malfunction, and then 5 million cars have to be recalled, impacting 5 million people (as opposed to only the families of those two in the former example) that would then personally spread the bad news. Also the "bad PR" doesn't seem to affect tech companies, or even retailers, or banks, all that much, so I doubt it would affect car companies that much more in the future (for the reasons I mentioned above).

nickpsecurity 10y ago
You looked at PR and outrage but not a major cost: class-action lawsuits. It's what made Pinto risk assessment so wrong.

raverbashing 10y ago

Which teenager hackers? Yes, if the IT defenses are poor and they get in fair enough, another one is if they get the password list and shop around You're saying like it's ok to rob the house with only one lock as opposed to the one with several locks and security cameras

codedokode 10y ago
Hacking is not the same as robbing. Hacker doesn't take anything away from you, except some reputation.
- coldcode 10y ago
  Money, lost business, customer data are valuable things and hardly nothing.
- raverbashing 10y ago
  If they're taking password from users (and maybe even other data like Credit Card numbers - regardless of the security failures of the site), they are taking something from you Blaming the victim is easy.
- jazzyb 10y ago
  I don't understand the point your trying to make. In most recent high-profile hacking cases, hackers stole customer information (including credit card numbers) from the businesses. The financial fall-out for those customers could be much worse than a physical robbery.
  - codedokode 10y ago
    Stealing money can be robbing, I agree. But (this is unrelated matter) why is it possible to steal someone's money just by copying several short numbers? We have all kinds of advanced cryptography today but some payment systems still rely on transistor era technologies. And even worse, companies can track customers using CC numbers. That is wrong too. The shop should not get your name or other unique identifier when you just buy something with a card.
    - M_Grey 10y ago
      They didn't steal money, they stole information which could be used to get money. What you're saying is equivalent to, "They stole the design for our car's master ignition key, but since they didn't steal an actual key or a car, no harm no foul." It's not the same as stealing a car, but it's also clearly about stealing cars.

saiya-jin 10y ago

I get what you mean, but poor defense ain't no excuse to hack the hell out of company, neither legally nor morally. plus i don't buy the notion that some teenager had no clue what he was doing would harm other's livehood (if yes, then he should go through psychiatric evaluation). if I don't put 3m electric fence with automatic sentry guns around my whole hypothetical house and land, does it mean everybody is automatically invited to freely try to break in, do damage, steal my stuff or post my private and legal data online for others? state should have better use for these guys, but there should definitely be punishment, not reward in any way. that's how all countries run these days

arobertson 10y ago
I don't think the house analogy works. You don't keep other peoples stuff at your house. If you ran a storage warehouse, I'm pretty sure your customers would expect you to have adequate security. If a customer came in through the back door of my warehouse, and told me the lock doesn't work, I wouldn't punish him. I would fix the lock.
- ctrl-j 10y ago
  > If a customer came in through the back door of my warehouse, and told me the lock doesn't work, I wouldn't punish him. I would fix the lock. And if that same customer smashed a bunch of stuff, vandalized the walls, and stole product that was being stored in the warehouse - you'd prosecute the hell out of him... and then fix the lock.
cmdrfred 10y ago
Indeed but if you don't build a fence around your swimming pool and a child wanders over and drowns that is often on you. I'd like to see some fines for negligence in examples like this. Both the attacker and the victim are at fault in my opinion.
thr0waway1239 10y ago
I am not sure the analogy is very accurate. You do not advertise your house as a place where other people can come and freely store their valuables and then take it out as they please. If you did, there is a name for what you have built: a bank. And you can be pretty sure people then will not have any issues with whatever security measures you take. Most of all, your cost of security installation is now covered by other people's money, which effectively gives you very precise calculations on what exactly you can and cannot spend. You are more than free to return the money and shut down shop if you feel you are in a completely unsafe neighborhood which makes your bank impossible to run at a profit. To stretch this point a little further, imagine you did have a bank, and your customer comes and demands to take their money out, and you say "Oops. I had just left it out here on this desk, and when I went to pee, a kid just came in and ran out with all your money. I feel bad for you, but the cost of moving the stuff back and forth between front desk and the vault would make the service unprofitable. Its not my fault, its all these children in the neighborhood who keep pranking me". The lowered barriers to hacking, combined with an ever moving target for what constitutes good security, are genuine concerns. But as a company, you are expected to shoulder the burden of security as a precondition of making the claim that you provide a good service. One way or another, people actually pay you to take care of their data as part of the service.

SCdF 10y ago

Why not both?

M_Grey 10y ago

All that needs to happen is for a court to define poor IT security as an "Attractive Nuisance", and just generally make companies liable for their customer's information (and more broadly if possible).

TheCoelacanth 10y ago
Doesn't the attractive nuisance doctrine only apply to children?
- M_Grey 10y ago
  Yes, but then, the discussion was about "teenage hackers". More broadly though, I was just trying to get the idea across using an existing bit of common law.

taneq 10y ago

You wouldn't say the same about a deadbeat teenager who smashes a car window and grabs someone's purse. "It's not because they're criminal masterminds, it's because of poor car defense." Locks, physical and mathematical, are for the deterrence and convenience of the generally honest. Law enforcement, as an active defense, is for the deterrence of the actively attacking. At some point you're always going to have to stop turtling and build an army.

wil421 10y ago

It's not illegal to have crappy IT but it is illegal to hack or exploit a companies computer systems. Just because there isn't a fense around an area that says no trespassing doesn't make it legal to walk through. "But they didn't have a fense and it was easy to walk into the area."

a3n 10y ago

An uncovered and unlocked hot tub in the back yard can be seen as an "attractive nuisance." Sure, the kid trespassed by climbing over the fence, but he wouldn't have drowned if the thing had been secured. Sure, the hacker broke the law by hacking in, but I wouldn't have had my PII stolen if the thing had been secured.