4 ms·

>You can't blame a "careless programmer" when the real problem is organizations simply not committing any resources to security. How have you established that

by ksk 9y ago

>You can't blame a "careless programmer" when the real problem is organizations simply not committing any resources to security. How have you established that they didn't have a sufficient number of experts? What if they purchased a product or service and it simply didn't work? Its rather harsh to point fingers without having all of the information. >We'll keep seeing things like this until our laws are such that stewards of data like these have some sort of incentive to protect them. I think we need to give companies appliance-like products with a simple set of instructions that anyone can follow. Even a simple change where the data is stored in a 'vault' that requires the use of special tools with built in access controls and auditing would prevent a lot of data breaches. This means you cant email files around or share them on google docs or whatever. I'm convinced that people will do the right thing if you make it easy enough for them.

anigbrowl 9y ago
I'm really impressed at the lengths people will go to defend those whose malfeasance or ineptitude unarguably worsen the lives of up to two hundred million people. You seem like a smart person, please tell me how you think it's OK that these folks' contact details and potentially very detailed psychological and political profile information are now likely available on the dark web? Given that this data was collected for explicitly political purposes with the specific goal of shaping voting behavior - one of the few things in American life where privacy is considered sacrosanct - surely you don't need me to point out the potential for manipulation, exploitation, and intimidation that become available to bad actors in possession of this data. Are you familiar with the concept of 'strict liability'? Do you have any policy reason why such a standard shouldn't apply in cases like this?
- BinaryIdiot 9y ago
  > I'm really impressed at the lengths people will go to defend those whose malfeasance or ineptitude unarguably worsen the lives of up to two hundred million people. You seem like a smart person, please tell me how you think it's OK that these folks' contact details and potentially very detailed psychological and political profile information are now likely available on the dark web? So far I've seen people disagree with simply throwing them in jail and people who want more data (was is a screw up? even security people make mistakes. Did they not have appropriate resources? etc). I haven't seen anyone say this is OK in any way, shape or form. I see many reasonable discussions.
  - anigbrowl 9y ago
    We've been having reasonable discussions on these topics for many years. Discussions that never lead to decisions and actions are a sideshow. I'm calling for action - strong user-centric privacy protections with strict liability and significant personal and organization penalties for negligence, similar to the French model.
    - ksk 9y ago
      Criminalizing something doesn't mean you've "done something about it". It just means you've applied a traditionally flawed approach to fix a systemic problem that could be better handled through education, training and awareness. However, those things are much harder to do than to simply write something into the legal code without the public being any more prepared to deal with the situation.
      - anigbrowl 9y ago
        a systemic problem that could be better handled through education, training and awareness How's that been working out for you? This isn't a new problem. Where are those educational, training, and social awareness resources? What budgets have been allocated to them? What mechanisms put in place to monitor the effectiveness of the deployment? How many more years of theoretical discussions about ideal solutions should we have before acting, notwithstanding the possibility of error? If your cautious incrementalist approach is so great (and heaven knows I've spent many years thinking and advocating within that framework) why does the problem keep getting worse? How long and to what extent are you willing to wait for this informed public to manifest and (somehow) overcome all the countervailing forces that have economic and political interests in quite different outcomes? And why, I ask myself, did you respond to my positive proposal about "strong user-centric privacy protections with strict liability and significant personal and organization penalties for negligence" by ignoring it and instead knocking down a straw man of 'criminalization' that I took care to avoid? You don't want to be the person responsible for taking or advocating for a decision that might work out poorly, fine. But reiterating the reasons for your hesitancy achieves nothing.
- johnmarcus 9y ago
  Well, for one, you can legally obtain much more detailed information on a person from any background check application currently available. So, it's arguable this has really increased the likelihood of a future crime. "In criminal law, strict liability is liability for which mens rea (Latin for "guilty mind") does not have to be proven in relation to one or more elements comprising the actus reus (Latin for "guilty act") although intention, recklessness or knowledge may be required in relation to other elements of the offense." Proving recklessness is harder than you think. If data is leak because someone within a company with the appropriate level of access decides to sell out to the dark web, all the security in the world won't protect you. Should the CEO go to jail because an employee turned on the company? Heartbleed - you could have had 100 security professional on your team, and you still would have been vulnerable. Should every CEO on the planet go to jail? Security persons do make mistakes and leave keys in places they shouldn't, genuinely by accident. Whom is going to jail for this error? If you think you are sending the security personel to jail, well, we're going to have an exodus of people willing to call themselves security personel, because no one is paid enough to risk jail for a job. So, it's not a matter of defending ineptitude, it's a matter of recognizing the problem is complex and unless you can have clear boundries of what is punishible and what is not, your going to have a bad time enforcing anything that makes a difference. As a security person, I'm sure you know a policy without adequate enforcement is absolutely useless.
  - anigbrowl 9y ago
    That's all true, but continually talking about what a hard problem it is as a way to avoid settling on some harsh penalties (financial or custodial) for negligence of various types only perpetuates the problem. Courts can decide whether a harsh punishment should actually apply in any given case. But right now, no such punishments are even defined so there are no strong incentives to minimize negligence and restrict collection and distribution of that information. tl;dr penal incentives function like a sword of Damocles. As long as we're debating whether and what size of sword of sword to hang from a thread, Damocles has no reason to worry.
  - Retra 9y ago
    The hardest part of data processing is collecting it. If you can just grab already collated data for cheap, then it absolutely is more likely to be exploited.
- samstave 9y ago
  There are times when I disagree with you, but then there are times like this when I can't agree more. Now, with that said, I find this position slightly juxtaposed to the position you appeared to hold on the privacy of citizens when the Snowden leaks happened. Why would political preferences be more sacrosanct than other preferences or private predilections people hold... It would be great to define all the data-types a citizen can hold a position on and determine those which the government / entities can gain access to, and those which a citizen can expect privacy with... And have that as a simple checklist as opposed to hidden in lengthy language of laws?
  - anigbrowl 9y ago
    A good question indeed. I was not at all thrilled about eh Snowden leaks, but I had, and still have, some faith in the mechanisms of institutional governance, plus I viewed it in the context of strategic calculus. Being a Euro I personally favor very rigorous privacy protections, and think you should be able to know who has data on you, get detailed copies of it in some accessible format, and request its deletion. Public institutions that do have a custodial data function should be subject to increasing levels of accountability and their powers should not be unlimited. Now, since the US doesn't currently promulgate such strict data-gathering and retention standards in the public or private sector as I would like, it's a strategic reality that well-resourced actors like foreign governments can vacuum that up for their own ends, whether nefarious or merely curious. So I'm OK with the NSA collecting such data insofar as it seems irrational for the government to put itself at a disadvantage relative to everyone else in the private sector, in the same way that it would irrational for police officers to have fewer powers than regular people, as opposed to greater responsibility in the exercise of those powers. In short, if all that data on people can be legally bought or acquired, it'd be pretty stupid for the USA/NSA to be the only entity that didn't have a copy. I do heartily agree that data aggregation in both public and private sectors is way, way out of control, and I also agree that a checklist approach would be far preferable to yet more books of rules. I have some radical (but inchoate) technical approaches to this problem in mind, if you want to get in touch via gmail.

by ksk 9y ago

anigbrowl 9y ago

I'm really impressed at the lengths people will go to defend those whose malfeasance or ineptitude unarguably worsen the lives of up to two hundred million people. You seem like a smart person, please tell me how you think it's OK that these folks' contact details and potentially very detailed psychological and political profile information are now likely available on the dark web? Given that this data was collected for explicitly political purposes with the specific goal of shaping voting behavior - one of the few things in American life where privacy is considered sacrosanct - surely you don't need me to point out the potential for manipulation, exploitation, and intimidation that become available to bad actors in possession of this data. Are you familiar with the concept of 'strict liability'? Do you have any policy reason why such a standard shouldn't apply in cases like this?

BinaryIdiot 9y ago
> I'm really impressed at the lengths people will go to defend those whose malfeasance or ineptitude unarguably worsen the lives of up to two hundred million people. You seem like a smart person, please tell me how you think it's OK that these folks' contact details and potentially very detailed psychological and political profile information are now likely available on the dark web? So far I've seen people disagree with simply throwing them in jail and people who want more data (was is a screw up? even security people make mistakes. Did they not have appropriate resources? etc). I haven't seen anyone say this is OK in any way, shape or form. I see many reasonable discussions.
- anigbrowl 9y ago
  We've been having reasonable discussions on these topics for many years. Discussions that never lead to decisions and actions are a sideshow. I'm calling for action - strong user-centric privacy protections with strict liability and significant personal and organization penalties for negligence, similar to the French model.
  - ksk 9y ago
    Criminalizing something doesn't mean you've "done something about it". It just means you've applied a traditionally flawed approach to fix a systemic problem that could be better handled through education, training and awareness. However, those things are much harder to do than to simply write something into the legal code without the public being any more prepared to deal with the situation.
    - anigbrowl 9y ago
      a systemic problem that could be better handled through education, training and awareness How's that been working out for you? This isn't a new problem. Where are those educational, training, and social awareness resources? What budgets have been allocated to them? What mechanisms put in place to monitor the effectiveness of the deployment? How many more years of theoretical discussions about ideal solutions should we have before acting, notwithstanding the possibility of error? If your cautious incrementalist approach is so great (and heaven knows I've spent many years thinking and advocating within that framework) why does the problem keep getting worse? How long and to what extent are you willing to wait for this informed public to manifest and (somehow) overcome all the countervailing forces that have economic and political interests in quite different outcomes? And why, I ask myself, did you respond to my positive proposal about "strong user-centric privacy protections with strict liability and significant personal and organization penalties for negligence" by ignoring it and instead knocking down a straw man of 'criminalization' that I took care to avoid? You don't want to be the person responsible for taking or advocating for a decision that might work out poorly, fine. But reiterating the reasons for your hesitancy achieves nothing.
johnmarcus 9y ago
Well, for one, you can legally obtain much more detailed information on a person from any background check application currently available. So, it's arguable this has really increased the likelihood of a future crime. "In criminal law, strict liability is liability for which mens rea (Latin for "guilty mind") does not have to be proven in relation to one or more elements comprising the actus reus (Latin for "guilty act") although intention, recklessness or knowledge may be required in relation to other elements of the offense." Proving recklessness is harder than you think. If data is leak because someone within a company with the appropriate level of access decides to sell out to the dark web, all the security in the world won't protect you. Should the CEO go to jail because an employee turned on the company? Heartbleed - you could have had 100 security professional on your team, and you still would have been vulnerable. Should every CEO on the planet go to jail? Security persons do make mistakes and leave keys in places they shouldn't, genuinely by accident. Whom is going to jail for this error? If you think you are sending the security personel to jail, well, we're going to have an exodus of people willing to call themselves security personel, because no one is paid enough to risk jail for a job. So, it's not a matter of defending ineptitude, it's a matter of recognizing the problem is complex and unless you can have clear boundries of what is punishible and what is not, your going to have a bad time enforcing anything that makes a difference. As a security person, I'm sure you know a policy without adequate enforcement is absolutely useless.
- anigbrowl 9y ago
  That's all true, but continually talking about what a hard problem it is as a way to avoid settling on some harsh penalties (financial or custodial) for negligence of various types only perpetuates the problem. Courts can decide whether a harsh punishment should actually apply in any given case. But right now, no such punishments are even defined so there are no strong incentives to minimize negligence and restrict collection and distribution of that information. tl;dr penal incentives function like a sword of Damocles. As long as we're debating whether and what size of sword of sword to hang from a thread, Damocles has no reason to worry.
- Retra 9y ago
  The hardest part of data processing is collecting it. If you can just grab already collated data for cheap, then it absolutely is more likely to be exploited.
samstave 9y ago
There are times when I disagree with you, but then there are times like this when I can't agree more. Now, with that said, I find this position slightly juxtaposed to the position you appeared to hold on the privacy of citizens when the Snowden leaks happened. Why would political preferences be more sacrosanct than other preferences or private predilections people hold... It would be great to define all the data-types a citizen can hold a position on and determine those which the government / entities can gain access to, and those which a citizen can expect privacy with... And have that as a simple checklist as opposed to hidden in lengthy language of laws?
- anigbrowl 9y ago
  A good question indeed. I was not at all thrilled about eh Snowden leaks, but I had, and still have, some faith in the mechanisms of institutional governance, plus I viewed it in the context of strategic calculus. Being a Euro I personally favor very rigorous privacy protections, and think you should be able to know who has data on you, get detailed copies of it in some accessible format, and request its deletion. Public institutions that do have a custodial data function should be subject to increasing levels of accountability and their powers should not be unlimited. Now, since the US doesn't currently promulgate such strict data-gathering and retention standards in the public or private sector as I would like, it's a strategic reality that well-resourced actors like foreign governments can vacuum that up for their own ends, whether nefarious or merely curious. So I'm OK with the NSA collecting such data insofar as it seems irrational for the government to put itself at a disadvantage relative to everyone else in the private sector, in the same way that it would irrational for police officers to have fewer powers than regular people, as opposed to greater responsibility in the exercise of those powers. In short, if all that data on people can be legally bought or acquired, it'd be pretty stupid for the USA/NSA to be the only entity that didn't have a copy. I do heartily agree that data aggregation in both public and private sectors is way, way out of control, and I also agree that a checklist approach would be far preferable to yet more books of rules. I have some radical (but inchoate) technical approaches to this problem in mind, if you want to get in touch via gmail.