4 ms·

Is anyone being punished for all of the massive security breaches which appear to be happening on a nearly daily basis?

g051051 9y ago
Well, they try to find and convict the hackers, of course. Or did you mean the companies like Equifax, or Target, or Home Depot that are the victims of the break-ins?
- ceejayoz 9y ago
  In some of these cases, the victims have been negligent with the data entrusted to them by consumers, who are themselves victims.
- cjhanks 9y ago
  I mean the companies like Equifax. Is there nothing illegal about being careless enough to leak this much important information to hackers? I personally think they should be held accountable.
  - g051051 9y ago
    Accountable for what? That they're a target for hackers, who managed to break into their network? How is that careless? There's no such thing as perfect security.
    - Nelson69 9y ago
      This case seems a little different in that it's pretty difficult to not have your personal information in their system. You roll in to Target or Home Depot, you decide to pay with a check, card or cash. You decide to give them your information or not. You decide if you want to go back after they mismanage your information. Can you opt out of Equifax's business and still get credit or loans? Can you even opt out at all?
      - g051051 9y ago
        You're assuming mismanagement...but there's simply no way to guarantee perfect computer security.
  - bodz 9y ago
    Putting aside the whole "punishing the victim" argument, the problem is that it's excruciatingly hard to draw a line between "being careless" and "you did everything right but it still wasn't enough", and thus it's really hard to punish someone for cybersecurity mistakes. I work in cybersec consulting, and it's certainly true that a large number of companies are simply not investing enough money/time/effort into cybersecurity protections, and are thus doing a disservice to their customers. However, there are also plenty of companies that spend hundreds of millions of dollars, with massive cybersec departments devoted to protecting from breaches like this, doing pretty much everything they possibly can right, and they will still be hacked. Cybersecurity is incredibly difficult, incredibly expensive, and takes a really long time. And even if you get 99.999999% of your company completely impervious to attackers, it only takes that 0.0000001% of exposure to sink your ship. Cybersec is also constantly evolving, so it's nearly impossible to keep up with the latest attack vectors, etc. Take the Target breach, for example: Target has a massive effort focused on cybersecurity. They actually have a cybersec research lab that some law enforcement agencies go to for help with cybersec issues. But the attack that hit them took them totally by surprise simply because it was a type of attack that hadn't really been considered, and thus was very very low on the radar (if there at all) when it came to protecting against it. Now, companies in the US actually are held accountable (to an extent). Data breaches that result in HIPAA violations, for example, usually result in massive fines for companies. Violations of PCI-DSS will land you in hot water with the major payment card companies. Some states also have cybersec regulations that result in fines if you're found to be in violation of them during an audit. The problem, again, is that cybersec is constantly evolving and these regulations are years behind. The HIPAA cybersec requirements are actually pretty laughable, partly because of all the reasons listed above.
    - yborg 9y ago
      >and thus it's really hard to punish someone for cybersecurity mistakes No. If you take it upon yourself to hold this information, you are accepting the responsibility for its disclosure. If you are not willing to accept penalty for this happening despite your best efforts, you should not be doing it.
      - 9y ago
- wavefunction 9y ago
  They may have meant the actual victims, in this case 146,000,00 Americans.
  - g051051 9y ago
    Why do you think Equifax (or Home Depot, or Target) is any less of a victim here?
    - scarmig 9y ago
      I leave my home with a house sitter. The house sitter throws a kegger, and his guests cause six figures worth of property damage, including stealing the house sitter's laptop. Who are all the criminal parties here?
      - deleted 9y ago
        [deleted]
      - g051051 9y ago
        So you're saying that companies that get hacked are "asking for it", or are complicit in the criminal activity? That's an incredibly broad stretch.
        liberte82 9y ago
        Yes, because they're too lazy or it cuts into their profits too much to implement correct security.
cm2187 9y ago
It's like the financial crisis. Crass incompetence isn't a criminal offense.
jkchu 9y ago
This is a great point. Without heavy fines and penalties, it seems many companies are happy to be lax on security just quietly become another "victim" company. They just need their breach to smaller than Yahoo's (which is easy for most companies).
ericd 9y ago
I'm not a lawyer, and I don't know if what they've done violated the FCRA (Fair Credit Reporting Act). That said, doing a bit of research, if they've violated the FCRA knowingly, they're liable for actual damages, plus no more than $1,000 per incident, but also no less than $100 per incident. If it's just inadvertent negligence, then they're only liable for actual damages. So, assuming each person whose info was compromised is a separate incident, willfully negligent violation could result in up to a company-shattering $143B fine, but no less than $14.3B on the low end. I imagine that that even the lower figure would be hard for them to absorb as well. I have to imagine that class action lawyers all over the country are licking their lips, if there's an opening via FCRA. I'm not sure what the FCRA says about PII data security practices, though - it might just be having processes in place and the like.

Well, they try to find and convict the hackers, of course. Or did you mean the companies like Equifax, or Target, or Home Depot that are the victims of the break-ins?

ceejayoz 9y ago
In some of these cases, the victims have been negligent with the data entrusted to them by consumers, who are themselves victims.
cjhanks 9y ago
I mean the companies like Equifax. Is there nothing illegal about being careless enough to leak this much important information to hackers? I personally think they should be held accountable.
- g051051 9y ago
  Accountable for what? That they're a target for hackers, who managed to break into their network? How is that careless? There's no such thing as perfect security.
  - Nelson69 9y ago
    This case seems a little different in that it's pretty difficult to not have your personal information in their system. You roll in to Target or Home Depot, you decide to pay with a check, card or cash. You decide to give them your information or not. You decide if you want to go back after they mismanage your information. Can you opt out of Equifax's business and still get credit or loans? Can you even opt out at all?
    - g051051 9y ago
      You're assuming mismanagement...but there's simply no way to guarantee perfect computer security.
- bodz 9y ago
  Putting aside the whole "punishing the victim" argument, the problem is that it's excruciatingly hard to draw a line between "being careless" and "you did everything right but it still wasn't enough", and thus it's really hard to punish someone for cybersecurity mistakes. I work in cybersec consulting, and it's certainly true that a large number of companies are simply not investing enough money/time/effort into cybersecurity protections, and are thus doing a disservice to their customers. However, there are also plenty of companies that spend hundreds of millions of dollars, with massive cybersec departments devoted to protecting from breaches like this, doing pretty much everything they possibly can right, and they will still be hacked. Cybersecurity is incredibly difficult, incredibly expensive, and takes a really long time. And even if you get 99.999999% of your company completely impervious to attackers, it only takes that 0.0000001% of exposure to sink your ship. Cybersec is also constantly evolving, so it's nearly impossible to keep up with the latest attack vectors, etc. Take the Target breach, for example: Target has a massive effort focused on cybersecurity. They actually have a cybersec research lab that some law enforcement agencies go to for help with cybersec issues. But the attack that hit them took them totally by surprise simply because it was a type of attack that hadn't really been considered, and thus was very very low on the radar (if there at all) when it came to protecting against it. Now, companies in the US actually are held accountable (to an extent). Data breaches that result in HIPAA violations, for example, usually result in massive fines for companies. Violations of PCI-DSS will land you in hot water with the major payment card companies. Some states also have cybersec regulations that result in fines if you're found to be in violation of them during an audit. The problem, again, is that cybersec is constantly evolving and these regulations are years behind. The HIPAA cybersec requirements are actually pretty laughable, partly because of all the reasons listed above.
  - yborg 9y ago
    >and thus it's really hard to punish someone for cybersecurity mistakes No. If you take it upon yourself to hold this information, you are accepting the responsibility for its disclosure. If you are not willing to accept penalty for this happening despite your best efforts, you should not be doing it.
    - 9y ago
wavefunction 9y ago
They may have meant the actual victims, in this case 146,000,00 Americans.
- g051051 9y ago
  Why do you think Equifax (or Home Depot, or Target) is any less of a victim here?
  - scarmig 9y ago
    I leave my home with a house sitter. The house sitter throws a kegger, and his guests cause six figures worth of property damage, including stealing the house sitter's laptop. Who are all the criminal parties here?
    - deleted 9y ago
      [deleted]
    - g051051 9y ago
      So you're saying that companies that get hacked are "asking for it", or are complicit in the criminal activity? That's an incredibly broad stretch.
      - liberte82 9y ago
        Yes, because they're too lazy or it cuts into their profits too much to implement correct security.

cm2187 9y ago

It's like the financial crisis. Crass incompetence isn't a criminal offense.

jkchu 9y ago

This is a great point. Without heavy fines and penalties, it seems many companies are happy to be lax on security just quietly become another "victim" company. They just need their breach to smaller than Yahoo's (which is easy for most companies).

ericd 9y ago

I'm not a lawyer, and I don't know if what they've done violated the FCRA (Fair Credit Reporting Act). That said, doing a bit of research, if they've violated the FCRA knowingly, they're liable for actual damages, plus no more than $1,000 per incident, but also no less than $100 per incident. If it's just inadvertent negligence, then they're only liable for actual damages. So, assuming each person whose info was compromised is a separate incident, willfully negligent violation could result in up to a company-shattering $143B fine, but no less than $14.3B on the low end. I imagine that that even the lower figure would be hard for them to absorb as well. I have to imagine that class action lawyers all over the country are licking their lips, if there's an opening via FCRA. I'm not sure what the FCRA says about PII data security practices, though - it might just be having processes in place and the like.