6 ms·

I've been saying for a long time. Companies that store sensitive information should be required to insure it. Want my SSN for some inane reason? 5 million^H^H^H

I've been saying for a long time. Companies that store sensitive information should be required to insure it. Want my SSN for some inane reason? 5 million^H^H^H^H^H^H^H^H^H 500k dollar insurance policy on each one. Seem excessive? Better buckle down on security or better yet not store extremely sensitive and damaging information for arbitrary reasons. There is literally zero reason or consequences for any company to care about security right now.

banned1 9y ago
Maybe it's better to enact legislation to stop using the SSN the way it's used today.
- chrisabrams 9y ago
  I think you and OP both hit valid points that should happen, but never will under government. However, on the blockchain...well that might just happen, but it won't be a government running the identity system.
  - pavel_lishin 9y ago
    What about on the cloud? Or on the world wide web? Or the information superhighway? Are those buzzwords too outdated?
    - emodendroket 9y ago
      Wow, sounds like a real paradigm shift.
    - BoiledCabbage 9y ago
      Yes and lets lose the ability to trace any and all criminal activity. Underground crime will love that - bring on the golden years!
      - pavel_lishin 9y ago
        I honestly can't tell if you're arguing for or against the blockchain here, but regardless, I think you've misunderstood my comment because I left off the /s tag.
  - superobserver 9y ago
    It is a mistake and perhaps Pollyanna-ish to believe a governmental entity has not and cannot exert control over a blockchain ledger system of any kind either by means of protocol or other methods. In any case, I find it highly unlikely blockchains will not be implemented by various governmental agencies. As a store of auditable data, they would certainly be more trustworthy than some papers filed away somewhere or in some given database.
    - emodendroket 9y ago
      Certainly a lot of banks seem to be interested, and if banks can find a use for them I can't see why not governments as well.
- anonymousiam 9y ago
  Do you mean something like the Privacy Act of 1974?
  - steego 9y ago
    Can you expand on how this law is supposed to help but doesn't?
    - anonymousiam 9y ago
      Sure. See: https://www.justice.gov/opcl/social-security-number-usage https://www.justice.gov/opcl/social-security-number-usage
      - steego 9y ago
        How is this law supposed to help with this situation? Summarize what you think this law is preventing in your words and we can compare it to what the law actually says.
- herewulf 9y ago
  The Social Security Administration could make everyone's SSN public[1] immediately and then we could watch the entire credit industry scramble. Probably not a good idea without a reasonable alternative already in place but I think a certain amount of grim satisfaction would be gained in seeing the issue forced. [1]: But unfortunately they may be constrained by the aforementioned Privacy Act of 1974.
YCode 9y ago
I suppose a proper government issued ID number that doesn't double as a password would also be useful.
_Codemonkeyism 9y ago
Making insurance obligatory also would force companies to implement proper security to drive insurance premiums down.
- metalliqaz 9y ago
  I really like this idea and I wish the government actually cared enough to try it. Too bad the current party in power has only one mandate: tear down everything the last guy accomplished.
  - ticviking 9y ago
    Honestly this kind of idea would appeal to the MAGA crowd.
- davis_m 9y ago
  Would it? I can imagine at least some companies would stop worrying about security since they are insured if something goes wrong.
  - nothrabannosir 9y ago
    That's when insurance companies make premiums depend on your security. E.g. (some (our)) home insurance premiums depend on the quality of your lock, etc. It's a case of let the market sort it out.
rabidonrails 9y ago
This isn't realistic. The cost would be astronomical for a 5MM insurance policy on each user. Further, no matter how seriously you take security there's always a chance, even if a minimal one, that a hack happens. So, for example, if you were a bank and had 100,000 members and you had their SSN's and were hacked you're talking about a possible $500B settlement. The bank wouldn't take out such a policy due to cost and no underwriter would grant it because it would put the company out of business.
- goialoq 9y ago
  insurance doesn't mean "pay out the max if anything happens", it means "cover damages up to limit"
jerf 9y ago
I understand the emotional appeal of overselling the problem, but you'd get much better response with a $50K insurance policy than an obviously absurd $5M. Even $50K is sort of generous and probably generally more towards the worst case end of identity theft than the average case. It is plainly obvious to everyone that when Bob the upstanding middle class guy is hit by identity theft that Bob may experience great loss of money and time from his point of view, but that identity theft was not the one thing standing between Bob and $5M. At scale $50K still adds up to a lot, and we'd probably have to cap it some other way too because at-scale breaches don't add up that far, because the system does in fact react to them. This particular breach would be a seven trillion dollar payout if we don't cap it, and the simple reality is that this breach, no matter how much pain it may eventually cause us, is not going to cause anywhere near seven trillion dollar's worth of damage to consumers, or the economy, or anything else. But $50K makes sense for isolated cases that don't get a coordinated response.
- yazan94 9y ago
  Not the person you replied to, but while I see your point, there should not be a cap to prevent companies from taking consumer trust for granted, especially at the scale and magnitude of companies that handle almost all American's information. If a person's SSN is pretty much a key to screwing that person's financial life up is not worth protecting correctly by these companies, these companies should be financially screwed too. In the current state, will Equifax be held liable for any identity theft that occurs from this breach?
  - jerf 9y ago
    I think we can probably all find a cap somewhere south of 1/3rd of the 2016 United States GDP for a single breach. I mean, really, once you get past the amount of assets that Apple holds, it's all the same penalty anyhow: Instant corporate bankruptcy. Arguing about whether we penalize a company trillions of dollars or quadrillions of dollars is not really an argument.
- goialoq 9y ago
  insuring for the "average case" defeats the entire purpose of insurance.
calvinbhai 9y ago
And similar to travel insurance, they'll make it an option you pay for. In fact, it's the best case scenario for the company, to make even more money by selling insurance for protecting the data you just gave them.
HillaryBriss 9y ago
if a hacker took my info how would I prove they got it from Equifax so I could get the insurance money? wouldn't disclosure of hacks (by Equifax) be strongly disincentivized with this scheme? wouldn't Equifax just lie to the public if they discovered a hack so that their insurance premiums stayed low? worse yet, would Equifax just eliminate security audits and stop looking for hacks altogether so they could plausibly claim their data was secure?
- mythrwy 9y ago
  Clear regulations with legal penalties and regular audits for companies that hold information like SSNs. Maybe this would lead to a rise in secure storage firms that actually do their job with this so small outfits like employers could continue to identify employees without having to actually have a SSN in the database.
  - HillaryBriss 9y ago
    > regular audits is the government going to do those? it doesn't seem to be able to do that sort of thing now. how will the government gain the resources, the capability?
    - mythrwy 9y ago
      The government inspects buildings, food, a number of things. Somewhat capably. For the record I'm not a big proponents of more government. But something needs to be done about companies irresponsibly holding personal information at this level.
      - HillaryBriss 9y ago
        i'm not against government regulations or government inspections, but it seems to me the government is mainly good at passing laws and regulations it cannot or will not enforce. i don't see the government doing a good job of regulation enforcement. sometimes it's corrupt (e.g. building inspection approvals in Los Angeles, where I live, have sometimes required side payments to the inspectors). sometimes it's underfunded. one source estimates that only 2% of imported food is inspected: http://www.nbcnews.com/id/44701433/ns/health-food_safety/t/flood-food-imported-us-only-percent-inspected/#.WbMS_K2ZOJU http://www.nbcnews.com/id/44701433/ns/health-food_safety/t/f...

banned1 9y ago

Maybe it's better to enact legislation to stop using the SSN the way it's used today.

chrisabrams 9y ago
I think you and OP both hit valid points that should happen, but never will under government. However, on the blockchain...well that might just happen, but it won't be a government running the identity system.
- pavel_lishin 9y ago
  What about on the cloud? Or on the world wide web? Or the information superhighway? Are those buzzwords too outdated?
  - emodendroket 9y ago
    Wow, sounds like a real paradigm shift.
  - BoiledCabbage 9y ago
    Yes and lets lose the ability to trace any and all criminal activity. Underground crime will love that - bring on the golden years!
    - pavel_lishin 9y ago
      I honestly can't tell if you're arguing for or against the blockchain here, but regardless, I think you've misunderstood my comment because I left off the /s tag.
- superobserver 9y ago
  It is a mistake and perhaps Pollyanna-ish to believe a governmental entity has not and cannot exert control over a blockchain ledger system of any kind either by means of protocol or other methods. In any case, I find it highly unlikely blockchains will not be implemented by various governmental agencies. As a store of auditable data, they would certainly be more trustworthy than some papers filed away somewhere or in some given database.
  - emodendroket 9y ago
    Certainly a lot of banks seem to be interested, and if banks can find a use for them I can't see why not governments as well.
anonymousiam 9y ago
Do you mean something like the Privacy Act of 1974?
- steego 9y ago
  Can you expand on how this law is supposed to help but doesn't?
  - anonymousiam 9y ago
    Sure. See: https://www.justice.gov/opcl/social-security-number-usage https://www.justice.gov/opcl/social-security-number-usage
    - steego 9y ago
      How is this law supposed to help with this situation? Summarize what you think this law is preventing in your words and we can compare it to what the law actually says.
herewulf 9y ago
The Social Security Administration could make everyone's SSN public[1] immediately and then we could watch the entire credit industry scramble. Probably not a good idea without a reasonable alternative already in place but I think a certain amount of grim satisfaction would be gained in seeing the issue forced. [1]: But unfortunately they may be constrained by the aforementioned Privacy Act of 1974.

YCode 9y ago

I suppose a proper government issued ID number that doesn't double as a password would also be useful.

_Codemonkeyism 9y ago

Making insurance obligatory also would force companies to implement proper security to drive insurance premiums down.

metalliqaz 9y ago
I really like this idea and I wish the government actually cared enough to try it. Too bad the current party in power has only one mandate: tear down everything the last guy accomplished.
- ticviking 9y ago
  Honestly this kind of idea would appeal to the MAGA crowd.
davis_m 9y ago
Would it? I can imagine at least some companies would stop worrying about security since they are insured if something goes wrong.
- nothrabannosir 9y ago
  That's when insurance companies make premiums depend on your security. E.g. (some (our)) home insurance premiums depend on the quality of your lock, etc. It's a case of let the market sort it out.

rabidonrails 9y ago

This isn't realistic. The cost would be astronomical for a 5MM insurance policy on each user. Further, no matter how seriously you take security there's always a chance, even if a minimal one, that a hack happens. So, for example, if you were a bank and had 100,000 members and you had their SSN's and were hacked you're talking about a possible $500B settlement. The bank wouldn't take out such a policy due to cost and no underwriter would grant it because it would put the company out of business.

goialoq 9y ago
insurance doesn't mean "pay out the max if anything happens", it means "cover damages up to limit"

jerf 9y ago

I understand the emotional appeal of overselling the problem, but you'd get much better response with a $50K insurance policy than an obviously absurd $5M. Even $50K is sort of generous and probably generally more towards the worst case end of identity theft than the average case. It is plainly obvious to everyone that when Bob the upstanding middle class guy is hit by identity theft that Bob may experience great loss of money and time from his point of view, but that identity theft was not the one thing standing between Bob and $5M. At scale $50K still adds up to a lot, and we'd probably have to cap it some other way too because at-scale breaches don't add up that far, because the system does in fact react to them. This particular breach would be a seven trillion dollar payout if we don't cap it, and the simple reality is that this breach, no matter how much pain it may eventually cause us, is not going to cause anywhere near seven trillion dollar's worth of damage to consumers, or the economy, or anything else. But $50K makes sense for isolated cases that don't get a coordinated response.

yazan94 9y ago
Not the person you replied to, but while I see your point, there should not be a cap to prevent companies from taking consumer trust for granted, especially at the scale and magnitude of companies that handle almost all American's information. If a person's SSN is pretty much a key to screwing that person's financial life up is not worth protecting correctly by these companies, these companies should be financially screwed too. In the current state, will Equifax be held liable for any identity theft that occurs from this breach?
- jerf 9y ago
  I think we can probably all find a cap somewhere south of 1/3rd of the 2016 United States GDP for a single breach. I mean, really, once you get past the amount of assets that Apple holds, it's all the same penalty anyhow: Instant corporate bankruptcy. Arguing about whether we penalize a company trillions of dollars or quadrillions of dollars is not really an argument.
goialoq 9y ago
insuring for the "average case" defeats the entire purpose of insurance.

calvinbhai 9y ago

And similar to travel insurance, they'll make it an option you pay for. In fact, it's the best case scenario for the company, to make even more money by selling insurance for protecting the data you just gave them.

HillaryBriss 9y ago

if a hacker took my info how would I prove they got it from Equifax so I could get the insurance money? wouldn't disclosure of hacks (by Equifax) be strongly disincentivized with this scheme? wouldn't Equifax just lie to the public if they discovered a hack so that their insurance premiums stayed low? worse yet, would Equifax just eliminate security audits and stop looking for hacks altogether so they could plausibly claim their data was secure?

mythrwy 9y ago
Clear regulations with legal penalties and regular audits for companies that hold information like SSNs. Maybe this would lead to a rise in secure storage firms that actually do their job with this so small outfits like employers could continue to identify employees without having to actually have a SSN in the database.
- HillaryBriss 9y ago
  > regular audits is the government going to do those? it doesn't seem to be able to do that sort of thing now. how will the government gain the resources, the capability?
  - mythrwy 9y ago
    The government inspects buildings, food, a number of things. Somewhat capably. For the record I'm not a big proponents of more government. But something needs to be done about companies irresponsibly holding personal information at this level.
    - HillaryBriss 9y ago
      i'm not against government regulations or government inspections, but it seems to me the government is mainly good at passing laws and regulations it cannot or will not enforce. i don't see the government doing a good job of regulation enforcement. sometimes it's corrupt (e.g. building inspection approvals in Los Angeles, where I live, have sometimes required side payments to the inspectors). sometimes it's underfunded. one source estimates that only 2% of imported food is inspected: http://www.nbcnews.com/id/44701433/ns/health-food_safety/t/flood-food-imported-us-only-percent-inspected/#.WbMS_K2ZOJU http://www.nbcnews.com/id/44701433/ns/health-food_safety/t/f...