10 ms·

I will be blunt, and I am very incensed by this. My comments ... https://twitter.com/hpcjoe/status/906549917509980160 https://twitter.com/hpcjoe/status/906549

by hpcjoe 9y ago

I will be blunt, and I am very incensed by this. My comments ... https://twitter.com/hpcjoe/status/906549917509980160 https://twitter.com/hpcjoe/status/906549917509980160 This is an extinction level event for Equifax. They need to be disassembled, their stored data destroyed correctly and securely, their negligent officers charged. This isn't an accident. You don't surface 0.134 BILLION bits of PII without some sort of criminal level incompetence. Any organization that uses Equifax data in any decision making process needs to be held accountable, as there may have been earlier intrusions also undiscovered, that have altered. Which, if they then choose to use them in any decision process whatsoever, brings them liability for misuse of possibly tampered with data. I am quite serious when I say that Equifax should cease to exist as a result of this. All others should be audited for security, and audited hard. Again, not being hyperbolic. But quite direct, with appropriate levels of anger at Equifax.

programbreeding 9y ago
It's (unfortunately) far more likely that they'll simply re-brand as something else. For all intents and purposes, Equifax will cease to exist; except it will be exactly the same thing under a different name.
coliveira 9y ago
I agree completely. The only reason for this company to exist is to maintain the data that now is compromised. This company needs to be brought down as quickly as possible for everyone's safety, and the other two companies need to be seriously monitored.
cmurf 9y ago
The department of justice should break them. This is their job. But this is a government with a grifter at the top, so I have almost no confidence attorney general Sessions will investigate this seriously, let alone destroy the company. He very clearly enjoys targeting e.g. black people who smoke weed with incarceration, destroying their lives, than punishing Equifax's officers, board, or shareholders with destruction. I have more confidence in a handful of state attorneys general working on this effort.
latch 9y ago
Every generation is galvanized by serious injustices. But, it feels like we're far less effective at turning that anger into change; though maybe that's always how it feels at the time. I'm almost sure I once saw a quote from Bill Clinton's press secretary that said something like "We knew that if we could survive the first 5 days of a bad story, it would get dropped." That perspective solidified for me during the Occupy Movement. Granted, it lasted much longer than 5 days, but ultimately, what of it? The FBI didn't investigate the bankers, it investigated the protesters. You see it with Flint. You see it with Climate Change. I've always been politically apathetic. Moreso as a foreigner where I recognize that living in a foreign country is a privilege, not a right. Plus I'm a cynical person (not a healthy habit). Which means that whenever I hear about "boycotts", or "writing to your representative", or "held criminally responsible", or "..." I always think two things. First, that people are naïve, and second, what's it going to take to drive people to take un-ignorable action? Brave New World.
- lwyr 9y ago
  cynicism == obedience
  - anindha 9y ago
    Disagree. I think the examples in the grandparent comment are spot on. You can be cynical of the government and the regulators and still do something about it. If you are a landlord and running a credit check don't use Equifax. Maybe this will open the door for startup in the space.
- plandis 9y ago
  What can you do when the businesses own the lawmakers? Outside of violence I'm not sure exactly who has the power to get justice here. I honestly think that criminally they are going to get a slap on the wrist if anything. The majority of damages will come from civil suits.
  - pjc50 9y ago
    I do wonder if America will see some kind of Red Brigades armed political group in the coming decade. There's already an extensive armed rightwing political movement.
downandout 9y ago
So a few years back, Equifax bought a company I cofounded. They assisted my former business partner in diverting ~$13 million of the purchase proceeds that were supposed to go to me over to him. Then they helped stonewall the resulting litigation for years. While I am upset on behalf of all affected consumers, mere words cannot adequately express the unbridled joy that I experienced when I found out that they were likely, at a minimum, going to lose hundreds of millions (or more) over this. Having dealt with high level executives at the company, I can tell you that an event like this is wholly unsurprising given their nonchalant attitudes toward...pretty much everything. I absolutely hope you are right that this is an extinction level event for them. My admittedly biased opinion is that they are an irresponsible company with far too much power over peoples' lives, run by malevolent executives. The company should probably cease to exist, at least in its current form.
- sutble 9y ago
  Did they have a specific reason for screwing you over? It just seems like a lot of effort to go through on their part with no tangible benefit. Sorry if this is too personal a question.
  - downandout 9y ago
    It's a very long story, but my business partner was running everything by the time they came into the picture and so their allegiance was to him. We had a personal falling out and based upon that he became hellbent on ensuring I got nothing once it was clear that the acquisition was going to happen. It was easier and cheaper for Equifax to take the position they took. If I were a corporate lawyer, I likely would have given Equifax the same advice. That doesn't make it right though.
JaniceLeblanc 9y ago
> 0.134 BILLION So 134 Million then. I mean that's still an extreme amount of bits ofc. Just seems silly to use the "billion" signifier for something that is less than 1 billion. Likewise it'd be strange to call something "1000 milliunits" instead of just 1 unit. (Unless ofc milli happens to be the frame of reference for some obvious reason like "15 millunits of x is a deadly dose".)
- hpcjoe 9y ago
  This is stylistic. It's basically setting a scale factor for you, that this isn't a small breach, but a noticeable fraction of a billion. I could have written it as 1.34E+08 though fewer people would have understood this, though it would have been as correct. 134 Million is obviously "alot", though from a psychological perspective, the billion gets more attention than the million, even though the number isn't changing. Again, stylistic.
- dmlittle 9y ago
  He could have also said ~2% of the world's population.
whyenot 9y ago
This is an Enron-level event. Company executives need to lose their fortunes and some people probably should end up in jail.
hn_throwaway_99 9y ago
Just directing it at Equifax is much too narrow, though. At the very, very least some legislation should come out of this mandating that ALL credit bureaus should allow credit freezes, at any time, for free. The thing that really incenses me about this whole debacle is the system is designed to benefit from its own incompetence! All these "identity theft solutions" that the big credit bureaus provide are just a way to charge consumers more for a problem that the consumer had nothing to do with in the first place!
- tonyztan 9y ago
  North Carolina already mandates free online security freezes with all credit bureaus. Now if only we can get this passed nationwide... http://www.ncdoj.gov/freefreeze http://www.ncdoj.gov/freefreeze
pjc50 9y ago
This is a "too big to fail" event. Getting rid of or changing Equifax would disrupt too many other businesses, therefore any wrongdoing of theirs will be waived away and the costs pushed onto consumers. Equifax were already in the process of having the law rewritten in their favour by the Republican party, at least that might be derailed or delayed for a few years. https://www.americanbanker.com/news/equifax-breach-may-kill-repeal-of-cfpb-mandatory-arbitration-rule https://www.americanbanker.com/news/equifax-breach-may-kill-... There's some claims here about the history of Equifax as a form of legal redlining, but they're a bit hard to substantiate with simple googling: https://twitter.com/matthewstoller/status/906257077215133696 https://twitter.com/matthewstoller/status/906257077215133696
otakucode 9y ago
For more than a decade, a debate has been going on in the Communications of the ACM (as well as other places, thats just where I've read of it most often). You can't make charges of negligence stick against companies using technology. There are no 'standard practices' they are negligent of following. If they were building a bridge, they would hire licensed certified engineers, and they would be legally bound to give those engineers access to the tools needed to do their job, the time needed to do the job correctly, and even if the CEO wanted to push the project forward despite misgivings of the engineers over safety, he would be legally forbidden to do so (and criminally personally culpable if he did). The same is not true of software-driven systems. There are no licensed developers, no regulatory body determining what tools must be made available, no guarantee of primacy of technical engineering concerns over business management. If a software engineer says "it needs more testing" or even "there is a bug that will kill people" and the CEO says "ship it", it ships and the courts will do nothing. This was proven to be true even in cases where incompetent management results in bad software that gets people killed in the case against Toyota with their "unintended acceleration" due to a firmware bug that would have been caught immediately if the developers had static analysis tools. Companies fight against the establishment of any sort of standards because it would reduce their profit margins. Developers fight against the establishment of any sort of standards because it would raise the barrier to entry in the field and no matter who the standards body consists of, they will select standards which people disagree with, they will be reluctant and slow to change or update them, etc. Both sides are right. But the alternative is companies having free reign up to and including incompetence of the degree which gets people killed with no accountability. People are overall very bad at decisions between two scenarios with clear negatives on both sides. They feel entitled to a 'clean' option and are uncomfortable with saying "I embrace the negatives and accept the burden of working hard to try to minimize their harm in order to gain the benefits of this option." Accepting the negatives implies taking some responsibility for bringing them to fruition and no one wants to be responsible for that - even if the alternative is worse. Not every decision is easy.
mortenjorck 9y ago
While I certainly agree in spirit, Equifax is, as has been said elsewhere, unfortunately too big to fail. Too much infrastructure has been built around it. So, instead of dissolution, I propose two very reasonable remedies that I would consider the absolute minimum in concert with whatever fines and sanctions may be levied: 1. Credit freezes/unfreezes must be offered free in perpetuity. “They cost us money to perform” is not a remotely appropriate objection - offering this for free should be a basic cost of doing business in the credit reporting industry. 2. Affected individuals (everyone, basically) must be granted a minimum of 10 years of credit monitoring following the breach. One year is a free sample you get with a coupon code from a podcast. Furthermore, the service must not auto-renew at the end of the term: send users a security report and let them decide if they want to opt-in to continued monitoring after the term ends.
- otakucode 9y ago
  Why 10 years? I mean, I don't see how one could defend any term shorter than the term of the validity and danger of the information stolen. I won't get a new SSN in 10 years. I won't get a new name. All the information will persist and still be useful. I'm personally in a worse position as my information was part of the OPM breach years ago and even images of my fingerprints are in the wild. And I got 18 months of free credit monitoring out of it. When a charge of more than $100 is made on my credit card, I get a text message instantly. When I log into my banks web system, I get a text message instantly. I was able to set those things up. I don't see why it would be unreasonable to have a similar thing set up so that I could be alerted every single time my credit history is queried with information about who is querying it for what purpose, ideally with the ability to block it by replying to the text message.
  - edoceo 9y ago
    How do you get a text message when crims setup a new credit account in your name? That's what the 10yr monitoring is for?
0xcde4c3db 9y ago
Agreed. At this point, the only sensible thing to do is to assume that Equifax is -- and perhaps has been -- compromised indefinitely. If not by external agents, then by internal incompetence or malfeasance. They've not clearly demonstrated either the intention or the ability to handle this breach in a diligent, professional, ethically sound way. To me, that calls into serious question their ability to embody those qualities in their operations before the breach as well.

by hpcjoe 9y ago

programbreeding 9y ago

It's (unfortunately) far more likely that they'll simply re-brand as something else. For all intents and purposes, Equifax will cease to exist; except it will be exactly the same thing under a different name.

coliveira 9y ago

I agree completely. The only reason for this company to exist is to maintain the data that now is compromised. This company needs to be brought down as quickly as possible for everyone's safety, and the other two companies need to be seriously monitored.

cmurf 9y ago

The department of justice should break them. This is their job. But this is a government with a grifter at the top, so I have almost no confidence attorney general Sessions will investigate this seriously, let alone destroy the company. He very clearly enjoys targeting e.g. black people who smoke weed with incarceration, destroying their lives, than punishing Equifax's officers, board, or shareholders with destruction. I have more confidence in a handful of state attorneys general working on this effort.

latch 9y ago

Every generation is galvanized by serious injustices. But, it feels like we're far less effective at turning that anger into change; though maybe that's always how it feels at the time. I'm almost sure I once saw a quote from Bill Clinton's press secretary that said something like "We knew that if we could survive the first 5 days of a bad story, it would get dropped." That perspective solidified for me during the Occupy Movement. Granted, it lasted much longer than 5 days, but ultimately, what of it? The FBI didn't investigate the bankers, it investigated the protesters. You see it with Flint. You see it with Climate Change. I've always been politically apathetic. Moreso as a foreigner where I recognize that living in a foreign country is a privilege, not a right. Plus I'm a cynical person (not a healthy habit). Which means that whenever I hear about "boycotts", or "writing to your representative", or "held criminally responsible", or "..." I always think two things. First, that people are naïve, and second, what's it going to take to drive people to take un-ignorable action? Brave New World.

lwyr 9y ago
cynicism == obedience
- anindha 9y ago
  Disagree. I think the examples in the grandparent comment are spot on. You can be cynical of the government and the regulators and still do something about it. If you are a landlord and running a credit check don't use Equifax. Maybe this will open the door for startup in the space.
plandis 9y ago
What can you do when the businesses own the lawmakers? Outside of violence I'm not sure exactly who has the power to get justice here. I honestly think that criminally they are going to get a slap on the wrist if anything. The majority of damages will come from civil suits.
- pjc50 9y ago
  I do wonder if America will see some kind of Red Brigades armed political group in the coming decade. There's already an extensive armed rightwing political movement.

downandout 9y ago

So a few years back, Equifax bought a company I cofounded. They assisted my former business partner in diverting ~$13 million of the purchase proceeds that were supposed to go to me over to him. Then they helped stonewall the resulting litigation for years. While I am upset on behalf of all affected consumers, mere words cannot adequately express the unbridled joy that I experienced when I found out that they were likely, at a minimum, going to lose hundreds of millions (or more) over this. Having dealt with high level executives at the company, I can tell you that an event like this is wholly unsurprising given their nonchalant attitudes toward...pretty much everything. I absolutely hope you are right that this is an extinction level event for them. My admittedly biased opinion is that they are an irresponsible company with far too much power over peoples' lives, run by malevolent executives. The company should probably cease to exist, at least in its current form.

sutble 9y ago
Did they have a specific reason for screwing you over? It just seems like a lot of effort to go through on their part with no tangible benefit. Sorry if this is too personal a question.
- downandout 9y ago
  It's a very long story, but my business partner was running everything by the time they came into the picture and so their allegiance was to him. We had a personal falling out and based upon that he became hellbent on ensuring I got nothing once it was clear that the acquisition was going to happen. It was easier and cheaper for Equifax to take the position they took. If I were a corporate lawyer, I likely would have given Equifax the same advice. That doesn't make it right though.

JaniceLeblanc 9y ago

> 0.134 BILLION So 134 Million then. I mean that's still an extreme amount of bits ofc. Just seems silly to use the "billion" signifier for something that is less than 1 billion. Likewise it'd be strange to call something "1000 milliunits" instead of just 1 unit. (Unless ofc milli happens to be the frame of reference for some obvious reason like "15 millunits of x is a deadly dose".)

hpcjoe 9y ago
This is stylistic. It's basically setting a scale factor for you, that this isn't a small breach, but a noticeable fraction of a billion. I could have written it as 1.34E+08 though fewer people would have understood this, though it would have been as correct. 134 Million is obviously "alot", though from a psychological perspective, the billion gets more attention than the million, even though the number isn't changing. Again, stylistic.
dmlittle 9y ago
He could have also said ~2% of the world's population.

whyenot 9y ago

This is an Enron-level event. Company executives need to lose their fortunes and some people probably should end up in jail.

hn_throwaway_99 9y ago

Just directing it at Equifax is much too narrow, though. At the very, very least some legislation should come out of this mandating that ALL credit bureaus should allow credit freezes, at any time, for free. The thing that really incenses me about this whole debacle is the system is designed to benefit from its own incompetence! All these "identity theft solutions" that the big credit bureaus provide are just a way to charge consumers more for a problem that the consumer had nothing to do with in the first place!

tonyztan 9y ago
North Carolina already mandates free online security freezes with all credit bureaus. Now if only we can get this passed nationwide... http://www.ncdoj.gov/freefreeze http://www.ncdoj.gov/freefreeze

pjc50 9y ago

This is a "too big to fail" event. Getting rid of or changing Equifax would disrupt too many other businesses, therefore any wrongdoing of theirs will be waived away and the costs pushed onto consumers. Equifax were already in the process of having the law rewritten in their favour by the Republican party, at least that might be derailed or delayed for a few years. https://www.americanbanker.com/news/equifax-breach-may-kill-repeal-of-cfpb-mandatory-arbitration-rule https://www.americanbanker.com/news/equifax-breach-may-kill-... There's some claims here about the history of Equifax as a form of legal redlining, but they're a bit hard to substantiate with simple googling: https://twitter.com/matthewstoller/status/906257077215133696 https://twitter.com/matthewstoller/status/906257077215133696

otakucode 9y ago

For more than a decade, a debate has been going on in the Communications of the ACM (as well as other places, thats just where I've read of it most often). You can't make charges of negligence stick against companies using technology. There are no 'standard practices' they are negligent of following. If they were building a bridge, they would hire licensed certified engineers, and they would be legally bound to give those engineers access to the tools needed to do their job, the time needed to do the job correctly, and even if the CEO wanted to push the project forward despite misgivings of the engineers over safety, he would be legally forbidden to do so (and criminally personally culpable if he did). The same is not true of software-driven systems. There are no licensed developers, no regulatory body determining what tools must be made available, no guarantee of primacy of technical engineering concerns over business management. If a software engineer says "it needs more testing" or even "there is a bug that will kill people" and the CEO says "ship it", it ships and the courts will do nothing. This was proven to be true even in cases where incompetent management results in bad software that gets people killed in the case against Toyota with their "unintended acceleration" due to a firmware bug that would have been caught immediately if the developers had static analysis tools. Companies fight against the establishment of any sort of standards because it would reduce their profit margins. Developers fight against the establishment of any sort of standards because it would raise the barrier to entry in the field and no matter who the standards body consists of, they will select standards which people disagree with, they will be reluctant and slow to change or update them, etc. Both sides are right. But the alternative is companies having free reign up to and including incompetence of the degree which gets people killed with no accountability. People are overall very bad at decisions between two scenarios with clear negatives on both sides. They feel entitled to a 'clean' option and are uncomfortable with saying "I embrace the negatives and accept the burden of working hard to try to minimize their harm in order to gain the benefits of this option." Accepting the negatives implies taking some responsibility for bringing them to fruition and no one wants to be responsible for that - even if the alternative is worse. Not every decision is easy.

mortenjorck 9y ago

While I certainly agree in spirit, Equifax is, as has been said elsewhere, unfortunately too big to fail. Too much infrastructure has been built around it. So, instead of dissolution, I propose two very reasonable remedies that I would consider the absolute minimum in concert with whatever fines and sanctions may be levied: 1. Credit freezes/unfreezes must be offered free in perpetuity. “They cost us money to perform” is not a remotely appropriate objection - offering this for free should be a basic cost of doing business in the credit reporting industry. 2. Affected individuals (everyone, basically) must be granted a minimum of 10 years of credit monitoring following the breach. One year is a free sample you get with a coupon code from a podcast. Furthermore, the service must not auto-renew at the end of the term: send users a security report and let them decide if they want to opt-in to continued monitoring after the term ends.

otakucode 9y ago
Why 10 years? I mean, I don't see how one could defend any term shorter than the term of the validity and danger of the information stolen. I won't get a new SSN in 10 years. I won't get a new name. All the information will persist and still be useful. I'm personally in a worse position as my information was part of the OPM breach years ago and even images of my fingerprints are in the wild. And I got 18 months of free credit monitoring out of it. When a charge of more than $100 is made on my credit card, I get a text message instantly. When I log into my banks web system, I get a text message instantly. I was able to set those things up. I don't see why it would be unreasonable to have a similar thing set up so that I could be alerted every single time my credit history is queried with information about who is querying it for what purpose, ideally with the ability to block it by replying to the text message.
- edoceo 9y ago
  How do you get a text message when crims setup a new credit account in your name? That's what the 10yr monitoring is for?

0xcde4c3db 9y ago

Agreed. At this point, the only sensible thing to do is to assume that Equifax is -- and perhaps has been -- compromised indefinitely. If not by external agents, then by internal incompetence or malfeasance. They've not clearly demonstrated either the intention or the ability to handle this breach in a diligent, professional, ethically sound way. To me, that calls into serious question their ability to embody those qualities in their operations before the breach as well.