21 ms·

Get Rid of Equifax

362 points by hvo 9y ago

monochromatic 9y ago
“Any company doing something I don’t like should be nationalized.” No. They should be liable for the damage they cause with negligently allowing hacks like this, but the existence of private businesses should be default-allow.
- chillydawg 9y ago
  And in this case, a reasonable exception made to deny.
- mannykannot 9y ago
  I am not philosophically opposed to nationalization in a case like this, where market forces do not have much influence, but I completely agree that the proposal address neither of the the major issues, which are a) incompetence in security, and b) the widespread use of identity and authentication systems that are predicated on a level of confidentiality that does not exist in practice. Frankly, I don't know what should be done about b), but nationalization of credit reporting is not going to make any difference. As for a), as has been pointed out many times, one problem is that the people responsible do not have enough skin in the game. So long as the companies are private, something could, in principle, be done to to increase that, but in a nationalized industry, the responsible people would have even less personally at risk.
- paulgb 9y ago
  How do you ensure that a company doesn't become liable for more damage than they can afford to repair, though? Maybe nationalization isn't the answer, but with the current state of things the public essentially subsidizes careless companies by taking on most of their downside risk.
  - inetknght 9y ago
    Why should we ensure that a company doesn't become liable for more damage than they can afford to repair? The implication there is that the company has a right to exist. If they're so grossly negligent, why should they have a right to exist? I don't know anyone outside of high finance who had a good opinion of Equifax before the breach was announced. Their recent hardships has certainly not helped that. For myself, I definitely think that companies and their officers should absolutely be liable for negligence.
    - sp332 9y ago
      Because they're not going to be able to pay back the damage they did. If they screw over a hundred million people and then go bankrupt, those hundred million people are stuck with the bill.
      - Applejinx 9y ago
        And if they continue to operate and continue to screw people over, what's the cost of that? It's not like they're benefitting anybody (not 'people' anybody).
        paulgb 9y ago
        The problem isn't that they're allowed to go bankrupt, it's that they're allowed to make bets with huge downside risk knowing that if they lose the bet they don't bare the cost.
        keganunderwood 9y ago
        What about when an SV darling company offers "lifetime" product and sells itself to another SV darling? I'm of course talking about joyent but it could be me next time. If we get rid of limited liability, do I become liable for BP's oil spills because I have own a few cents worth of petroleum stock through vanguard? I like your idea that companies should be able to bear the cost of a possible future liability. I don't know how we can implement it besides some form of insurance (like sometime else said a $10 fine per person per breach but I'd up it to (2000 * minimum wage per hour) for every incident per person. At some point though we will need criminal charges for negligence or worse attempts of cover up (Equifax). We need to make it easier to convict CEOs and the board to put them in prison in case of attempted cover up or non disclosure.
- fortythirteen 9y ago
  "Let's fix a massive problem, caused by the lack of accountability that comes with bureaucracy, by adding even more bureaucracy!"
  - vec 9y ago
    Equifax doesn't lack accountability because they're bureaucratic. They just lack accountability, period. The customers aren't being hurt and the people being hurt aren't customers. Adding accountability to the general public via regulation may make them more bureaucratic. It may make them less. That's up to the invisible hand to decide, once their incentive structure matches their real world impact.
    - Applejinx 9y ago
      They ARE the invisible hand, personified. The invisible hand got us here. Clearly, it's an invisible hand with palsy (possibly claws, or leprosy). Mind you, I agree about adding accountability. I just doubt that's really a solution; it's part of a solution.
  - wpietri 9y ago
    Have you ever worked in a regulated industry? My experience is that regulators add accountability to bureaucracy. Bureaucracies brush off harm to customers pretty well. But when a regulator can fuck their shit up, they listen.
    - fortythirteen 9y ago
      Sure have. The bureaucracy brought on by regulation rewards company employees who are bureaucratic beasts themselves. I've never worked in a more political, wasteful, back-stabbing environment than when I worked for a large company whose business was regulated.
      - wpietri 9y ago
        Huh. That hasn't been my experience. I can't talk about the details due to NDA, but I was surprised at the extent to which fear of regulators produced useful behaviors.
- yebyen 9y ago
  I never consented to have my information in their database, and I have no power to get it out of their database. They have roundly and repeatedly demonstrated that they are not fit to hold and be trusted with maintaining the SSNs and other personal information of the entire country's worth of credit holders. Is there even a license that the Equifax company needs to have, in order to do this type of work, that can be revoked? It needs to be revoked! But I'm afraid they don't need any license, they just woke up like this. The right to covertly surveil and maintain dossiers on 50%+ of the citizens of this country should not be default-allow. Strongly disagree. People in power holding that kind of opinion, is exactly how we got here.
  - newscracker 9y ago
    > I never consented to have my information in their database, Don't you think that somewhere in the T&Cs of a loan you took or a credit card that you got or a phone contract you signed up for (or many other things) are lines explaining that your information would be shared with credit reporting agencies? So legally, you would've consented to the sharing of information at those times. If that isn't true, then I'd assume that you should be able to sue the institution that shared your information with all these agencies.
    - brango 9y ago
      Oh yeah, so you do have a choice if you want to live in a cave.
      - dmoy 9y ago
        What is a reasonable alternative to credit agencies? Most countries I know use similar (or sometimes the same, like the UK) agencies, though sometimes with a caveat that they only log defaults or other stuff you mess up.
        yebyen 9y ago
        The alternative is the two other credit agencies that haven't (as far as we know) given up all of our personal information to hackers, and who haven't responded to the news of the breach by linking some of their customers to a parody/phishing site that was nearly indistinguishable from their own (very bad) breach response website. There is no way out of this (the cat is out of the bag) but we can go on about our lives without Equifax. They need to be unplugged.
- scott_s 9y ago
  The existence of private business is default allow. That objection makes it sound like the author is arguing that all business should have to get government permission to exist. (Which, they kinda do if they want to get incorporated, but that's a low bar.) The author is making a different argument: this particular business is working in a market with incentives so perverse that they are more likely to be harmful than not. If we deem these kind of services necessary, then let's make it a government program so that the incentives are correctly aligned.
- rectang 9y ago
  > the existence of private businesses should be default-allow Equifax spreads misery across the general population. I have seen no practical proposals which allow us ordinary people to claw back the time and frustration these private companies suck out of us. How endlessly should they be allowed to socialize their losses and force us to subsidize them?
  - bogomipz 9y ago
    Indeed and to putting a fraud alert on your credit profile is only good for 90 days. This is curious since one's identity - name and social security number don't change after 90 days. The onus of protection is on the consumer - the very people who never authorized the companies to collect and sell their financial identity. The concerned consumer needs to call back every 3 months to continue a fraud alert. For those who don't know the value in placing a fraud alert is that it forces anyone extending you credit to first call you and verify that you actually intended to open the line of credit in your name. This is something that should be standard operating procedure and not a special consideration.
    - KGIII 9y ago
      There are two ways to freeze your credit. The first is good for 90 days and you have to authorize any requests. The second is permanent, until you revoke it. To revoke it, you need a PIN that they give you when you freeze it. There are three companies to do it at. The cost is low and it is mandated to be free in some jurisdictions.
      - rectang 9y ago
        Do you seriously believe that credit freezes are an adequate response to the massive harms inflicted upon individuals by identity theft and credit report inaccuracies?
        bogomipz 9y ago
        They aren't and they further shift the responsibility of dealing with credit agencies negligence onto the consumer. You want to rent an apartment, change your cell phone carrier, get home owner's insurance, order cable - all of these things require a credit check and you having to pay 5 dollars to each agency and making 3 separate calls to each of them to do so.
- caseysoftware 9y ago
  The problem is that we already have a nationalized version of this - the OPM database for security clearances - and it too has been hacked. It was known vulnerable in 2009 and nothing was done about it until it was known to be hacked 6 years later. Even worse, while the author criticizes how Equifax got started - private investigators looking for affairs, etc - that is exactly what the OPM database is. They're looking for things that could be used to blackmail an individual so it includes financial history, marital info, drug use/abuse info, and potentially medical records. My coverage of it at the time: https://caseysoftware.com/blog/why-this-security-breach-is-worse-than-all-the-others-combined https://caseysoftware.com/blog/why-this-security-breach-is-w... And no, there has been zero accountability around it. Whenever someone says "the govt can protect this info better!" remember that this is the same government that doesn't follow the law with regards to wiretaps, FOIA requests, background check info, and many, many other things. Oh, and the NSA can't even protect their best tools.
  - KGIII 9y ago
    All I got from the OPM hack was a form letter and free credit monitoring that I had no use for. Instead, I had to freeze my credit. Fortunately, I'm not really at risk for blackmail and I'm not worried about my information being out there. I am, however, worried about the information in my file that is about other people. They contacted and interviewed lots of my friends and family. Those notes, and the associations between these groups of people, are all in the data that was exfiltrated. You know what my friends and family got? Nothing, not even a form letter. Me? I'll be fine. However, some of them are now associated with others and who knows what other connections can be drawn when you cross-check with other information from the hack? So, yeah, I'm jaded and skeptical about the idea of having it be a government operation. People keep saying this is the worst hack ever. Man, if they only knew what was in the clearance application. I disclosed all sorts of things that I really don't want to be public information. And I got a form letter that was barely an apology. Hell, I think my notification was actually on a post card. Yeah, I just double checked. They sent my notification on a post card, not even in a secure envelope. I may be a bit biased.
    - turk184 9y ago
- 1_2__4 9y ago
  The cry of the neo-liberal: "The market will sort this out!", usually in response to an event demonstrating the exact opposite.
  - wpietri 9y ago
    Definitely. I love markets; they can do amazing stuff. But we're talking an invisible hand, not an invisible magic sparkle unicorn. I look at a market as a machine that we can deploy. It does a specific thing, but only with the right inputs and working conditions. Here, we are not Equifax's customers. Harm to us is a negative externality, which is a classic kind of market failure: http://www.economicsonline.co.uk/Market_failures/Types_of_market_failure.html http://www.economicsonline.co.uk/Market_failures/Types_of_ma... So markets don't fix this even in theory. Personally, I'd like to see this problem turned over to an institution something like the Smithsonian: not a regular part of government, but a trust with a specific purpose. I'd be even happier with it if it had directly elected privacy commissioners, so that it was more accountable to the people whose data it safeguards. We're only going to end up with more data that's about people, even if it's not generated or held by those people. Having a home for that data, one with a public purpose and public accountability, seems way better to me than leaving it for a private, profit-making corporation to exploit.
    - dredmorbius 9y ago
      NB, but the "invisible hand" rhetoric is a gross misrepresentation of Smith's intent. Economic historian Gavin Kennedy has made something of a career debunking this fallacy. Among his many writings: The sorry invisible hand myth owes more to imagination and hope than it does to economics from Adam Smith. Its modern form really began its take off with Paul Samuelson’s successful textbook, “Economics: an analytical introduction”, McGraw-Hill 1948, and continued through to edition 20 in 2010. It had an earlier oral presence at Chicago (where Samuelson was an undergraduate) and Cambridge, England (A. C. Pigou). Even Oscar Lange postulated (1938 and 1947) a rival and “better” invisible-hand role by socialist planners. The Soviet planned economy challenged capitalism from the 1930s and in Cold War rivalry, with large communist parties and social-democratic in Western Europe, the myth asserted the innate superiority of capitalism with its “invisible hand”. Since the current recession, increasing questions appeared about its existence. Warren Samuel’s last book, “Erasing the Invisible Hand, essays on a elusive and misused concept in economics”, 2011 (Cambridge) exposes the modern history of the mythical “invisible hand” since its heyday from the 1960s through to the late 1990s http://adamsmithslostlegacy.blogspot.com/2012/04/political-scientist-most-right-in.html http://adamsmithslostlegacy.blogspot.com/2012/04/political-s...
- kazinator 9y ago
  > They should be liable for the damage If they are are so liable, then to remain profitable they will find a way to pass on their cost to the customers. Those customers in turn, will pass it on to the consumer. So then you end up footing liability insurance bill for the privilege of being subject to a credit search.
  - rectang 9y ago
    That's better than the situation we have now, where Equifax and the credit agencies are only profitable because they stick the general population with the liability and the losses.
    - kazinator 9y ago
      How does liability help? What's the idea; that if a whole network of criminals now has my personal info, there will be an insurance-backed fund that will instantly buy me a whole new identity, so life goes on merrily? Nope! We must rather completely get rid of this Equifax and make it a criminal offense for anyone to share such info with any emerging Equifax-like agency, or with anyone else. Your data going to Equifax is the fucking security breach. What happens afterward is just a footnote.
  - dredmorbius 9y ago
    If they're liable, they can also mitigate risk and /or exit lines of business with excessive risk.
- awj 9y ago
  I need to be licensed to drive because my incompetence could ruin people's lives. Why is that commonly accepted, but it's horrible to contemplate regulation of Equifax for the same essential reasons?
- ExactActuation 9y ago
  "default-allow". What is this, a firewall config file or a conversation?
- curun1r 9y ago
  In addition, untrue entries in their database should constitute libel. Most (but not all) of the damage from letting SSN/name/address combinations out into the wild that you're referring to comes from adding false entries to their own databases, so allowing consumer to sue for libel whenever an entry is wrong would force them and their up-stream data providers to clean up their act in a hurry.
JoeCoder_ 9y ago
When a private company has a massive failure, customers have the freedom to go elsewhere and the company may go out of business. When a government agency has a massive failure, we're of stuck with it, short of hoping politicians might do something about it.
- whafro 9y ago
  That's sorta the point – in this case, I have no ability (as a consumer) to "go elsewhere." Aside from the two times I've placed freezes on my credit history, I have no relationship with Equifax, and have never consented in any way to what they collect and share about me. This contrasts pretty heavily with, say, Facebook – where even though they collect and share plenty of information about me, I'm at least both consenting and continuing to feed them by using a service I presumably find worth the trade-off. If you are the type of person who gets upset about this dynamic of Facebook, then Equifax should be completely next-level.
  - dominotw 9y ago
    > and have never consented in any way to what they collect and share about me. Dont you consent to credit reporting when you sign up to get credit, though. You can "choose" to not use Equifax by not getting credit from people who report to equifax.
    - tclancy 9y ago
      How would that possibly work? There are (I think) 3 brokers and creditors tend to share info back to all of them.
    - lghh 9y ago
      > Dont you consent to credit reporting when you sign up to get credit, though. No, I consent to allow creditors to do their due diligence to see if I'm a viable candidate for their product. Equifax is not required in this transaction, it's just beneficial for the creditor, their customer, to use them to streamline that information collecting process. Loans and credit existed prior to credit reporting agencies and will exist long after.
0xfeba 9y ago
A pipe dream. As evidenced by the stock price, nothing will change. People don't care--at least not enough to do something like call their elected official, if they even know who they are. Which brings me to a question of the "have things always been like this?" sort. Do we have data on the percentage of any population who's active in politics over the past, say, 7 decades?
lukejduncan 9y ago
The interesting thing about this sentiment and reasoning is that it could equally be said of data brokers in general. Changes here could have big impacts on the ads ecosystem. I don't know my opinion here, but between things like GDPR and op eds like this I have to imagine there are ad and data broker executives doing some worst case analysis and spin/ talking point preparation.
koolba 9y ago
> Equifax is the oldest of the Big Three credit reporting bureaus, and it got its start as a private investigator in the late 1800s. A client — a business or a bank — would ask it about a consumer, and it would go about digging up dirt on things like marital problems and convictions. That client would then pay it for its services. > This questionable business model raised eyebrows in the 1960s, when the companies were still compiling information on people’s “moral character” such as affairs or drinking problems. At the time, the reports weren’t available at all to the subjects themselves. That changed with the Fair Credit Reporting Act, which was signed in 1970. But even that reform put virtually no oversight on the bureaus’ practices. As if there aren't a bunch of companies trying to do exactly this with a combination of tracking cookies, browser history, purchase history, and ML. Separately, from the article (emphasis mine): > The United States government is, of course, not impervious to data breaches, nor does it have a perfect track record of fending them off. In 2015, it announced that hackers had stolen “sensitive information” on 21.5 million people. But the government is at least accountable to public pressure. Equifax never will be, even under the tightest regulation. Equifax may not have to change anything as there's a very real chance it goes bankrupt because of this. It's not just from the cost of lawsuits from consumers. There's a longer term cost of businesses not wanting to deal with them. The risk of that happening to one of the other big credit reporting agencies is the biggest driver for them to clean up their act. The threat to their businesses is real and I'd imagine their internal responses will be as well. I also think regardless of what they do it's only a matter of time till they have a breach as well. You only have to screw up once. > Credit bureaus have proved to be complete failures at safeguarding the public. Nearly all companies are complete failures at data security. There's not special about credit bureaus here. They just happen to have a lot of sensitive data on a lot of people and thus are a hot target. As an example, we've had plenty of breaches in the health insurance industry as well. Perhaps the best approach would be a "too big to fail" limit on the bureaus. Put a cap on the total size (in accounts / people covered) of a credit bureau. The libertarian in me is screaming at the thought of something like that but at least it has the advantage of limiting breaches to a max number of people. > Let’s demand we get our data back. It was never your data.
dmh2000 9y ago
sp the government is better at security? https://www.nytimes.com/2017/09/20/business/sec-hacking-attack.html https://www.nytimes.com/2017/09/20/business/sec-hacking-atta...
- rmdundon 9y ago
  Not to mention the OPM hack
SamuelAdams 9y ago
"Equifax could easily have patched the hole in its system that hackers exploited, but it simply didn’t." We don't know why, though. Perhaps they were working with law enforcement to track the attacker. Closing the hole would certainly alert the attackers and end the chance to catch them. This reads just like the Cuckoo's Egg.
- inetknght 9y ago
  Your argument is that law enforcement wanted to risk the identities of millions of Americans they're supposed to protect? That logic is simply broken. Either the argument is strawman or law enforcement is just as guilty of negligence as Equifax is.
  - talmand 9y ago
    I don't know about this situation but I'm willing to bet one could find many examples of law enforcement doing that very thing in various different cases. Law enforcement is about enforcing the law, not protecting law-abiding citizens from criminals.
matt-attack 9y ago
I don't agree with trying to create a public government-run institution to track how "reliable" each citizen is. The solution to all of this is clear. Credit agencies provide a service primarily to lenders. These lenders count on the agencies' ratings to be a reliable predictor of the reliability of its potential customers. If those companies' products are no longer a reliable predictor, they shouldn't use them.
- cmiles74 9y ago
  > If those companies' products are no longer a reliable predictor, they shouldn't use them. I think this is very optimistic. It's hard for me to imagine a situation in which lenders are questioning the reliability of these credit reports and the only scenario I can come up with is one in which the reporting agency are over-estimating people's ability to reliably repay debt to the point where the lenders are losing so much money that they actually notice. Given that most consumers complain that these reports include erroneous /negative/ information, this scenario seems unlikely. Lenders will continue to use these reporting companies, no matter how poor their product, because there is no measure against which to judge their product except each other. They'll continue to use them out of inertia, out of erring on the side of caution, and because this is the way they have always done business.
  - stult 9y ago
    Well, I guess the sticking point is that no one has found a better way to measure loan risk. If they had, lenders would work with the agency that more accurately assesses their risk because otherwise they are leaving money on the table by not lending to creditworthy individuals.
    - cmiles74 9y ago
      Agreed. As long as credit reporting companies report conservative numbers and lenders err on the side of minimizing risk, all of the potential lost dollars will fall into the "loans I could've made money on but decided not to loan out" category and that is difficult to gauge.
jedbrown 9y ago
This can be fixed by a small change to privacy liability law. Current law requires litigants to show actual economic harm. That is hard to do in cases of identity theft and privacy violations, which is why the OPM case was just dismissed [1]. If this was changed so that a privacy violation could be litigated, companies like Equifax would need to buy insurance against such actions. Alternatively, there could be a new law that any company storing SSN-type data owed some nominal amount (say, $10) to the owner of that data if it is compromised for any reason. Either way, companies that aggregate large amounts of such data would end up buying insurance. No insurance company would sell such policies without due diligence -- they would establish security requirements and pen testing. Consumers are protected by the existence of an actuarially fair insurance policy. not by the (nominal) compensation. Note that Equifax's customers are (primarily) not consumers. Regulations (in the form of liability law reform or nominal compensation) may not be required in industries where companies only hold the data of their own customers, but such companies could cite their insurance policy to convince their customers that they take security seriously. (Now it's always empty words.) [1] https://www.washingtonpost.com/news/powerpost/wp/2017/09/20/federal-court-denies-cash-awards-to-22-million-opm-data-theft-victims/ https://www.washingtonpost.com/news/powerpost/wp/2017/09/20/...
- mediocrejoker 9y ago
  This sounds like the most efficient solution to me. There is no need (and for many, no desire) for the government to take on the role of tracking citizens. A minor but strategic change in liability law around privacy would shift incentives in the way you describe and suddenly it becomes in the best financial interests of the companies to protect the data. Indeed this is the only kind of incentive they will respond to. Nationalizing the credit industry doesn't really solve any real problems as far as I can tell.
  - Frondo 9y ago
    Frankly speaking, if we're going to be tracked (and we are, lots and lots), I want the government as involved as possible, whether through strict regulations or through being the central repository for that information. Maybe do it state-by-state, so long as each state follows some federal guidelines and each state provides a way to interoperate with the rest, and with private businesses that need access to that information, if the feds freak you out. Why? Because I can, in theory, have my say in how the government operates. I can vote, I can submit comments, I can go talk to elected officials, whatever. I have zero recourse when private companies schlep my data around and wreck my life. Voting with your vote is best, but I can't even vote with my dollar with Equifax.
khana 9y ago
YES
eternalban 9y ago
This is a perfect opportunity for "distrupting" this sector. Why is no one stepping up and flipping the business model on credit reporting?
- tantalor 9y ago
  Here are some, https://www.prbc.com/ https://www.prbc.com/ (2002) http://www.dataxltd.com/ http://www.dataxltd.com/ (2004) https://ws.factortrust.com/ https://ws.factortrust.com/ (2005) See also https://wallethub.com/edu/credit-reporting-agencies/25518/ https://wallethub.com/edu/credit-reporting-agencies/25518/
- wpietri 9y ago
  Disruption solve a problem better for the customer. There's little evidence that credit bureau customers (lenders, et al) experience this as a problem. So I don't think this is much of an opportunity for disruption.
ma2rten 9y ago
In at least 40 other countries — including Belgium, France, Germany, Italy and Spain — credit reporting can be done by a public credit registry. This is not true for Germany. https://en.wikipedia.org/wiki/Schufa https://en.wikipedia.org/wiki/Schufa
transverse 9y ago
Just can't stop posting paywalled crap? Yes, NYT is paywalled after a certain low number of free articles.
- jwilk 9y ago
  From the FAQ: It's ok to post stories from sites with paywalls that have workarounds. In comments, it's ok to ask how to read an article and to help other users do so. But please don't post complaints about paywalls. Those are off topic.
  - transverse 9y ago
    I know how to read an article. I click on the link, the article loads, and I read it. If only NYT knew that HN was popularizing workarounds, they'd be so happy about it, not. It is because of you that paywalled sites haven't died yet.
_jal 9y ago
Now here is a perfect, legitimate use of libel law. If a company with whom you have no relationship is lying about you to people with whom you're attempting to do business, that sounds like libel to me. Of course, that's preempted by a federal law that Equifax & friends carefully purchased. Perhaps all we need is for them to lose that protection to give them a reason to care.
- rectang 9y ago
  Now you're talkin'! Today, an ordinary person can barely even get inaccuracies in a credit report changed after laborious effort -- to say nothing of being denied a house, a car, or a job as a result of that inaccurate info. Equifax and the credit agencies only exist because they are allowed to perpetrate great harm spread across millions. They are a giant negative externality.
kazinator 9y ago
> Although they call themselves bureaus, there is nothing governmental about what these private companies do. That is a naive statement, perhaps based on an idealized version of a few cherry-picked governments.
bogomipz 9y ago
The only proposal for any kind of action I have heard on this is the Warren and Schatz legislation which is appropriately titled" Freedom from Equifax Exploitation (FREE) Act"[1] Aside from Senator Warren I have heard very little concern from lawmakers in Washington regarding the menace that these credit reporting agencies have become and the threat they pose to people. [1] https://www.warren.senate.gov/?p=press_release&id=1837 https://www.warren.senate.gov/?p=press_release&id=1837
njarboe 9y ago
I can understand the impulse to want Equifax punished for getting hacked and releasing all of this information. But I think these credit bureaus are small fry compared the size of the companies that are at the root of the problem: banks and other entities that make loans. The reason most people don't like the credit bureaus are the fear of "identity theft" not the spread of truthful information about themselves. A bank makes a loan to a fraudster who is impersonating you. The fraudster defaults on the loan and the the bank tells a lie about you to the credit bureau, which gets spread around and hurts you in many ways. If we called this situation "bank slander" or "bank libel", the focus would be on who is creating the problem: the bank with its lie. Create high enough penalties for banks reporting false loan defaults and "identity theft" will disappear as the banks become more cautious of fraudsters. This is unlikely to happen as banks are concentrated and powerful institutions. "To big to fail" I believe is the term. I don't think the credit bureaus themselves are that influential in Congress but the banks want them and will lobby on their behalf. It would be interesting to know how much money the banks get from people illegally each year from people paying off fraudsters debts to clear their credit reports from the false default reports from banks.
DamnInteresting 9y ago
I keep seeing calls for the government to revoke Equifax's corporate charter, because we citizens cannot vote with our wallets in this case; we are not Equifax's customers. But I wonder about Equifax's actual customers, the financial institutions that choose to rely on Equifax for credit reporting. What sensible institution would continue to trust Equifax after all of this nonsense? Perhaps banks and the like should all abandon Equifax as a credit reporting source and let the company die of natural causes.
- dredmorbius 9y ago
  Equifax's actual customers face no risk, on the outbound reports side. Data sources might be another case.
optimuspaul 9y ago
I think the real problem is that we have no definitive way to prove who we are. A SSN is fine and all but it's just a number that anyone can obtain and say they are me. We need key pairs or some way to prove that when we are requesting credit that we are in fact the person that we say we are. Until that happens the systems is exploitable by even the most inept of criminals.
- 24gttghh 9y ago
  I wrote to my senator about this solution weeks ago and have yet to receive an actual reply. I think the problem is figuring out the transition from SSN's to something like key pairs/TOTP. How do we securely establish the "new" identity and pair it to the old SSN? Do we even bother and just start from scratch?
deleted 9y ago
[deleted]
mywittyname 9y ago
Individuals should have the option to tell companies requesting credit checks that they do not consent. Further more, it should be illegal to hold non-consent against the individual.
eevilspock 9y ago
> That’s because we are not the customers... but the product. An increasingly familiar pattern. The free market is flipping against the people.

362 points by hvo 9y ago

“Any company doing something I don’t like should be nationalized.” No. They should be liable for the damage they cause with negligently allowing hacks like this, but the existence of private businesses should be default-allow.

chillydawg 9y ago
And in this case, a reasonable exception made to deny.
mannykannot 9y ago
I am not philosophically opposed to nationalization in a case like this, where market forces do not have much influence, but I completely agree that the proposal address neither of the the major issues, which are a) incompetence in security, and b) the widespread use of identity and authentication systems that are predicated on a level of confidentiality that does not exist in practice. Frankly, I don't know what should be done about b), but nationalization of credit reporting is not going to make any difference. As for a), as has been pointed out many times, one problem is that the people responsible do not have enough skin in the game. So long as the companies are private, something could, in principle, be done to to increase that, but in a nationalized industry, the responsible people would have even less personally at risk.
paulgb 9y ago
How do you ensure that a company doesn't become liable for more damage than they can afford to repair, though? Maybe nationalization isn't the answer, but with the current state of things the public essentially subsidizes careless companies by taking on most of their downside risk.
- inetknght 9y ago
  Why should we ensure that a company doesn't become liable for more damage than they can afford to repair? The implication there is that the company has a right to exist. If they're so grossly negligent, why should they have a right to exist? I don't know anyone outside of high finance who had a good opinion of Equifax before the breach was announced. Their recent hardships has certainly not helped that. For myself, I definitely think that companies and their officers should absolutely be liable for negligence.
  - sp332 9y ago
    Because they're not going to be able to pay back the damage they did. If they screw over a hundred million people and then go bankrupt, those hundred million people are stuck with the bill.
    - Applejinx 9y ago
      And if they continue to operate and continue to screw people over, what's the cost of that? It's not like they're benefitting anybody (not 'people' anybody).
      - paulgb 9y ago
        The problem isn't that they're allowed to go bankrupt, it's that they're allowed to make bets with huge downside risk knowing that if they lose the bet they don't bare the cost.
        keganunderwood 9y ago
        What about when an SV darling company offers "lifetime" product and sells itself to another SV darling? I'm of course talking about joyent but it could be me next time. If we get rid of limited liability, do I become liable for BP's oil spills because I have own a few cents worth of petroleum stock through vanguard? I like your idea that companies should be able to bear the cost of a possible future liability. I don't know how we can implement it besides some form of insurance (like sometime else said a $10 fine per person per breach but I'd up it to (2000 * minimum wage per hour) for every incident per person. At some point though we will need criminal charges for negligence or worse attempts of cover up (Equifax). We need to make it easier to convict CEOs and the board to put them in prison in case of attempted cover up or non disclosure.
fortythirteen 9y ago
"Let's fix a massive problem, caused by the lack of accountability that comes with bureaucracy, by adding even more bureaucracy!"
- vec 9y ago
  Equifax doesn't lack accountability because they're bureaucratic. They just lack accountability, period. The customers aren't being hurt and the people being hurt aren't customers. Adding accountability to the general public via regulation may make them more bureaucratic. It may make them less. That's up to the invisible hand to decide, once their incentive structure matches their real world impact.
  - Applejinx 9y ago
    They ARE the invisible hand, personified. The invisible hand got us here. Clearly, it's an invisible hand with palsy (possibly claws, or leprosy). Mind you, I agree about adding accountability. I just doubt that's really a solution; it's part of a solution.
- wpietri 9y ago
  Have you ever worked in a regulated industry? My experience is that regulators add accountability to bureaucracy. Bureaucracies brush off harm to customers pretty well. But when a regulator can fuck their shit up, they listen.
  - fortythirteen 9y ago
    Sure have. The bureaucracy brought on by regulation rewards company employees who are bureaucratic beasts themselves. I've never worked in a more political, wasteful, back-stabbing environment than when I worked for a large company whose business was regulated.
    - wpietri 9y ago
      Huh. That hasn't been my experience. I can't talk about the details due to NDA, but I was surprised at the extent to which fear of regulators produced useful behaviors.
yebyen 9y ago
I never consented to have my information in their database, and I have no power to get it out of their database. They have roundly and repeatedly demonstrated that they are not fit to hold and be trusted with maintaining the SSNs and other personal information of the entire country's worth of credit holders. Is there even a license that the Equifax company needs to have, in order to do this type of work, that can be revoked? It needs to be revoked! But I'm afraid they don't need any license, they just woke up like this. The right to covertly surveil and maintain dossiers on 50%+ of the citizens of this country should not be default-allow. Strongly disagree. People in power holding that kind of opinion, is exactly how we got here.
- newscracker 9y ago
  > I never consented to have my information in their database, Don't you think that somewhere in the T&Cs of a loan you took or a credit card that you got or a phone contract you signed up for (or many other things) are lines explaining that your information would be shared with credit reporting agencies? So legally, you would've consented to the sharing of information at those times. If that isn't true, then I'd assume that you should be able to sue the institution that shared your information with all these agencies.
  - brango 9y ago
    Oh yeah, so you do have a choice if you want to live in a cave.
    - dmoy 9y ago
      What is a reasonable alternative to credit agencies? Most countries I know use similar (or sometimes the same, like the UK) agencies, though sometimes with a caveat that they only log defaults or other stuff you mess up.
      - yebyen 9y ago
        The alternative is the two other credit agencies that haven't (as far as we know) given up all of our personal information to hackers, and who haven't responded to the news of the breach by linking some of their customers to a parody/phishing site that was nearly indistinguishable from their own (very bad) breach response website. There is no way out of this (the cat is out of the bag) but we can go on about our lives without Equifax. They need to be unplugged.
scott_s 9y ago
The existence of private business is default allow. That objection makes it sound like the author is arguing that all business should have to get government permission to exist. (Which, they kinda do if they want to get incorporated, but that's a low bar.) The author is making a different argument: this particular business is working in a market with incentives so perverse that they are more likely to be harmful than not. If we deem these kind of services necessary, then let's make it a government program so that the incentives are correctly aligned.
rectang 9y ago
> the existence of private businesses should be default-allow Equifax spreads misery across the general population. I have seen no practical proposals which allow us ordinary people to claw back the time and frustration these private companies suck out of us. How endlessly should they be allowed to socialize their losses and force us to subsidize them?
- bogomipz 9y ago
  Indeed and to putting a fraud alert on your credit profile is only good for 90 days. This is curious since one's identity - name and social security number don't change after 90 days. The onus of protection is on the consumer - the very people who never authorized the companies to collect and sell their financial identity. The concerned consumer needs to call back every 3 months to continue a fraud alert. For those who don't know the value in placing a fraud alert is that it forces anyone extending you credit to first call you and verify that you actually intended to open the line of credit in your name. This is something that should be standard operating procedure and not a special consideration.
  - KGIII 9y ago
    There are two ways to freeze your credit. The first is good for 90 days and you have to authorize any requests. The second is permanent, until you revoke it. To revoke it, you need a PIN that they give you when you freeze it. There are three companies to do it at. The cost is low and it is mandated to be free in some jurisdictions.
    - rectang 9y ago
      Do you seriously believe that credit freezes are an adequate response to the massive harms inflicted upon individuals by identity theft and credit report inaccuracies?
      - bogomipz 9y ago
        They aren't and they further shift the responsibility of dealing with credit agencies negligence onto the consumer. You want to rent an apartment, change your cell phone carrier, get home owner's insurance, order cable - all of these things require a credit check and you having to pay 5 dollars to each agency and making 3 separate calls to each of them to do so.
caseysoftware 9y ago
The problem is that we already have a nationalized version of this - the OPM database for security clearances - and it too has been hacked. It was known vulnerable in 2009 and nothing was done about it until it was known to be hacked 6 years later. Even worse, while the author criticizes how Equifax got started - private investigators looking for affairs, etc - that is exactly what the OPM database is. They're looking for things that could be used to blackmail an individual so it includes financial history, marital info, drug use/abuse info, and potentially medical records. My coverage of it at the time: https://caseysoftware.com/blog/why-this-security-breach-is-worse-than-all-the-others-combined https://caseysoftware.com/blog/why-this-security-breach-is-w... And no, there has been zero accountability around it. Whenever someone says "the govt can protect this info better!" remember that this is the same government that doesn't follow the law with regards to wiretaps, FOIA requests, background check info, and many, many other things. Oh, and the NSA can't even protect their best tools.
- KGIII 9y ago
  All I got from the OPM hack was a form letter and free credit monitoring that I had no use for. Instead, I had to freeze my credit. Fortunately, I'm not really at risk for blackmail and I'm not worried about my information being out there. I am, however, worried about the information in my file that is about other people. They contacted and interviewed lots of my friends and family. Those notes, and the associations between these groups of people, are all in the data that was exfiltrated. You know what my friends and family got? Nothing, not even a form letter. Me? I'll be fine. However, some of them are now associated with others and who knows what other connections can be drawn when you cross-check with other information from the hack? So, yeah, I'm jaded and skeptical about the idea of having it be a government operation. People keep saying this is the worst hack ever. Man, if they only knew what was in the clearance application. I disclosed all sorts of things that I really don't want to be public information. And I got a form letter that was barely an apology. Hell, I think my notification was actually on a post card. Yeah, I just double checked. They sent my notification on a post card, not even in a secure envelope. I may be a bit biased.
  - turk184 9y ago
1_2__4 9y ago
The cry of the neo-liberal: "The market will sort this out!", usually in response to an event demonstrating the exact opposite.
- wpietri 9y ago
  Definitely. I love markets; they can do amazing stuff. But we're talking an invisible hand, not an invisible magic sparkle unicorn. I look at a market as a machine that we can deploy. It does a specific thing, but only with the right inputs and working conditions. Here, we are not Equifax's customers. Harm to us is a negative externality, which is a classic kind of market failure: http://www.economicsonline.co.uk/Market_failures/Types_of_market_failure.html http://www.economicsonline.co.uk/Market_failures/Types_of_ma... So markets don't fix this even in theory. Personally, I'd like to see this problem turned over to an institution something like the Smithsonian: not a regular part of government, but a trust with a specific purpose. I'd be even happier with it if it had directly elected privacy commissioners, so that it was more accountable to the people whose data it safeguards. We're only going to end up with more data that's about people, even if it's not generated or held by those people. Having a home for that data, one with a public purpose and public accountability, seems way better to me than leaving it for a private, profit-making corporation to exploit.
  - dredmorbius 9y ago
    NB, but the "invisible hand" rhetoric is a gross misrepresentation of Smith's intent. Economic historian Gavin Kennedy has made something of a career debunking this fallacy. Among his many writings: The sorry invisible hand myth owes more to imagination and hope than it does to economics from Adam Smith. Its modern form really began its take off with Paul Samuelson’s successful textbook, “Economics: an analytical introduction”, McGraw-Hill 1948, and continued through to edition 20 in 2010. It had an earlier oral presence at Chicago (where Samuelson was an undergraduate) and Cambridge, England (A. C. Pigou). Even Oscar Lange postulated (1938 and 1947) a rival and “better” invisible-hand role by socialist planners. The Soviet planned economy challenged capitalism from the 1930s and in Cold War rivalry, with large communist parties and social-democratic in Western Europe, the myth asserted the innate superiority of capitalism with its “invisible hand”. Since the current recession, increasing questions appeared about its existence. Warren Samuel’s last book, “Erasing the Invisible Hand, essays on a elusive and misused concept in economics”, 2011 (Cambridge) exposes the modern history of the mythical “invisible hand” since its heyday from the 1960s through to the late 1990s http://adamsmithslostlegacy.blogspot.com/2012/04/political-scientist-most-right-in.html http://adamsmithslostlegacy.blogspot.com/2012/04/political-s...
kazinator 9y ago
> They should be liable for the damage If they are are so liable, then to remain profitable they will find a way to pass on their cost to the customers. Those customers in turn, will pass it on to the consumer. So then you end up footing liability insurance bill for the privilege of being subject to a credit search.
- rectang 9y ago
  That's better than the situation we have now, where Equifax and the credit agencies are only profitable because they stick the general population with the liability and the losses.
  - kazinator 9y ago
    How does liability help? What's the idea; that if a whole network of criminals now has my personal info, there will be an insurance-backed fund that will instantly buy me a whole new identity, so life goes on merrily? Nope! We must rather completely get rid of this Equifax and make it a criminal offense for anyone to share such info with any emerging Equifax-like agency, or with anyone else. Your data going to Equifax is the fucking security breach. What happens afterward is just a footnote.
- dredmorbius 9y ago
  If they're liable, they can also mitigate risk and /or exit lines of business with excessive risk.
awj 9y ago
I need to be licensed to drive because my incompetence could ruin people's lives. Why is that commonly accepted, but it's horrible to contemplate regulation of Equifax for the same essential reasons?
ExactActuation 9y ago
"default-allow". What is this, a firewall config file or a conversation?
curun1r 9y ago
In addition, untrue entries in their database should constitute libel. Most (but not all) of the damage from letting SSN/name/address combinations out into the wild that you're referring to comes from adding false entries to their own databases, so allowing consumer to sue for libel whenever an entry is wrong would force them and their up-stream data providers to clean up their act in a hurry.

JoeCoder_ 9y ago

When a private company has a massive failure, customers have the freedom to go elsewhere and the company may go out of business. When a government agency has a massive failure, we're of stuck with it, short of hoping politicians might do something about it.

whafro 9y ago
That's sorta the point – in this case, I have no ability (as a consumer) to "go elsewhere." Aside from the two times I've placed freezes on my credit history, I have no relationship with Equifax, and have never consented in any way to what they collect and share about me. This contrasts pretty heavily with, say, Facebook – where even though they collect and share plenty of information about me, I'm at least both consenting and continuing to feed them by using a service I presumably find worth the trade-off. If you are the type of person who gets upset about this dynamic of Facebook, then Equifax should be completely next-level.
- dominotw 9y ago
  > and have never consented in any way to what they collect and share about me. Dont you consent to credit reporting when you sign up to get credit, though. You can "choose" to not use Equifax by not getting credit from people who report to equifax.
  - tclancy 9y ago
    How would that possibly work? There are (I think) 3 brokers and creditors tend to share info back to all of them.
  - lghh 9y ago
    > Dont you consent to credit reporting when you sign up to get credit, though. No, I consent to allow creditors to do their due diligence to see if I'm a viable candidate for their product. Equifax is not required in this transaction, it's just beneficial for the creditor, their customer, to use them to streamline that information collecting process. Loans and credit existed prior to credit reporting agencies and will exist long after.

0xfeba 9y ago

A pipe dream. As evidenced by the stock price, nothing will change. People don't care--at least not enough to do something like call their elected official, if they even know who they are. Which brings me to a question of the "have things always been like this?" sort. Do we have data on the percentage of any population who's active in politics over the past, say, 7 decades?

lukejduncan 9y ago

The interesting thing about this sentiment and reasoning is that it could equally be said of data brokers in general. Changes here could have big impacts on the ads ecosystem. I don't know my opinion here, but between things like GDPR and op eds like this I have to imagine there are ad and data broker executives doing some worst case analysis and spin/ talking point preparation.

koolba 9y ago

> Equifax is the oldest of the Big Three credit reporting bureaus, and it got its start as a private investigator in the late 1800s. A client — a business or a bank — would ask it about a consumer, and it would go about digging up dirt on things like marital problems and convictions. That client would then pay it for its services. > This questionable business model raised eyebrows in the 1960s, when the companies were still compiling information on people’s “moral character” such as affairs or drinking problems. At the time, the reports weren’t available at all to the subjects themselves. That changed with the Fair Credit Reporting Act, which was signed in 1970. But even that reform put virtually no oversight on the bureaus’ practices. As if there aren't a bunch of companies trying to do exactly this with a combination of tracking cookies, browser history, purchase history, and ML. Separately, from the article (emphasis mine): > The United States government is, of course, not impervious to data breaches, nor does it have a perfect track record of fending them off. In 2015, it announced that hackers had stolen “sensitive information” on 21.5 million people. But the government is at least accountable to public pressure. Equifax never will be, even under the tightest regulation. Equifax may not have to change anything as there's a very real chance it goes bankrupt because of this. It's not just from the cost of lawsuits from consumers. There's a longer term cost of businesses not wanting to deal with them. The risk of that happening to one of the other big credit reporting agencies is the biggest driver for them to clean up their act. The threat to their businesses is real and I'd imagine their internal responses will be as well. I also think regardless of what they do it's only a matter of time till they have a breach as well. You only have to screw up once. > Credit bureaus have proved to be complete failures at safeguarding the public. Nearly all companies are complete failures at data security. There's not special about credit bureaus here. They just happen to have a lot of sensitive data on a lot of people and thus are a hot target. As an example, we've had plenty of breaches in the health insurance industry as well. Perhaps the best approach would be a "too big to fail" limit on the bureaus. Put a cap on the total size (in accounts / people covered) of a credit bureau. The libertarian in me is screaming at the thought of something like that but at least it has the advantage of limiting breaches to a max number of people. > Let’s demand we get our data back. It was never your data.

dmh2000 9y ago

sp the government is better at security? https://www.nytimes.com/2017/09/20/business/sec-hacking-attack.html https://www.nytimes.com/2017/09/20/business/sec-hacking-atta...

rmdundon 9y ago
Not to mention the OPM hack

SamuelAdams 9y ago

"Equifax could easily have patched the hole in its system that hackers exploited, but it simply didn’t." We don't know why, though. Perhaps they were working with law enforcement to track the attacker. Closing the hole would certainly alert the attackers and end the chance to catch them. This reads just like the Cuckoo's Egg.

inetknght 9y ago
Your argument is that law enforcement wanted to risk the identities of millions of Americans they're supposed to protect? That logic is simply broken. Either the argument is strawman or law enforcement is just as guilty of negligence as Equifax is.
- talmand 9y ago
  I don't know about this situation but I'm willing to bet one could find many examples of law enforcement doing that very thing in various different cases. Law enforcement is about enforcing the law, not protecting law-abiding citizens from criminals.

matt-attack 9y ago

I don't agree with trying to create a public government-run institution to track how "reliable" each citizen is. The solution to all of this is clear. Credit agencies provide a service primarily to lenders. These lenders count on the agencies' ratings to be a reliable predictor of the reliability of its potential customers. If those companies' products are no longer a reliable predictor, they shouldn't use them.

cmiles74 9y ago
> If those companies' products are no longer a reliable predictor, they shouldn't use them. I think this is very optimistic. It's hard for me to imagine a situation in which lenders are questioning the reliability of these credit reports and the only scenario I can come up with is one in which the reporting agency are over-estimating people's ability to reliably repay debt to the point where the lenders are losing so much money that they actually notice. Given that most consumers complain that these reports include erroneous /negative/ information, this scenario seems unlikely. Lenders will continue to use these reporting companies, no matter how poor their product, because there is no measure against which to judge their product except each other. They'll continue to use them out of inertia, out of erring on the side of caution, and because this is the way they have always done business.
- stult 9y ago
  Well, I guess the sticking point is that no one has found a better way to measure loan risk. If they had, lenders would work with the agency that more accurately assesses their risk because otherwise they are leaving money on the table by not lending to creditworthy individuals.
  - cmiles74 9y ago
    Agreed. As long as credit reporting companies report conservative numbers and lenders err on the side of minimizing risk, all of the potential lost dollars will fall into the "loans I could've made money on but decided not to loan out" category and that is difficult to gauge.

jedbrown 9y ago

This can be fixed by a small change to privacy liability law. Current law requires litigants to show actual economic harm. That is hard to do in cases of identity theft and privacy violations, which is why the OPM case was just dismissed [1]. If this was changed so that a privacy violation could be litigated, companies like Equifax would need to buy insurance against such actions. Alternatively, there could be a new law that any company storing SSN-type data owed some nominal amount (say, $10) to the owner of that data if it is compromised for any reason. Either way, companies that aggregate large amounts of such data would end up buying insurance. No insurance company would sell such policies without due diligence -- they would establish security requirements and pen testing. Consumers are protected by the existence of an actuarially fair insurance policy. not by the (nominal) compensation. Note that Equifax's customers are (primarily) not consumers. Regulations (in the form of liability law reform or nominal compensation) may not be required in industries where companies only hold the data of their own customers, but such companies could cite their insurance policy to convince their customers that they take security seriously. (Now it's always empty words.) [1] https://www.washingtonpost.com/news/powerpost/wp/2017/09/20/federal-court-denies-cash-awards-to-22-million-opm-data-theft-victims/ https://www.washingtonpost.com/news/powerpost/wp/2017/09/20/...

mediocrejoker 9y ago
This sounds like the most efficient solution to me. There is no need (and for many, no desire) for the government to take on the role of tracking citizens. A minor but strategic change in liability law around privacy would shift incentives in the way you describe and suddenly it becomes in the best financial interests of the companies to protect the data. Indeed this is the only kind of incentive they will respond to. Nationalizing the credit industry doesn't really solve any real problems as far as I can tell.
- Frondo 9y ago
  Frankly speaking, if we're going to be tracked (and we are, lots and lots), I want the government as involved as possible, whether through strict regulations or through being the central repository for that information. Maybe do it state-by-state, so long as each state follows some federal guidelines and each state provides a way to interoperate with the rest, and with private businesses that need access to that information, if the feds freak you out. Why? Because I can, in theory, have my say in how the government operates. I can vote, I can submit comments, I can go talk to elected officials, whatever. I have zero recourse when private companies schlep my data around and wreck my life. Voting with your vote is best, but I can't even vote with my dollar with Equifax.

khana 9y ago

YES

eternalban 9y ago

This is a perfect opportunity for "distrupting" this sector. Why is no one stepping up and flipping the business model on credit reporting?

tantalor 9y ago
Here are some, https://www.prbc.com/ https://www.prbc.com/ (2002) http://www.dataxltd.com/ http://www.dataxltd.com/ (2004) https://ws.factortrust.com/ https://ws.factortrust.com/ (2005) See also https://wallethub.com/edu/credit-reporting-agencies/25518/ https://wallethub.com/edu/credit-reporting-agencies/25518/
wpietri 9y ago
Disruption solve a problem better for the customer. There's little evidence that credit bureau customers (lenders, et al) experience this as a problem. So I don't think this is much of an opportunity for disruption.

ma2rten 9y ago

In at least 40 other countries — including Belgium, France, Germany, Italy and Spain — credit reporting can be done by a public credit registry. This is not true for Germany. https://en.wikipedia.org/wiki/Schufa https://en.wikipedia.org/wiki/Schufa

transverse 9y ago

Just can't stop posting paywalled crap? Yes, NYT is paywalled after a certain low number of free articles.

jwilk 9y ago
From the FAQ: It's ok to post stories from sites with paywalls that have workarounds. In comments, it's ok to ask how to read an article and to help other users do so. But please don't post complaints about paywalls. Those are off topic.
- transverse 9y ago
  I know how to read an article. I click on the link, the article loads, and I read it. If only NYT knew that HN was popularizing workarounds, they'd be so happy about it, not. It is because of you that paywalled sites haven't died yet.

_jal 9y ago

Now here is a perfect, legitimate use of libel law. If a company with whom you have no relationship is lying about you to people with whom you're attempting to do business, that sounds like libel to me. Of course, that's preempted by a federal law that Equifax & friends carefully purchased. Perhaps all we need is for them to lose that protection to give them a reason to care.

rectang 9y ago
Now you're talkin'! Today, an ordinary person can barely even get inaccuracies in a credit report changed after laborious effort -- to say nothing of being denied a house, a car, or a job as a result of that inaccurate info. Equifax and the credit agencies only exist because they are allowed to perpetrate great harm spread across millions. They are a giant negative externality.

kazinator 9y ago

> Although they call themselves bureaus, there is nothing governmental about what these private companies do. That is a naive statement, perhaps based on an idealized version of a few cherry-picked governments.

bogomipz 9y ago

The only proposal for any kind of action I have heard on this is the Warren and Schatz legislation which is appropriately titled" Freedom from Equifax Exploitation (FREE) Act"[1] Aside from Senator Warren I have heard very little concern from lawmakers in Washington regarding the menace that these credit reporting agencies have become and the threat they pose to people. [1] https://www.warren.senate.gov/?p=press_release&id=1837 https://www.warren.senate.gov/?p=press_release&id=1837

njarboe 9y ago

I can understand the impulse to want Equifax punished for getting hacked and releasing all of this information. But I think these credit bureaus are small fry compared the size of the companies that are at the root of the problem: banks and other entities that make loans. The reason most people don't like the credit bureaus are the fear of "identity theft" not the spread of truthful information about themselves. A bank makes a loan to a fraudster who is impersonating you. The fraudster defaults on the loan and the the bank tells a lie about you to the credit bureau, which gets spread around and hurts you in many ways. If we called this situation "bank slander" or "bank libel", the focus would be on who is creating the problem: the bank with its lie. Create high enough penalties for banks reporting false loan defaults and "identity theft" will disappear as the banks become more cautious of fraudsters. This is unlikely to happen as banks are concentrated and powerful institutions. "To big to fail" I believe is the term. I don't think the credit bureaus themselves are that influential in Congress but the banks want them and will lobby on their behalf. It would be interesting to know how much money the banks get from people illegally each year from people paying off fraudsters debts to clear their credit reports from the false default reports from banks.

DamnInteresting 9y ago

I keep seeing calls for the government to revoke Equifax's corporate charter, because we citizens cannot vote with our wallets in this case; we are not Equifax's customers. But I wonder about Equifax's actual customers, the financial institutions that choose to rely on Equifax for credit reporting. What sensible institution would continue to trust Equifax after all of this nonsense? Perhaps banks and the like should all abandon Equifax as a credit reporting source and let the company die of natural causes.

dredmorbius 9y ago
Equifax's actual customers face no risk, on the outbound reports side. Data sources might be another case.

optimuspaul 9y ago

I think the real problem is that we have no definitive way to prove who we are. A SSN is fine and all but it's just a number that anyone can obtain and say they are me. We need key pairs or some way to prove that when we are requesting credit that we are in fact the person that we say we are. Until that happens the systems is exploitable by even the most inept of criminals.

24gttghh 9y ago
I wrote to my senator about this solution weeks ago and have yet to receive an actual reply. I think the problem is figuring out the transition from SSN's to something like key pairs/TOTP. How do we securely establish the "new" identity and pair it to the old SSN? Do we even bother and just start from scratch?

deleted 9y ago

[deleted]

mywittyname 9y ago

Individuals should have the option to tell companies requesting credit checks that they do not consent. Further more, it should be illegal to hold non-consent against the individual.

eevilspock 9y ago

> That’s because we are not the customers... but the product. An increasingly familiar pattern. The free market is flipping against the people.