12 ms·

“Any company doing something I don’t like should be nationalized.” No. They should be liable for the damage they cause with negligently allowing hacks like thi

“Any company doing something I don’t like should be nationalized.” No. They should be liable for the damage they cause with negligently allowing hacks like this, but the existence of private businesses should be default-allow.

chillydawg 9y ago
And in this case, a reasonable exception made to deny.
mannykannot 9y ago
I am not philosophically opposed to nationalization in a case like this, where market forces do not have much influence, but I completely agree that the proposal address neither of the the major issues, which are a) incompetence in security, and b) the widespread use of identity and authentication systems that are predicated on a level of confidentiality that does not exist in practice. Frankly, I don't know what should be done about b), but nationalization of credit reporting is not going to make any difference. As for a), as has been pointed out many times, one problem is that the people responsible do not have enough skin in the game. So long as the companies are private, something could, in principle, be done to to increase that, but in a nationalized industry, the responsible people would have even less personally at risk.
paulgb 9y ago
How do you ensure that a company doesn't become liable for more damage than they can afford to repair, though? Maybe nationalization isn't the answer, but with the current state of things the public essentially subsidizes careless companies by taking on most of their downside risk.
- inetknght 9y ago
  Why should we ensure that a company doesn't become liable for more damage than they can afford to repair? The implication there is that the company has a right to exist. If they're so grossly negligent, why should they have a right to exist? I don't know anyone outside of high finance who had a good opinion of Equifax before the breach was announced. Their recent hardships has certainly not helped that. For myself, I definitely think that companies and their officers should absolutely be liable for negligence.
  - sp332 9y ago
    Because they're not going to be able to pay back the damage they did. If they screw over a hundred million people and then go bankrupt, those hundred million people are stuck with the bill.
    - Applejinx 9y ago
      And if they continue to operate and continue to screw people over, what's the cost of that? It's not like they're benefitting anybody (not 'people' anybody).
      - paulgb 9y ago
        The problem isn't that they're allowed to go bankrupt, it's that they're allowed to make bets with huge downside risk knowing that if they lose the bet they don't bare the cost.
        keganunderwood 9y ago
        What about when an SV darling company offers "lifetime" product and sells itself to another SV darling? I'm of course talking about joyent but it could be me next time. If we get rid of limited liability, do I become liable for BP's oil spills because I have own a few cents worth of petroleum stock through vanguard? I like your idea that companies should be able to bear the cost of a possible future liability. I don't know how we can implement it besides some form of insurance (like sometime else said a $10 fine per person per breach but I'd up it to (2000 * minimum wage per hour) for every incident per person. At some point though we will need criminal charges for negligence or worse attempts of cover up (Equifax). We need to make it easier to convict CEOs and the board to put them in prison in case of attempted cover up or non disclosure.
        colorint 9y ago
        The global financial crisis showed that insurance isn't the answer. The problem with "hedging against all futures" is that the hedging is part of the system, and when the hedge grows to the scale of the thing being hedged, you have to start asking how you hedge the hedge (and so forth). That is, if Equifax can't pay out for a sufficiently large mistake, why would you expect their insurer to be able to do so? And, worse, what if the insurer is "too big to fail," so instead you just have the public serve as the backstop? Hence I think your latter point is right, executives really need to be more criminally liable. It's hardly unheard of, even if Ken Lay died before sentencing.
- Shivetya 9y ago
  how are we so quick to excuse companies that would provide credit without validating who is actually applying? the danger with the Equifax exposure is the lack of safeguards companies using the information apply. just because someone gets my information by no means any company should accept a credit application, especially those outside of the area where the person has residence. It is this lack of safeguards that we should take issue with. Those issuing credit should always be liable for any loss.
  - deleted 9y ago
    [deleted]
  - harikb 9y ago
    This is not just about "credit". There is a lot more damage caused by the leak of untold amount of information about you. Wait till someone stars social engineering attacks against other sites based on revealed data.
- cmiles74 9y ago
  It's not the public's responsibility to ensure that companies don't over-extend themselves. When they do, they go out of business; this is how the market should work, in my opinion.
  - scott_s 9y ago
    That is not paulgb's concern, as I understand it. That is, paulgb is not concerned with the company itself, but rather its ability to undo harms to others. Companies going out of business doesn't correct the harm done to society.
    - cmiles74 9y ago
      I see what your saying, but that also seems like the market at work. If the harm done to society is sufficiently large, perhaps at that point society might decide create a government entity to meet the need... I do think that the company's failure and the infliction of harm on society is an important part of the feedback loop; I'm not sure we should be trying to prevent that (I mean, harm in terms of dollars or time lost, etc.)
fortythirteen 9y ago
"Let's fix a massive problem, caused by the lack of accountability that comes with bureaucracy, by adding even more bureaucracy!"
- vec 9y ago
  Equifax doesn't lack accountability because they're bureaucratic. They just lack accountability, period. The customers aren't being hurt and the people being hurt aren't customers. Adding accountability to the general public via regulation may make them more bureaucratic. It may make them less. That's up to the invisible hand to decide, once their incentive structure matches their real world impact.
  - Applejinx 9y ago
    They ARE the invisible hand, personified. The invisible hand got us here. Clearly, it's an invisible hand with palsy (possibly claws, or leprosy). Mind you, I agree about adding accountability. I just doubt that's really a solution; it's part of a solution.
- wpietri 9y ago
  Have you ever worked in a regulated industry? My experience is that regulators add accountability to bureaucracy. Bureaucracies brush off harm to customers pretty well. But when a regulator can fuck their shit up, they listen.
  - fortythirteen 9y ago
    Sure have. The bureaucracy brought on by regulation rewards company employees who are bureaucratic beasts themselves. I've never worked in a more political, wasteful, back-stabbing environment than when I worked for a large company whose business was regulated.
    - wpietri 9y ago
      Huh. That hasn't been my experience. I can't talk about the details due to NDA, but I was surprised at the extent to which fear of regulators produced useful behaviors.
yebyen 9y ago
I never consented to have my information in their database, and I have no power to get it out of their database. They have roundly and repeatedly demonstrated that they are not fit to hold and be trusted with maintaining the SSNs and other personal information of the entire country's worth of credit holders. Is there even a license that the Equifax company needs to have, in order to do this type of work, that can be revoked? It needs to be revoked! But I'm afraid they don't need any license, they just woke up like this. The right to covertly surveil and maintain dossiers on 50%+ of the citizens of this country should not be default-allow. Strongly disagree. People in power holding that kind of opinion, is exactly how we got here.
- newscracker 9y ago
  > I never consented to have my information in their database, Don't you think that somewhere in the T&Cs of a loan you took or a credit card that you got or a phone contract you signed up for (or many other things) are lines explaining that your information would be shared with credit reporting agencies? So legally, you would've consented to the sharing of information at those times. If that isn't true, then I'd assume that you should be able to sue the institution that shared your information with all these agencies.
  - brango 9y ago
    Oh yeah, so you do have a choice if you want to live in a cave.
    - dmoy 9y ago
      What is a reasonable alternative to credit agencies? Most countries I know use similar (or sometimes the same, like the UK) agencies, though sometimes with a caveat that they only log defaults or other stuff you mess up.
      - yebyen 9y ago
        The alternative is the two other credit agencies that haven't (as far as we know) given up all of our personal information to hackers, and who haven't responded to the news of the breach by linking some of their customers to a parody/phishing site that was nearly indistinguishable from their own (very bad) breach response website. There is no way out of this (the cat is out of the bag) but we can go on about our lives without Equifax. They need to be unplugged.
scott_s 9y ago
The existence of private business is default allow. That objection makes it sound like the author is arguing that all business should have to get government permission to exist. (Which, they kinda do if they want to get incorporated, but that's a low bar.) The author is making a different argument: this particular business is working in a market with incentives so perverse that they are more likely to be harmful than not. If we deem these kind of services necessary, then let's make it a government program so that the incentives are correctly aligned.
rectang 9y ago
> the existence of private businesses should be default-allow Equifax spreads misery across the general population. I have seen no practical proposals which allow us ordinary people to claw back the time and frustration these private companies suck out of us. How endlessly should they be allowed to socialize their losses and force us to subsidize them?
- bogomipz 9y ago
  Indeed and to putting a fraud alert on your credit profile is only good for 90 days. This is curious since one's identity - name and social security number don't change after 90 days. The onus of protection is on the consumer - the very people who never authorized the companies to collect and sell their financial identity. The concerned consumer needs to call back every 3 months to continue a fraud alert. For those who don't know the value in placing a fraud alert is that it forces anyone extending you credit to first call you and verify that you actually intended to open the line of credit in your name. This is something that should be standard operating procedure and not a special consideration.
  - KGIII 9y ago
    There are two ways to freeze your credit. The first is good for 90 days and you have to authorize any requests. The second is permanent, until you revoke it. To revoke it, you need a PIN that they give you when you freeze it. There are three companies to do it at. The cost is low and it is mandated to be free in some jurisdictions.
    - rectang 9y ago
      Do you seriously believe that credit freezes are an adequate response to the massive harms inflicted upon individuals by identity theft and credit report inaccuracies?
      - bogomipz 9y ago
        They aren't and they further shift the responsibility of dealing with credit agencies negligence onto the consumer. You want to rent an apartment, change your cell phone carrier, get home owner's insurance, order cable - all of these things require a credit check and you having to pay 5 dollars to each agency and making 3 separate calls to each of them to do so.
caseysoftware 9y ago
The problem is that we already have a nationalized version of this - the OPM database for security clearances - and it too has been hacked. It was known vulnerable in 2009 and nothing was done about it until it was known to be hacked 6 years later. Even worse, while the author criticizes how Equifax got started - private investigators looking for affairs, etc - that is exactly what the OPM database is. They're looking for things that could be used to blackmail an individual so it includes financial history, marital info, drug use/abuse info, and potentially medical records. My coverage of it at the time: https://caseysoftware.com/blog/why-this-security-breach-is-worse-than-all-the-others-combined https://caseysoftware.com/blog/why-this-security-breach-is-w... And no, there has been zero accountability around it. Whenever someone says "the govt can protect this info better!" remember that this is the same government that doesn't follow the law with regards to wiretaps, FOIA requests, background check info, and many, many other things. Oh, and the NSA can't even protect their best tools.
- KGIII 9y ago
  All I got from the OPM hack was a form letter and free credit monitoring that I had no use for. Instead, I had to freeze my credit. Fortunately, I'm not really at risk for blackmail and I'm not worried about my information being out there. I am, however, worried about the information in my file that is about other people. They contacted and interviewed lots of my friends and family. Those notes, and the associations between these groups of people, are all in the data that was exfiltrated. You know what my friends and family got? Nothing, not even a form letter. Me? I'll be fine. However, some of them are now associated with others and who knows what other connections can be drawn when you cross-check with other information from the hack? So, yeah, I'm jaded and skeptical about the idea of having it be a government operation. People keep saying this is the worst hack ever. Man, if they only knew what was in the clearance application. I disclosed all sorts of things that I really don't want to be public information. And I got a form letter that was barely an apology. Hell, I think my notification was actually on a post card. Yeah, I just double checked. They sent my notification on a post card, not even in a secure envelope. I may be a bit biased.
  - turk184 9y ago
1_2__4 9y ago
The cry of the neo-liberal: "The market will sort this out!", usually in response to an event demonstrating the exact opposite.
- wpietri 9y ago
  Definitely. I love markets; they can do amazing stuff. But we're talking an invisible hand, not an invisible magic sparkle unicorn. I look at a market as a machine that we can deploy. It does a specific thing, but only with the right inputs and working conditions. Here, we are not Equifax's customers. Harm to us is a negative externality, which is a classic kind of market failure: http://www.economicsonline.co.uk/Market_failures/Types_of_market_failure.html http://www.economicsonline.co.uk/Market_failures/Types_of_ma... So markets don't fix this even in theory. Personally, I'd like to see this problem turned over to an institution something like the Smithsonian: not a regular part of government, but a trust with a specific purpose. I'd be even happier with it if it had directly elected privacy commissioners, so that it was more accountable to the people whose data it safeguards. We're only going to end up with more data that's about people, even if it's not generated or held by those people. Having a home for that data, one with a public purpose and public accountability, seems way better to me than leaving it for a private, profit-making corporation to exploit.
  - dredmorbius 9y ago
    NB, but the "invisible hand" rhetoric is a gross misrepresentation of Smith's intent. Economic historian Gavin Kennedy has made something of a career debunking this fallacy. Among his many writings: The sorry invisible hand myth owes more to imagination and hope than it does to economics from Adam Smith. Its modern form really began its take off with Paul Samuelson’s successful textbook, “Economics: an analytical introduction”, McGraw-Hill 1948, and continued through to edition 20 in 2010. It had an earlier oral presence at Chicago (where Samuelson was an undergraduate) and Cambridge, England (A. C. Pigou). Even Oscar Lange postulated (1938 and 1947) a rival and “better” invisible-hand role by socialist planners. The Soviet planned economy challenged capitalism from the 1930s and in Cold War rivalry, with large communist parties and social-democratic in Western Europe, the myth asserted the innate superiority of capitalism with its “invisible hand”. Since the current recession, increasing questions appeared about its existence. Warren Samuel’s last book, “Erasing the Invisible Hand, essays on a elusive and misused concept in economics”, 2011 (Cambridge) exposes the modern history of the mythical “invisible hand” since its heyday from the 1960s through to the late 1990s http://adamsmithslostlegacy.blogspot.com/2012/04/political-scientist-most-right-in.html http://adamsmithslostlegacy.blogspot.com/2012/04/political-s...
kazinator 9y ago
> They should be liable for the damage If they are are so liable, then to remain profitable they will find a way to pass on their cost to the customers. Those customers in turn, will pass it on to the consumer. So then you end up footing liability insurance bill for the privilege of being subject to a credit search.
- rectang 9y ago
  That's better than the situation we have now, where Equifax and the credit agencies are only profitable because they stick the general population with the liability and the losses.
  - kazinator 9y ago
    How does liability help? What's the idea; that if a whole network of criminals now has my personal info, there will be an insurance-backed fund that will instantly buy me a whole new identity, so life goes on merrily? Nope! We must rather completely get rid of this Equifax and make it a criminal offense for anyone to share such info with any emerging Equifax-like agency, or with anyone else. Your data going to Equifax is the fucking security breach. What happens afterward is just a footnote.
- dredmorbius 9y ago
  If they're liable, they can also mitigate risk and /or exit lines of business with excessive risk.
awj 9y ago
I need to be licensed to drive because my incompetence could ruin people's lives. Why is that commonly accepted, but it's horrible to contemplate regulation of Equifax for the same essential reasons?
ExactActuation 9y ago
"default-allow". What is this, a firewall config file or a conversation?
curun1r 9y ago
In addition, untrue entries in their database should constitute libel. Most (but not all) of the damage from letting SSN/name/address combinations out into the wild that you're referring to comes from adding false entries to their own databases, so allowing consumer to sue for libel whenever an entry is wrong would force them and their up-stream data providers to clean up their act in a hurry.

chillydawg 9y ago

And in this case, a reasonable exception made to deny.

mannykannot 9y ago

I am not philosophically opposed to nationalization in a case like this, where market forces do not have much influence, but I completely agree that the proposal address neither of the the major issues, which are a) incompetence in security, and b) the widespread use of identity and authentication systems that are predicated on a level of confidentiality that does not exist in practice. Frankly, I don't know what should be done about b), but nationalization of credit reporting is not going to make any difference. As for a), as has been pointed out many times, one problem is that the people responsible do not have enough skin in the game. So long as the companies are private, something could, in principle, be done to to increase that, but in a nationalized industry, the responsible people would have even less personally at risk.

paulgb 9y ago

How do you ensure that a company doesn't become liable for more damage than they can afford to repair, though? Maybe nationalization isn't the answer, but with the current state of things the public essentially subsidizes careless companies by taking on most of their downside risk.

inetknght 9y ago
Why should we ensure that a company doesn't become liable for more damage than they can afford to repair? The implication there is that the company has a right to exist. If they're so grossly negligent, why should they have a right to exist? I don't know anyone outside of high finance who had a good opinion of Equifax before the breach was announced. Their recent hardships has certainly not helped that. For myself, I definitely think that companies and their officers should absolutely be liable for negligence.
- sp332 9y ago
  Because they're not going to be able to pay back the damage they did. If they screw over a hundred million people and then go bankrupt, those hundred million people are stuck with the bill.
  - Applejinx 9y ago
    And if they continue to operate and continue to screw people over, what's the cost of that? It's not like they're benefitting anybody (not 'people' anybody).
    - paulgb 9y ago
      The problem isn't that they're allowed to go bankrupt, it's that they're allowed to make bets with huge downside risk knowing that if they lose the bet they don't bare the cost.
      - keganunderwood 9y ago
        What about when an SV darling company offers "lifetime" product and sells itself to another SV darling? I'm of course talking about joyent but it could be me next time. If we get rid of limited liability, do I become liable for BP's oil spills because I have own a few cents worth of petroleum stock through vanguard? I like your idea that companies should be able to bear the cost of a possible future liability. I don't know how we can implement it besides some form of insurance (like sometime else said a $10 fine per person per breach but I'd up it to (2000 * minimum wage per hour) for every incident per person. At some point though we will need criminal charges for negligence or worse attempts of cover up (Equifax). We need to make it easier to convict CEOs and the board to put them in prison in case of attempted cover up or non disclosure.
        colorint 9y ago
        The global financial crisis showed that insurance isn't the answer. The problem with "hedging against all futures" is that the hedging is part of the system, and when the hedge grows to the scale of the thing being hedged, you have to start asking how you hedge the hedge (and so forth). That is, if Equifax can't pay out for a sufficiently large mistake, why would you expect their insurer to be able to do so? And, worse, what if the insurer is "too big to fail," so instead you just have the public serve as the backstop? Hence I think your latter point is right, executives really need to be more criminally liable. It's hardly unheard of, even if Ken Lay died before sentencing.
Shivetya 9y ago
how are we so quick to excuse companies that would provide credit without validating who is actually applying? the danger with the Equifax exposure is the lack of safeguards companies using the information apply. just because someone gets my information by no means any company should accept a credit application, especially those outside of the area where the person has residence. It is this lack of safeguards that we should take issue with. Those issuing credit should always be liable for any loss.
- deleted 9y ago
  [deleted]
- harikb 9y ago
  This is not just about "credit". There is a lot more damage caused by the leak of untold amount of information about you. Wait till someone stars social engineering attacks against other sites based on revealed data.
cmiles74 9y ago
It's not the public's responsibility to ensure that companies don't over-extend themselves. When they do, they go out of business; this is how the market should work, in my opinion.
- scott_s 9y ago
  That is not paulgb's concern, as I understand it. That is, paulgb is not concerned with the company itself, but rather its ability to undo harms to others. Companies going out of business doesn't correct the harm done to society.
  - cmiles74 9y ago
    I see what your saying, but that also seems like the market at work. If the harm done to society is sufficiently large, perhaps at that point society might decide create a government entity to meet the need... I do think that the company's failure and the infliction of harm on society is an important part of the feedback loop; I'm not sure we should be trying to prevent that (I mean, harm in terms of dollars or time lost, etc.)

fortythirteen 9y ago

"Let's fix a massive problem, caused by the lack of accountability that comes with bureaucracy, by adding even more bureaucracy!"

vec 9y ago
Equifax doesn't lack accountability because they're bureaucratic. They just lack accountability, period. The customers aren't being hurt and the people being hurt aren't customers. Adding accountability to the general public via regulation may make them more bureaucratic. It may make them less. That's up to the invisible hand to decide, once their incentive structure matches their real world impact.
- Applejinx 9y ago
  They ARE the invisible hand, personified. The invisible hand got us here. Clearly, it's an invisible hand with palsy (possibly claws, or leprosy). Mind you, I agree about adding accountability. I just doubt that's really a solution; it's part of a solution.
wpietri 9y ago
Have you ever worked in a regulated industry? My experience is that regulators add accountability to bureaucracy. Bureaucracies brush off harm to customers pretty well. But when a regulator can fuck their shit up, they listen.
- fortythirteen 9y ago
  Sure have. The bureaucracy brought on by regulation rewards company employees who are bureaucratic beasts themselves. I've never worked in a more political, wasteful, back-stabbing environment than when I worked for a large company whose business was regulated.
  - wpietri 9y ago
    Huh. That hasn't been my experience. I can't talk about the details due to NDA, but I was surprised at the extent to which fear of regulators produced useful behaviors.

yebyen 9y ago

I never consented to have my information in their database, and I have no power to get it out of their database. They have roundly and repeatedly demonstrated that they are not fit to hold and be trusted with maintaining the SSNs and other personal information of the entire country's worth of credit holders. Is there even a license that the Equifax company needs to have, in order to do this type of work, that can be revoked? It needs to be revoked! But I'm afraid they don't need any license, they just woke up like this. The right to covertly surveil and maintain dossiers on 50%+ of the citizens of this country should not be default-allow. Strongly disagree. People in power holding that kind of opinion, is exactly how we got here.

newscracker 9y ago
> I never consented to have my information in their database, Don't you think that somewhere in the T&Cs of a loan you took or a credit card that you got or a phone contract you signed up for (or many other things) are lines explaining that your information would be shared with credit reporting agencies? So legally, you would've consented to the sharing of information at those times. If that isn't true, then I'd assume that you should be able to sue the institution that shared your information with all these agencies.
- brango 9y ago
  Oh yeah, so you do have a choice if you want to live in a cave.
  - dmoy 9y ago
    What is a reasonable alternative to credit agencies? Most countries I know use similar (or sometimes the same, like the UK) agencies, though sometimes with a caveat that they only log defaults or other stuff you mess up.
    - yebyen 9y ago
      The alternative is the two other credit agencies that haven't (as far as we know) given up all of our personal information to hackers, and who haven't responded to the news of the breach by linking some of their customers to a parody/phishing site that was nearly indistinguishable from their own (very bad) breach response website. There is no way out of this (the cat is out of the bag) but we can go on about our lives without Equifax. They need to be unplugged.

scott_s 9y ago

The existence of private business is default allow. That objection makes it sound like the author is arguing that all business should have to get government permission to exist. (Which, they kinda do if they want to get incorporated, but that's a low bar.) The author is making a different argument: this particular business is working in a market with incentives so perverse that they are more likely to be harmful than not. If we deem these kind of services necessary, then let's make it a government program so that the incentives are correctly aligned.

rectang 9y ago

> the existence of private businesses should be default-allow Equifax spreads misery across the general population. I have seen no practical proposals which allow us ordinary people to claw back the time and frustration these private companies suck out of us. How endlessly should they be allowed to socialize their losses and force us to subsidize them?

bogomipz 9y ago
Indeed and to putting a fraud alert on your credit profile is only good for 90 days. This is curious since one's identity - name and social security number don't change after 90 days. The onus of protection is on the consumer - the very people who never authorized the companies to collect and sell their financial identity. The concerned consumer needs to call back every 3 months to continue a fraud alert. For those who don't know the value in placing a fraud alert is that it forces anyone extending you credit to first call you and verify that you actually intended to open the line of credit in your name. This is something that should be standard operating procedure and not a special consideration.
- KGIII 9y ago
  There are two ways to freeze your credit. The first is good for 90 days and you have to authorize any requests. The second is permanent, until you revoke it. To revoke it, you need a PIN that they give you when you freeze it. There are three companies to do it at. The cost is low and it is mandated to be free in some jurisdictions.
  - rectang 9y ago
    Do you seriously believe that credit freezes are an adequate response to the massive harms inflicted upon individuals by identity theft and credit report inaccuracies?
    - bogomipz 9y ago
      They aren't and they further shift the responsibility of dealing with credit agencies negligence onto the consumer. You want to rent an apartment, change your cell phone carrier, get home owner's insurance, order cable - all of these things require a credit check and you having to pay 5 dollars to each agency and making 3 separate calls to each of them to do so.

caseysoftware 9y ago

The problem is that we already have a nationalized version of this - the OPM database for security clearances - and it too has been hacked. It was known vulnerable in 2009 and nothing was done about it until it was known to be hacked 6 years later. Even worse, while the author criticizes how Equifax got started - private investigators looking for affairs, etc - that is exactly what the OPM database is. They're looking for things that could be used to blackmail an individual so it includes financial history, marital info, drug use/abuse info, and potentially medical records. My coverage of it at the time: https://caseysoftware.com/blog/why-this-security-breach-is-worse-than-all-the-others-combined https://caseysoftware.com/blog/why-this-security-breach-is-w... And no, there has been zero accountability around it. Whenever someone says "the govt can protect this info better!" remember that this is the same government that doesn't follow the law with regards to wiretaps, FOIA requests, background check info, and many, many other things. Oh, and the NSA can't even protect their best tools.

KGIII 9y ago
All I got from the OPM hack was a form letter and free credit monitoring that I had no use for. Instead, I had to freeze my credit. Fortunately, I'm not really at risk for blackmail and I'm not worried about my information being out there. I am, however, worried about the information in my file that is about other people. They contacted and interviewed lots of my friends and family. Those notes, and the associations between these groups of people, are all in the data that was exfiltrated. You know what my friends and family got? Nothing, not even a form letter. Me? I'll be fine. However, some of them are now associated with others and who knows what other connections can be drawn when you cross-check with other information from the hack? So, yeah, I'm jaded and skeptical about the idea of having it be a government operation. People keep saying this is the worst hack ever. Man, if they only knew what was in the clearance application. I disclosed all sorts of things that I really don't want to be public information. And I got a form letter that was barely an apology. Hell, I think my notification was actually on a post card. Yeah, I just double checked. They sent my notification on a post card, not even in a secure envelope. I may be a bit biased.
- turk184 9y ago

1_2__4 9y ago

The cry of the neo-liberal: "The market will sort this out!", usually in response to an event demonstrating the exact opposite.

wpietri 9y ago
Definitely. I love markets; they can do amazing stuff. But we're talking an invisible hand, not an invisible magic sparkle unicorn. I look at a market as a machine that we can deploy. It does a specific thing, but only with the right inputs and working conditions. Here, we are not Equifax's customers. Harm to us is a negative externality, which is a classic kind of market failure: http://www.economicsonline.co.uk/Market_failures/Types_of_market_failure.html http://www.economicsonline.co.uk/Market_failures/Types_of_ma... So markets don't fix this even in theory. Personally, I'd like to see this problem turned over to an institution something like the Smithsonian: not a regular part of government, but a trust with a specific purpose. I'd be even happier with it if it had directly elected privacy commissioners, so that it was more accountable to the people whose data it safeguards. We're only going to end up with more data that's about people, even if it's not generated or held by those people. Having a home for that data, one with a public purpose and public accountability, seems way better to me than leaving it for a private, profit-making corporation to exploit.
- dredmorbius 9y ago
  NB, but the "invisible hand" rhetoric is a gross misrepresentation of Smith's intent. Economic historian Gavin Kennedy has made something of a career debunking this fallacy. Among his many writings: The sorry invisible hand myth owes more to imagination and hope than it does to economics from Adam Smith. Its modern form really began its take off with Paul Samuelson’s successful textbook, “Economics: an analytical introduction”, McGraw-Hill 1948, and continued through to edition 20 in 2010. It had an earlier oral presence at Chicago (where Samuelson was an undergraduate) and Cambridge, England (A. C. Pigou). Even Oscar Lange postulated (1938 and 1947) a rival and “better” invisible-hand role by socialist planners. The Soviet planned economy challenged capitalism from the 1930s and in Cold War rivalry, with large communist parties and social-democratic in Western Europe, the myth asserted the innate superiority of capitalism with its “invisible hand”. Since the current recession, increasing questions appeared about its existence. Warren Samuel’s last book, “Erasing the Invisible Hand, essays on a elusive and misused concept in economics”, 2011 (Cambridge) exposes the modern history of the mythical “invisible hand” since its heyday from the 1960s through to the late 1990s http://adamsmithslostlegacy.blogspot.com/2012/04/political-scientist-most-right-in.html http://adamsmithslostlegacy.blogspot.com/2012/04/political-s...

kazinator 9y ago

> They should be liable for the damage If they are are so liable, then to remain profitable they will find a way to pass on their cost to the customers. Those customers in turn, will pass it on to the consumer. So then you end up footing liability insurance bill for the privilege of being subject to a credit search.

rectang 9y ago
That's better than the situation we have now, where Equifax and the credit agencies are only profitable because they stick the general population with the liability and the losses.
- kazinator 9y ago
  How does liability help? What's the idea; that if a whole network of criminals now has my personal info, there will be an insurance-backed fund that will instantly buy me a whole new identity, so life goes on merrily? Nope! We must rather completely get rid of this Equifax and make it a criminal offense for anyone to share such info with any emerging Equifax-like agency, or with anyone else. Your data going to Equifax is the fucking security breach. What happens afterward is just a footnote.
dredmorbius 9y ago
If they're liable, they can also mitigate risk and /or exit lines of business with excessive risk.

awj 9y ago

I need to be licensed to drive because my incompetence could ruin people's lives. Why is that commonly accepted, but it's horrible to contemplate regulation of Equifax for the same essential reasons?

ExactActuation 9y ago

"default-allow". What is this, a firewall config file or a conversation?

curun1r 9y ago

In addition, untrue entries in their database should constitute libel. Most (but not all) of the damage from letting SSN/name/address combinations out into the wild that you're referring to comes from adding false entries to their own databases, so allowing consumer to sue for libel whenever an entry is wrong would force them and their up-stream data providers to clean up their act in a hurry.