12 ms·

> How so? What would you expect from law enforcement here? Copied from another sub-thread I posted in... When Sonny Vleisides plead guilty to Felony Mail Frau

by yebyen 9y ago

> How so? What would you expect from law enforcement here? Copied from another sub-thread I posted in... When Sonny Vleisides plead guilty to Felony Mail Fraud in 2007, he was forbidden to engage in loan programs, gambling or gaming activities, telemarketing activities, investment programs or any other business involving the solicitation of funds. He went on to co-found the company called Butterfly Labs in 2010, a company that took pre-orders for Bitcoin mining equipment (in many cases soliciting funds for hardware that didn't exist, until it did). Many people argued that this business model was a direct violation of the terms of his supervised release. He stood in front of a judge in 2014 that said there was a "strong smell" of fraud with respect to his company. Equifax it seems gets to skip the whole "plead guilty" thing and just announced their negligent failure directly to the world. When does Equifax get their 14 months in jail followed by a supervised release? Never, apparently, they just go on about their business and no charges are filed. I would expect for them to get a "time-out" after their bungling of the response to this breach, at the bare minimum. But no, let's give them a participation trophy instead, let them continue handling the response to the breach, they've earned it...

g051051 9y ago
> Equifax it seems gets to skip the whole "plead guilty" thing and just announced their negligent failure directly to the world. You're presuming that Equifax is guilty of something. Of what? Of being victims of a hack? What about the SEC, who just notified the public now that they were hacked back in 2016? You seem to think that Equifax is guilty of negligence. Good luck proving that. They're subject to security audits not only from the government, but in relation to the contracts they have with their various customers (standard stuff when companies deal with each other, not least of which when consumer data is involved). Their security wasn't good enough, but they didn't know that until too late. Same as Target. Same as Home Depot. Same as the SEC. Equifax is going to get fined. They're going to lose business. They're going to eat the cost of providing identity theft protection/monitoring to the entire country. They're going to have to fight their way back to whatever previous stature they had. But any thought that they're going to be found criminally liable for this is simply not credible.
- yebyen 9y ago
  Their behavior during the response has been chock full of negligence, and I don't need to prove it in a court of law. I just need you to concede that point, and I can go on with my day. :-D They should not have been in charge of the response, but there was no way for us to know that for sure until they had already flubbed it so badly. They are guilty of handling the response very poorly in a way that has been hashed out and rehashed at least six dozen times on HN until the culmination (so far) yesterday, when we found out that their site was so easy to spoof it fooled even Tim, the Twitter guy from Equifax, who tweeted links to the spoof site out to eight or nine customers over the course of the response. That was possible because of their initial poor (evidently hasty, and negligently so) response. I'm not asking to make anyone criminally liable, I'm suggesting that next time a company leaks sensitive records on 140MM Americans, we should remember this chain of events and somehow all do better. (And not have another repeat of this shit show, if possible... but who am I kidding, it will repeat.) The poor response was probably made worse because of their internal culture that resulted in the CIO and CISO being canned (that sounds like all of their top technical leadership put out the door) right as the response was just getting underway. That too, in my opinion, was probably negligence! I know we don't put companies in "time out" but it seems like we had better think about doing exactly that in this case, lest we soon find out what it will look like when the (next) other shoe drops. The Equifax story will only continue to get worse! Just wait until their new free credit monitoring systems are breached, and we get to find out exactly what that mandatory class-action arbitration clause we've all heard about is actually intended to do!
  - g051051 9y ago
    > They should not have been in charge of the response Then who should have? > we should remember this chain of events and somehow all do better. (And not have another repeat of this shit show, if possible... but who am I kidding, it will repeat.) 100% agreement here.
    - yebyen 9y ago
      > > They should not have been in charge of the response > Then who should have? Better question: what would be an appropriate response? Because this one isn't, that much is sure, but I don't have an answer for this question other than "one that is not so hastily and shoddily implemented."

by yebyen 9y ago

g051051 9y ago

> Equifax it seems gets to skip the whole "plead guilty" thing and just announced their negligent failure directly to the world. You're presuming that Equifax is guilty of something. Of what? Of being victims of a hack? What about the SEC, who just notified the public now that they were hacked back in 2016? You seem to think that Equifax is guilty of negligence. Good luck proving that. They're subject to security audits not only from the government, but in relation to the contracts they have with their various customers (standard stuff when companies deal with each other, not least of which when consumer data is involved). Their security wasn't good enough, but they didn't know that until too late. Same as Target. Same as Home Depot. Same as the SEC. Equifax is going to get fined. They're going to lose business. They're going to eat the cost of providing identity theft protection/monitoring to the entire country. They're going to have to fight their way back to whatever previous stature they had. But any thought that they're going to be found criminally liable for this is simply not credible.

yebyen 9y ago
Their behavior during the response has been chock full of negligence, and I don't need to prove it in a court of law. I just need you to concede that point, and I can go on with my day. :-D They should not have been in charge of the response, but there was no way for us to know that for sure until they had already flubbed it so badly. They are guilty of handling the response very poorly in a way that has been hashed out and rehashed at least six dozen times on HN until the culmination (so far) yesterday, when we found out that their site was so easy to spoof it fooled even Tim, the Twitter guy from Equifax, who tweeted links to the spoof site out to eight or nine customers over the course of the response. That was possible because of their initial poor (evidently hasty, and negligently so) response. I'm not asking to make anyone criminally liable, I'm suggesting that next time a company leaks sensitive records on 140MM Americans, we should remember this chain of events and somehow all do better. (And not have another repeat of this shit show, if possible... but who am I kidding, it will repeat.) The poor response was probably made worse because of their internal culture that resulted in the CIO and CISO being canned (that sounds like all of their top technical leadership put out the door) right as the response was just getting underway. That too, in my opinion, was probably negligence! I know we don't put companies in "time out" but it seems like we had better think about doing exactly that in this case, lest we soon find out what it will look like when the (next) other shoe drops. The Equifax story will only continue to get worse! Just wait until their new free credit monitoring systems are breached, and we get to find out exactly what that mandatory class-action arbitration clause we've all heard about is actually intended to do!
- g051051 9y ago
  > They should not have been in charge of the response Then who should have? > we should remember this chain of events and somehow all do better. (And not have another repeat of this shit show, if possible... but who am I kidding, it will repeat.) 100% agreement here.
  - yebyen 9y ago
    > > They should not have been in charge of the response > Then who should have? Better question: what would be an appropriate response? Because this one isn't, that much is sure, but I don't have an answer for this question other than "one that is not so hastily and shoddily implemented."