14 ms·

So if I design a car with a faulty steering mechanism that fails under unusual circumstances but, when it does, can cause a possibly fatal accident, I have a hu

• deleted 9y ago
  [deleted]
• zitterbewegung 9y ago
  This is because laws are slower to make than technology in general. Since the other laws were made with blood or money I would assume the same holds now. Once we have enough of these data breaches where people are fed up with it the laws will follow.
  • kevin_thibedeau 9y ago
    Computerized consumer data warehousing has been going on for 50 years now. In that time span we've gotten all sorts of mandated safety and emissions features on cars.
• blowski 9y ago
  If we start screaming "something must be done!", we'll be very unhappy with what actually gets done. There are so many people who are at least partly to blame when something like this happens. Bob the engineering manager who committed a quick but insecure fix years ago, Shirley the intern who didn't know what she was doing, Joe the manager who hired Bob and Shirley in the first place, Mike the manager at the company supplying third party software that ends up being exploited, etc. The worst outcome is that companies outsource all their IT security and therefore responsibility to companies that disappear as soon as there is a problem. But if we rush too quickly to impose criminal sanctions, that will be the likely outcome. The better solution is to work this one out as a society. Stop relying on things like SSNs and maiden name as "security", and stop building enormous silos of unnecessary data.
  • Multicomp 9y ago
    I agree. It's very difficult to get a government to pass a 'common sense law' given the myriad influences of different alliances, lobbyists, special interests, etc. that seem to corrupt just about any bill that goes before Congress, no matter how well-founded it may be at the very beginning. I'd also much rather have government under-react than over-react. (The former has a lot more flexibility) EDIT: Fixed words
  • ak217 9y ago
    Equifax must be dismantled and driven into bankruptcy. You present a fallacy. No, a rational company with accountability for its data doesn't outsource their IT security or let the intern access production. They take their job seriously and prevent something like this from happening by building security into their architecture. I have worked for companies that recognize they are liable for protecting the data they hold, and that it only takes one breach for trust to be destroyed. We spent countless hours hardening, compartmentalizing, and monitoring our infrastructure. The nihilistic implication that nothing can be done is maddening.
    • nevir 9y ago
      Companies that take this sort of thing seriously ALSO have breaches occur. They just do a better job of mitigating them, and messaging them.
• dokein 9y ago
  The major purpose of class actions is as a deterrent for the company. If I cause $10 in harm to a 10 million people, it's not financially viable for them each to sue me, but someone should still be motivated to go after me civilly for that. Why do lawyers get so much? In the above hypothetical scenario, - No plaintiff is going to be adequately motivated to sue, so the lawyer has to have incentive. - No plaintiff has an incentive to pay a lawyer, so he or she has to operate on a contingency basis. This is a significant risk. - Finding and organizing a large number of plaintiffs (some percent of 10 million), and suing a large corporation, is an expensive process. - The cost of the suit is incurred before the payoff, which may be years later given the appeal process. I agree that class actions are often inappropriately used, but that lawyers make much more than the individual plaintiffs is not a priori a bad thing.
  • tommoor 9y ago
    great summary!
  • bradleyjg 9y ago
    > but someone should still be motivated to go after me civilly for that. In most (all?) other developed nations it is the role of the executive branch of the elected government to regulate and punish businesses so as to prevent defuse harms. This business with the civil justice system being distorted to create self appointed, profit seeking, ad hoc regulators is not the only way to skin the cat.
    • MarkPNeyer 9y ago
      Seconding this here. If the state isn't going to prosecute big businesses for misbehaving, say goodbye to _any_ public support for business at all, small or bit. There was a philosophy that said, 'markets are important, so when a big player misbehaves, make sure the state his them HARD, otherwise people will lose faith in the markets' Now the prevailing attitude is 'these people can't be allowed to fail or the whole system will fall down.' And then, to nobody's surprise, they misbehave.
      • 9y ago
• rtb 9y ago
  Because you can't prove damages. If you suffer loss that you can directly link back to Equifax, and you manage to get your day in court, you'd get damages just like if you had a faulty steering wheel. The problem for the law is that things are much more indirect in this case.
  • jononor 9y ago
    Somehow difficulty of proving damages is not so problematic when someone is prosecuted for downloading movies.
    • deelowe 9y ago
      Very few of those cases make it to court for good reason.
    • true_religion 9y ago
      You don't have to prove damages with movie downloads, the high punitive fine is written into the statute. Now if you wanted to sue for $1 million per copy instead of $10,000 or so, then you'd have to take it to court and prove those damages.
      • jononor 9y ago
        It would be good to have such standardized fines for breaches of private data.
        • rhizome 9y ago
          Yes, yes it would. I've been saying the same since at least the Target breach. Not that I'm anybody, but the idea is out there.
  • bradleyjg 9y ago
    This is the correct answer. The tort system is designed to make people whole. If you haven't suffered damages then there's nothing to sue about. Copyright infringement is a red herring, IP is an entirely separate area of law from torts. If you've been harmed by Equifax but it is difficult for you to legally prove the chain of causation, that's a problem that tort law needs to solve. The law is flexible enough to come up with such solutions, albeit slowly. See for example the doctrine of market share liability.
• TheCapn 9y ago
  On one hand you have the tech sector who likes to run things "fast and dirty". Regulation? Something made to disrupt! Lot's of homemade hackers outside the "established order" doing great things. On the other hand you have rigorous protocol with professional regulated engineers held responsible for their actions and the consequences of design. I've always been a bit of a proponent for bringing these regulations into tech jobs when it matters on public safety but the tech groups can swing wildly in pro/anti favor of such direction on a day to day basis. You definitely lose a bit of the "do it quick and break things" attitude which is responsible for a lot of great product but the stability and rigor is what benefits imo.
• 1_2__4 9y ago
  > Why haven't product liability laws caught up with information services? I fear that the simple answer is because we no longer live in a country (or political climate, if you prefer something more optimistic) where regulatory and legal structures like product liability are thought of being the role of government. The neoliberal response to this is "the market will punish Equifax and other, more responsible competitors will take their place or force them to change their ways." The very concept of human beings exerting political will to make a company do something is almost unfathomable these days.
  • dopamean 9y ago
    I'm curious what you mean by "neoliberal" here. It's not a term I'm very familiar with. It is especially confusing to me because what you went on to describe is traditional Conservative reasoning.
    • chefandy 9y ago
      Kind of a buzzword these days, but the Wikipedia describes the term pretty effectively. https://en.wikipedia.org/wiki/Neoliberalism https://en.wikipedia.org/wiki/Neoliberalism
    • 1_2__4 9y ago
      Not really, the traditional conservative answer would be more along the lines of companies should be allowed to do whatever they want because ultimately that's better for the individual. The neoliberal argument is closer to one of the inevitability of markets, both in the negative in the positive: the invisible hand will solve this, and the invisible hand is inexorable so it's futile and wrong to try and do anything except let it do its work.
    • eternalban 9y ago
      It is, in my opinion, designed to be confusing. Neo-Liberalism is the ideology of the discovery of law through economics (which is held to be a sort of axiomatic "scientific" given). Basically if corporations were people -- and hey look here, they are -- and were to get together and dream up an ideology for themselves -- you know, corporations of the world, unite!! -- they would task some of their human lackies to manipulate their institutions to install Neo-Liberalism as the world wide political-economical regime. Any other questions?
• tehwebguy 9y ago
  At this point it should be a criminal fraud investigation.
• samstave 9y ago
  Speaking to class action lawsuits: My credit score was 800 and I had a mortgage for $409,000 I put $80,000 down in cash. I never missed a payment and was never late. I went to pay my mortgage and the website looked the same, but the payment button was removed. I called and was told that my mortgage was sold and that I'll get a welcome packet in the mail explaining to whom I should pay my mortgage... It never came. I called daily for months. Finally I got something in the mail. A foreclosure notice for not paying my mortgage... I got in touch with them and they told me "don't do anything, Obamas going to fix this" (literally that's what they said) Then I got another notice. Then they said they would refi me... then they said I made "too much money to qualify for a refi, and that I needed to pay $52,000 right then to not get foreclosed. I got foreclosed upon. They came one day and changed the locks when I was at work. I contacted the person who left a sticker on my door and told him I would come to his house and shoot him in the face if he didn't come open my house within two hours. He showed up. I filed suit, class action, and I won. I won $1,008.00 My credit is ruined
  • yourapostasy 9y ago
    Was your mortgage initially underwritten by a credit union? What did your personal attorney try to mitigate this situation, and what were the outcomes? Are you under a gag order, or can you publish details and name names?
  • wehadfun 9y ago
    Wow. Wow. Wow. When was this? Did they sell your house or do you still have it?
    • samstave 9y ago
      2009 they sold my house, ruined my credit, the mortgage companies in question went out of business and I have no recourse...
  • gamad 9y ago
    You filed a "class action lawsuit?" More details, please. Who was the class? Why a "class action" when you were personally harmed in a major way?
• john_teller02 9y ago
  Please sign the petition for Congress to step in and make sure that affected individuals get free credit monitoring service for their lifetime and not just a few months: https://petitions.whitehouse.gov/petition/equifax-should-provide-free-lifetime-credit-monitoring-service-affected-individuals-2017-data-breach-incident https://petitions.whitehouse.gov/petition/equifax-should-pro...
• adekok 9y ago
  > The Equifax breach here was caused by, at the very least, reckless negligence in that they failed to patch a published vulnerability for MONTHS after it was disclosed Managed by a security VP who had no relevant experience? I posted this in another comment, and got massively downvoted. Not sure why...
  • gamad 9y ago
    Because you can't criticize "women" in "IT".
  • abritinthebay 9y ago
    I actually haven't seen their experience posted anywhere. I have seen their degree, but that's meaningless as most of the truly talented developers and technical people I know have a degree that is not directly specific to their current role. What was their experience before Equifax? Do you have links?
    • adekok 9y ago
      http://www.marketwatch.com/story/equifax-ceo-hired-a-music-major-as-the-companys-chief-security-officer-2017-09-15 http://www.marketwatch.com/story/equifax-ceo-hired-a-music-m... Equifax “Chief Security Officer” Susan Mauldin has a bachelor’s degree and a master of fine arts degree in music composition from the University of Georgia. Her LinkedIn professional profile lists no education related to technology or security. Her LinkedIn profile has since been removed entirely. A copy is shown here: https://www.hollywoodlanews.com/equifax-chief-security-officer/ https://www.hollywoodlanews.com/equifax-chief-security-offic... She was previously Senior Vice President and Chief Security Officer at First Data Corporation, until July 2013. The snippet posted there shows her previous jobs as "professional". No security person I know has zero security experience on their resume.
      • abiox 9y ago
        it's not like a c-level at a large corp is personally handling technical implementation details. outside of a small startup, an exec is not a 'security person' in the sense you say. it's one thing to say it happened on mauldin's watch and as the senior person in charge of security they bear responsibility (as any leader does). this degree stuff, however, is mostly security theater and very weak argumentation.
• ksk 9y ago
  Should developers who introduce security vulnerabilities go to jail?
  • dkersten 9y ago
    No, unless its proven that they were wilfully negligent, then yes.
    • ksk 9y ago
      The argument is, according to the OP, that the entity responsible for designing/administering/maintaining software services/software/IT systems is liable. But it seems like they would like to punish the employer, and not the employees.
    • interstitial 9y ago
      What if they didn't intend to be willfully negligent when they broke the air gap and removed documents from an internal network to a public network?
  • ams6110 9y ago
    If it can be shown they did it with intent, then maybe. If they did it from incompetence or simple error then their employer should be responsible for not providing adequate training and review of work product, inadequate QA, etc. In general I think civil penalties will be more appropriate for this sort of thing than throwing people in jail. Jail time when there was criminal intent could be reasonable, though.
• g051051 9y ago
  > so if I design a car with a faulty steering mechanism that fails under unusual circumstances but, when it does, can cause a possibly fatal accident What was the faulty product in this case? Struts? Why is Equifax liable? > The Equifax breach here was caused by, at the very least, reckless negligence in that they failed to patch a published vulnerability for MONTHS after it was disclosed. You have no knowledge of their internal security practices, or what the status of knowledge of the vulnerability was. Did they make a mistake? Absolutely. But no security is perfect. You have zero basis to make such a claim. > What I'm talking about is having the same expectations, requirements and civil and criminal punishments that product liability would have with a physical product, at least when it comes to willful negligence of this sort. There are already laws on the books that cover this, as well as the CFPB. I expect significant fines and additional oversight for Equifax in the coming months. > The VW emissions scandal (rightly) is resulting in criminal prosecutions for fraud. Because that was a real, provable, honest to goodness fraud, where there was provable criminal intent. Just like Enron. Where's the criminal intent with Equifax?
  • raesene6 9y ago
    As to the first point, Equifax could be liable as they are the one operating the system (for profit), and they're the one processing personal information using it. If they had been using commercial software they might have been able to shift the liability (if it existed) to the vendor based on it being not fit for purpose, but as they were using open source, no such option would be open to them.
    • g051051 9y ago
      How is that a "product liability" issue, as put forth by OP? What faulty product did they sell to consumers?
      • raesene6 9y ago
        Well they sold services which made use of a vulnerable version of struts.... You can argue services != products, but It could be argued a similar approach could apply. The fact that they didn't sell those services to consumers but that consumers are the ones impacted is actually a big part of the problem. There's an externality here in that the people who suffer the loss have no part in the transaction (they are neither buyer no seller) so have no way to, in an economic sense, impact Equifax's behaviour, which does lead to the idea that regulation could be an appropriate approach.
• deleted 9y ago
  [deleted]
• spullara 9y ago
  In the Equifax case you aren't really the customer and didn't provide that data to them for their safe keeping. They are actually in the business of exposing the data they collect to 3rd parties.
• justboxing 9y ago
  > I just don't get it. It's not supposed to make sense. This is how Corporate America works these days (or more precisely, since the late 80s). He ( C.E.O ) is gracefully landing on his retirement pad in his Golden Parachute of at least 18 MILLION, and there's no mention of any of this in most mainstream media stories. The senate is also preparing to Grant Equifax Immunity from consumer lawsuits > Disgraced Equifax CEO Richard Smith runs for the hills – toting $18 million in retirement benefits – with 143 million consumers still left in the lurch. Source: => https://www.commondreams.org/newswire/2017/09/26/not-another-golden-parachute-departing-equifax-ceo-could-get-millions-senate https://www.commondreams.org/newswire/2017/09/26/not-another...
  • civilian 9y ago
    uhhhhh. Do you have a second citation for "> The senate is also preparing to Grant Equifax Immunity from consumer lawsuits". A quick google search didn't reveal anything, and the website you linked to has a radical left bias. [edit1] The closet thing I can find is that senate republicans aren't co-signing bills to add more regulation. Not that they're trying to grant immunity to Equifax. http://www.pbs.org/newshour/rundown/equifax-breach-congress-unlikely-pass-new-rules-protect-consumer-data/ http://www.pbs.org/newshour/rundown/equifax-breach-congress-... [edit2] And at the end of the article: > Even if the Equifax breach fails to bring about the passage of new legislation, it has scuttled one bill in the works. On the day of Equifax’s announcement, a House subcommittee examined legislation that would have decreased the potential consequences when consumer reporting agencies falsely malign someone. Such mistakes can haunt consumers for years. > The bill would have eliminated punitive damages for violations of the Fair Credit Reporting Act. The bill’s sponsor, Rep Barry Loudermilk, R-Ga., said the legislation was aimed at curbing frivolous lawsuits and would not have granted any immunity to Equifax for the data breach. “Nevertheless, given the unfounded attacks on me and the rampant misinformation circulating about this legislation, the Financial Services Committee has not scheduled further action on any bill at this time.” So I suppose there was bill that could have done that, but it's dead now.
    • justboxing 9y ago
      > Do you have a second citation for "> The senate is also preparing to Grant Equifax Immunity from consumer lawsuits" Here you go: Ga. lawmaker defends bill curtailing class actions after Equifax hack => http://politics.blog.myajc.com/2017/09/16/ga-lawmaker-defends-bill-curtailing-class-actions-after-equifax-hack/ http://politics.blog.myajc.com/2017/09/16/ga-lawmaker-defend... > Georgia Congressman Barry Loudermilk is shooting back at consumer protection groups and other critics who have slammed his bill to curb the use of class action lawsuits in the aftermath of Equifax’s mammoth data breach. Note the Congressman is from Georgia and Equifax is HQ-ed in Atlanta, Georgia.
• ams6110 9y ago
  > Why haven't product liability laws caught up with information services? Data breaches seldom result in fatalities or physical injury.
• chiefalchemist 9y ago
  "Why haven't product liability laws caught up with information services?" We all know the drill. If you're not sure what the product is then you're the product. This "information services" aren't for the advantage of the masses. They exist for the elites. Think about. You're being tracked and there's no provision to opt out of that. We're not protected because in the eyes of the powers that be we're the product. We're not in danger. We're what's being sold.