8 ms·
Pure speculation ahead: Suppose for a moment that the Equifax hack was carried out by a nation-state (like, say, North Korea). This is not an issue of consumer
by peterlk 9y ago
Pure speculation ahead:
Suppose for a moment that the Equifax hack was carried out by a nation-state (like, say, North Korea). This is not an issue of consumer trust and safety. It is an issue of national (US) security and safety.
To give another analogy, imagine that in 1920, the Canadian military marched over the border and robbed some banks. Does it make sense for the patrons of that bank to be able to sue the bank? Maybe. It seems like that's less of an issue than the fact that Canada has seized assets that belong to US citizens.
My point is not that Equifax is innocent, or that the situation is being handled appropriately, but rather that this whole thing looks weird enough that there it's probably a lot worse (and more complicated) than we think it is.
- ringaroundthetx 9y agoWhat looks weird about it? Most Fortune 500 companies do not have bug bounties and have poor security. One was exploited using a disclosed vulnerability. This is on the polar opposite side of the spectrum of things that would give you the idea of nation state, before ruling everything else out.
- cinquemb 9y agoHowever, it would make some sense that politically connected individuals/companies would stand benefit from any claims of national security related to such incidences in order to protect them from liability, even if the exposure to severity of such incidences were preventable to some degree. When national security claims protect your six, rational actors eventually will seek to exploit such…
- ringaroundthetx 9y agoat this point, why WOULDN'T you proxy through a server in Russia or even "just" Eastern Europe when you execute even a wordpress vulnerability A server with an IP in Russia = Russian Hackers = State Sponsored Russian Hackers = Vladimir Putin destabilizing Democracy While you are eating popcorn and have millions of dollars of cryptocurrency no questions asked.
- peterlk 9y agoWell, like I said, pure speculation, so I don't have much to back it up. Just musing
- ngold 9y agoIf the banks left all their customers money protected by a wind screen door that was accessible in the alley, I think suing could be justified.
- jonny_eh 9y agoAnd if the banks had your money, even though you never gave it to them.
- JumpCrisscross 9y ago> even though you never gave it to them You can argue you were coerced into giving it to them. But at the end of the day, you signed bank and credit card and employment agreements that let your information be transmitted.
- CommentCard 9y agoYour example falls under the purview of negligence in tort law. Nevertheless an arbitration agreement may supersede a potential lawsuit. The widespread use of forced arbitration seems ripe for examination by the SCOTUS. I'm no lawyer, but it seems like a fairly blatant violation of the 7th amendment.
- kharms 9y agoThey looked at a related issue not too long ago. https://www.classdefenseblog.com/2015/12/supreme-court-holds-that-federal-arbitration-act-preempts-california-courts-interpretation-of-arbitration-clause/ https://www.classdefenseblog.com/2015/12/supreme-court-holds...
- prawn 9y agoCouldn't that be left to a judge to decide?
- cinquemb 9y agoWell if the FISA court decide(s|d) upon this (assuming that this would fall under some national security protocol), we (the public) would never hear of it… well anytime soon at least… outside of publicly visible aftershocks people would speculate upon.
- rgbrenner 9y agoThat is not an apt analogy. The resources of a nation state were not required to hack equifax.. a kid with a laptop could have done it. This is a consumer trust and safety issue because basic care was not taken to protect the data that Equifax was trusted with guarding. If it turns out that a nation state is the one that carried out the hack.. then that's a national security issue AND a consumer trust and safety issue. But that doesn't excuse gross incompetence.
- iamleppert 9y agoThe way to get better security is to let the free market system work as its intended: Equifax should die a painful death by the masses, if necessary piecemeal one lawsuit at a time until the company coffers have been emptied (and preferably any directors, agents, vested entities, and anyone else within a legally-defensible stone's throw). It may sound harsh, but that's life and life ain't fair. That's the only way to send a message strong enough that if you are going to operate an IT business, which is what Equifax is, and you have poor security, you will not be protected by the government. In fact, protecting Equifax and other companies who fail to properly maintain adequate security will send a message to other corporations that this kind of behavior will be tolerated, and these companies may be incentivized to not invest in their security. I've seen situations exactly like this play out at companies before. If the rules of the market suddenly change, so will the industry. And why should we risk the stability of an entire industry because of one company? The security problems aren't going away, even if we decide to create laws that say they don't matter -- they will still be there at the end of the day, and someone will be able to exploit them. It's bad for business, bad for consumers, and ultimately bad for whatever government is foolish enough to create such policy.
- unchocked 9y agoYour claim sounds good the way you put it, but less so when you consider that retributive justice seems ineffectual at deterring violent crime... unless you're also going to claim that shitty companies are generally smarter than felons.
- nerdponx 9y agoThe analogy does not work. People commit violent crimes for very different reasons than shitty companies commit economic crimes. And at the end of the day, there is some amount of basic deterrence for people who are not in some kind of adverse mental state. How many more crimes of passion would there be if murder, or assault, were not so harshly penalized? The “deterrence does not work“ line as a matter of degrees, not absolutes, and only applies to a subset of the population. For the rest of us, it works just fine. So to re-join the topic at hand, think of it this way: there will always be outright criminal corporate actors, and deterrence by corporate death will never stop them. These are the Bernie Madoffs and Jeffrey Skillings of the world. Their corporate actors, however, only act the way they do because they are simply are no consequences for doing otherwise, and upper management has evidently quashed their consciences entirely: AT&T (selling deanonymized data with token, non-retractable consent), BP (Gulf oil spill), Equifax (not caring about your security). Lest we forget that these businesses are in the business of making money, and they do so with terrifying efficiency, and their management is soullessly shrewd. If something is risky and expensive because it entails a high chance of a lawsuit or some other penalty, they will think twice about it.
- aussieguy1234 9y agoEquifax knew they were running a vulnerable version of Apache tomcat. To not fix it is pure incompetence, like a bank leaving it's doors unlocked overnight. What did they expect to happen?
- astura 9y agoApache Struts, not Tomcat.
- mtgx 9y agoThere should be such thing as "gross negligence" when it comes to security. If believe it applies to companies managing "critical infrastructure". But, fortunately for Equifax, companies that manage social security numbers haven't been declared critical infrastructure. If they were, I'm sure Equifax could have been found guilty of gross negligence.
- pjc50 9y ago> imagine that in 1920, the Canadian military marched over the border and robbed some banks The international law on this is rather complicated but I believe that those affected would have a case against the Canadian government, as well as being covered by the US bank insurance system. However, in the case of Equifax, personal data isn't the property of the person (in the US system) and so you don't have a case. You'd need to have an EU-style data protection system rather than a US system which treats data as free speech.
- drharby 9y agoWhich is why military operations are conducted as an extension of policy, not as an isolated show of force. It would be the mounties robbing the banks and then threatening to return with greater force if we show any attempt to recoup losses from canada, but then we steal their lumberjacks, then they strike out alaskan oil sites, oh boy are we at war? National security advisors have long indicated civilian infrastructure to be the primary cyber vulnerability, not military assets. Its the german ballbearing factory all over again. So to not hold these companies liable is genuinely generating a national security threat, where threat is defined as a risk with a real probability of being realized.
- s73ver_ 9y agoHow does that change things? Why does that mean that I should not be able to unite with my fellow consumers to hold them accountable?
- specialist 9y agoBecause collective action would level the battlefield.
- lr4444lr 9y agoThe degree of fault is determined through investigation, and it's not all or none. If the banks had negligently lax security that should have resulted in only 75% of the actual robbed monies being lost, they'd be on the hook for the remainder.
- saalweachter 9y agoI think positing a nation-state is an unnecessary complication. Let's imagine two different bank robberies, carried out by the same wicked bank robbers. In the first, the bank robbers steal a bulldozer and a crate of dynamite, knock down half the bank in the middle of the night, blow the safe, and run away with the money. In the second, the bank has left the safe and all the doors unlocked at the end of the day when everyone goes home. The robbers stroll in through the open door, take the money, and casually walk away. In both situations, the robbers are fully culpable. They don't get a pass just because the money was left lying around where anyone could take it. They should be pursued and an appropriate punishment (or rehabilitation, if that's your thing) should be meted out in either case. But in the second scenario, the bank is also culpable - they failed to take reasonable precautions, they were negligent in their duties. If someone is negligent in their duties and that negligence results in harm to others, they should be held responsible for it. The situation doesn't change if it was a nation-state that took advantage of the negligence; the hypothetical bank aren't being punished for being robbed, and it doesn't matter that a hypothetical determined robber could still have broken through nearly any security you could imagine, they were still negligent in their duties.
- ifhd 9y ago> Does it make sense for the patrons of that bank to be able to sue the bank? If they left the doors unlocked and didn't bother to hire security then sure.