4 ms·

Always love Mr. Schneier, but I think torts would be a better way of handling this. There are several problems with regulation: a) Whack-a-mole, new ideas and

Always love Mr. Schneier, but I think torts would be a better way of handling this. There are several problems with regulation: a) Whack-a-mole, new ideas and business models arise faster than the speed of government. b) Regulatory capture, like what happened to our banking regulations. c) More often than not, penalties are captured by the regulator, but compensation is not made to the injured parties. d) International law / trade agreement complications. I'm sure there are many more. If manufacturers knew they'd be on the hook for damages in a dollar-to-dollar way, they'd put more engineering into their work, they would price it accordingly, and personally I'd be fine with that.

Sniffnoy 9y ago
Schneier's said elsewhere that torts would be another way of handling this (I also think it's probably the better way); don't know why that isn't in this article.
dragonwriter 9y ago
The creation and definition of torts (or the generalization of existing torts to cover new relsted domains) is a mechanism of regulation.
- jstewartmobile 9y ago
  Yes. In the postwar period, the word regulation typically entails new laws, possibly a new regulating agency, and a mix of civil and/or criminal penalties. I think a more liberal interpretation of existing torts would be simpler, more just, and harder to game.
  - eropple 9y ago
    It also encourages the tiering of IoT such that insecure-and-cheap remains on the market and is pushed towards people who can least afford to be pwned. Regulation is not blind, but it does raise the floor.
    - jstewartmobile 9y ago
      "least afford"??? As though these IoT devices weren't pure bored yuppie disposable income in the first place? I would figure large service providers, and big companies with fleets of marginally protected devices, would be the ones to bear most of the damages coming from shoddy IoT devices being pwned and rolled into larger ddos/ransomware/etc attacks.
      - eropple 9y ago
        At the moment, yes, they are at the high end of the market. In three years, you can expect that to be either in the process of moving downmarket. In five, they will be comfortably midmarket and still moving downward. And, the cheaper the device, the more corners cut in production. The more corners cut, the higher the likelihood that at least some of them are in terms of security.
        jstewartmobile 9y ago
        We are governed by people who have trouble agreeing that 30 year olds propositioning minors is a bad thing. I just think broadening the concept of liability in our industry to the point where some company's negligence is finally made an example of has a much better chance of improving things than a panel of regulatory agency appointees that have either already been paid as industry lobbyists, or are operating under the carrot of a future position as a highly-paid exec--just like the FCC, or Robert Rubin, or any of Trump's appointees, or so many others...

Sniffnoy 9y ago

Schneier's said elsewhere that torts would be another way of handling this (I also think it's probably the better way); don't know why that isn't in this article.

dragonwriter 9y ago

The creation and definition of torts (or the generalization of existing torts to cover new relsted domains) is a mechanism of regulation.

jstewartmobile 9y ago
Yes. In the postwar period, the word regulation typically entails new laws, possibly a new regulating agency, and a mix of civil and/or criminal penalties. I think a more liberal interpretation of existing torts would be simpler, more just, and harder to game.
- eropple 9y ago
  It also encourages the tiering of IoT such that insecure-and-cheap remains on the market and is pushed towards people who can least afford to be pwned. Regulation is not blind, but it does raise the floor.
  - jstewartmobile 9y ago
    "least afford"??? As though these IoT devices weren't pure bored yuppie disposable income in the first place? I would figure large service providers, and big companies with fleets of marginally protected devices, would be the ones to bear most of the damages coming from shoddy IoT devices being pwned and rolled into larger ddos/ransomware/etc attacks.
    - eropple 9y ago
      At the moment, yes, they are at the high end of the market. In three years, you can expect that to be either in the process of moving downmarket. In five, they will be comfortably midmarket and still moving downward. And, the cheaper the device, the more corners cut in production. The more corners cut, the higher the likelihood that at least some of them are in terms of security.
      - jstewartmobile 9y ago
        We are governed by people who have trouble agreeing that 30 year olds propositioning minors is a bad thing. I just think broadening the concept of liability in our industry to the point where some company's negligence is finally made an example of has a much better chance of improving things than a panel of regulatory agency appointees that have either already been paid as industry lobbyists, or are operating under the carrot of a future position as a highly-paid exec--just like the FCC, or Robert Rubin, or any of Trump's appointees, or so many others...