3 ms·

Covering up data breaches should be straight-up illegal, as in prison time. If I am the employee who is about to cost my company $$$$, I'd much rather report it

Covering up data breaches should be straight-up illegal, as in prison time. If I am the employee who is about to cost my company $$$$, I'd much rather report it than risk going away.

deleted 9y ago
[deleted]
ars 9y ago
> Covering up data breaches should be straight-up illegal, as in prison time. Is it also illegal to cause a breach? Do you understand the backwards motivations you are giving people? He can disclose the breach, cause himself (or his co-workers) to risk prison, and cost his company $$$$, which is likely to get people fired. Or, Cover the whole thing up (i.e. quietly fix the bug), and no one will ever know. And if they do find out, he can say "I didn't know anything about a breach, I proactively fixed a bug, I didn't realize someone had taken advantage of the bug" - i.e. he's safe either way.
- jakelazaroff 9y ago
  There are two separate infractions here that shouldn't be conflated: allowing a data breach to occur, and failing to disclose a breach. As far as I can tell, the perverse incentive you're describing is that the if the penalty for a breach occurring is too harsh, it could lead companies to cover up a breach rather than disclose it. A penalty for failing to disclose a breach would be meant to discourage that, and I don't see how that penalty is itself a perverse incentive. The penalty for a data breach must be harsh enough that it would cost a company more than it would to guard against it. I don't believe that there exists a penalty that satisfies that condition yet is also light enough that a company wouldn't cover up any breaches that occurred.
  - simcop2387 9y ago
    Triple the fines in the event of a coverup would probably help too.
  - irascible 9y ago
    I agree. If my boss instructs me to implement data collection, then the company must be liable for everything that proceeds from there. Full stop. If that is too much of a risk, then companies will have to NOT COLLECT DATA.
jimnotgym 9y ago
Under the European GDPR regs coming in next may it will be illegal not to disclose.
- toomuchtodo 9y ago
  And GDPR regs apply not only to EU citizens, but also US citizens residing in the EU.
  - zaarn 9y ago
    And to US companies who do business with EU citizens and to the data of US citizens who have business with EU companies Or anything that touches the EU, really.

Covering up data breaches should be straight-up illegal, as in prison time. If I am the employee who is about to cost my company $$$$, I'd much rather report it than risk going away.

deleted 9y ago

[deleted]

ars 9y ago

> Covering up data breaches should be straight-up illegal, as in prison time. Is it also illegal to cause a breach? Do you understand the backwards motivations you are giving people? He can disclose the breach, cause himself (or his co-workers) to risk prison, and cost his company $$$$, which is likely to get people fired. Or, Cover the whole thing up (i.e. quietly fix the bug), and no one will ever know. And if they do find out, he can say "I didn't know anything about a breach, I proactively fixed a bug, I didn't realize someone had taken advantage of the bug" - i.e. he's safe either way.

jakelazaroff 9y ago
There are two separate infractions here that shouldn't be conflated: allowing a data breach to occur, and failing to disclose a breach. As far as I can tell, the perverse incentive you're describing is that the if the penalty for a breach occurring is too harsh, it could lead companies to cover up a breach rather than disclose it. A penalty for failing to disclose a breach would be meant to discourage that, and I don't see how that penalty is itself a perverse incentive. The penalty for a data breach must be harsh enough that it would cost a company more than it would to guard against it. I don't believe that there exists a penalty that satisfies that condition yet is also light enough that a company wouldn't cover up any breaches that occurred.
- simcop2387 9y ago
  Triple the fines in the event of a coverup would probably help too.
- irascible 9y ago
  I agree. If my boss instructs me to implement data collection, then the company must be liable for everything that proceeds from there. Full stop. If that is too much of a risk, then companies will have to NOT COLLECT DATA.

jimnotgym 9y ago

Under the European GDPR regs coming in next may it will be illegal not to disclose.

toomuchtodo 9y ago
And GDPR regs apply not only to EU citizens, but also US citizens residing in the EU.
- zaarn 9y ago
  And to US companies who do business with EU citizens and to the data of US citizens who have business with EU companies Or anything that touches the EU, really.