3 ms·

While I agree, as a CTO I would be terrified if a data breach could hold me personally liable. It'd be like a Director of Security at a bank being liable for th

by throwaway2016a 9y ago

While I agree, as a CTO I would be terrified if a data breach could hold me personally liable. It'd be like a Director of Security at a bank being liable for their bank being robbed with a tank. But at the same time there is a line. I would be for holding companies liable if, for instance, the data gets out there and you find it is entirely unencrypted and the passwords are MD5 hashed or plain text. There has to be a baseline. Mistakes should not be punished as long as there is not also negligence.

ryandrake 9y ago
The Director of Security at a bank should at least be fired if their bank is robbed by a guy brandishing a banana. I'd speculate that that's the nature of most data breaches: amateur attackers taking advantage of grossly incompetent security.
- darepublic 9y ago
  Well I think bank tellers where I live are instructed to comply with robber's demands for money even if they are not visibly brandishing any weapon
daveFNbuck 9y ago
No one said anything about holding the CTO personally liable. The idea is to hold the company liable. This makes sense because the company is in the best position to prevent the bad outcome. If the company is always liable, it can find an optimal balance between the costs of security and the costs of breaches. If the company is only liable when negligent, it is incentivized to minimize the cost of security to the bare non-negligent minimum. This pushes all the costs onto the people whose data are compromised. These people are not in a position to spend small amounts of money to dramatically lower the expected costs of breaches, so they just end up paying huge costs that cannot be mitigated.
nathan_long 9y ago
> While I agree, as a CTO I would be terrified if a data breach could hold me personally liable. Personal liability is going too far, IMO. > Mistakes should not be punished as long as there is not also negligence. The problem with this is that you'd have to enshrine, in law, what "negligence" is. Technology changes too fast to put that into law. "How many people got hurt and how badly?" is a question attorneys can reasonably address. "Was there sufficient input sanitization?" is not.

ryandrake 9y ago

The Director of Security at a bank should at least be fired if their bank is robbed by a guy brandishing a banana. I'd speculate that that's the nature of most data breaches: amateur attackers taking advantage of grossly incompetent security.

darepublic 9y ago
Well I think bank tellers where I live are instructed to comply with robber's demands for money even if they are not visibly brandishing any weapon

daveFNbuck 9y ago

No one said anything about holding the CTO personally liable. The idea is to hold the company liable. This makes sense because the company is in the best position to prevent the bad outcome. If the company is always liable, it can find an optimal balance between the costs of security and the costs of breaches. If the company is only liable when negligent, it is incentivized to minimize the cost of security to the bare non-negligent minimum. This pushes all the costs onto the people whose data are compromised. These people are not in a position to spend small amounts of money to dramatically lower the expected costs of breaches, so they just end up paying huge costs that cannot be mitigated.

nathan_long 9y ago

> While I agree, as a CTO I would be terrified if a data breach could hold me personally liable. Personal liability is going too far, IMO. > Mistakes should not be punished as long as there is not also negligence. The problem with this is that you'd have to enshrine, in law, what "negligence" is. Technology changes too fast to put that into law. "How many people got hurt and how badly?" is a question attorneys can reasonably address. "Was there sufficient input sanitization?" is not.