11 ms·

Elizabeth Warren's bill would fine the next Equifax for data breach

• rectang 9y ago
  This legislation isn't my preferred solution, but at least it has its priorities right. Nothing gets me more ticked off than hearing that the myriad individual human tragedies arising from the misaligned incentives of the credit rating industry are an unsolvable problem. Heck, in moments of intemperance, I've yearned for vigilante hackers to take revenge for the victims of identity theft since no one else will, and I know I'm not alone.
  • bmelton 9y ago
    So, what is your preferred solution?
• g051051 9y ago
  Sadly, she seems to have a gross misunderstanding of the facts of the case, as well as cybersecurity in general. There's essentially no chance of this being passed, she's just showboating. Key questions: 1. Does this apply to all data aggregators, or just CRAs? 2. Does it apply to government breaches, banks, individual businesses, etc? 3. What additional oversight is going to be applied by the FTC that isn't already happening as part of the vast amount of other regulations? How will it protect consumers?
  • scrollaway 9y ago
    > she seems to have a gross misunderstanding of the facts of the case, as well as cybersecurity in general. Could you actually point to where the issues are rather than make such generic claims?
    • g051051 9y ago
      > "Equifax allowed personal data on more than half the adults in the country to get stolen, and its legal liability is so limited that it may end up making money off the breach." "Allowed"? She phrases that to make it sound like Equifax just left the front door open. In truth, they were hacked by sophisticated criminals (possibly state sponsored), who pinpointed a flaw in their security and exploited it. There was a detailed Bloomberg article that covered the breach in depth. They found that Equifax had paid top dollar for solid tools, but they were misconfigured (or misused) in such a way as to actually not be working. They found that they had good written procedures. Equifax knew about this vulnerability, and thought they had patched it. So how is any of that "allowed"? In addition, Equifax stock took a huge dip and hasn't recovered (down 21 as of this morning). They're also going to provide features so that all consumers (whether they were potentially impacted by the breach or not) will be able to lock and unlock their credit file, for free, forever. So not only did they take a big hit in terms of stock price, they are giving away the revenue generating lock and unlock service. > If passed into law, the bill would give the US Federal Trade Commission the authority to inspect the companies that collect vast amounts of financial data on consumers to make sure they're protecting that information. In what way does this in any way actually help consumers? Does the FTC have some sort of magic wand to prevent breaches? Does this help out with the overall problem of identity theft? Will this add any security or confidence above and beyond the existing government and industry regulations that are already in effect? Will her new law address any of these? https://www.identityforce.com/blog/2017-data-breaches https://www.identityforce.com/blog/2017-data-breaches
      • maxerickson 9y ago
        So thinking you patched a vulnerability is the same thing as patching it now? I'm gonna run to the bank and tell them I think I'm a millionaire!
      • tssva 9y ago
        If their expensive tools were misconfigured in a manner to render them effectively useless than they didn't have good procedures and follow best practices. Best practices would have included testing and auditing procedures both at deployment and ongoing to verify that they were operating as intended. By not having the proper auditing in place Equifax did allow the breach to occur.
  • fortythirteen 9y ago
    Question 4: Where does the money from the fines go? Her main regulatory creation was a whole new agency that is completely unaccountable to the people it was supposed to serve. She's the last politician I trust with these sorts of things.
    • yostrovs 9y ago
      Similar to Al Gore, if passed, she will claim credit for inventing Internet security.
      • acdha 9y ago
        You mean similar as in “she also won’t make any such claim”, right? https://www.snopes.com/quotes/internet.asp https://www.snopes.com/quotes/internet.asp
    • lgbr 9y ago
      > Her main regulatory creation was a whole new agency that is completely unaccountable to the people it was supposed to serve Honest question: Is that her fault? She was just chosen to run it, but she wasn't responsible for the legislation that created it and its lack of accountability, or is that wrong?
      • fortythirteen 9y ago
        It was her bill to create a consumer protection agency under the Federal Reserve, with lifetime appointees in charge of levying fines agains businesses. Word on the street is the reason Warren and other Democrats were fighting tooth and nail (with absolutely no legal standing) to keep Trump from appointing the new head of that agency, was because they've been redistributing the fines collected to left wing political action groups.
        • deleted 9y ago
          [deleted]
        • SauciestGNU 9y ago
• throwaway2016a 9y ago
  Data breaches are inevitable. Admittedly I haven't read the bill but I would general be against something like this unless it provides rules for: - Securing your system (like PCI) - Training your employees - Disclosing a data breach in a timely way AND if the company follows all the rules they are protected from the fines. There is no reason why a company that does their absolute best to be secure but falls vicim to a zero-day vulnerability should be treated the same way as someone that was willfully negligent like Equifax. If a company is willfully negligent (Equifax, Uber, and AshleyMadison are notable examples) I think a fine is not enough. Revoking their license to do business needs to be on the table as a maximum penalty in the most egregious cases. I'm talking companies that try to hide the breach from the victims, systematically underspend on security, etc. Edit: As an aside, as someone who has done a number of startups in a CTO role. Sometimes getting the board and upper management to agree on spending money on security is like pulling teeth. A lot of startups end up getting to a 100,000 users without even thinking about security never mind putting appropriate systems in place. Penalties for neglecting security would give CTOs powerful ammunition to be able to invest in this critical area.
  • nathantotten 9y ago
    IMO, the specifics of how to secure are less important than ensuring proper cost of not securing your systems. I think having rigid rules like PCI would be significant burden and not allow flexibility as technology and business changes. On the other hand, simply ensuring that the financial penalties are in line with the damage done should be enough to solve the issue. You said yourself that boards won’t agree to spend money. If they saw a huge financial downside risk they would be more likely to invest in security.
    • throwaway2016a 9y ago
      I agree. PCI is way too rigid. But you wouldn't want something like that for legislation anyway. I don't want Congress picking my security standards. But I think there should be some bar that companies can reach that protects them from the most serious penalties of any laws. That bar may even move depending on factors like revenue, number of users, and sensitivity of data. > On the other hand, simply ensuring that the financial penalties are in line with the damage done should be enough to solve the issue. You said yourself that boards won’t agree to spend money. If they saw a huge financial downside risk they would be more likely to invest in security. I completely agree. Not sure if it came off correctly but that was the point of my edit at the end.
• HenryBemis 9y ago
  Lobbying in USA has corrupted many values. Equifax is not a teenager child that broke a vase and got a 2h-off-wifi penalty. They knowingly ignored basic security practices to maximize gain. Since basic risks were not addressed, Equifax (and anyone else showing this level of neglect) should be severely punished.
  • bognition 9y ago
    I'm not sure they knowingly ignored best practices, it's probably more that they were ignorant to them. I've personally meet with Chaos (chief security officer) from fortune 50 companies who didn't have a clue what ACLs are, how encryption works, or what an onion security model is. A lot of these people have been in the game long enough that many best practices we're invented after they stopped learning. This is does not justify their behavior, rather it provides more context around the a potential contributing cause.
    • nathantotten 9y ago
      I would assume that a CSO at a F500 company is mostly responsible for things like budgeting, hiring, and high level strategy. I would think not knowing these specifics is reasonable. What isn’t excusable though is these companies ignoring advice from internal and external sources. Companies clearly make deliberate budget choices by weighing risk/reward and a CSO at a big company often rationally doesn’t make the right security choice because the risk is small. IMO, bills like this are needed in order to force companies to properly value the risk of bad security.
      • alphonsegaston 9y ago
        The idea that you can make high-level strategy choices about security without intimate knowledge of that domain is what needs to go away. That kind of thinking is the product of a business culture designed to keeping rich people with MBAs employed over making sane decisions.
        • nathantotten 9y ago
• mxuribe 9y ago
  Even if this is not the ideal solution, or even if this is too much like a hammer where a more surgical approach would be best...this is a start and certainly better than nothing. These types of breaches can be so harmful, and have such far reaching ramifications that we need something - almost anything here!
• exabrial 9y ago
  Are they _not_ being fined?
• willvarfar 9y ago
  I bumped into this talk today: Frank Abagnale: "Catch Me If You Can" https://www.youtube.com/watch?v=vsMydMDi3rI https://www.youtube.com/watch?v=vsMydMDi3rI He became an FBI agent and works with data breaches. So after entertainingly describing his life story he does mention the Equifax breach at the 37m mark. He paints a very negative picture of Equifax. Its well worth watching the whole thing, and not just skipping to his FBI Agent opinion of Equifax.
• twoodfin 9y ago
  I’d rather attack this from the other side: There will always be large aggregations of semi-public consumer data, and there will always be breaches... unless we make that data less valuable for criminal enterprises. Increase the penalties for banks and other institutions that issue fraudulent credit or otherwise fail to properly identify and authenticate the consumers with whom they’re doing business. Simply having the details of my credit report and my Social Security number should not be enough to open a bank account in my name.
  • crispyambulance 9y ago
    It is perfectly reasonable to WISH that a couple of flimsy pieces of information cannot be used for identify theft and fraud. Maybe in the next few decades we will modernize such things? Until then, however, if companies like Equifax are going to deign to hold sensitive information on behalf of THE PUBLIC and profit of of that, they had better take responsibility for it or face consequences if they fail.
• dandermotj 9y ago
  In the EU we have the incoming GDPR to legislate for (and penalise) data breaches like this. This directive is very clear and detailed on how data should be collected, securely stored and disposed of. US law is a decade behind the EU.
  • mtremsal 9y ago
    To be fair, the GDPR extends to any company that processes personal information from EU subjects. It is raising the bar for most US companies.
• rufusroflpunch 9y ago
  I hate the idea of regulatory agencies fining anyone for anything. Why should the agency/government get revenue from someone's failure? The purpose of courts is to assign damages, that's the whole reason courts exist. If the courts aren't able to do their only job, then work on fixing that instead of creating yet another agency.
  • allworknoplay 9y ago
    It covers the cost of creating enforcement agencies that can actually be effective.
  • acdha 9y ago
    If nothing else, relying on the courts requires funding for lawsuits. Most people don’t have the resources to bring a suit, especially if they can’t show a significant personal loss — and an increasing number of companies require you to waive your ability to sue or join a class action case in their terms of service. It’s not the only way to address those problems but a regulatory agency doesn’t have any of them.
  • forapurpose 9y ago
    Perhaps the fines could go to the government's general treasury.
• cmiles74 9y ago
  From the article: "The agencies already comply with the same rigorous data protection standards as banks," said Francis Creighton, President and CEO of the Consumer Data Industry Association, which represents Equifax as well as Experian and TransUnion. Well, clearly it's not all that rigorous.
  • mLuby 9y ago
    US Banks are laughably insecure. They get away with it because they can undo most of their mistakes by calling up fellow banks and reversing transactions. It works because the asset (money) is still in a system they control, as a group. With data breaches, there is no undo because the asset (data) moves outside a system the breached parties control.
• patrickaljord 9y ago
  If I use a third party to store my clients information and that this third party gets hacked, my clients would be suing me for choosing a bad third party and losing their data. I don't understand why people aren't suing the government in this case instead of picking on Equifax or am I missing something?
  • g051051 9y ago
    > my clients would be suing me for choosing a bad third party and losing their data. And their cases would be tossed out of court for being meritless.
• sol_remmy 9y ago
  If people are victimized then why does the money from the fine go to the government? I would prefer receiving a $50 check in the mail from a class action lawsuit. All this does is add more money to gov't coffers
• thinkMOAR 9y ago
  So when a data breach happens at a government body, who will be fined?