7 ms·

Data breaches are inevitable. Admittedly I haven't read the bill but I would general be against something like this unless it provides rules for: - Securing yo

by throwaway2016a 9y ago

Data breaches are inevitable. Admittedly I haven't read the bill but I would general be against something like this unless it provides rules for: - Securing your system (like PCI) - Training your employees - Disclosing a data breach in a timely way AND if the company follows all the rules they are protected from the fines. There is no reason why a company that does their absolute best to be secure but falls vicim to a zero-day vulnerability should be treated the same way as someone that was willfully negligent like Equifax. If a company is willfully negligent (Equifax, Uber, and AshleyMadison are notable examples) I think a fine is not enough. Revoking their license to do business needs to be on the table as a maximum penalty in the most egregious cases. I'm talking companies that try to hide the breach from the victims, systematically underspend on security, etc. Edit: As an aside, as someone who has done a number of startups in a CTO role. Sometimes getting the board and upper management to agree on spending money on security is like pulling teeth. A lot of startups end up getting to a 100,000 users without even thinking about security never mind putting appropriate systems in place. Penalties for neglecting security would give CTOs powerful ammunition to be able to invest in this critical area.

nathantotten 9y ago
IMO, the specifics of how to secure are less important than ensuring proper cost of not securing your systems. I think having rigid rules like PCI would be significant burden and not allow flexibility as technology and business changes. On the other hand, simply ensuring that the financial penalties are in line with the damage done should be enough to solve the issue. You said yourself that boards won’t agree to spend money. If they saw a huge financial downside risk they would be more likely to invest in security.
- throwaway2016a 9y ago
  I agree. PCI is way too rigid. But you wouldn't want something like that for legislation anyway. I don't want Congress picking my security standards. But I think there should be some bar that companies can reach that protects them from the most serious penalties of any laws. That bar may even move depending on factors like revenue, number of users, and sensitivity of data. > On the other hand, simply ensuring that the financial penalties are in line with the damage done should be enough to solve the issue. You said yourself that boards won’t agree to spend money. If they saw a huge financial downside risk they would be more likely to invest in security. I completely agree. Not sure if it came off correctly but that was the point of my edit at the end.
  - nathantotten 9y ago
    Yeah, that makes sense. You’re right there needs to be a reward for achieving some measure of security.
  - maxerickson 9y ago
    Companies that want to protect themselves from breaches should avoid collecting and quickly discard sensitive data.
    - throwaway2016a 9y ago
      Agreed completely. PCI and many data protection laws and industry frameworks already dictate that you should discard data as soon as you no longer need it and not collect sensitive data unless you legitimately need it. That can be part of the law.
      - maxerickson 9y ago
        Right, but my point is that there isn't a deep need for a box checking exercise that gets a company out of liability, if they don't want liability they can just avoid creating it. Conveniently this is most onerous for stupid business models.
    - AJ007 9y ago
      It could also be a way to offload sensitive processing & storage to a third party; e.g. Stripe. I'm leaning much more toward John Young's (Cryptome) viewpoint of information security -- smoke and mirrors. Maybe nothing is secure and it is only a question of how interested the adversary is in creating a break and then what they decide to do with the information after. Robert Cringely has the most practical advice I've read -- keep secure communications off the internet.
grasshopperpurp 9y ago
>If a company is willfully negligent I agree with a lot of the points in this post, but I think it's important to remove 'willfully' from this statement. If a company takes on this type of power and responsibility, it should not matter whether their negligence was willful.
- throwaway2016a 9y ago
  My implication is that on a scale of 0 to 10 with 0 being completely unaccountable that companies that are willfully negligent should be at 10. I'm not arguing that that companies who are accidentally negligent should be at 0. If I pre-meditate to purposely use my car to kill someone that is a different crime than if I am driving following all the rules of the road and I don't notice the person crossing the street until it is too late.
  - grasshopperpurp 9y ago
    I understand. I just disagree. I don't think the car analogy is apt, because it doesn't capture the inherit risk (to so many) that these companies accept. They willfully accept that risk - when data breaches are inevitable. I'm saying they should both be 10.
    - matt4077 9y ago
      There is something similar with cars, actually. In many countries, when you injure a pedestrian through absolutely no fault of your own (i. e. they drunkenly stumbled onto the street and you had no time to react), you (or your insurance) are still liable for damages. Why is that? Because when you drive a car, you get all the benefits of, well, driving. Pedestrians get absolutely nothing, except the "chance" to suffer whenever they don't pay enough attention. Note that this is civil law. If you had no chance to avoid the accident, nobody is blaming you, nor will you face criminal charges. But the pedestrian suffered damages, and cash transfers can (re-)distribute those damages to more accurately represent what would be considered "fair".
  - acdha 9y ago
nothrabannosir 9y ago
I like the approach of defining the cost of a breach, and letting the market figure out what is necessary to protect against it. If you prescribe something, all you’re doing is creating a regulatory moat. And if a company decides that it can’t completely protect itself.. hey, what about not collecting so much bloody data?? Wouldn’t that be a lovely side effect? If (P.I.) data, by its very existence, became a toxic asset, to be handled only when absolutely necessary?
Retric 9y ago
The advantage of a fine is you offload all the costs of enforcement from the government to industry/ private insurance companies that underwrite the industry. Adding yet more bureaucracy to maintain solid regulations is a real cost, on the other hand you are going to need the same detection and enforcement ether way. So, we might as well save the taxpayer money and simply fine based on outcomes. PS: It also simlifies the court cases as demstrating a data breach is more straightforward than demonstrating a company followed all reasonable precautions even though they failed.
- throwaway2016a 9y ago
  I agree that is a real concern. The disadvantage though is that thanks to zero-day vulnerabilities it means anyone who runs a software company can get hit my lightning at any time. And quite possibly through no fault of their own. Though I suppose there could be insurance policies for that in the same way a home contractor has insurance for if they fall off a ladder. At the same time, sending an auditor to an office for a couple days to assess their security readiness is cheaper for the tax payers than tying up the courts if/when a large company disputes the fine.
  - zonethundery 9y ago
    The feds already have a technology service provider supervision (i.e. 'audit') program through the FFIEC[0], which includes cybersecurity standards. The challenge for regulators is that companies not providing technology infrastructure for depository institutions are not covered. [0] Supervision of Technology Service Providers examination booklet: https://ithandbook.ffiec.gov/it-booklets/supervision-of-technology-service-providers.aspx https://ithandbook.ffiec.gov/it-booklets/supervision-of-tech...
  - zardo 9y ago
    Another possibility, is vendors that take responsibility for security flaws in their hardware or software. To take your contractor falling off a ladder analogy, the company that built the ladder could be held partially liable for the flaw as well.
smt88 9y ago
We've had our Enron-scale disaster(s). We need Sarbanes-Oxley for security: all companies have to be audited by a responsible third party. Fines aren't enough because the leadership of the company is often totally insulated from them (case in point: Equifax).
epanchin 9y ago
I personally believe companies should be fined regardless. But one caveat I’d add to your point. Companies should not have a free pass for losing data that isn’t directly required for providing the service the user requested; or when storing data the user did not give them permission to acquire. Data should be a liability not an asset.
moron4hire 9y ago
It would be easier to get the board to agree to spend money on security if it was required by law, with serious consequences for non-compliance. Technically, accessibility is required by law, but the law has no teeth.
sitkack 9y ago
Hold the Board criminally responsible.
matt4077 9y ago
Fines have two different justifications, and I believe you're mixing them up. One is a sort of punishment for what is considered a moral failure. For people there's criminal law, but when organizations "misbehave", fines are usually easier to assess rather than individual responsibilities. That is the context in which you are concerned about fines, because it seems unjust to punish where no intent to harm (or gross negligence) existed. But fines in this sort of civil law context also serve a different purpose: much like a carbon tax or late fees at the the video rental store, they serve to internalize negative external effects. In this light, there is no moral judgement or stigma attached to fines. Put another way: the damage is already done when the data is lost. All that's left is to assign responsibility. "No fines" leaves all of the burden with the individuals whose data was lost, even though they are unlikely to have any power to stop such breeches. By fining the company (and possibly compensating the victims) the existing damage is only moved to the party that had at least some control over the situation.
voidmain 9y ago
That approach - safe harbors or a negligence standard - leads to compliance box checking, breaches, and shrugging of shoulders. Ultimately it leads to obsolete standards and regulatory capture that actively mandate insecure practices. Strict liability leads to the market actually solving the problem. It's not just that insurers, who have skin in the game, will do a better job of coming up with standards and auditing them than regulators. It's not just that the cost of insuring excessive amounts of personal information will lead to companies not storing private information unnecessarily. It's also that this cost will create demand for actual secure hardware and software. Zero day vulnerabilities are not inevitable in a world where their costs are actually internalized. We could build secure systems, if we were willing to pay for it.
- TheCoelacanth 9y ago
  The liability for zero day vulnerabilities should fall on the vendor selling whatever product had the zero day vulnerability unless they prominently disclose to the buyer that the software is not fit for the purpose they are buying it for. We don't let car companies sell cars and then just add some fine print saying "this car might blow up and kill you even if you use it correctly and we are not responsible for that". Why do we let software companies do the same?
  - voidmain 9y ago
    If the companies that are actually leaking personal data had any liability, perhaps they would want to buy software that came with such a warranty! I don't think software warranties should be mandated by law - if that were the case, open source software would probably never have come to exist. But I agree with you that software intended to sit in important security boundaries probably mostly should be available with a warranty. Again, imposing strict liability on the company leaking the data will find this equilibrium if it is the right one. You will go to buy "cyber insurance" for the 100 million user profiles you are storing- a $10 billion possible loss for the insurer- and they will read the fine print of your software licenses! When we are talking about stuff sold to consumers- smartphones that lose your personal information or webcams that are part of botnets- it's a little less clear. The legal system probably isn't up to holding individual webcam owners liable for an attractive nuisance, and then having them turn around and sue the manufacturers, etc. It is more practical to impose liability on the manufacturer of the product by default (unless the consumer use is negligent). But again, any such regime needs to be crafted carefully to not effectively outlaw free software, hobbyist friendly hardware, etc. Be careful what you wish for.
Eridrus 9y ago
Have you ever dealt with PCI or HIPPAA compliance? It's all about checking boxes. This approach has not worked. We need to adequately start pricing in the costs of externalised losses, and studying what actually works, otherwise nothing will get better.

nathantotten 9y ago

IMO, the specifics of how to secure are less important than ensuring proper cost of not securing your systems. I think having rigid rules like PCI would be significant burden and not allow flexibility as technology and business changes. On the other hand, simply ensuring that the financial penalties are in line with the damage done should be enough to solve the issue. You said yourself that boards won’t agree to spend money. If they saw a huge financial downside risk they would be more likely to invest in security.

throwaway2016a 9y ago
I agree. PCI is way too rigid. But you wouldn't want something like that for legislation anyway. I don't want Congress picking my security standards. But I think there should be some bar that companies can reach that protects them from the most serious penalties of any laws. That bar may even move depending on factors like revenue, number of users, and sensitivity of data. > On the other hand, simply ensuring that the financial penalties are in line with the damage done should be enough to solve the issue. You said yourself that boards won’t agree to spend money. If they saw a huge financial downside risk they would be more likely to invest in security. I completely agree. Not sure if it came off correctly but that was the point of my edit at the end.
- nathantotten 9y ago
  Yeah, that makes sense. You’re right there needs to be a reward for achieving some measure of security.
- maxerickson 9y ago
  Companies that want to protect themselves from breaches should avoid collecting and quickly discard sensitive data.
  - throwaway2016a 9y ago
    Agreed completely. PCI and many data protection laws and industry frameworks already dictate that you should discard data as soon as you no longer need it and not collect sensitive data unless you legitimately need it. That can be part of the law.
    - maxerickson 9y ago
      Right, but my point is that there isn't a deep need for a box checking exercise that gets a company out of liability, if they don't want liability they can just avoid creating it. Conveniently this is most onerous for stupid business models.
  - AJ007 9y ago
    It could also be a way to offload sensitive processing & storage to a third party; e.g. Stripe. I'm leaning much more toward John Young's (Cryptome) viewpoint of information security -- smoke and mirrors. Maybe nothing is secure and it is only a question of how interested the adversary is in creating a break and then what they decide to do with the information after. Robert Cringely has the most practical advice I've read -- keep secure communications off the internet.

grasshopperpurp 9y ago

>If a company is willfully negligent I agree with a lot of the points in this post, but I think it's important to remove 'willfully' from this statement. If a company takes on this type of power and responsibility, it should not matter whether their negligence was willful.

throwaway2016a 9y ago
My implication is that on a scale of 0 to 10 with 0 being completely unaccountable that companies that are willfully negligent should be at 10. I'm not arguing that that companies who are accidentally negligent should be at 0. If I pre-meditate to purposely use my car to kill someone that is a different crime than if I am driving following all the rules of the road and I don't notice the person crossing the street until it is too late.
- grasshopperpurp 9y ago
  I understand. I just disagree. I don't think the car analogy is apt, because it doesn't capture the inherit risk (to so many) that these companies accept. They willfully accept that risk - when data breaches are inevitable. I'm saying they should both be 10.
  - matt4077 9y ago
    There is something similar with cars, actually. In many countries, when you injure a pedestrian through absolutely no fault of your own (i. e. they drunkenly stumbled onto the street and you had no time to react), you (or your insurance) are still liable for damages. Why is that? Because when you drive a car, you get all the benefits of, well, driving. Pedestrians get absolutely nothing, except the "chance" to suffer whenever they don't pay enough attention. Note that this is civil law. If you had no chance to avoid the accident, nobody is blaming you, nor will you face criminal charges. But the pedestrian suffered damages, and cash transfers can (re-)distribute those damages to more accurately represent what would be considered "fair".
- acdha 9y ago

nothrabannosir 9y ago

I like the approach of defining the cost of a breach, and letting the market figure out what is necessary to protect against it. If you prescribe something, all you’re doing is creating a regulatory moat. And if a company decides that it can’t completely protect itself.. hey, what about not collecting so much bloody data?? Wouldn’t that be a lovely side effect? If (P.I.) data, by its very existence, became a toxic asset, to be handled only when absolutely necessary?

Retric 9y ago

The advantage of a fine is you offload all the costs of enforcement from the government to industry/ private insurance companies that underwrite the industry. Adding yet more bureaucracy to maintain solid regulations is a real cost, on the other hand you are going to need the same detection and enforcement ether way. So, we might as well save the taxpayer money and simply fine based on outcomes. PS: It also simlifies the court cases as demstrating a data breach is more straightforward than demonstrating a company followed all reasonable precautions even though they failed.

throwaway2016a 9y ago
I agree that is a real concern. The disadvantage though is that thanks to zero-day vulnerabilities it means anyone who runs a software company can get hit my lightning at any time. And quite possibly through no fault of their own. Though I suppose there could be insurance policies for that in the same way a home contractor has insurance for if they fall off a ladder. At the same time, sending an auditor to an office for a couple days to assess their security readiness is cheaper for the tax payers than tying up the courts if/when a large company disputes the fine.
- zonethundery 9y ago
  The feds already have a technology service provider supervision (i.e. 'audit') program through the FFIEC[0], which includes cybersecurity standards. The challenge for regulators is that companies not providing technology infrastructure for depository institutions are not covered. [0] Supervision of Technology Service Providers examination booklet: https://ithandbook.ffiec.gov/it-booklets/supervision-of-technology-service-providers.aspx https://ithandbook.ffiec.gov/it-booklets/supervision-of-tech...
- zardo 9y ago
  Another possibility, is vendors that take responsibility for security flaws in their hardware or software. To take your contractor falling off a ladder analogy, the company that built the ladder could be held partially liable for the flaw as well.

smt88 9y ago

We've had our Enron-scale disaster(s). We need Sarbanes-Oxley for security: all companies have to be audited by a responsible third party. Fines aren't enough because the leadership of the company is often totally insulated from them (case in point: Equifax).

epanchin 9y ago

I personally believe companies should be fined regardless. But one caveat I’d add to your point. Companies should not have a free pass for losing data that isn’t directly required for providing the service the user requested; or when storing data the user did not give them permission to acquire. Data should be a liability not an asset.

moron4hire 9y ago

It would be easier to get the board to agree to spend money on security if it was required by law, with serious consequences for non-compliance. Technically, accessibility is required by law, but the law has no teeth.

sitkack 9y ago

Hold the Board criminally responsible.

matt4077 9y ago

Fines have two different justifications, and I believe you're mixing them up. One is a sort of punishment for what is considered a moral failure. For people there's criminal law, but when organizations "misbehave", fines are usually easier to assess rather than individual responsibilities. That is the context in which you are concerned about fines, because it seems unjust to punish where no intent to harm (or gross negligence) existed. But fines in this sort of civil law context also serve a different purpose: much like a carbon tax or late fees at the the video rental store, they serve to internalize negative external effects. In this light, there is no moral judgement or stigma attached to fines. Put another way: the damage is already done when the data is lost. All that's left is to assign responsibility. "No fines" leaves all of the burden with the individuals whose data was lost, even though they are unlikely to have any power to stop such breeches. By fining the company (and possibly compensating the victims) the existing damage is only moved to the party that had at least some control over the situation.

voidmain 9y ago

That approach - safe harbors or a negligence standard - leads to compliance box checking, breaches, and shrugging of shoulders. Ultimately it leads to obsolete standards and regulatory capture that actively mandate insecure practices. Strict liability leads to the market actually solving the problem. It's not just that insurers, who have skin in the game, will do a better job of coming up with standards and auditing them than regulators. It's not just that the cost of insuring excessive amounts of personal information will lead to companies not storing private information unnecessarily. It's also that this cost will create demand for actual secure hardware and software. Zero day vulnerabilities are not inevitable in a world where their costs are actually internalized. We could build secure systems, if we were willing to pay for it.

TheCoelacanth 9y ago
The liability for zero day vulnerabilities should fall on the vendor selling whatever product had the zero day vulnerability unless they prominently disclose to the buyer that the software is not fit for the purpose they are buying it for. We don't let car companies sell cars and then just add some fine print saying "this car might blow up and kill you even if you use it correctly and we are not responsible for that". Why do we let software companies do the same?
- voidmain 9y ago
  If the companies that are actually leaking personal data had any liability, perhaps they would want to buy software that came with such a warranty! I don't think software warranties should be mandated by law - if that were the case, open source software would probably never have come to exist. But I agree with you that software intended to sit in important security boundaries probably mostly should be available with a warranty. Again, imposing strict liability on the company leaking the data will find this equilibrium if it is the right one. You will go to buy "cyber insurance" for the 100 million user profiles you are storing- a $10 billion possible loss for the insurer- and they will read the fine print of your software licenses! When we are talking about stuff sold to consumers- smartphones that lose your personal information or webcams that are part of botnets- it's a little less clear. The legal system probably isn't up to holding individual webcam owners liable for an attractive nuisance, and then having them turn around and sue the manufacturers, etc. It is more practical to impose liability on the manufacturer of the product by default (unless the consumer use is negligent). But again, any such regime needs to be crafted carefully to not effectively outlaw free software, hobbyist friendly hardware, etc. Be careful what you wish for.

Eridrus 9y ago

Have you ever dealt with PCI or HIPPAA compliance? It's all about checking boxes. This approach has not worked. We need to adequately start pricing in the costs of externalised losses, and studying what actually works, otherwise nothing will get better.