9 ms·

You Can’t Fire Equifax, but Your Employer Can

209 points by tysone 9y ago

rdtsc 9y ago
Good to see. This is a great development hopefully others follow suit. It was telling in how Equifax announced their breach -- they stressed that "no customer information was impacted" very strongly, right at the top: https://investor.equifax.com/news-and-events/news/2017/09-07-2017-213000628 https://investor.equifax.com/news-and-events/news/2017/09-07... Most of US population got exposed but hey our customers are safe, so no big deal. We'll just give everyone credit monitoring and they'll shut up. The thing is looking back, Equifax wasn't really that impacted. Their stock is back to where it was last January. They'll have some lawsuits but it doesn't seem like they'll be going out of business like everyone expected (hoped even). The other terrible thing there is that it was a lesson for others in the industry. They are watching and learning, if Equifax didn't suffer that much why bother enhancing their security posture. Why spend money if even with such a huge breach the consequences are not that bad. People are always surprised how banks or other institution have terrible security practices, this is why.
- maxxxxx 9y ago
  Yeah, it's surprising how little impact this had on Equifax so far.
  - FireBeyond 9y ago
    I wish I could say I agreed with you. In truth, it’s eminently unsurprising to me how little impact there has been. Any time we see one of these “should be devastating” data breaches, people/ politicians shake their fist for about a week, but there’s little consequences. Sure, sometimes a company might be fined _five per cent_ of the _profit_ they made from the behavior that lead to the breach. Not sure that’s so much a slap on the wrist as a “tsk, tsk”.
    - maxxxxx 9y ago
      That was a really big one at a company that has a lot of valuable start on almost every citizen. I can't think of many worse possible breaches. Maybe the IRS or Visa?
      - toomuchtodo 9y ago
        OPM. https://www.opm.gov/cybersecurity/cybersecurity-incidents/ https://www.opm.gov/cybersecurity/cybersecurity-incidents/
      - deleted 9y ago
        [deleted]
tedivm 9y ago
I would never work for a company that used this service. > Lots of employers use it. Equifax claims that more than 5,500 have signed up, including over 75 percent of Fortune 500 companies and many federal agencies. The service works by setting up a sort of central line to your employer’s payroll operation, uploading your paycheck information each period. It also records your job title and tenure.
- fra 9y ago
  Are you sure yours does not? Most large tech firms use Equifax for The Work Number.
  - abecedarius 9y ago
    How does this work? Does the employer have a clause in your contract, plus a deal with this company to feed them this data, in exchange for what? It wasn't clear to me from poking around their website. Does it buy the employer the ability to query this database about their new candidates? I don't remember anything like this when last I worked fulltime for a bigco, in 2007.
    - rdtsc 9y ago
      > in exchange for what? Guessing here but it could be in exchange to letting them use the data as well. By feeding data back into it, they might get some benefit like a discount for example. People join and leave companies regularly and having access to the system allows them to low-ball people in salary negotiations thus saving them a considerable chunk of money. Wonder how legal that is. It's obviously not completely illegal but it seems like it would be a gray area. Should the company be allowed to share a worker's salary information? Does that belong to the worker or the company? If it belongs to the worker the company could still just claim if you work here on page 95 of your contract you agreed to let us share this and it looks like you signed and agreed, so tough luck. You can almost see some executive there realizing "Hey, I read in <whatever business journal> people are getting pretty good jumps in salaries just by moving jobs. Regular workers shouldn't be able to do those kinda things. It seems if we invent this new product we could fuck people over and make a good chunk of money for ourselves" (followed by maniacal evil laughter).
sxates 9y ago
I'd really like there to be a law that allows you to opt-out of credit reporting agencies. This would work similarly to the do-not-call list - I give them my social and they are instructed to disregard any data they receive that's associated with that number, and will destroy whatever information they currently have about it. Doing this potentially locks you out of getting credit, but if you can do it on a per-agency basis, then it's a good way for individuals to punish bad actors like Equifax. If even 10% of Americans opted out after the breach, their business would be over, the remaining agencies would have proper motivation to improve their security standards, and it would open a gap in the market that a better run startup could move into.
- x0x0 9y ago
  I doubt this would work. There are really only 3 vendors for this data, and most banks seem to have exclusive contracts by region for which data source they consult. This, of course, goes hand in hand with the plummeting amount of national banks available in the US. We're really down to Wells Fargo, Citi, Chase, BOA, and one or two others. In my experience, my two credit unions -- and credit unions kind of suck anyway -- are only set up with a single CRA. So people have few choices of creditors and have very little negotiating power. I think the right answer is for there to be exactly one CRA and for it to be a pseudo-public and very heavily regulated.
  - anfilt 9y ago
    I would enjoy not having a credit score. However, I also don't take loans out. --EDIT Not sure why I get the down vote. Pretty neutral comment. I think the credit score is just a sham. If someone wants to get a loan I don't see how a single number has any bearing on reliability. It boils a multi variable question into one number. Further, the number could be quite misleading. Also I don't think any 3rd party should have this data without a written contract from the individual. Maybe that will get more down-votes, but I at least can see some disagreement in that. However, "I would enjoy not having a credit score" is just a statement... I view loans negatively. If I can't save up for it. I don't need it. I am certainly not going to pay more for something thanks to that pesky interest. I also got rid of all my credit cards 5 years ago, and made certain to never take out any more debt. Not even for a house. The only exception I could see is if I started a business as it allows for additional cash when needed. For example more orders than anticipated, and I don't get paid till the customer has the product. Either, customers suffer delays or infuse some extra cash to increase cash flow, but then immediately pay it back.
TrainedMonkey 9y ago
Interesting question of what happens to the trove of data they have if Equifax does go out of business. Sensible alternatives are either regulators will have to step in or they are in too big to fail boat. Less sensible would be to do nothing and hope data does not end up in bad hands.
- maxxxxx 9y ago
  Somebody will buy the data. Equifax won't just disappear one day.
  - jessaustin 9y ago
    Actually it seems possible. The demand for their service won't disappear, but with their unpopularity and poor security practices someone who can might just decide to burn them to the ground. Their only assets are data. I'm sure they have offline backups, but a patient enough attack would bork the backups too. They'd probably try to continue doing business, because YOLO, but eventually enough erstwhile 850s would get their Audi leases rejected that the lawsuits would really pile up. About that time some pissed-off employees would start talking to reporters, and that would end the whole thing.
- mindslight 9y ago
  A company based around the mission of extracting wealth through exacerbating negotiating power imbalance is already just about the worst hands possible! Even though USG's surveillance databases have steep outcomes (eg prison/murder), they're at least targeted at an idea of discrete criminals. Commercial surveillance is an attack against literally everybody.
s73ver_ 9y ago
I've said this in every thread about these scummy companies, but it is entirely unconscionable that not only are we not allowed to constantly look at and correct the data about us that they have, we are forced to pay for it if we want to do it more than once a year. For them to profit off of us like that is completely and utterly immoral, especially when they clearly do not give a crap about keeping that sensitive data about us secure.
rectang 9y ago
Voluntary forebearance is not a solution. Most companies are not The New York Times, and Equifax is providing powerful data for management to wield in relations with their workforce. Unless it becomes illegal (as it has in California), there will always be many, many companies who will not willingly give up such an advantage in information asymmetry.
- FireBeyond 9y ago
  Exactly. We are not their customers. Employers and lenders are, no more, no less, simple as that. Even “fraud protection” / “credit monitoring”, ostensibly the closest we come to being customers, is in many senses “protect you from our customers and our fuckups” (forgive the language).
neil_s 9y ago
This looks like a service we could recreate, and sell to employers who don't want to be responsible for handing over their employees' data to a firm that risks creating embarrassing PR for them. There are obviously network advantages, but you could bootstrap it if you got even a single employer on board. Is there some other complexity I'm missing?
- cornholio 9y ago
  There are massive network effects, employers only sign up to learn information from other companies, and give up their own information as a condition for the former. It's a business that bootstraps when you have an existing customer base of related services, dealing with employee and payroll management, credit ratings etc. and mine your existing data for a prototype product good enough until the network effects kick in. Maybe you could make it bootstrap by making it very cheap or free, so that, even if employers don't usually get anything from you, they still remained enrolled for the rare instance when you deliver something that others lack, so that you can buildup your database in time. But then highly secure, easy to use and long term come at odds with free.
petilon 9y ago
Here's an example of a report sold by The Work Number: https://www.theworknumber.com/samples/The-Work-Number-Employment-Data-Report-EFX-WS-0205-11-21-14.pdf https://www.theworknumber.com/samples/The-Work-Number-Employ... Notice that one of the items they disclose about you is Workers' Comp. If you are injured at work you can get treatment for your injury through Workers' Compensation and this is usually much more generous than your regular health insurance: there are no co-pays or deductibles, for example. But be careful - when you interview for a new job, The Work Number may disclose this info to your prospective employer and they may consider this a red flag. This happened to me. When I interviewed at a large software company the recruiter mentioned something about my using Workers Comp. Fortunately I had only used it a little and that was many years ago. She also thanked me for my honesty regarding my salary at my previous job. I found that appalling. Me voluntarily disclosing my salary is one thing, but some data purveyor selling my salary info to a prospective employer is a violation of my privacy, and it may depress the salary offered by the new employer. Unfortunately there are no laws preventing employers from disclosing your salary to such companies, and they often do.
- srtjstjsj 9y ago
  > Me voluntarily disclosing my salary is one thing, but some data purveyor selling my salary info to a prospective employer is a violation of my privacy, You consented to this disclosure during your application, or else Equifax violated its contracts.
  - philipov 9y ago
    Coerced consent isn't consent. A drunk person can't consent, and neither can someone who is presented with an impenetrable contract without a lawyer present.
    - colejohnson66 9y ago
      Except you’re not drunk when signing the papers at the beginning of the job... So I fail to see the parallel.
Molaxx 9y ago
What about the crazy idea of nationalizing this? If it's a cartel and very hard to open to competition, and reap the benefits of centralization and not only the disadvantages.

209 points by tysone 9y ago

Good to see. This is a great development hopefully others follow suit. It was telling in how Equifax announced their breach -- they stressed that "no customer information was impacted" very strongly, right at the top: https://investor.equifax.com/news-and-events/news/2017/09-07-2017-213000628 https://investor.equifax.com/news-and-events/news/2017/09-07... Most of US population got exposed but hey our customers are safe, so no big deal. We'll just give everyone credit monitoring and they'll shut up. The thing is looking back, Equifax wasn't really that impacted. Their stock is back to where it was last January. They'll have some lawsuits but it doesn't seem like they'll be going out of business like everyone expected (hoped even). The other terrible thing there is that it was a lesson for others in the industry. They are watching and learning, if Equifax didn't suffer that much why bother enhancing their security posture. Why spend money if even with such a huge breach the consequences are not that bad. People are always surprised how banks or other institution have terrible security practices, this is why.

maxxxxx 9y ago
Yeah, it's surprising how little impact this had on Equifax so far.
- FireBeyond 9y ago
  I wish I could say I agreed with you. In truth, it’s eminently unsurprising to me how little impact there has been. Any time we see one of these “should be devastating” data breaches, people/ politicians shake their fist for about a week, but there’s little consequences. Sure, sometimes a company might be fined _five per cent_ of the _profit_ they made from the behavior that lead to the breach. Not sure that’s so much a slap on the wrist as a “tsk, tsk”.
  - maxxxxx 9y ago
    That was a really big one at a company that has a lot of valuable start on almost every citizen. I can't think of many worse possible breaches. Maybe the IRS or Visa?
    - toomuchtodo 9y ago
      OPM. https://www.opm.gov/cybersecurity/cybersecurity-incidents/ https://www.opm.gov/cybersecurity/cybersecurity-incidents/
    - deleted 9y ago
      [deleted]

tedivm 9y ago

I would never work for a company that used this service. > Lots of employers use it. Equifax claims that more than 5,500 have signed up, including over 75 percent of Fortune 500 companies and many federal agencies. The service works by setting up a sort of central line to your employer’s payroll operation, uploading your paycheck information each period. It also records your job title and tenure.

fra 9y ago
Are you sure yours does not? Most large tech firms use Equifax for The Work Number.
- abecedarius 9y ago
  How does this work? Does the employer have a clause in your contract, plus a deal with this company to feed them this data, in exchange for what? It wasn't clear to me from poking around their website. Does it buy the employer the ability to query this database about their new candidates? I don't remember anything like this when last I worked fulltime for a bigco, in 2007.
  - rdtsc 9y ago
    > in exchange for what? Guessing here but it could be in exchange to letting them use the data as well. By feeding data back into it, they might get some benefit like a discount for example. People join and leave companies regularly and having access to the system allows them to low-ball people in salary negotiations thus saving them a considerable chunk of money. Wonder how legal that is. It's obviously not completely illegal but it seems like it would be a gray area. Should the company be allowed to share a worker's salary information? Does that belong to the worker or the company? If it belongs to the worker the company could still just claim if you work here on page 95 of your contract you agreed to let us share this and it looks like you signed and agreed, so tough luck. You can almost see some executive there realizing "Hey, I read in <whatever business journal> people are getting pretty good jumps in salaries just by moving jobs. Regular workers shouldn't be able to do those kinda things. It seems if we invent this new product we could fuck people over and make a good chunk of money for ourselves" (followed by maniacal evil laughter).

sxates 9y ago

I'd really like there to be a law that allows you to opt-out of credit reporting agencies. This would work similarly to the do-not-call list - I give them my social and they are instructed to disregard any data they receive that's associated with that number, and will destroy whatever information they currently have about it. Doing this potentially locks you out of getting credit, but if you can do it on a per-agency basis, then it's a good way for individuals to punish bad actors like Equifax. If even 10% of Americans opted out after the breach, their business would be over, the remaining agencies would have proper motivation to improve their security standards, and it would open a gap in the market that a better run startup could move into.

x0x0 9y ago
I doubt this would work. There are really only 3 vendors for this data, and most banks seem to have exclusive contracts by region for which data source they consult. This, of course, goes hand in hand with the plummeting amount of national banks available in the US. We're really down to Wells Fargo, Citi, Chase, BOA, and one or two others. In my experience, my two credit unions -- and credit unions kind of suck anyway -- are only set up with a single CRA. So people have few choices of creditors and have very little negotiating power. I think the right answer is for there to be exactly one CRA and for it to be a pseudo-public and very heavily regulated.
- anfilt 9y ago
  I would enjoy not having a credit score. However, I also don't take loans out. --EDIT Not sure why I get the down vote. Pretty neutral comment. I think the credit score is just a sham. If someone wants to get a loan I don't see how a single number has any bearing on reliability. It boils a multi variable question into one number. Further, the number could be quite misleading. Also I don't think any 3rd party should have this data without a written contract from the individual. Maybe that will get more down-votes, but I at least can see some disagreement in that. However, "I would enjoy not having a credit score" is just a statement... I view loans negatively. If I can't save up for it. I don't need it. I am certainly not going to pay more for something thanks to that pesky interest. I also got rid of all my credit cards 5 years ago, and made certain to never take out any more debt. Not even for a house. The only exception I could see is if I started a business as it allows for additional cash when needed. For example more orders than anticipated, and I don't get paid till the customer has the product. Either, customers suffer delays or infuse some extra cash to increase cash flow, but then immediately pay it back.

TrainedMonkey 9y ago

Interesting question of what happens to the trove of data they have if Equifax does go out of business. Sensible alternatives are either regulators will have to step in or they are in too big to fail boat. Less sensible would be to do nothing and hope data does not end up in bad hands.

maxxxxx 9y ago
Somebody will buy the data. Equifax won't just disappear one day.
- jessaustin 9y ago
  Actually it seems possible. The demand for their service won't disappear, but with their unpopularity and poor security practices someone who can might just decide to burn them to the ground. Their only assets are data. I'm sure they have offline backups, but a patient enough attack would bork the backups too. They'd probably try to continue doing business, because YOLO, but eventually enough erstwhile 850s would get their Audi leases rejected that the lawsuits would really pile up. About that time some pissed-off employees would start talking to reporters, and that would end the whole thing.
mindslight 9y ago
A company based around the mission of extracting wealth through exacerbating negotiating power imbalance is already just about the worst hands possible! Even though USG's surveillance databases have steep outcomes (eg prison/murder), they're at least targeted at an idea of discrete criminals. Commercial surveillance is an attack against literally everybody.

s73ver_ 9y ago

I've said this in every thread about these scummy companies, but it is entirely unconscionable that not only are we not allowed to constantly look at and correct the data about us that they have, we are forced to pay for it if we want to do it more than once a year. For them to profit off of us like that is completely and utterly immoral, especially when they clearly do not give a crap about keeping that sensitive data about us secure.

rectang 9y ago

Voluntary forebearance is not a solution. Most companies are not The New York Times, and Equifax is providing powerful data for management to wield in relations with their workforce. Unless it becomes illegal (as it has in California), there will always be many, many companies who will not willingly give up such an advantage in information asymmetry.

FireBeyond 9y ago
Exactly. We are not their customers. Employers and lenders are, no more, no less, simple as that. Even “fraud protection” / “credit monitoring”, ostensibly the closest we come to being customers, is in many senses “protect you from our customers and our fuckups” (forgive the language).

neil_s 9y ago

This looks like a service we could recreate, and sell to employers who don't want to be responsible for handing over their employees' data to a firm that risks creating embarrassing PR for them. There are obviously network advantages, but you could bootstrap it if you got even a single employer on board. Is there some other complexity I'm missing?

cornholio 9y ago
There are massive network effects, employers only sign up to learn information from other companies, and give up their own information as a condition for the former. It's a business that bootstraps when you have an existing customer base of related services, dealing with employee and payroll management, credit ratings etc. and mine your existing data for a prototype product good enough until the network effects kick in. Maybe you could make it bootstrap by making it very cheap or free, so that, even if employers don't usually get anything from you, they still remained enrolled for the rare instance when you deliver something that others lack, so that you can buildup your database in time. But then highly secure, easy to use and long term come at odds with free.

petilon 9y ago

Here's an example of a report sold by The Work Number: https://www.theworknumber.com/samples/The-Work-Number-Employment-Data-Report-EFX-WS-0205-11-21-14.pdf https://www.theworknumber.com/samples/The-Work-Number-Employ... Notice that one of the items they disclose about you is Workers' Comp. If you are injured at work you can get treatment for your injury through Workers' Compensation and this is usually much more generous than your regular health insurance: there are no co-pays or deductibles, for example. But be careful - when you interview for a new job, The Work Number may disclose this info to your prospective employer and they may consider this a red flag. This happened to me. When I interviewed at a large software company the recruiter mentioned something about my using Workers Comp. Fortunately I had only used it a little and that was many years ago. She also thanked me for my honesty regarding my salary at my previous job. I found that appalling. Me voluntarily disclosing my salary is one thing, but some data purveyor selling my salary info to a prospective employer is a violation of my privacy, and it may depress the salary offered by the new employer. Unfortunately there are no laws preventing employers from disclosing your salary to such companies, and they often do.

srtjstjsj 9y ago
> Me voluntarily disclosing my salary is one thing, but some data purveyor selling my salary info to a prospective employer is a violation of my privacy, You consented to this disclosure during your application, or else Equifax violated its contracts.
- philipov 9y ago
  Coerced consent isn't consent. A drunk person can't consent, and neither can someone who is presented with an impenetrable contract without a lawyer present.
  - colejohnson66 9y ago
    Except you’re not drunk when signing the papers at the beginning of the job... So I fail to see the parallel.

Molaxx 9y ago

What about the crazy idea of nationalizing this? If it's a cartel and very hard to open to competition, and reap the benefits of centralization and not only the disadvantages.