4 ms·

There can be multiple parties responsible. If someone steals a bunch of Social Security numbers using SQLI on an insecure website and sells them on the black m

There can be multiple parties responsible. If someone steals a bunch of Social Security numbers using SQLI on an insecure website and sells them on the black market, should the intruder be held criminally responsible? Yes, in my book. That's entirely on top of the website operator. There should be some liability there, IMO, but it's unclear to me how much. Though I wouldn't mind a world where all personal data is viewed like a form of radioactive waste to be avoided at all costs, it's not obvious that that's what our legal system should encourage.

bb88 9y ago
> That's entirely on top of the website operator. There should be some liability there, IMO, but it's unclear to me how much. The minimum companies need to do is notify the affected consumers. I think we can all agree on this. > Though I wouldn't mind a world where all personal data is viewed like a form of radioactive waste to be avoided at all costs, it's not obvious that that's what our legal system should encourage. From a market perspective, as long as PII has intrinsic black-market value, people will want it. The government could tax the amount of PII a company might store, say, but the black-market wouldn't pay the tax, anyway. Removing value from PII would mean removing convenience for the sake of security. So I can't get loans/credit card applications online anymore, etc.