4 ms·

What you don't realize is that the lawlessness around user data hurts big corporations too. If you're a big corporation collecting significant data than you've

by dnomad 8y ago

What you don't realize is that the lawlessness around user data hurts big corporations too. If you're a big corporation collecting significant data than you've taken on a significant liability but the nature of this liability is amorphous. How much will it cost you if your data gets hacked? What will be the impact if you share the data with a partner and the partner gets hacked? How much can you share in your api? What if you sell the data to a foreign firm and that firm turns out to be the Russian government? What happens when a client sues you and claims you caused harm to her because you have the wrong data about her? Every corporation has to answer these questions but right now they have to do it with no real guidance from the government. This makes the data a ticking time bomb. It's not clear what can be done with it or even how much it's worth. It's not clear what best practices exist in terms of technologies and ethical guidelines. That said nobody expects something like the GDPR too happen in America. Pretty much every other country will adopt similar laws though. If Americans are lucky they'll get some benefit from that.

whatshisface 8y ago
>How much will it cost you if your data gets hacked? What will be the impact if you share the data with a partner and the partner gets hacked? Historically, these numbers have been $0.0+/-0. Executives aren't exactly bumbling around with hazardous materials.
- hannasanarion 8y ago
  Tell that to Equifax.
  - criddell 8y ago
    Elizabeth Warren thinks it may end up making money for Equifax: https://www.marketplace.org/2018/02/28/tech/sen-elizabeth-warren-equifax-may-actually-make-money-breach https://www.marketplace.org/2018/02/28/tech/sen-elizabeth-wa...
- atomic77 8y ago
  Interesting you should use the hazardous materials analogy - Bruce Schneier made a pretty convincing case two years ago that data should be considered a toxic asset. https://www.schneier.com/blog/archives/2016/03/data_is_a_toxic.html https://www.schneier.com/blog/archives/2016/03/data_is_a_tox...
mannschott 8y ago
I'm not seeing "significant liability" in how even major data breaches have been handled in the US so far. Where are the fines large enough to be noticed for gross negligence? Where are the prisons terms for the captains of industry that set the priorities and determine the budgets that inevitably lead to such negligence? Equifax? Yahoo? Target? Heartland? TJX? eBay? JP Morgan Chase? Adult Friend Finder? Locationsmart and the cell phone carriers providing real time location information on all of their customers to third parties? A CEO of a major corporation The Land of the Free™, wouldn't consider liability for negligent data handling very seriously given the government's seeming lack of interest in seriously prosecuting same. S/he'd probably even argue that investing more in security would lower profits and harm investors. And we can't have that. What am I missing?
mbesto 8y ago
> How much will it cost you if your data gets hacked? If I understand it correctly (IANAL), there are no penalties for getting hacked. Rather there are penalties for not having proper procedures for how to respond to a hack.
- DanBC 8y ago
  It depends what data you had; why you had it; whether you knew you had it; and how it was hacked. https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2016/10/talktalk-gets-record-400-000-fine-for-failing-to-prevent-october-2015-attack/ https://ico.org.uk/about-the-ico/news-and-events/news-and-bl... > The data was taken from an underlying customer database that was part of TalkTalk’s acquisition of Tiscali’s UK operations in 2009. The data was accessed through an attack on three vulnerable webpages within the inherited infrastructure. TalkTalk failed to properly scan this infrastructure for possible threats and so was unaware the vulnerable pages existed or that they enabled access to a database that held customer information. > TalkTalk was not aware that the installed version of the database software was outdated and no longer supported by the provider. The company said it did not know at the time that the software was affected by a bug – for which a fix was available. The bug allowed the attacker to bypass access restrictions. Had it been fixed, this would not have been possible.
  - mbesto 8y ago
    That's not a GDPR fine, that's an ICO fine under a different (but similar and related) regulation (Germany and France have similar ones IIRC). The suggestion is that the US adopt GDPR-style regulation, which penalizes for infringement to procedures of data governance, NOT whether data is actually breached. (EDIT: obviously a breach will trigger a GDPR investigation)
    - DanBC 8y ago
      Yes, that's an ICO fine under the previous data protection law in the UK. Now that we have GDPR and the new data protection law ICO will be issuing fines under the new law. This old case is an example of how the ICO regulate, and the things they'll take into account. GDPR wouldn't make much difference for this case.
mnm1 8y ago
Or, in the US, you can just make your customers sign arbitration agreements and deal with it on a case by case basis without incurring any significant penalties. See Equifax, Yahoo, Apple, and pretty much every data breach ever. If those companies didn't have arbitration agreements, it's only because they are behind the curve on this trend of doing an end run around the judicial system. Sorry, I fail to see how this hurts big businesses in any of the ways you list.

by dnomad 8y ago

whatshisface 8y ago

>How much will it cost you if your data gets hacked? What will be the impact if you share the data with a partner and the partner gets hacked? Historically, these numbers have been $0.0+/-0. Executives aren't exactly bumbling around with hazardous materials.

hannasanarion 8y ago
Tell that to Equifax.
- criddell 8y ago
  Elizabeth Warren thinks it may end up making money for Equifax: https://www.marketplace.org/2018/02/28/tech/sen-elizabeth-warren-equifax-may-actually-make-money-breach https://www.marketplace.org/2018/02/28/tech/sen-elizabeth-wa...
atomic77 8y ago
Interesting you should use the hazardous materials analogy - Bruce Schneier made a pretty convincing case two years ago that data should be considered a toxic asset. https://www.schneier.com/blog/archives/2016/03/data_is_a_toxic.html https://www.schneier.com/blog/archives/2016/03/data_is_a_tox...

mannschott 8y ago

I'm not seeing "significant liability" in how even major data breaches have been handled in the US so far. Where are the fines large enough to be noticed for gross negligence? Where are the prisons terms for the captains of industry that set the priorities and determine the budgets that inevitably lead to such negligence? Equifax? Yahoo? Target? Heartland? TJX? eBay? JP Morgan Chase? Adult Friend Finder? Locationsmart and the cell phone carriers providing real time location information on all of their customers to third parties? A CEO of a major corporation The Land of the Free™, wouldn't consider liability for negligent data handling very seriously given the government's seeming lack of interest in seriously prosecuting same. S/he'd probably even argue that investing more in security would lower profits and harm investors. And we can't have that. What am I missing?

mbesto 8y ago

> How much will it cost you if your data gets hacked? If I understand it correctly (IANAL), there are no penalties for getting hacked. Rather there are penalties for not having proper procedures for how to respond to a hack.

DanBC 8y ago
It depends what data you had; why you had it; whether you knew you had it; and how it was hacked. https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2016/10/talktalk-gets-record-400-000-fine-for-failing-to-prevent-october-2015-attack/ https://ico.org.uk/about-the-ico/news-and-events/news-and-bl... > The data was taken from an underlying customer database that was part of TalkTalk’s acquisition of Tiscali’s UK operations in 2009. The data was accessed through an attack on three vulnerable webpages within the inherited infrastructure. TalkTalk failed to properly scan this infrastructure for possible threats and so was unaware the vulnerable pages existed or that they enabled access to a database that held customer information. > TalkTalk was not aware that the installed version of the database software was outdated and no longer supported by the provider. The company said it did not know at the time that the software was affected by a bug – for which a fix was available. The bug allowed the attacker to bypass access restrictions. Had it been fixed, this would not have been possible.
- mbesto 8y ago
  That's not a GDPR fine, that's an ICO fine under a different (but similar and related) regulation (Germany and France have similar ones IIRC). The suggestion is that the US adopt GDPR-style regulation, which penalizes for infringement to procedures of data governance, NOT whether data is actually breached. (EDIT: obviously a breach will trigger a GDPR investigation)
  - DanBC 8y ago
    Yes, that's an ICO fine under the previous data protection law in the UK. Now that we have GDPR and the new data protection law ICO will be issuing fines under the new law. This old case is an example of how the ICO regulate, and the things they'll take into account. GDPR wouldn't make much difference for this case.

mnm1 8y ago

Or, in the US, you can just make your customers sign arbitration agreements and deal with it on a case by case basis without incurring any significant penalties. See Equifax, Yahoo, Apple, and pretty much every data breach ever. If those companies didn't have arbitration agreements, it's only because they are behind the curve on this trend of doing an end run around the judicial system. Sorry, I fail to see how this hurts big businesses in any of the ways you list.