15 ms·
Prison time, hefty fines for data privacy violations: draft U.S. Senate bill
- rayiner 8y agoPrison time for this is madness.
- tptacek 8y agoIt reads to me like the prison time in this bill is reserved for the crime of knowingly mis-certifying annual reports to the FTC on data protection (ie, for defrauding the government) --- those reports are also only required from businesses with $1B+ of revenue. The rest of the penalties in the bill seem to take the form of liability under FTC's "Unfair Trade Practices" authority.
- _cs2017_ 8y agoThanks for clarifying; I completely misunderstood that. If only journalists were half as good as you at reporting information...
- tptacek 8y agoJournalists are much better than me at obtaining and reporting information. This story just isn't very important; it's a "discussion draft" of controversial legislation by a lone member of the minority party. It wasn't allocated many resources by Reuters.
- austincheney 8y agoI disagree. The current standard is that privacy and security are only so important as to prevent law suits unless there is law that says otherwise. That is a pretty low bar. With this privacy and security must be taken seriously from the start. I am of the opinion that wanton neglect that results in massive consumer harm (think Equifax hack) should warrant prison time.
- geggam 8y agoThis. Leaving databases exposed to the net. Leaving S3 buckets open to the public. All of these sorts of things needs to carry punishments not for the people who are told to set the stuff up. It needs punishment for the management who doesnt allow time to set things up properly
- bdcravens 8y ago> It needs punishment for the management who doesnt allow time to set things up properly Hard to show it was management's fault, and not the result of a developer who really didn't have the AWS skills (though that's probably still the fault of management, for not verifying skillsets before hiring or giving AWS keys) Everything we know about iteration cycles, quick access to devops resources, etc, will change when prison time becomes an option.
- torstenvl 8y ago> Hard to show it was management's fault, and not the result of a developer... No. A leader is ultimately responsible for everything that happens or fails to happen under his or her leadership. Full stop. The people in charge of your hypothetical developer are the only ones with the ability to put processes in place to prevent it from happening. They are the least-cost avoider. Therefore, the power and the responsibility belong there. Strict liability for the least-cost avoider is a sound strategy from both a moral perspective and a law & economics perspective. When proving knowledge and proximate cause are difficult, and someone is clearly in charge, and the harm is great - you place the liability on the people in charge whenever something goes wrong, and be done with it.
- bdcravens 8y agoAs a member of upper management, how would you address this then? More QA? More management of development practices? Move way from "devops" and back toward a world where there's a clear isolation between ops and development? Over the past few years, developers have seen more and more autonomy and power. I can't imagine there's a way to avoid walking some of that back (if it can be)
- Tomte 8y agoI think there are states in America where you can go to prison for stealing a pack of bubble gum. So I won't really cry for the targets here.
- prolikewh0a 8y ago>Number of people arrested for a marijuana law violation in 2017: 659,700 http://www.drugpolicy.org/issues/drug-war-statistics http://www.drugpolicy.org/issues/drug-war-statistics Yeah, I'm not going to even bat an eye about millionaires and billionaires going to jail for actual crimes and damage done to significant parts of the population. We need to start putting more millionaires and billionaires in jail for crimes instead of black teenagers for having 2 grams of weed in their pocket.
- deleted 8y ago[deleted]
- bdcravens 8y agoWould you if developers start going to jail for leaks?
- Tomte 8y agoI'm working in a field where there is a slim, but non-zero chance of going to jail if my software fails.
- prolikewh0a 8y agoI disagree. It's time to start setting an example for white collar crime.
- jfolkins 8y agoWhen a $30B+ corp sits on a security vulnerability for 14 months while their customer's in K12 and local government sit exposed, something has to change. Student's futures and safety will be impacted.
- mchannon 8y agoI agree. The journalist who posted the original article was too busy to put a link to the proposed bill. [EDIT: link: https://www.wyden.senate.gov/imo/media/doc/Wyden%20Privacy%20Bill%20Discussion%20Draft%20Nov%201.pdf https://www.wyden.senate.gov/imo/media/doc/Wyden%20Privacy%2...] To those who say white collar crime is out of control, I agree, but we don't get it under control by criminalizing new things. We control it through fairer and better enforcement of things that are already illegal. I strongly suspect the only people criminally prosecuted under such a bill will be patsies, leaving the politically powerful free to continue rear-ending Americans while prosecutors continue to whistle and look the other way, occasionally rounding up (and convicting) the usual suspects to appear busy, and laughing all the way to the bank when they run for higher office and the same politically powerful underwrite their campaigns.
- Tomte 8y ago> I strongly suspect the only people criminally prosecuted under such a bill will be patsies You can claim that about any criminal law. And there is an antidote. You even describe it yourself: > through fairer and better enforcement of things Voila, no patsies prosecuted!
- tptacek 8y agoThis bill is linked from a prominent story on the front page of Wyden's website. It's hard to see how much easier he could have made it for you to read it. I found it in less than a minute.
- tzs 8y ago> I strongly suspect the only people criminally prosecuted under such a bill will be patsies The only people that can be prosecuted under it are the chief executive officer, the chief privacy officer, and the chief information security officer. The thing that is criminal under this bill and thus can subject them to prosecution is, despite what most news stories imply, not violating privacy. The bill requires the company to file an annual privacy report with the FTC. The aforementioned three offices are required to provide a written certification to accompany that filing certifying that the report follows the rules of the bill. The crime is certifying a report that they know does not follow the rules. Draft text of bill: https://www.wyden.senate.gov/imo/media/doc/Wyden%20Privacy%20Bill%20Discussion%20Draft%20Nov%201.pdf https://www.wyden.senate.gov/imo/media/doc/Wyden%20Privacy%2...
- api 8y agoIt should be heavy per leaked datum fines like HIPAA. This would transform huge troves of personal data from assets to liabilities, which is what we need.
- geggam 8y agoInteresting... I would prefer my doctors have all the required data to make informed choices. Create a motivating factor for them to delete my records and you impact this.
- chuckgreenman 8y agoSure, but you wouldn't want your doctor to sell your medical records to data brokers.
- analog31 8y agoI wonder if the process could be modeled after the recording industry, where the owner of the information can sue for damages that are set at a pre-determined amount per violation.
- iscrewyou 8y agoNo it’s not. People should be jailed for messing with other people’s lives. Don’t gather data if you can’t protect it.
- bdcravens 8y agoThe part that scares me that management could held legally accountable for a mistake of a developer.
- elliekelly 8y agoThat's already sort of the case in the investment management world with trading algorithms. Axa Rosenberg comes to mind. When that case first came down a lot of people were weary of how that relationship between the PM and the programmers would shake out. For the most part it's been okay. PMs were required to become a bit more familiar with what the tech guys were doing and allow a little bit more oversight into the process so that the programmers had time for a maker/checker process as opposed to coding it all in as fast as they could and hoping they didn't make a mistake.
- iscrewyou 8y agoHire good developers. Or prove the developer is at fault. Then the developer should be jailed. Developers should be responsible for deploying good code. Software engineers act like they are professionals, want to get paid like they are professionals, want to be treated like they are professionals but don’t want to take on the ethical argument. Maybe they should be required to take ethical exams like other professions.
- tgsovlerkhgsel 8y agoPrison time for executives is the only thing that gets taken seriously. Fines to executives can just be paid by executive insurance, and unless you crank them up to 4% of global revenue like GDPR, fines to the company will likely simply become cost of doing business. But threaten the executives with prison, and they'll suddenly make sure that the company complies with the law. I bet e.g. SOX would be taken a lot less seriously without those teeth. Besides that, I don't see a reason why wilful privacy violations should not be met with prison terms. Don't want to go to prison? Don't collect/share data that you're not allowed to collect/share. Even for negligence, there is precedent to send people to prison, although that usually requires the negligence to result in death. But the scale at which software mistakes can cause damage is often higher than the scale at which mechanical/structural engineering does: A collapsing building kills hundreds of people. A collapsing Equifax database doesn't kill anyone directly, but affects over a hundred million people, and has the potential to ruin their lives (imagine e.g. private Facebook profiles outing people in intolerant areas - would probably lead to a larger number of deaths than most modern-day building collapses).
- mchannon 8y agoEasily disproven. The 2008 crash is full of executives who did not comply with the law, and did not take the threat of prison seriously. I think to this date you can count the number in prison on two hands, and most of those were more foot soldiers than masterminds.
- PunchTornado 8y agowell that's because it wasn't enforced properly. we need prison time and to enforce it.
- XorNot 8y agoHuh? Doesn't this prove the point? None of the people went to prison in the end, and the message remained clear: you won't go to prison. That's why it's not taken seriously.
- 8y ago
- gingerbread-man 8y agoFailure to disclose a significant data breach isn't just about deceit against users, it's also about defrauding investors. To borrow a phrase from Matt Levine (Bloomberg), "everything is securities fraud," including failure to disclose a data breach certain to have a material effect on the company's stock price. Failure to disclose (or unreasonable delay in disclosing) a massive data breach by the executives of a public company is already a criminal offense! But I don't know of any cases where criminal charges have actually been brought. It's possible that assembling a securities fraud case is extremely challenging, or that US Attorneys are not keen to go after tech co. execs. If the latter is true, I don't suspect a new data privacy law would be any better enforced.
- tareqak 8y agoWhat do you think is a more effective alternative?
- clairity 8y agoagreed, but at the same time, we send small time druggies to prison for years, which is also madness. these are all valuable humans, despite the othering identity politics of law and order rhetoric, and our focus should be bringing them back into the fold, not harshly and debilitatingly punishing them. very few people are so far gone that (long) prison terms make sense. with that said, it'd be an injustice if we didn't also send privacy violators to prison, as it would unfairly advantage to them in the eyes of the law. above all, the legal system should strive evermore toward fairnesse. obviously the best solution is not to send any of these folks to prison. ideally, privacy violators should have to face the consequences of their actions as part of their punishment (like personally making whole each victim, as an extreme example).
- manigandham 8y agoIndeed. Most people have absolutely no idea what prison is, how it works, who actually suffers, the lasting secondary effects, and how little it changes anything. Throwing around prison lightly is dangerous. For some reason data privacy gets people emotionally charged instead of thinking clearly, and it's easy to say "lock them up", but that's exactly the same attitude that led to such heavy criminalization of other things that now takes up resources, fills up courts, wastes lives, and accomplishes almost nothing.
- JustSomeNobody 8y agoMy pet theory is this is firing a shell across the bow of BigCorp. Telling them change is coming. Maybe this won’t pass, but be prepared to be held more accountable.
- elliekelly 8y agoThe FTC already has quite a lot of authority over privacy regulations (in the financial sector at least) and does next to nothing with that authority. They spend zero time affirmatively looking into regulatory compliance and only take (very limited) action after receiving numerous reports about egregious violations. I suspect this far more of a "look at how much we're helping consumers" that will add some teeth to the few enforcement actions they do pursue but won't do much by way of removing their head-in-the-sand approach to consumer privacy.
- alexS 8y agoThis is going to make it impossible to start a startup. We need to organize a movement against this.
- TazeTSchnitzel 8y agoOf course, Europe has had no startups at all since the Data Protection Directive (95/46/EC) was passed in 1995. /s
- alexS 8y agoExactly.
- tareqak 8y agoThere are plenty of startups in Europe.
- manigandham 8y agoEurope does not have anything comparable to Silicon Valley, and heavy regulations are often cited as making it hard to do business there.
- elliekelly 8y agoYet they still seem to find a way. That tells me the regulations aren't as onerous as some businesses would have you believe.
- manigandham 8y agoWho is "they"? Sure there are some companies, but clearly nothing like SV.
- twtw 8y agoI'd be A-ok if it had been impossible for Google, Facebook, etc to build advertising empires.
- paulsutter 8y agoWould these rules also apply to NSA/CIA misuse of surveillance?
- deleted 8y ago[deleted]
- glasz 8y agoi love how you packaged your sarcasm and irony in such an innocent-looking question.
- bdcravens 8y ago"...grant the Federal Trade Commission authority to write privacy regulations." I presume the FTC doesn't have authority over the NSA/CIA, so no.
- gingerbread-man 8y agoThere have been a handful of prosecutions (and many hundreds of firings) for misuse of the FBI's NCIC database by law enforcement officials. For instance, ex-NYPD Sergeant Joseph Dwyer was convicted of conspiracy in federal court in 2016 for selling information from NCIC to private defense investigators. Personally, I believe this kind of breach-of-trust should be prosecuted much more vigorously. But besides the fear of embarrassment, I suspect federal agencies are unwilling to compromise intelligence methods to prosecute misbehavior.
- jjoonathan 8y agoOf course, but it shouldn't be up to them.
- syshum 8y agoThe key here is Misuse under the FBI's guidelines which are no where near as strict as they should be under a properly enforced 4th amendment, most of what the FBI collects in the first place should be unconstitutional for them to have if we had a properly enforced constitution, unfortunately we do not.
- 8y ago
- sigfubar 8y agoJust about the only threat that execs will take seriously is a posse of well-armed men. I’m personally not against dispensing some long overdue vigilante justice, but I wonder whether we’d know when to stop?
- tehlike 8y agoThis would probably mean more compensation at executive level for the increased risks!
- thrmsforbfast 8y agoCompanies will have a Chief Privacy Officer whose job is basically to provide oversight and, of course, absorb the risk. That person will probably be paid well. I'm actually OK with that. We're always complaining that companies don't take security/privacy seriously because there's no incentive to do so. See e.g. the Equifax HN threads. Having a person in the C suite who'll end up in jail if the company seriously fucks up is, IMO, a net positive for the world.
- weberc2 8y agoI just hope it’s crafted such that it won’t inhibit small businesses or hobbyists.
- tehlike 8y agoThat's exactly my hope. Only large companies benefit from such laws (including, potentially GDPR), other smaller ones get slowed down. With gdpr, many newspaper outlets stopped access from outside of the US.
- TeMPOraL 8y agoMaybe. That compensation would still have to come out of company's coffers. Either way, this law will definitely make large companies spend money - as it should, because that's what you buy back risk with.
- glasz 8y agoso they admit, that the war on drugs is not working anymore. a new paper dragon is needed.
- wool_gather 8y agoThis is a very strange comparison to me, given the enormous disparity in the targets. But can you expand on your line of thought?
- vuln 8y agoWould love to hear more of your point of view.
- chewzerita 8y agoPage not found :(
- slivanes 8y agoThat data is too private.
- circleoncircles 8y ago555
- SCAQTony 8y agoThat is a stiffer sentence than a second degree murder charge which is 15-years in California. https://en.wikipedia.org/wiki/Murder_(United_States_law)#California https://en.wikipedia.org/wiki/Murder_(United_States_law)#Cal...
- k_sh 8y agoThat's not a fair comparison - you're measuring the bill's maximum against a murder charge's minimum. The bill allows anything from fines up to 20 years in prison, while a murder charge has a mandatory minimum of 15 years (up to life).
- SCAQTony 8y agoSecond degree murder from one jurisdiction to another. In California I stand mostly corrected: The penalty is: 15-years to Life. At the 15-year mark they are eligible for parole. https://en.wikipedia.org/wiki/Murder_(United_States_law)#California https://en.wikipedia.org/wiki/Murder_(United_States_law)#Cal...
- flagfeedingusa 8y agoAlso less of a sentence than purposely infecting others with aids in California.
- danalloway 8y agofull bill text can be found here: https://www.wyden.senate.gov/imo/media/doc/Wyden%20Privacy%20Bill%20Discussion%20Draft%20Nov%201.pdf https://www.wyden.senate.gov/imo/media/doc/Wyden%20Privacy%2...
- excalibur 8y agoUnintended consequences: This could make running a public Wifi hotspot a losing proposition for many businesses that operate one today.
- Rjevski 8y agoGiven that most (all?) public Wi-Fi's primary function is to collect data & stalk people for advertising, it's not a big loss.
- cdoxsey 8y agoRegardless of their intended purpose, in a world of costly cell phone data plans, the widespread availability of public wifi has been fantastic when you need it. Would be a real bummer to lose that if nothing takes its place.
- thrmsforbfast 8y agoNope. The bill defines covered entities in Sec. 2.(5)(A) and 2.(5)(B). In particular, companies with less than $50,000,000 in gross receipts and information on fewer than 1,000,000 customers are not covered by this legislation. And even if those apply to your local coffee shop or whatever, Sec. 2(5)(B)(iii) further limits the definition of covered entity so that businesses that do not provide 3rd party access to information are not covered. So Starbucks and other huge coffee chains/retail shops are the only organizations that would have to re-evaluate data collection from their public Wifi hotspots, and even then might be exempt depending on what they are collecting and how they are using that information. And, I should point out, these companies will need privacy experts on staff anyways, so this provision is highly unlikely to cause them to shutter their in-store Wifi networks... Additionally, some of the more onerous requirements only apply to a subset of covered entities with yet larger gross receipts and yet larger numbers of tracked consumers. But, unequivocally, your locally owned mom & pop coffee shop is excluded from consideration under this provision multiple times over.
- blululu 8y agoUnless inflation happens... This only applies to big businesses now, but in 25 years it will start effecting medium sized firms and it will eventually hit small businesses. This will create a morass of bureaucratic regulations stifling entrepreneurship...
- stevespang 8y agoThis bill is "dead on arrival". Facebook, Google and all the others will be BURYING politicians with boatloads of bribes to stop this.
- paulcnichols 8y agoThe biggest unintended consequence I see is that more tech businesses will have to charge for their service rather than make money in opaque ways.
- i_am_nomad 8y agoThat would be a very positive consequence.
- paulcnichols 8y agoVery true in some cases, i.e. unrollme. But I also like free content and am mostly willing to trade a little privacy for access.
- Etheryte 8y agoI think the trade-off should be a lot more explicit though, e.g. you get to choose whether pay 5€ per month or your usage data gets sold.
- scarejunba 8y agoIf you want to be GDPR compliant I don't think you can do that. If you offer the "usage data gets sold" option you also have to make that full opt-in _and_ not deny the service if they don't opt-in.
- esotericn 8y agoIs charging a (reasonable) fee 'denying the service'?
- kruczek 8y agoPossibly. Under GDPR, if your data processing is based on user consent, then that consent must be given freely. That means you should provide equivalent service, regardless of consent being given. Providing one service for free and another for a fee is not equivalent, so I'd argue that such consent would be invalid, as it was not freely given. However, consent is only one of several conditions for processing data. Another would be "legitimate interests" of the business. If you choose to process data based on it, then you do not need consent at all. In such case you can provide separate services: free with data sharing, and paid without data sharing. The trick here is that you actually need to be able to prove that "legitimate interests" of your business require collection and processing of that data. And additionally such interests are overridden by "fundamental rights and freedoms" of users. Which is probably why most businesses went the consent route, as it appears to be more clear-cut.
- mevile 8y agoI'm fine with fines, but I hope prison time is restricted to intentional and malicious illicit behavior and not anything due to neglect or oversight. I'm not a fan of people being put in cages unless they're violent or have ruined people's lives intentionally.
- thrmsforbfast 8y agoIt is. Read Sec 5.(d). It's not like people will be thrown in prison because their DB wasn't patched quickly enough. They have to knowingly and intentionally lie to the federal government in an annual report.
- rhizome 8y agoThey have to knowingly and intentionally lie to the federal government in an annual report So it's a nonstarter, since the people being prosecuted for these things will have lawyers adept at whittling down intent to only the most brazen and malicious behavior. Not only that, but Sarbanes-Oxley showed us how effective "annual report" red lines are.
- thrmsforbfast 8y agoPerhaps. But that's not a compelling argument against this bill. Perfect enemy of better and all that.
- rhizome 8y agoI agree that the nirvana fallacy is implicated, but there were zero convictions under SarbOx, zero prosecutions even.
- JacobJans 8y agoPDF Full Text : https://www.wyden.senate.gov/download/11012018-wyden-privacy-bill-discussion-draft&download=1 https://www.wyden.senate.gov/download/11012018-wyden-privacy...
- downandout 8y agoFortunately, this is just a "discussion draft" and I don't believe it would ever be passed as it is written. This clause would expose mom-and-pop app developers who have apps that happen to go viral and get more than 1 million installs to the same expensive, onerous requirements as an entity with $1 billion or more in revenue: Each covered entity that has not less than $1,000,000,000 per year in revenue and stores, shares, or uses personal information on more than 1,000,000 consumers or consumer devices or any covered entity that stores, shares, or uses personal information.." Putting those two vastly different classes of entities under the same umbrella and exposing them to decades in prison seems like it would have a chilling effect on the startup community. You would just have to hope that your app/website doesn't get to 1 million users, otherwise you're exposed to requirements where the implementation will bankrupt a small team or independent developer. I guess you could simply stop allowing new registrations at 999,999 people, but it seems like a bad idea to discourage businesses from growing beyond that.
- ledriveby 8y agoI could see this seriously effing with software jobs. Even if a company intends to keep their noses squeaky clean, every developer hired becomes an additional risk. Companies will try to control more of the process from the top down (and that works out great LOL) and they'll try to do more with less. Or GTFO of the country.
- codegeek 8y agoI read this and immediately thought "oh shit, yet another regulation for a small bootstrapped software business where we try to be honest while the big guys will still find a way to circumvent it". Thankfully, I looked into the fine print and was wrong. This bill is only for Corporations that do over $50,000,000 in revenues or higher OR (EDITED from AND) have info on at least 1,000,000 or more customers. Of course, I don't mean to imply that smaller tech. companies are all saints but this bill clearly seems to be drafted for the bigger fishes who are powerful enough to blatantly ignore privacy laws. EDIT: I clarified one thing user downandout pointed that it could apply to App developers who may have a million users as well but overall, it should not affect bootstrappers or smaller tech. businesses that don't have that high amount of consumer data so my overall point still remains. Below is the link to the details on this bill: https://www.wyden.senate.gov/news/press-releases/wyden-releases-discussion-draft-of-legislation-to-provide-real-protections-for-americans-privacy https://www.wyden.senate.gov/news/press-releases/wyden-relea...
- gigatexal 8y agoSo then big corps do all their customer information risking behavior in spun out small wholly owned subsidiaries or even arms length non owned ones and if successful acquire them for some fixed amount but if they screw up with this law the company just folds and the parent is free from financial damage.
- codegeek 8y agoI am not an expert bill reader but seems like this loophole is covered as there is another point that says : "(ii) is not substantially owned, oper ated, or controlled by a person, partner ship, or corporation that does not meet the 6 requirements under clause"
- r00fus 8y agoContracting it out still seems to bypass the regulation
- 8y ago
- wpdev_63 8y agoWhy are bills like these always drafted after the fact? E.g. Equifax, Google+, Facebook hack, etc. It would be common sense to pass laws before it happened and would of incentivize companies to beef up security.
- nelsonic 8y agoOr make the bill retroactive ... ?
- howard941 8y agoIf it'll retroactively apply criminal penalties you're going to need a companion amendment to the Constitution.
- TeMPOraL 8y agoUsually, drafting a bill in advance would be a bad case of premature optimization. Regulation by definition restricts freedom, which is a negative thing in itself. Drafting and maintaining regulations costs money directly and increases complexity of the legal system. Regulators aren't omniscient, they aren't able to consider the entire problem space and pinpoint every issue that needs to be proactively focused on. When a problem is known and risk judged high enough to outweigh the costs mentioned above, a proactive bill can be introduced. (Or, at least this is how it's supposed to work; in practice, you also need to add politics and lobbying to the mix.)
- wool_gather 8y agoBecause not enough people care enough for it to register politically until a disaster brings it to public attention.
- sbhn 8y agoSo Facebook, google, Microsoft, et al, will continue to sell my attention, and now pass the insurance bill onto me. Lol. I know, it’s for my security.
- Jaepa 8y agoAs you mentioned Facebook, Google, & in large part Microsoft sell your attention. How do you propose that they are going to pass the insurance tab onto you?
- sbhn 8y agoInternet tax
- Jaepa 8y agoSooo to be clear... Your theory is: 1. Large companies by insurance for data privacy violations 2. They then lobby to repeal H.R. 3086 (Permanent Internet Tax Freedom Act 3. They then lobby for another bill for taxation on internet use. 4. Then they lobby for what would be equivalent to a hand out in order to recoup losses.
- sbhn 8y agoI don’t think it would be that hard. Lots of pieces of pie for all involved. It may just happen wait and see
- afpx 8y agoOn one hand, I think this is a good thing. That is, I certainly would like to have more control over who uses my own data. But, on the other hand, the scope of this bill has some risk of bringing about a technology winter. Most people outside of tech don't realize how much of the software they use has been indirectly subsidized by the ad and data brokering industries.
- ianmcgowan 8y agoIsn't that kind of the point? I'm not anti-google/facebook in the least, and like to think that I'm knowingly trading some privacy in return for ad-supported services that have value to me. But it's tough to think of any compelling arguments for why companies making billions shouldn't be required to a) provide some minimal level of care over the data they collect, and b) disclose what they're doing with all that data. How will that bring about a tech winter?
- afpx 8y agoWhat I mean is that it's become a major part of the US's economy. Globally, this industry probably generates 100s of billions of dollars, and those companies mostly spend their revenue on more software, more hardware, more research, more computer scientists, more computer engineers, etc. Indirectly, probably almost all of us here are partially paid from the ad-network-value-chain. And, what about all of the open source products that have been funded by these companies.
- schiffern 8y agoSounds like a labor mis-allocation bubble. Bubbles burst. Furthermore bubbles should burst, for the health of the economy.
- afpx 8y agoHow is this a bubble? Unlike previous bubbles, the current technology surge is actually funded by real value, real demand, real revenues, and gigantic profits.
- yuhong 8y agoThe point of my essay was to trace the problems back to Larry/Sergey.
- afpx 8y ago"Wyden would also create a national “Do Not Track” system to stop companies from tracking internet users by sharing or selling data and targeting advertisements based on their personal information." Why not just reform EULAs so that people have more power over what they're often blindly agreeing to? If people could easily see the details and to what they're agreeing to and have more power over certain clauses, I think market forces would take the industry into a different direction, and there'd be more transparency. I don't always believe a market-solution is optimal, but in this case, it seems right.
- tptacek 8y agoThis is an extremely frustrating headline. The draft bill we're discussing does not appear to establish "prison time" for "data privacy violations". The bill "covers" any entity with over 1MM users (Flappy Bird) or $50MM in revenue over 3 years (most mid-sized startups). It creates a compliance regime, violations of which can be pursued by the FTC under its "Unfair Trade Practices" authority. A subset of Covered Entities (those with over 50MM users [very few startups] or $1B in revenue [virtually no startups]) are further obligated by this proposal to file annual Data Protection Reports. If the CEO, CISO, or Chief Privacy Officer of one of those entities deliberately certifies such a report knowing it to be false, those specific people are liable for imprisonment. Actual failure to comply with data protection and privacy requirements are not enough to get you charged criminally in this proposal. The violation that can actually get you imprisoned in this proposal would constitute a deliberate attempt to defraud the government. You have to be a relatively big company, fail to comply with the requirements of this draft, and then lie about it to the FTC to end up in prison. (For what it's worth: I don't think this bill is going anywhere; it's a discussion draft by a single member of the minority party.)
- conradev 8y ago> (For what it's worth: I don't think this bill is going anywhere; it's a discussion draft by a single member of the minority party.) Ron Wyden is indeed a single member of the minority party, but he is establishing himself as one of the leading voices on these issues. Christopher Soghoian probably played a big role in drafting this bill as his Senior Advisor for Privacy and Cybersecurity.
- 8y ago
- kevinpet 8y agoThe problematic aspect of regulation is that you don't just need to comply, you need to _convince the regulators_ that you've complied. A better approach is to create liability for certain specific failures if the company didn't follow reasonable best practices, which means you might get sued, but in that case it would be on the plaintiff to show that you didn't follow best practices, rather than the regulatory approach which makes it a burden on the company to prove to regulators (who have no incentive to keep costs of compliance down, or even limit themselves to cases where customers are in some sense harmed).
- phkahler 8y agoI find the notion of a do-not-track registry disturbing. It would actually become an identifier for you that could be used to link all the disjointed information collected under that identity. Kind of the opposite of what it's intended to do.
- mahgnous 8y agoYeah, good luck getting that passed, lol.
- Tsubasachan 8y agoSillicon Valley has spend the last few years investing in their lobbying so I'm not holding my breath for a US GDPR.Especially not with current administration.
- badrabbit 8y agoI've said it before, when it comes to mass surveillance,intentionally malicious backdoors and general societal loss of ptivacy, the solution should be primarly legislative not technical. Good example: every store with a camera uses ML to identify customers and passerby's and shares this info with 3rd parties. Should we talk about how to best facial and gait ML analysis or is the answer simply criminally outlawing this practice? Why can't I file a restraining order against big tech that states "if you identify activity and you correlate it with my identity,immediately erase it and take steps to avert similar activity data collection": because I feel bigtech's abuse of this data pauses a danger to my liberties and free excercise of my civil rights. Modern privacy laws are overdue as it is and they need to be criminal,not civil. Another one: ISPs would think twice about selling your celltower correlated location data and web/dns activity to 3rd parties if this meant jail time to the CEO. If this practice is outlawed with only fines and regulations as the penalty,the only person that can sue them is a well resourced attorney general or a very very wealthy person that can afford a multi year legal battle. Unfortunately,even when bigcorps break CFAA the FBI won't even listen to civilian complaints.
- fjsolwmv 8y agoIt can't be criminal because corporations can't go to jail. The only punishment you can apply to corporation is to take a little bit of its money, but not so much that it declares bankruptcy and gives all its assets to a new corporation formed by the same owners, who are protected from the Limited Liability structure from having to pay their debts.
- badrabbit 8y agoThat's what CEOs are for. All corporations have a structure where one person or a group of persons are accountable for decisions. For example,look at financial crimes(think Enron),executives are sent to jail all the time.
- alexanderwept 8y ago>The only punishment you can apply to corporation is to take a little bit of its money There's a death penalty for corporations - revoking their charter.
- fjsolwmv 8y agoThis is campaign nonsense. It's a partisan bill sponsored by the minority party, not a serious proposal.
- fredgrott 8y agolets see how do we put a legal corporation in jail? anyone have the answer to this that our congress people lack?
- anticensor 8y agoThe board replaced by military officers along with suspension of business license of original owners.
- ryan-allen 8y agoI'm cynical, if bankers can get away with the mortgage securities fraud and not go to jail, then how can a data breach in a tech company cause people to go to jail? Faulty thinking on my part, probably.
- runeks 8y agoIt would be nice if the government imposed the same requirements on its own departments for violations of privacy as it does on private companies. Seems to me that government is eager to punish private companies for violations, while increasing its own storage of personal information on innocent people. In this comments section, someone else said: > [..] when it comes to mass surveillance,intentionally malicious backdoors and general societal loss of ptivacy, the solution should be primarly legislative not technical. I'd object to this, given that a legislative solution is unable to restrict government collection of private data, while a technical one isn't (case in point: cryptography).
- rjfherf 8y agowhy hack ( ͡° ͜ʖ ͡°)=ε/̵͇̿̿/'̿
- rjfherf 8y agowhyh hack ( ͡° ͜ʖ ͡°)=ε/̵͇̿̿/'̿