3 ms·

Bear Stearns failed because it was overextended on subprime mortgages and lost the ability to conduct business when the cash dried up. Enron was convicted of m

Bear Stearns failed because it was overextended on subprime mortgages and lost the ability to conduct business when the cash dried up. Enron was convicted of massive, deliberate accounting fraud. The company wasn't viable without the fraud. Not even remotely similar to the Equifax breach.

AnimalMuppet 8y ago
Is Equifax viable if they actually secure their data? (Security costs, and it slows down operations, with leaves some profits on the table.)
arduanika 8y ago
Dissimilar from Enron only in that Equifax was never convicted for its fairly deliberate negligence of the public interest, or for its massively distributed tort, because the civil case is infeasible, and because no law or regulation is adequate to cover what ought to be criminal case -- this I think is yalogin's point. The security patch here is not a technical solution. It's to wipe out the stockholders of any company this negligent, and repossess the spare homes of the entire C-suite. That should cover most attack vectors pretty reliably.
- g051051 8y ago
  > its fairly deliberate negligence of the public interest, or for its massively distributed tort If anything, the report says the opposite of that. > It's to wipe out the stockholders of any company this negligent, and repossess the spare homes of the entire C-suite. This is why we don't get any real reform...citizens have these insane ideas on how to "fix" the problem. How can the government take you seriously?
  - arduanika 8y ago
    > the report says the opposite My comment was not aimed at agreeing with the majority report. Would you dispute my characterization of those expired certs as "negligence"? Or perhaps you don't consider the budget meetings that declared how low cybersecurity fell on the list of priorities as "fairly deliberate"? > insane ideas Hmm, maybe you're right. Monetary penalties for undesirable behavior is insane. Let's repeal all tort laws and cancel criminal fines, and make no attempt to levy proportional damages for anything. Let the C-suite keep their options! > How can the government take you seriously? If all else fails, a yellow vest might help. I'm hoping it doesn't come to that here.
    - g051051 8y ago
      > Would you dispute my characterization of those expired certs as "negligence"? I would. Does the report indicate that the cert was expired due to budget issues? Does it show that cybersecurity was low priority? Again, the report shows the opposite: they had solid policies and procedures in place, but the failures seem to be in execution and training. > Monetary penalties for undesirable behavior is insane. No, that's just fine. And Equifax took a huge stock hit, had to make a potentially cash generating service free for everyone, has to earn back its reputation, etc. > Let's repeal all tort laws and cancel criminal fines, and make no attempt to levy proportional damages for anything. Let the C-suite keep their options! Show the criminal activity that resulted in the breach (by Equifax, not the attackers). Show the damages that have resulted from the breach. > If all else fails, a yellow vest might help. I'm hoping it doesn't come to that here. If it does, it won't be over the Equifax breach (or even the other 4 larger breaches: https://abcnews.go.com/Technology/marriotts-data-breach-large-largest-worst-corporate-hacks/story?id=59520391 https://abcnews.go.com/Technology/marriotts-data-breach-larg...).
      - arduanika 8y ago
        > Does the report indicate... > Does it show... > the report shows... I'm not asking you whether the House Republicans would call the expired certs negligent, or the security underprioritized. I'm asking you, as the reader of a technical forum. Do you believe everything the government tells you? Or here, what one party tells you? At the very least, read the minority report linked elsewhere in this thread, and interpolate. > huge stock hit Nowhere near huge enough, and it rebounded once it was clear there were basically no consequences. > has to earn back its reputation Why? Equifax could care less what its unwilling inventory thinks of it. > Show the criminal activity... Name one victim whose damages are large enough to merit hiring a lawyer to comb all the contracts to identify the line where a bank promised that Equifax promised that the victim's data would be safe, and I'll show you a breach of contract. Hint: it's a different line for each victim. > Show the damages... Precisely my point: the damages to the public are "massively distributed" and infeasible to pin down, which is why there should be a criminal penalty, like we do for say, ozone-depleting chemicals. > it won't be over the Equifax breach (sigh) you're probably right.

AnimalMuppet 8y ago

Is Equifax viable if they actually secure their data? (Security costs, and it slows down operations, with leaves some profits on the table.)

arduanika 8y ago

Dissimilar from Enron only in that Equifax was never convicted for its fairly deliberate negligence of the public interest, or for its massively distributed tort, because the civil case is infeasible, and because no law or regulation is adequate to cover what ought to be criminal case -- this I think is yalogin's point. The security patch here is not a technical solution. It's to wipe out the stockholders of any company this negligent, and repossess the spare homes of the entire C-suite. That should cover most attack vectors pretty reliably.

g051051 8y ago
> its fairly deliberate negligence of the public interest, or for its massively distributed tort If anything, the report says the opposite of that. > It's to wipe out the stockholders of any company this negligent, and repossess the spare homes of the entire C-suite. This is why we don't get any real reform...citizens have these insane ideas on how to "fix" the problem. How can the government take you seriously?
- arduanika 8y ago
  > the report says the opposite My comment was not aimed at agreeing with the majority report. Would you dispute my characterization of those expired certs as "negligence"? Or perhaps you don't consider the budget meetings that declared how low cybersecurity fell on the list of priorities as "fairly deliberate"? > insane ideas Hmm, maybe you're right. Monetary penalties for undesirable behavior is insane. Let's repeal all tort laws and cancel criminal fines, and make no attempt to levy proportional damages for anything. Let the C-suite keep their options! > How can the government take you seriously? If all else fails, a yellow vest might help. I'm hoping it doesn't come to that here.
  - g051051 8y ago
    > Would you dispute my characterization of those expired certs as "negligence"? I would. Does the report indicate that the cert was expired due to budget issues? Does it show that cybersecurity was low priority? Again, the report shows the opposite: they had solid policies and procedures in place, but the failures seem to be in execution and training. > Monetary penalties for undesirable behavior is insane. No, that's just fine. And Equifax took a huge stock hit, had to make a potentially cash generating service free for everyone, has to earn back its reputation, etc. > Let's repeal all tort laws and cancel criminal fines, and make no attempt to levy proportional damages for anything. Let the C-suite keep their options! Show the criminal activity that resulted in the breach (by Equifax, not the attackers). Show the damages that have resulted from the breach. > If all else fails, a yellow vest might help. I'm hoping it doesn't come to that here. If it does, it won't be over the Equifax breach (or even the other 4 larger breaches: https://abcnews.go.com/Technology/marriotts-data-breach-large-largest-worst-corporate-hacks/story?id=59520391 https://abcnews.go.com/Technology/marriotts-data-breach-larg...).
    - arduanika 8y ago
      > Does the report indicate... > Does it show... > the report shows... I'm not asking you whether the House Republicans would call the expired certs negligent, or the security underprioritized. I'm asking you, as the reader of a technical forum. Do you believe everything the government tells you? Or here, what one party tells you? At the very least, read the minority report linked elsewhere in this thread, and interpolate. > huge stock hit Nowhere near huge enough, and it rebounded once it was clear there were basically no consequences. > has to earn back its reputation Why? Equifax could care less what its unwilling inventory thinks of it. > Show the criminal activity... Name one victim whose damages are large enough to merit hiring a lawyer to comb all the contracts to identify the line where a bank promised that Equifax promised that the victim's data would be safe, and I'll show you a breach of contract. Hint: it's a different line for each victim. > Show the damages... Precisely my point: the damages to the public are "massively distributed" and infeasible to pin down, which is why there should be a criminal penalty, like we do for say, ozone-depleting chemicals. > it won't be over the Equifax breach (sigh) you're probably right.