4 ms·

We can look at their precautions or lack thereof and see if that constitutes negligence. But regardless of negligence, Marriot and Equifax were victims of crimi

We can look at their precautions or lack thereof and see if that constitutes negligence. But regardless of negligence, Marriot and Equifax were victims of criminals. Were the perpetrators ever identified and punished? "Marriott currently has no incentive to spend money to do a good security audit." I bet they've had good security audits.

darkpuma 8y ago
In cases where the 'victims' are corporations, punishing 'victims' is totally acceptable. Don't let rhetorical conflation between between humans and corporations fool you.
- crandycodes 8y ago
  Put another way: Marriott is the victim of "cyber" crimes. Marriott's customers are victims of Marriott's negligence. I'd argue it has nothing to do with corporation or non-corporation. If someone is injured in a car accident due to an unfastened seatbelt, the driver is also potentially both a victim (assuming they weren't at fault for the accident) and guilty of negligence (for not making sure safety equipment was used properly).
  - alexis_fr 8y ago
    More like, if a car is caught in a pile-up accident, it is both guilty of hitting the car ahead and victim of being hit by the next car. If he was pushed by the back car into the front car, and took all necessary precautions, he can call for a kind of force majeure and make the back car pay for both, but the agressor has to be formally identified. Mariott didn’t take enough precautions to pretend being victim of a hacker.
    - throwaway5752 8y ago
      "Mariott didn’t take enough precautions to pretend being victim of a hacker." Marriott was literally, prima facie, the victim of a hacker. The data didn't steal itself. Someone trespassed into Marriott's network and stole data that did not belong to them. Legal culpability, while certainly not the strong point of HN, is a thing. Negligent, grossly negligent, and reckless conduct are technical terms that exist and have meaning. I'm sick of replying to this because I don't like defending Marriott in this case. I hope they get a painful class action ruling. I think legal reforms around this are needed, but I am entirely unconvinced anyone here has a reasonable framework of regulations that would benefit anyone.
      - crandycodes 8y ago
        I was confused by this comment but I think what you're trying to criticize is this: "Mariott didn’t take enough precautions to pretend being victim of a hacker." I agree with that criticism. It's not a crime to be a victim, but being a victim also doesn't mean you're not guilty. Marriott might, however, still be liable for some damages due to not following common security practices for sensitive personal information. Anyone from California, for example, would have § 1798.81.5 [1] and § 1798.91.04 [2] which would backup their right to have their data handled properly. The FTC might also get involved with their fairly broad powers to protect users privacy (though that agency has been limited in this administration). [1] http://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.81.5 http://leginfo.legislature.ca.gov/faces/codes_displaySection... [2] https://leginfo.legislature.ca.gov/faces/billCompareClient.xhtml?bill_id=201720180SB327 https://leginfo.legislature.ca.gov/faces/billCompareClient.x...
    - throwaway5752 8y ago
      For the record I didn't think anything you wrote warranted a downvote and hope my response (though sincere, and I definitely disagree with you) didn't cause anyone else to downvote your comment. I don't think it varies much from much of the sentiment expressed in this discussion.
  - AmericanChopper 8y ago
    This is what civil courts are for, there’s no need at all for a new law. A general frustration that’s pretty common in internet communities is how regulators and legislators deem it necessary to create so many new laws just for the internet. We expect that the 4th amendment should apply to our packets just as it does our mail, and houses, and persons. So I can’t help but see hypocrisy whenever I hear demands that companies should be financially or criminally punished after being a victim of a cyber crime. If there’s a legitimate tort, then you already have legal recourse.
- throwaway5752 8y ago
  Two things can be true. A company or service (sole proprietorship/lifestyle project can be hacked just as easily as a massive C corp) can be liable for negligence. But I'm emphasizing that one should never lose sight of who perpetrates and benefits from the crime. That would be the actual criminals/intelligence services who steal (and perhaps sell) the data.
  - darkpuma 8y ago
    Realistically consumers will only be protected once these corporations start facing severe legal penalties whenever their negligence allows them to get hacked. Nobody is interested in letting the hackers off the hook, so your concern is misplaced. But you'll never protect consumers by focusing on the hackers, that just isn't practical. > " benefits from the crime." These corporations are benefiting from their negligence every day when they save money by being negligent with security and facing no real consequences for it.
    - ljm 8y ago
      Penalties are too reactive. Regulation would be more proactive. A huge corporation will mostly see a fine as a cost of doing business. It won't work when you're looking at negligence, or security, because you can hedge all of your bets on never being found out, or otherwise only being found out so far in the future that the negligence has already paid for itself. Regulating the storage of sensitive information, same as you have with HIPAA and GDPR, presents a much stronger case for being more careful up front. You're no longer talking about negligence: the expectation for how you handle sensitive info is made clear right from the start, and you can treat egregious violations (like storing passport numbers alongside other account details like a physical address without securing the system) as malicious.
- matte_black 8y ago
  Corporations are ultimately just people; a large group of people. Think of what would happen if we punished the hell out of Marriot. Many of those people could lose their jobs and be unable to provide for their families, for something that didn’t really have much to do with them other than they chose to work at the wrong corporation.
  - Scoundreller 8y ago
    Most bankruptcies don’t result in liquidation, just total loss for shareholders and a haircut for creditors.
  - mattnewton 8y ago
    This line of reasoning can be used to defend virtually any conduct from a business that employs many people, and that alone should disqualify it from discourse. But in this case the ideal punishment would be unlikely to result in any real damage to careers, just would incentivize Marriot and other hotels to avoid a repeat of this.

darkpuma 8y ago

In cases where the 'victims' are corporations, punishing 'victims' is totally acceptable. Don't let rhetorical conflation between between humans and corporations fool you.

crandycodes 8y ago
Put another way: Marriott is the victim of "cyber" crimes. Marriott's customers are victims of Marriott's negligence. I'd argue it has nothing to do with corporation or non-corporation. If someone is injured in a car accident due to an unfastened seatbelt, the driver is also potentially both a victim (assuming they weren't at fault for the accident) and guilty of negligence (for not making sure safety equipment was used properly).
- alexis_fr 8y ago
  More like, if a car is caught in a pile-up accident, it is both guilty of hitting the car ahead and victim of being hit by the next car. If he was pushed by the back car into the front car, and took all necessary precautions, he can call for a kind of force majeure and make the back car pay for both, but the agressor has to be formally identified. Mariott didn’t take enough precautions to pretend being victim of a hacker.
  - throwaway5752 8y ago
    "Mariott didn’t take enough precautions to pretend being victim of a hacker." Marriott was literally, prima facie, the victim of a hacker. The data didn't steal itself. Someone trespassed into Marriott's network and stole data that did not belong to them. Legal culpability, while certainly not the strong point of HN, is a thing. Negligent, grossly negligent, and reckless conduct are technical terms that exist and have meaning. I'm sick of replying to this because I don't like defending Marriott in this case. I hope they get a painful class action ruling. I think legal reforms around this are needed, but I am entirely unconvinced anyone here has a reasonable framework of regulations that would benefit anyone.
    - crandycodes 8y ago
      I was confused by this comment but I think what you're trying to criticize is this: "Mariott didn’t take enough precautions to pretend being victim of a hacker." I agree with that criticism. It's not a crime to be a victim, but being a victim also doesn't mean you're not guilty. Marriott might, however, still be liable for some damages due to not following common security practices for sensitive personal information. Anyone from California, for example, would have § 1798.81.5 [1] and § 1798.91.04 [2] which would backup their right to have their data handled properly. The FTC might also get involved with their fairly broad powers to protect users privacy (though that agency has been limited in this administration). [1] http://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.81.5 http://leginfo.legislature.ca.gov/faces/codes_displaySection... [2] https://leginfo.legislature.ca.gov/faces/billCompareClient.xhtml?bill_id=201720180SB327 https://leginfo.legislature.ca.gov/faces/billCompareClient.x...
  - throwaway5752 8y ago
    For the record I didn't think anything you wrote warranted a downvote and hope my response (though sincere, and I definitely disagree with you) didn't cause anyone else to downvote your comment. I don't think it varies much from much of the sentiment expressed in this discussion.
- AmericanChopper 8y ago
  This is what civil courts are for, there’s no need at all for a new law. A general frustration that’s pretty common in internet communities is how regulators and legislators deem it necessary to create so many new laws just for the internet. We expect that the 4th amendment should apply to our packets just as it does our mail, and houses, and persons. So I can’t help but see hypocrisy whenever I hear demands that companies should be financially or criminally punished after being a victim of a cyber crime. If there’s a legitimate tort, then you already have legal recourse.
throwaway5752 8y ago
Two things can be true. A company or service (sole proprietorship/lifestyle project can be hacked just as easily as a massive C corp) can be liable for negligence. But I'm emphasizing that one should never lose sight of who perpetrates and benefits from the crime. That would be the actual criminals/intelligence services who steal (and perhaps sell) the data.
- darkpuma 8y ago
  Realistically consumers will only be protected once these corporations start facing severe legal penalties whenever their negligence allows them to get hacked. Nobody is interested in letting the hackers off the hook, so your concern is misplaced. But you'll never protect consumers by focusing on the hackers, that just isn't practical. > " benefits from the crime." These corporations are benefiting from their negligence every day when they save money by being negligent with security and facing no real consequences for it.
  - ljm 8y ago
    Penalties are too reactive. Regulation would be more proactive. A huge corporation will mostly see a fine as a cost of doing business. It won't work when you're looking at negligence, or security, because you can hedge all of your bets on never being found out, or otherwise only being found out so far in the future that the negligence has already paid for itself. Regulating the storage of sensitive information, same as you have with HIPAA and GDPR, presents a much stronger case for being more careful up front. You're no longer talking about negligence: the expectation for how you handle sensitive info is made clear right from the start, and you can treat egregious violations (like storing passport numbers alongside other account details like a physical address without securing the system) as malicious.
matte_black 8y ago
Corporations are ultimately just people; a large group of people. Think of what would happen if we punished the hell out of Marriot. Many of those people could lose their jobs and be unable to provide for their families, for something that didn’t really have much to do with them other than they chose to work at the wrong corporation.
- Scoundreller 8y ago
  Most bankruptcies don’t result in liquidation, just total loss for shareholders and a haircut for creditors.
- mattnewton 8y ago
  This line of reasoning can be used to defend virtually any conduct from a business that employs many people, and that alone should disqualify it from discourse. But in this case the ideal punishment would be unlikely to result in any real damage to careers, just would incentivize Marriot and other hotels to avoid a repeat of this.