17 ms·
Proposed Jail Time for Tech Companies Who Steal Data
- inamberclad 8y agoWyden seems like he's been on top of the ball recently.
- maxxxxx 8y agoWyden is one of the few people in Congress who seems to make a real effort to address difficult issues in balanced and reasonable way.
- bitxbitxbitcoin 8y agoS.420 is another good example of Wyden being on top of the ball recently.
- vjeux 8y ago“Oops, we didn’t notice, but it’s another to be a company like Facebook that takes your private messages and sells that data. It takes your address, it takes your interest, it takes your browsing history and sells that to people without your permission Wydens.” Does anyone know what context he refers to? I wasn’t aware that Facebook ever directly sold private messages. Same for address, interest...
- simplecomplex 8y agoThey don’t. It’s just part of the privacy and Facebook hysteria being pushed by the rage-machine that is the news cycle now.
- blub 8y agoWhen people start realising they've been getting proper fucked for more than a decade by the SV surveilance capitalism machine (led by Google and Facebook) they will get a bit hysterical. I'd prepare myself for the incoming fines and regulation if I were you, instead of trying to do damage control.
- crooked-v 8y agoThey don't sell your private messages. What they actually do is just give them away to business partners. https://www.nytimes.com/2018/12/18/technology/facebook-privacy.html https://www.nytimes.com/2018/12/18/technology/facebook-priva... > Facebook allowed Microsoft’s Bing search engine to see the names of virtually all Facebook users’ friends without consent, the records show, and gave Netflix and Spotify the ability to read Facebook users’ private messages.
- simplecomplex 8y agoNo, they didn’t “give it away”. Please let’s stick to facts. The news is being extremely dishonest. Apps that you could send FB messages through could see the message (how else would it work?) And it was explicitly opt-in, users had to authorize it. “Take Spotify for example. After signing in to your Facebook account in Spotify’s desktop app, you could then send and receive messages without ever leaving the app. Our API provided partners with access to the person’s messages in order to power this type of feature.” https://www.thewrap.com/members/2018/12/19/facebook-admits-netflix-spotify-access-user-messages/ https://www.thewrap.com/members/2018/12/19/facebook-admits-n...
- shaki-dora 8y agoRead that quote again. It only says opt-in was needed to use this „feature“, not for data access. And that does not even include the other parties in those messages.
- simplecomplex 8y ago“Did partners get access to messages? Yes. But people had to explicitly sign in to Facebook first to use a partner’s messaging feature,” Konstantinos Papamiltiadis, director of developer platforms and programs at Facebook, wrote in the blog post. “Take Spotify for example. After signing in to your Facebook account in Spotify’s desktop app, you could then send and receive messages without ever leaving the app. Our API provided partners with access to the person’s messages in order to power this type of feature.” Facebook did not play fast and loose with peoples data or abuse their privacy. They don’t sell or give away user data.
- mimixco 8y agoQuit expecting governments to save you. The easiest fix for this problem is to stop using these products! No matter how much bad news comes out about Facebook, Apple, Google, and Amazon using your data in bad ways -- people still keep using them. If enough people quit, this will stop or a competitor will rise up who doesn't do this stuff.
- Mirioron 8y agoWe should also demand for more control over what data our browsers send out.
- crooked-v 8y ago"Let the invisible hand of the market fix it" is not something that has a history of actually working on near-monopoly actors.
- maxxxxx 8y agoHow do you even know who does bad stuff?
- crooked-v 8y agoWell, see, you just have to thoroughly investigate holding companies, paywalled court filings, online security breach notices, and legal documentation conveniently available on the other side of the country in a locked filing cabinet in the unlit second subbasement, and do it every time you buy groceries, pay for gas, receive a shipped gift, or spend time in the vicinity of anyone who takes photos with the Facebook app. I don't see what makes it so difficult.
- mimixco 8y agoMonopolies have to be propped-up by governments. No monopoly can survive in a truly free market. Never has; never will. Power companies, cable companies, and telco operators are all monopolies propped up by government. An actually free market will always eliminate them when some competitor rises up with a lower cost, a better product, or better service. There has never in history been a monopoly company that could operate in a free market without government support.
- edoo 8y agoIf a human would have gone to jail for the crime the company should have its charter revoked for at least an equal amount of time. Even the giants. Usually at best a corporation gets a fine and it just becomes a cost of doing business. Everyone involved including the government profits from the crime.
- mnm1 8y agoAbout fucking time. Until legislation like this passes, nothing will change. I'm glad at least one of our senators has the balls to actually hold CEOs and companies accountable for their atrocious actions. This behavior should be criminal and this should be just the start. It doesn't make sense to send petty thieves to jail and hard labor, yet reward CEOs who cause millions or billions of dollars of damage to our society with gigantic resignation packages. These CEOs should languish in jail and find out for themselves what it's like to work for pennies a day. I'd bet any amount of money that once CEOs are actually held responsible for their reprehensible actions, things will change in regards to security and other overlooked practices. Once a company's profit and the CEO's resignation package can be clawed back with fines, these CEOs will think twice. Perhaps as a society we may rethink the idea of limited (in reality that just means nonexistent) liability corporations where even the officers who have the power of life or death over millions have no repercussions when they inevitably abuse and misuse that power to hurt and even kill people. That will probably take a lot longer, however. Until then, the best way to commit a crime and get away with it (including murder, poisoning, and other atrocious crimes) is still being a company executive.
- plainOldText 8y ago> ...including jail time, if their companies steal and sell user data, > or allow a massive data breach to occur at their company. What if the government loses our data? Then what? Will they go to jail too? Software is a moving target. It has become such a complex endeavor, always changing, always evolving. It's difficult to determine who's responsible for which part of the system; and by this I'm not suggesting we abolish responsibility. Good outcomes will be the result of multiple forces, balanced in the right mix: A. Users should ask more of their favorite companies (and mean it, e.g. boycott your favorite tech company when they behave unethically) B. Legislators should be more mindful of the legislation they propose (for one separate data (re)selling from data breaches, and what exactly is my data vs data generated by machines, etc) C. Reckless tech leaders should have their reputation affected by lose security, privacy & business practices D. And engineers should be more aware their craft affects the lives of millions and maintain a high standard of quality across their work In the grand scheme of things, we've just barely gotten off the ground with this thing called software. And software changed everything, but so did agriculture, which is 10,000 years old. If we develop careless regulation and start throwing people in jail for software faults, we're hardly encouraging innovation.
- donatj 8y agoOf course not. The government is never held accountable.
- SiempreViernes 8y agoYes, but they obviously can't all fit at once so they will have to take turns serving it, just like how all employees of companies are also collectively sentenced.
- SiempreViernes 8y agoSeriously though, what sort of question is that, don't you have rule of law in your country?
- gmuslera 8y ago"loses"? What about collecting, and even forcing private companies to give them your data without telling you? What was disclosed on 2013 is still running. The reason I don't think this will work is because the government and related contractors are major players on collecting, distributing and hacking private data. And if this works, it won't be because the government will stop doing it, but because want to control who else does.
- Cyclone_ 8y agoWhat if a data breach happens due to an 0 day exploit with a 3rd party library? Do people from the company where the data breach happened still go to jail then?
- foolrush 8y agoIn law, the term “negligence” usually plays an important role. “What ifs” have already been played out historically, which is case law.
- sigfubar 8y agoDouble the term: once for the breach, and again for poor security review & architecture.
- currymj 8y agoas far as I can tell, this bill would only allow jail time if there was a serious breach, at a large company, and higher-ups left it out of an official report they would be required to make to the government. in other words, all they have to do is fulfill their obligation disclose that they were hit by this 0-day, in order to at least be protected from jail time.
- pm90 8y agoWhich seems like a reasonable policy IMO. Its encouraging companies to be forthcoming with their data breaches .... or else.
- spydum 8y agoMy guess is prudent man principal applies - did they have a reasonable plan to remediate once the 0-day was known? How would peers in the industry have been affected? If it’s truly a 0-day, and they followed reporting the breach, I don’t see it being likely. You could argue a single 0-day should not result in a breach (security is best as a layered defense), but that’s probably far less likely to find. https://en.wikipedia.org/wiki/Prudent_man_rule https://en.wikipedia.org/wiki/Prudent_man_rule
- srkmno 8y agoPitchfork mobs dictating policy, that is why you don't elect an ex state attorney general to the legislative branch: prosecution and grandstanding is all they know. Also the principle concept of "stealing your data" is more ludicrous than "stealing" in the copyright sense; that data is meta data and it's not yours, it was generated by machines you don't own and have no claim over.
- crooked-v 8y ago> that data is meta data and it's not yours, it was generated by machines you don't own and have no claim over I'm pretty sure that, for example, the list of grocery brands someone buys using a store loyalty card isn't "metadata", and while "stealing" is hyperbole, I'm pretty sure most people would be upset upon realizing how far and wide that information is being sold.
- smsm42 8y agoPeople might be upset about a lot of things, the question is whether you have legal ownership on the knowledge about the facts about you. Can you sue somebody for disclosing true information about you as "theft"? Is writing a Wikipedia article about you means "stealing" your life facts? Does making your photo steal your soul? I'm pretty sure the only reason to use "steal" in this context is to hopelessly confuse the matter.
- eftychis 8y agoStill it is worth thinking the effects of disclosing meta-data that a legal entity has collected about another entity (here an individual). Is it not abetting to disclose when you are away from your house and what alarm system you have to a burglar? What if you do that via wikipedia? I think even if you have no ownership of the data and stealing is not involved, that does not give the collecting or managing party the right to sell or publicize or share that data, necessarily. There have been studies about the value (and impact) of inferences from metadata e.g. https://www.pnas.org/content/113/20/5536.short https://www.pnas.org/content/113/20/5536.short . ((Edit) Agreeing with you, steal is incorrect term in a lot of cases, however I am not sure if we can say it is not applicable in general.)
- xorgar831 8y ago> it’s one thing to just be bad at your job and you leak a bunch of data and oops, you didn’t notice that a hacker was in your system like a Kofax for months. Na, I'm tired of these excuses too. Maybe jail is too extreme in this case, but being sloppy isn't ok. Or not supporting MFA when you're dealing with financial data.
- Animats 8y agoA tough interpretation of the existing US Computer Fraud and Abuse Act, which has criminal penalties, could do much of that right now. See the "exceeds authorized access" provisions. Any slip-up in asking for permission could place a company stealing your data in serious legal jeopardy.
- solomatov 8y agoI am not a lawyer, but vague laws are unconstitutional, so, your interpretation is highly unlikely to pass scrutiny.
- tarr11 8y agoIs personal information really a kind of property, that can be stolen? If it is, aren’t we doing this all the time, any time we perceive anything about anyone? How is this different than taking a picture of someone? The image is owned by the photographer, not the subject(s) according to current laws. if I meet someone on the street, and record their name, the conversation we had, and the location where I met them, and their phone number, have I “taken their data”? Do they have the right to demand that I not record that information? Does my perspective or interpretation of that information give me some ownership to that data? What if I use that information for commercial gain? Is that what makes this illegal? Or is it only if I do this at a scale beyond which humans are not capable, and store it digitally, is that what makes this illegal?
- coldtea 8y ago>Is personal information really a kind of property, that can be stolen? If it is, aren’t we doing this all the time, any time we perceive anything about anyone? We are flexible and smarter than Vulcans. Something doesn't have to be necessarily expressible into a single, unambiguous universal formula to be made illegal. We can e.g. allow people to perceive things about other people in their brains (or even notebooks) as we've done for millennia, but not allow them to compile them into large aggregated digital databases of thousands or millions of people without their consent, or give them to advertisers. >How is this different than taking a picture of someone? The image is owned by the photographer, not the subject(s) according to current laws. Depending on the jurisdiction, taking an image of someone can be illegal. Sometimes, even if it's a public space. And using an image of someone to advertise stuff without their consent is illegal, including in public space.
- desc 8y agoThe problem, as always, is externalisation of costs. If they don't pay for the consequences of the risks they take (such as prioritising profits over security, etc) market forces demand that they take those risks. People talk about the market fixing things, but that only works if it's not possible to externalise costs. Unfortunately, the only practical way to enforce that is through government regulation. The government is also a system which seeks to externalise costs...
- leroy_masochist 8y ago> There is no reason why any person on Capitol Hill should vote against this. If I were an elected official, one reason why I would be very cautious about voting for this is that, if we make allowing a data breach a felony punishable by imprisonment, it is likely to have a somewhat chilling effect on the likelihood of engineers to start new companies where they as founders would be potentially prosecutable for such failures. I share the author's stated frustrations, and agree that jail time for gross data-related negligence would be right at least in some cases, but it's not the simple problem-simple solution issue he's making it out to be.
- crooked-v 8y ago> it is likely to have a somewhat chilling effect on the likelihood of engineers to start new companies where they as founders would be potentially prosecutable for such failures You seem to think that's a bad thing, for some reason.
- chillacy 8y agoPerhaps some of us browsing HN, a site by a venture capital firm in the bay area, might want to consider the effects of legislation on tech startups.
- scarejunba 8y agoPlease. This forum has more people saying they just want a 9-5 job than actual founders. It’s no surprise it’s anti-startup. It’s just /r/programming+technology now.
- thekyle 8y agoWell, less competition is generally considered to be a bad thing.
- Apocryphon 8y agoMaybe the result will not be less competition but rather better competition, as the entrants will be founders who have actually done their due diligence and research and are prepared to act responsibly in compliance with the public interest.
- smsm42 8y agoLooking at actual bill, it proposes: - Creating a paid "no tracking" option. Obvious failure mode: the option price is $100M, and anybody who uses it is unable to use 99% of the functionality, since it requires some form of tracking. Obvious next step - the law requiring this option to be no more than 10% more expensive than regular membership. Obvious next failure mode: inapplicable to sites that do not charge for membership. Obvious next step - creating a government commission empowered to decide what sites are supposed to charge for "no tracking" membership and which services it is supposed to cover. If you like your site subscription - you can keep your site subscription. - Penalize large companies that submit false information in their annual privacy report - thought submitting false information to any government agency is a crime anyway? And for a public company, I assume publishing almost any false report would immediately put them under the shadow of fraud charges from SEC. So declaring something that is already a crime a crime again is supposed to... what? - Require companies to assess their algorithms for accuracy, fairness, bias and discrimination. Obvious failure mode: who does the assessment? Obvious next step: creating a government commission empowered to approve algorithm fairness assessment standards. Obvious failure mode: since nobody knows what "fairness" it, it turns into another partisan tug of war, to be used as a club against companies affiliated with opposite tribe or just representing a good jumpstart to the next political campaign. Reasonable academic discussion of algorithmic bias becomes impossible, buried under layers of partisan tribal rhetoric and professional offense miners. Billions are spent annually on "bias prevention", without any shade of solution on the horizon, on the contrary, the problem becomes worse every day - at least if you're listen to bias prevention industry, but they're the only ones who are allowed to speak on the topic.
- bsder 8y agoIt's easy to complain, but the problem is that status quo ISN'T WORKING. That's no longer on the table. So, you either have to come up with something constructive, or someone else will.
- smsm42 8y agoThat's called "politician's fallacy" - "something needs to be done! This is something, therefore this needs to be done!". Obvious comment on it is that "something" must improve the situation after being done, merely doing something that doesn't work because current situation doesn't work is not likely to make it work. And if you're implying I have to right to criticize stupid proposals from politicians before I myself am elected into political office and make a full-formed policy proposal that solves all the problems - sorry, it's not how this thing works.
- JacobJans 8y agoThe great irony here is that people have no issue stealing data -- copyright theft is considered "normal" by many people. However, if it's your data, then maybe jail time should be on the table?
- majewsky 8y agoYes, because the potential damage is much more severe. If someone pirates a movie, the damage is about the price of a movie ticket. If someone's private data gets stolen, it can ruin their entire life.
- Dylan16807 8y agoIt's not irony. It's you being willfully blind to the difference between "this has copyright" and "this is personal data". Those two aren't even similar!
- scarejunba 8y agoIt's not "stealing" because the data isn't being taken away. It's "copying".
- donohoe 8y agoI love how we understand the value of intellectual property, but when we talk about private personal information we are unable.
- skybrian 8y agoIt's strange how some people think that gossip and intellectual property are somehow the same thing. You have no right to be paid when people talk about you.
- chillacy 8y agoBut I think everyone understands that it's shitty to be on the receiving end of gossip, especially if the rumors are untrue or can be used against you.
- skybrian 8y agoCertainly! But when you abstract it away as "personal information" then you also abstract away why sharing it is sometimes harmful.
- ilovecaching 8y agoPutting people in jail is the wrong solution. You're going to put CEOs in jail because some angry employee at the company decided to add some backdoors, or someone in middle management made the wrong call. Either way, the CEO and high level execs can't constantly monitor every part of a world scale business. Anyone in technology also knows it's impossible to become invulnerable to breaches. The people in congress/senate have no idea how technology works, because the younger generations are severely underrepresented, and so are technologists.
- badrabbit 8y agoLaws are usually clear about criminal intent. If it was done without the CEOs knowledge,the CEO would not be liabel.
- escape_goat 8y agoMost of the responses so far seem to concern themselves with law and policy rather than technology. It might be a bit more on-point to complain that the people in technology have no idea how laws or legislation works, perhaps because the older generations are severely underrepresented, as are lawyers/legislators.
- E_Quivocation 8y agoI was going to laugh at how stupid this sounds, but, then again, It would be cool to see corporate overlords suffering a comparable level of punishment for the equivalent of peer-to-peer MP3 file sharing. Bonus points if we can write a law for something like genetic profiling, or abuse of facial recognition, or microphone eavesdropping that becomes the corporate equivalent of internet child pornography, and carries the death penalty for C level officers. Perhaps by way of equivocating that voice, face and gene surveillance endangers the privacy of children because it is indiscriminate like chemical or biological weapons, so life in prison and capital punishment for upper echelon high command at the Nuremburg trials.
- solomatov 8y agoIf you are interested in a text of the bill, one of its drafts is available here: https://www.wyden.senate.gov/imo/media/doc/Wyden%20Privacy%20Bill%20Discussion%20Draft%20Nov%201.pdf https://www.wyden.senate.gov/imo/media/doc/Wyden%20Privacy%2...
- crazy_monkey 8y agoCan we exile them (employees and all) to Mississippi? We could turn the state into a very successful penal colony like Australia with semi-competent tech companies!