4 ms·

I wonder, who is responsible in a case like this? Is it the current owners of CompuServe for not clearing the PII before trashing the machines?

by shawnz 8y ago

icedchai 8y ago
This is very common. I've bought machines at auction with databases on them.
- neilv 8y ago
  Yes, though not as bad as it used to be, IME. It seems a lot of ordinary people now know to pull or wipe drives before disposing of a computer. I've acquired over 100 used computers, and, once I saw how common leaving data on them was, I began always very promptly DBAN-ing any disks, and wiping SSDs. If it has a non-SATA interface, I destroy the medium. Similar with some kind of wipe of smartphones. Besides wiping the disk/device seeming a responsible and considerate thing to do, it avoids remote yet severe liabilities.
  - opless 8y ago
    You know that you can't truly "wipe" SSDs, right?
    - detaro 8y ago
      It's not that simple. A secure erase should wipe all blocks (and since it is done by the firmware, physical blocks, not logical ones), but there have been instances of buggy drives that don't actually do it properly. Some SSDs also transparently encrypt all data written, and the key is replaced on a wipe command. Even if they don't wipe the data fully, it's now unusable, if the encryption works correctly. Quite old SSDs might not support any of this.
      - chx 8y ago
        I thought all SSDs support ATA password.
        detaro 8y ago
        I don't think ATA password necessarily means the drive content is encrypted, or helps you fully wipe a drive you obtained from somewhere else.
      - veeti 8y ago
        > Even if they don't wipe the data fully, it's now unusable, if the encryption works correctly. Unfortunately, you can't trust the SSD firmware developers to have their shit together [1]. [1] https://techcrunch.com/2018/11/05/crucial-samsung-solid-state-drives-busted-encryption/ https://techcrunch.com/2018/11/05/crucial-samsung-solid-stat...
        detaro 8y ago
        Which is why the if is in there :(
gowld 8y ago
The no longer existent corporate person is responsible. Same as if a real person copied all your info, published it, and died.
- shawnz 8y ago
  They do still exist though, and they are a subsidiary of Verizon. So is Verizon responsible even though nobody at Verizon had anything to do with it? Does the person who redistributed the data have any responsibility?
  - nathan_long 8y ago
    > So is Verizon responsible even though nobody at Verizon had anything to do with it? Imagine if CompuServe still existed, but they had undergone 100% employee turnover in recent years. They'd still be liable, right? It seems to me that when Verizon bought CompuServe, they calculated that its assets minus its liabilities totaled less than the purchase price and hence it was a good deal. If we treat leakable data as a legal liability, it should send the right financial signal - eg, maybe as a company you don't want to collect much.

I wonder, who is responsible in a case like this? Is it the current owners of CompuServe for not clearing the PII before trashing the machines?

by shawnz 8y ago

I wonder, who is responsible in a case like this? Is it the current owners of CompuServe for not clearing the PII before trashing the machines?

icedchai 8y ago

This is very common. I've bought machines at auction with databases on them.

neilv 8y ago
Yes, though not as bad as it used to be, IME. It seems a lot of ordinary people now know to pull or wipe drives before disposing of a computer. I've acquired over 100 used computers, and, once I saw how common leaving data on them was, I began always very promptly DBAN-ing any disks, and wiping SSDs. If it has a non-SATA interface, I destroy the medium. Similar with some kind of wipe of smartphones. Besides wiping the disk/device seeming a responsible and considerate thing to do, it avoids remote yet severe liabilities.
- opless 8y ago
  You know that you can't truly "wipe" SSDs, right?
  - detaro 8y ago
    It's not that simple. A secure erase should wipe all blocks (and since it is done by the firmware, physical blocks, not logical ones), but there have been instances of buggy drives that don't actually do it properly. Some SSDs also transparently encrypt all data written, and the key is replaced on a wipe command. Even if they don't wipe the data fully, it's now unusable, if the encryption works correctly. Quite old SSDs might not support any of this.
    - chx 8y ago
      I thought all SSDs support ATA password.
      - detaro 8y ago
        I don't think ATA password necessarily means the drive content is encrypted, or helps you fully wipe a drive you obtained from somewhere else.
    - veeti 8y ago
      > Even if they don't wipe the data fully, it's now unusable, if the encryption works correctly. Unfortunately, you can't trust the SSD firmware developers to have their shit together [1]. [1] https://techcrunch.com/2018/11/05/crucial-samsung-solid-state-drives-busted-encryption/ https://techcrunch.com/2018/11/05/crucial-samsung-solid-stat...
      - detaro 8y ago
        Which is why the if is in there :(

gowld 8y ago

The no longer existent corporate person is responsible. Same as if a real person copied all your info, published it, and died.

shawnz 8y ago
They do still exist though, and they are a subsidiary of Verizon. So is Verizon responsible even though nobody at Verizon had anything to do with it? Does the person who redistributed the data have any responsibility?
- nathan_long 8y ago
  > So is Verizon responsible even though nobody at Verizon had anything to do with it? Imagine if CompuServe still existed, but they had undergone 100% employee turnover in recent years. They'd still be liable, right? It seems to me that when Verizon bought CompuServe, they calculated that its assets minus its liabilities totaled less than the purchase price and hence it was a good deal. If we treat leakable data as a legal liability, it should send the right financial signal - eg, maybe as a company you don't want to collect much.