3 ms·

Not sure what you are trying to say here. The original article and the one you posted are not inconsistent - in your link Schneier quotes some research that th

Not sure what you are trying to say here. The original article and the one you posted are not inconsistent - in your link Schneier quotes some research that the stock market doesn't care about data breaches, probably because there is little direct financial damage. Hence there is little incentive for companies to stop stockpiling every scrap of data. Schneier is arguing that the risk to individuals and society at large is greater than any benefit this data could provide. One way to remove the incentives to gather and store data is through regulation and fines - then the stockmarket would care.

jiveturkey 7y ago
> Schneier is arguing that the risk to individuals and society at large is greater than any benefit this data could provide. I don't think we read the same (2016) article. In the one I read, he is claiming that holding onto personal data is about banking it for future revenue (he actually says profitability, but I think he is just not being savvy here). Where he specifically talks about risks, he talks about risks to the company, to PR. Nothing, not a chirp, about damage to the individuals or society at large. Earlier in the article he actually cites Anthem and Target, the 2 biggest breaches to date (as of 2016). Ironic because these breaches did no damage to the companies. Also, not a well formed argument because those companies weren't monetizing personal data in the way that we think of as privacy invasive, or "user as the product". Whether or not personal data is a toxic thing to be avoided, those companies needed to take that data. In the 2016 article I read, Schneier is claiming that the risk analysis is flawed and the damage to a company from the eventual breach/loss of personal data, outweighs the financial gain to be realized from that data. He's trying to appeal to market wisdom, not social good. "protect your bottom line", not "think of the children". Which is a fine thesis. But the 2 primary examples he gives in the same article prove himself wrong, and an academic study in 2018 further proves this to be wrong. > One way to remove the incentives to gather and store data is through regulation and fines - then the stockmarket would care. Yep, only then. It's a bit like a class action. Each individual person that is caught up in a privacy breach, suffers just this little bit and doesn't have an individual voice for redress at all. "The market" will thus do as it will with such data. We need a big hammer to fix it. GDPR has been a huge benefit for privacy, as partly evidenced by all the naysayers using implementation cost as their argument. In the US, when the dust finally settles around Equifax, we may move the needle. To finally answer your first point, I'm saying that Schneier was wrong in 2016 and he corrected himself in 2018.
- AndrewStephens 7y ago
  I think Schneier is trying to say in both cases that it is not worth the risks, but I'll concede that we are arguing a very fine point. In any case, I agree with Schneier in this latest post and have argued along these lines myself.

jiveturkey 7y ago

> Schneier is arguing that the risk to individuals and society at large is greater than any benefit this data could provide. I don't think we read the same (2016) article. In the one I read, he is claiming that holding onto personal data is about banking it for future revenue (he actually says profitability, but I think he is just not being savvy here). Where he specifically talks about risks, he talks about risks to the company, to PR. Nothing, not a chirp, about damage to the individuals or society at large. Earlier in the article he actually cites Anthem and Target, the 2 biggest breaches to date (as of 2016). Ironic because these breaches did no damage to the companies. Also, not a well formed argument because those companies weren't monetizing personal data in the way that we think of as privacy invasive, or "user as the product". Whether or not personal data is a toxic thing to be avoided, those companies needed to take that data. In the 2016 article I read, Schneier is claiming that the risk analysis is flawed and the damage to a company from the eventual breach/loss of personal data, outweighs the financial gain to be realized from that data. He's trying to appeal to market wisdom, not social good. "protect your bottom line", not "think of the children". Which is a fine thesis. But the 2 primary examples he gives in the same article prove himself wrong, and an academic study in 2018 further proves this to be wrong. > One way to remove the incentives to gather and store data is through regulation and fines - then the stockmarket would care. Yep, only then. It's a bit like a class action. Each individual person that is caught up in a privacy breach, suffers just this little bit and doesn't have an individual voice for redress at all. "The market" will thus do as it will with such data. We need a big hammer to fix it. GDPR has been a huge benefit for privacy, as partly evidenced by all the naysayers using implementation cost as their argument. In the US, when the dust finally settles around Equifax, we may move the needle. To finally answer your first point, I'm saying that Schneier was wrong in 2016 and he corrected himself in 2018.

AndrewStephens 7y ago
I think Schneier is trying to say in both cases that it is not worth the risks, but I'll concede that we are arguing a very fine point. In any case, I agree with Schneier in this latest post and have argued along these lines myself.