5 ms·

Is Equifax actually liable or responsible for anything? No jail time or other penalties for executives. Okay so how are they held accountable?

ummonk 7y ago
Jail time for executives seems a little excessive for some employee merely failing to apply a security patch... On the other hand, this settlement shouldn't have been capped at such a ridiculously low amount.
- 29athrowaway 7y ago
  > merely failing to apply a security patch ...and leaking information about every working age adult in the US. And having a music major as chief security officer. And having sensitive data stored as plaintext. Their entire business is about managing information. They failed to do the only thing they are supposed to do.
- jakobegger 7y ago
  > Jail time for executives seems a little excessive for some employee merely failing to apply a security patch... No, it's not. If you collect personal information of almost 150 million people, you have to take measures to protect that data. If you fail to do that, you can't just say "oops, I didn't mean that"...
  - tiborsaas 7y ago
    Apparently you can totally just say whoopsie. A bit backslash here, some penalties over there and it's fine, the sun comes up next day morning the same.
- tamrix 7y ago
  That's just what they want you to think. Really they just sold the data off on the international market.
  - anticensor 7y ago
    I am 1000000‰ sure it is both.
- pimmen 7y ago
  They made the conscious decision to monetize personal data belonging to more than a hundred million people. That means they should take every measure available to make sure something that sensitive is not released. If this was the US Airforce who lost an armed nuclear ICBM the commanding officer who was ok with this ”whoopsie” would have to explain him or herself to quite a few officials.
  - jimhefferon 7y ago
    > They made the conscious decision to monetize personal data belonging to more than a hundred million people. That means they should take every measure available I disagree. I think it means they owe a hundred million people (a) an offer to opt-in to their service and (b) a share of their profits for doing so.
    - pimmen 7y ago
      Yeah, I agree with that. Basically we want to use a and b as incentives for them to take every measure available not to fail like this ever again. And as incentives for everyone else in the business.
  - howard941 7y ago
    There's so much truth here. There are soldiers and marines fighting land wars in Asia that have to go on life risking missions to retrieve lost tech that's ITAR or worth more than some monetary amount I think $15 or $20K or spend months filling out paperwork explaining the loss. But CRAs get a free ride.
- goatinaboat 7y ago
  some employee It’s not “some employee”. It’s an entire management hierarchy that failed to prioritise and budget for and create a culture around security best practices.
- callmejonas 7y ago
  If you have not read the Equifax Data Breach Report put out by the US Congress, I highly recommend it. The security issues at Equifax went far beyond "failing to apply a security patch." https://republicans-oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf https://republicans-oversight.house.gov/wp-content/uploads/2...
- tracer4201 7y ago
  If you’re collecting personal and financial data points on over a hundred million people and one employee makes a mistakes that results in this kind of leak, as a leader you should be charged with with gross negligence. Why were there no guard rails in place? Why is one employee a single point of failure?
RachelF 7y ago
They were incredibly negligent and nepotistic. Their head of security, Susan Mauldin, had zero security or computer skills - she was a music teacher. https://www.marketwatch.com/story/equifax-ceo-hired-a-music-major-as-the-companys-chief-security-officer-2017-09-15 https://www.marketwatch.com/story/equifax-ceo-hired-a-music-...
- iliketosleep 7y ago
  It appears that the higher you go up the corporate ladder, the more it is about connections rather than actual knowledge, to the point that knowledge carries almost zero weight and connections are everything. A lot of companies are like this, and most of them (including Equifax) are still going strong. Meritocracy at the bottom and nepotism at the top seems to be the deal. Anyway, the last line of the article sums it up well: "Everything about this fiasco just gets more and more surreal."
  - pbhjpbhj 7y ago
    Look at UK politicians as an example, they usually have no specialist training for their brief (the government department they direct) and often jump from one section to another. There's a sense in which they have control of entire industry sectors, some higher learning or extended experience should really be required.
    - iliketosleep 7y ago
      I think it's because their job is to make purely political decisions, leading to decisions that on the surface actually look insane.
  - asdfman123 7y ago
    This is the way the corporate world has always worked. The problem is when this world collides with software, where actually knowing what the hell you're doing matters.
    - 7y ago

ummonk 7y ago

Jail time for executives seems a little excessive for some employee merely failing to apply a security patch... On the other hand, this settlement shouldn't have been capped at such a ridiculously low amount.

29athrowaway 7y ago
> merely failing to apply a security patch ...and leaking information about every working age adult in the US. And having a music major as chief security officer. And having sensitive data stored as plaintext. Their entire business is about managing information. They failed to do the only thing they are supposed to do.
jakobegger 7y ago
> Jail time for executives seems a little excessive for some employee merely failing to apply a security patch... No, it's not. If you collect personal information of almost 150 million people, you have to take measures to protect that data. If you fail to do that, you can't just say "oops, I didn't mean that"...
- tiborsaas 7y ago
  Apparently you can totally just say whoopsie. A bit backslash here, some penalties over there and it's fine, the sun comes up next day morning the same.
tamrix 7y ago
That's just what they want you to think. Really they just sold the data off on the international market.
- anticensor 7y ago
  I am 1000000‰ sure it is both.
pimmen 7y ago
They made the conscious decision to monetize personal data belonging to more than a hundred million people. That means they should take every measure available to make sure something that sensitive is not released. If this was the US Airforce who lost an armed nuclear ICBM the commanding officer who was ok with this ”whoopsie” would have to explain him or herself to quite a few officials.
- jimhefferon 7y ago
  > They made the conscious decision to monetize personal data belonging to more than a hundred million people. That means they should take every measure available I disagree. I think it means they owe a hundred million people (a) an offer to opt-in to their service and (b) a share of their profits for doing so.
  - pimmen 7y ago
    Yeah, I agree with that. Basically we want to use a and b as incentives for them to take every measure available not to fail like this ever again. And as incentives for everyone else in the business.
- howard941 7y ago
  There's so much truth here. There are soldiers and marines fighting land wars in Asia that have to go on life risking missions to retrieve lost tech that's ITAR or worth more than some monetary amount I think $15 or $20K or spend months filling out paperwork explaining the loss. But CRAs get a free ride.
goatinaboat 7y ago
some employee It’s not “some employee”. It’s an entire management hierarchy that failed to prioritise and budget for and create a culture around security best practices.
callmejonas 7y ago
If you have not read the Equifax Data Breach Report put out by the US Congress, I highly recommend it. The security issues at Equifax went far beyond "failing to apply a security patch." https://republicans-oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf https://republicans-oversight.house.gov/wp-content/uploads/2...
tracer4201 7y ago
If you’re collecting personal and financial data points on over a hundred million people and one employee makes a mistakes that results in this kind of leak, as a leader you should be charged with with gross negligence. Why were there no guard rails in place? Why is one employee a single point of failure?

RachelF 7y ago

They were incredibly negligent and nepotistic. Their head of security, Susan Mauldin, had zero security or computer skills - she was a music teacher. https://www.marketwatch.com/story/equifax-ceo-hired-a-music-major-as-the-companys-chief-security-officer-2017-09-15 https://www.marketwatch.com/story/equifax-ceo-hired-a-music-...

iliketosleep 7y ago
It appears that the higher you go up the corporate ladder, the more it is about connections rather than actual knowledge, to the point that knowledge carries almost zero weight and connections are everything. A lot of companies are like this, and most of them (including Equifax) are still going strong. Meritocracy at the bottom and nepotism at the top seems to be the deal. Anyway, the last line of the article sums it up well: "Everything about this fiasco just gets more and more surreal."
- pbhjpbhj 7y ago
  Look at UK politicians as an example, they usually have no specialist training for their brief (the government department they direct) and often jump from one section to another. There's a sense in which they have control of entire industry sectors, some higher learning or extended experience should really be required.
  - iliketosleep 7y ago
    I think it's because their job is to make purely political decisions, leading to decisions that on the surface actually look insane.
- asdfman123 7y ago
  This is the way the corporate world has always worked. The problem is when this world collides with software, where actually knowing what the hell you're doing matters.
  - 7y ago