3 ms·

This is about lying to the FTC, not about paying off hackers to keep data private. Ransomware has shown that the latter is accepted even if not exactly legal.

by 55555 6y ago

This is about lying to the FTC, not about paying off hackers to keep data private. Ransomware has shown that the latter is accepted even if not exactly legal. > The database included the drivers’ license numbers for approximately 600,000 people who drove for Uber. Drivers licenses are deterministic and can be generated by knowing full name and DOB and state. They aren't PII.

deleted 6y ago
[deleted]
vesche 6y ago
From reading the article it doesn't sound like this was ransomware: > "During this time, two hackers contacted Sullivan by email and demanded a six-figure payment in exchange for silence. The hackers ultimately revealed that they had accessed and downloaded an Uber database containing personally identifying information, or PII, associated with approximately 57 million Uber users and drivers." The hackers were demanding a ransom from Uber to keep silent about a data breach. Which is a whole lot different than paying a ransom to decrypt valuable, internal data. If a company has been breached, while it will almost certainly cause damage fiscally & to their reputation- they have a responsibility to notify users/customers. I'm unfamiliar with the law on this, but it should be illegal for a company to pay a ransom for malicious actors to keep silent about data they stole.
jheitmann 6y ago
I haven't had to deal with PII issues for a few years now so I might be a bit rusty but: Regardless of how driver's license ids are created, they are global identifiers of a specific person. If company A knows a person's driver's license number, and company B knows that same person's driver's license number, the two companies can be certain they're talking about the same person. That those ids are often formed from a transparent function of other PII only makes the issue more extreme. It's like PII^2.
kube-system 6y ago
This is not about lying, this is about actively assisting the criminals in concealing their crimes. The charges listed are obstruction of justice and misprision of a felony. Furthermore, data being derived from something else has no bearing on whether it’s PII or not. ID numbers are personally identifiable information by definition. The whole point of them is to personally identify someone.

by 55555 6y ago

deleted 6y ago

[deleted]

vesche 6y ago

From reading the article it doesn't sound like this was ransomware: > "During this time, two hackers contacted Sullivan by email and demanded a six-figure payment in exchange for silence. The hackers ultimately revealed that they had accessed and downloaded an Uber database containing personally identifying information, or PII, associated with approximately 57 million Uber users and drivers." The hackers were demanding a ransom from Uber to keep silent about a data breach. Which is a whole lot different than paying a ransom to decrypt valuable, internal data. If a company has been breached, while it will almost certainly cause damage fiscally & to their reputation- they have a responsibility to notify users/customers. I'm unfamiliar with the law on this, but it should be illegal for a company to pay a ransom for malicious actors to keep silent about data they stole.

jheitmann 6y ago

I haven't had to deal with PII issues for a few years now so I might be a bit rusty but: Regardless of how driver's license ids are created, they are global identifiers of a specific person. If company A knows a person's driver's license number, and company B knows that same person's driver's license number, the two companies can be certain they're talking about the same person. That those ids are often formed from a transparent function of other PII only makes the issue more extreme. It's like PII^2.

kube-system 6y ago

This is not about lying, this is about actively assisting the criminals in concealing their crimes. The charges listed are obstruction of justice and misprision of a felony. Furthermore, data being derived from something else has no bearing on whether it’s PII or not. ID numbers are personally identifiable information by definition. The whole point of them is to personally identify someone.