3 ms·
That is only a problem if you create mandatory fixed-cost liability requirements. You can solve the problem by allowing companies to opt-in to liability require
by Veserv 6y ago
That is only a problem if you create mandatory fixed-cost liability requirements. You can solve the problem by allowing companies to opt-in to liability requirements for some benefit. As an example, we could require that any company that wants to advertise security must do so in the form of a number specifying how much they will pay their customers in the event of a breach. So, they would not be able to advertise something like: "We have a secure cloud database.". They would instead be required to say: "We have a cloud database with $10M security." and in the event of a breach be forced to pay out $10M to its customers.
So, if a company is small and unable to afford any security, they can just set the number at $0 which means it is the customer's problem. However, if the company is big and people have security expectations, they would need to specify a reasonable number that would alleviate those concerns. As long as the number is clearly communicated and you are not allowed to fraudulently or misleadingly advertise a different number, then customer's would be able to make an informed decision with respect to the security level and liability they are accepting from their vendors.
Obviously there are some complexities with respect to properly communicating this information. For instance, for a consumer-facing company you would probably want a per-consumer number instead of an aggregate number. As an example, if Apple were to claim $300M for the iPhone, that might seem like a large number to an average person, but that would only amount to ~$1.50 per iPhone sold in a year. You also need to prevent misleading advertising that might attempt to divert from the quantitative liability they are actually accepting. However, the base scheme of mandatory labelling requirements along with opt-in liability should allow for a solution that is hard to bypass while being flexible enough to support both small and large businesses.
- joe_the_user 6y agoSo, if a company is small and unable to afford any security, they can just set the number at $0 which means it is the customer's problem. And if a company is large and low margin, they can do this too so nothing changes. A few companies will be out there promising things, like today, and maybe they can deliver and maybe you can sue them if they don't, like today.
- setr 6y agoWell, right now everyone and everything claims to be secure; this puts a number on that claim, and gives you companies explicitly claiming that they’re not secure (at least, they wouldn’t bet on it), which is quite a bit more information than you have today. Being able to actually get your money back... is another problem. But obviously a toothless regulation is toothless, and changes nothing, so its not a useful assumption to make
- Veserv 6y agoIf a company is large and low margin and does not care about security and they write in big bold print that they provide exactly zero guarantees about security and it is your problem if something happens and they never insinuate that there is any appreciable security, then I do not see the problem with that. The customer has been informed in no uncertain terms what they are getting and can make the cost-benefit analysis themselves. Obviously, there are complexities with regard to what exactly constitutes proper notice such that the customer can do a proper cost-benefit analysis, but the spirit of such a rule is clear. This is would be different than the current state of affairs because lying or overstating your security story would have direct, pre-committed, quantitative downside. This is contrast to the outcomes of a lawsuit which are expensive, highly variable, generally require proof of intent, and depend on demonstrating actual quantitative damages.
- no-dr-onboard 6y agoCouldn't agree with you more. The decision to take on risk for the purpose of marketing is not at all palatable to decision makers. Why would you want to accept an increase in risk for an unknown-unknown?
- Animats 6y agoLiability may also be to third parties. Actually, I'm surprised that someone facing a DDOS attack from compromised Windows systems hasn't sued Microsoft for negligence. The victim is not a party to Microsoft's EULA in that case.
- tptacek 6y agoSee the health supplement business for how well this regulatory approach has worked in practice.
- khafra 6y agoAttribution in security is really hard. But attribution in health supplements is far harder. Nobody's ever gotten a PoC for a health improvement to work every time in living organisms, even on the same organism version and platform. So there isn't a real option for supplement producers to make quantitative claims about their efficacy. Meanwhile, quantitative, money-linked claims about software security actually do happen in rare edge cases, already.