7 ms·

I’ve said it before and I’ll say it again, unless and until, companies like Facebook are fined appropriate amounts they’ll never stop. Quite literally, every b

I’ve said it before and I’ll say it again, unless and until, companies like Facebook are fined appropriate amounts they’ll never stop. Quite literally, every business school on the fucking planet will tell you do something if it’s cheaper. It is cheaper for them to not give a fuck, than to give one. Unless they are fined upwards of $20-50bn it’ll never stop because it’s always going to benefit their bottom line. Full stop. If you don’t take 10-15% from a company they won’t ever be incentivized to stop. This 5% or less bullshit has to stop if folks want change. Edit: small grammar fix.

dexen 6y ago
You are advocating creating perverse incentives. A specific branch of government, a select agency, to become a profit center through continuous finding and fining of ever more wrongdoings. All morally excused because the victims are faceless multinational corps. We all know how badly that goes with speed traps and red light cameras - instead of improving, the road conditions and sometimes even local rules are tweaked to maintain steady cashflow. Say no to revolving doors of regulators, say no to moral hazard of what effectively amounts to vice tax. Apply criminal penalties when reasonable, don't make data leaks & privacy breaches just another cost of doing business. -edit- Clarification: a fine works well when it's expected to be a rare penatly enacted on a singular player - as it makes that player noncompetitive in the market. Conversely, when fines are expected to apply regularly and at proportional rate to most, or all, players in a market, the fine no longer makes the player noncompetitive - it merely shifts the market. Perhaps some alternative markets (print? radio & TV?) would pick up some of the advertising slack, but largely it'd be a regular money transfer from corps to the government. And a "vice tax" like that is a clear moral hazard, with no natural end in sight.
- 6gvONxR4sf7o 6y ago
  They’re advocating the removing perverse incentives, so that data leaks and privacy breaches are not “just the cost of doing business.”
- Bluestein 6y ago
  Fine. Slippery slope perhaps.- Make it a "third sector", properly audited NGO (watchdog, thinktank, foundation ...), with ties to some appropriate umbrella (UN, ICJ), that uses some sort of blockchain solution to fine as needed, and then allocate compensation from this to aggrieved parties, or social programs, compensating not only for loss of privacy, but for the other nasty effects (fake news, emotional distress, political polarization ...) that F'book is causing.- Otherwise, our souls are just another cost of doing business to them.-
  - dexen 6y ago
    Now it makes more sense. Going a bit further you could perform it within the already existing framework: apply criminal penalties where sufficient threshold of harm have been reached. Perhaps even judicial doctrine a bit to better handle cases of large number of small, or statistical, harms - there are parallels to how we already tackle health hazards and other stochastic, broad harms. The key consideration is avoiding perverse incentives. A stellar example is how the GDPR disaster is unfolding: the smaller websites are still plastered with "cookie warnings" making them less usable, while the larger platforms - Youtube, Google - already pivoted the warning dialog into nagging for logging in, making anonymous browsing incrementally less practical. The difference in power lets the larger players use as a moat the regulation that's prima facie about privacy.
    - Bluestein 6y ago
      > there are parallels to how we already tackle health hazards and other stochastic, broad harms. I like your approach to these damages as stochastic, broad, ergo "actuarially" manageable ...
      - dexen 6y ago
        Thank you. We want to develop morals and jurisprudence around the subject for more reasons. Computerization, in particular networked computerization, has introduced problems like "wormable" devices - were impact of a single device or data item is tiny - however at scale they can quickly rack up considerable damages and losses.
- ric2b 6y ago
  > continuous finding and fining of ever more wrongdoings. How perverse indeed. > A specific branch of government, a select agency, to become a profit center So don't directly give them the money from the fines, simple.
1123581321 6y ago
If the value of data protection is that high then civil suit reform (lower overhead filing, improved class actions) should accomplish the same thing, and give the money to the owners of the data, without creating a massive defensive moat around the few companies that can afford the risk.
JoeAltmaier 6y ago
Its complicated. Some large companies make every effort, but are still plagued by lawsuits. Do everything to the best of your ability, still sometimes somebody will cut themselves shaving or whatever, and sue. I know of one that settles for anything under a quarter million without even determining merit. Because it never ends. I know, Facebook has made an egregious error. But overreacting (kill them all!) is not a good solution?
- another-dave 6y ago
  > Some large companies make every effort, but are still plagued by lawsuits. But that's clearly not what's happening in this case: > Facebook Inc did not notify the more than 530 million users whose details were obtained through the misuse of a feature before 2019 and recently made public in a database, and does not currently have plans to do so, a company spokesman said on Wednesday. ... > Ireland’s Data Protection Commission, the European Union’s lead regulator for Facebook, said on Tuesday it had contacted the company about the data leak. It said it received “no proactive communication from Facebook” but was now in contact. > The July 2019 FTC settlement requires Facebook to report details about unauthorized access to data on 500 or more users within 30 days of confirming an incident. I'm not sure how that can be categorised as making every effort? (EDIT: formatting)
haolez 6y ago
I have a strong suspicion that, if a government tried to fine a company in billions, that company would simply leave the country forever. I'm not saying that this is a good thing or a bad thing. It's just an intuition that I have.
- junon 6y ago
  And go... where?
  - guram11 6y ago
    China seems like a place for big brother love
- 542458 6y ago
  What do you mean? Companies have been fined multi-billion dollar amounts in the past. Withdrawing from the US market is simply not an option for many companies. I strongly suspect it wouldn’t be a realistic option for Facebook. That said, I think the parent comment that suggests “20-50B” fines is dramatically overestimating what it would take to promote more depositor behaviour here. Even much smaller fines with the threat of larger ones would likely be sufficient.
  - buran77 6y ago
    On top of that, withdrawing from the country after breaking the law and being fined is like fleeing the country after being convicted of a crime. It's not a legal cover. The first move is usually to legally object to the fine if it's more than the cost of doing business, leading to years of back and forth. Look at the fine the EU imposed on Intel in 2009 which keeps getting contested and reexamined. Increasing the cost and friction for the ones trying to recoup the fine makes them more willing to negotiate a faster settlement (usually better deal for the company). It's a good bargaining chip for the company if they have very few assets under that jurisdiction or it's a market they can afford to lose. So the company pays some of the fine and then sees much stricter controls applied to them in particular, not via law but via the settlement. Finally the company is represented by a CEO and/or board and those are the people ultimately responsible for disregarding a court decision. There could be attempts to hold them responsible but the US is famous for protecting any CEO from prison time (inside or outside of US borders). The US has a history of refusing to extradite CEOs convicted simply because they can purchase their way out of any trouble, it's only a matter of price. So this last step is mostly symbolic, the CEO is convicted because justice has to be served in the accusing jurisdiction.
qudat 6y ago
If customers do not care enough to stop using the product then there is no harm. Put in another way: the people you are trying to protect don't want your protection, because they don't care enough about the breach to stop using the product. They shouldn't be learning about the breaches from the company that has been breached because that gives the company too much power. Instead we should empower watchdog organizations to be our source of news for data breaches.
- danpalmer 6y ago
  People don't care enough because it's a privacy inconvenience vs all their communication with their family and friends. There's little that will tip that scale. The answer is probably strong anti-competitive legislation that makes it easier to move service, easier to inter-operate between services, and making services more granular.
- seveneightn9ne 6y ago
  > If customers do not care enough to stop using the product then there is no harm. Facebook users (notably not customers) are the ones being harmed here, and they don't exactly have free reign to choose the platform their communities talk and organize on. If I choose not to use Facebook then I'm isolating myself from my community.
  - trinsic-par 6y ago
    Relying on one irresponsible for-profit organization for your communications is a disaster waiting to happen. By using that service, you enable them to continue. It takes two to tango.
    - DerpyBaby123 6y ago
      You're ignoring the comment you're replying to. It's not 'two to tango', it's the network effect Facebook deliberately set up and perpetuates thru growth and acquisition.
    - briandear 6y ago
worker767424 6y ago
My only issues with this are that it's impractically hard to protect data to the extent necessary, and large fines become a lever for disgruntled employees to cause massive damage.
- 0x426577617265 6y ago
  Don’t store data you can’t protect. Because something is ‘hard’ doesn’t mean it shouldn’t be done.
  - worker767424 6y ago
    That's a great line for a stump speech, but try building this system yourself.
    - DerpyBaby123 6y ago
      Your argument doesn't hold water - lots of systems have users without collecting their phone numbers.
      - worker767424 6y ago
        It's not just phone numbers, though. It could be private messages, friends-only posts, IP address logs, physical addresses, SSNs--the list goes on. You'll quickly find that anything non-trivial will start collecting data users wouldn't want public.
        DerpyBaby123 6y ago
        >Don’t store data you can’t protect. Services like social networks don't need to store physical addresses, SSNs, phone numbers, etc. Therefore, that data should be looked at like a liability rather than an asset. It shouldn't be collected in the first place. Data like private messages, friends-only posts, etc are needed for the features they want to provide, and they should only provide those features if they can protect that data. https://martinfowler.com/bliki/Datensparsamkeit.html https://martinfowler.com/bliki/Datensparsamkeit.html
whywhywhywhy 6y ago
I agree but where would the money go?
- ixfo 6y ago
  Keep the relevant enforcement agencies fed and watered for starters, and the rest goes to govt as a contribution towards the usual things that taxes pay for.
- pmontra 6y ago
  In this period? Helping business and people hit by lockdowns. Vaccines. The list is too long to fit in this page. If there ever was a time for governments to go after megacorps money, this is it.
xtracto 6y ago
Here in Mexico, in theory every person record that is leaked without the holder permission can get the company a $5000 fine. Given that this leak has at least 50,000 records from Mexicans, Facebook could be fined up to $250,000,000. I don't understand why the government doesn't go for these type of things. On one side... it is easy money for the federation. On the other side, in a "personal" level for the bureaucrats, it is at least some good money they can keep corruptly.
- aksss 6y ago
  When I think about a small, bootstrapped operation, that kind of fine would bankrupt them. When I think about Facebook, that kind of fine wouldn’t even bother them. Not sure what the answer there is. At some level a very harsh fine says, no matter the value of the product, if you screw up we shut you down, unless you’re big enough to not care at all.
  - RankingMember 6y ago
    Perhaps the fine amount should be a function of market cap for public companies.
    - briandear 6y ago
      The fine should be proportional to the damage. A tiny medical startup that leaks psychotherapy records “hurts” more than a company that leaks your shoe size. Perhaps companies should buy insurance for this and then that would incentivize insurance companies to help protect their clients. Insurance requirements are a significant safety factor at many physical businesses. The law is important, but being denied insurance claims is a great private-sector solution. Or course for insurance to be meaningful, the penalties have to have significant teeth. However, a mega-Corp (by revenue) would likely self-insure, however they’d still have incentive to do right if the penalties were per record, not per breach. For HIPAA, there’s a fine of up to $10k per record for a breach. 10k times 200,000,000 users affected becomes real money even to Facebook. And, let’s make the fines payable to the user, not the government. The user is the one incurring the harm, not the government. The government still gets their slice since such awards are taxable.
at-fates-hands 6y ago
Or just break them up? Both parties in the US have spoken about breaking the "Big Tech" monopolies for a while now. Maybe some grass roots activism could finally get it some traction? We have a three strikes law in CA. I haven't done any research to find out how effective its been in reducing crime - but something similar for big companies like Facebook might be a way of dealing with this nonsense?
SN76477 6y ago
You are right. This should be a 25 billion dollar fine. For a business entity this is the only thing that will motivate them to try harder in the future.
Abishek_Muthian 6y ago
> every business school on the fucking planet will tell you do something if it’s cheaper. It is cheaper for them to not give a fuck, than to give one But Governments rarely have a fine based on the entity's revenue, let alone calculating fine based on the impact of the negligence like this. I guess FB has decided even if GDPR fine is triggered, paying that is better than reminding half-billion users that using their platform is dangerous. I've witnessed while literally getting sick due to the compliance burden when running the company as a single person i.e. in make sure I don't fall behind any of them; Large companies calculating the expenditure to 'fix the fine' if raised by the Govt. after several years and deciding NTGAF as the fine/fix is 'negligible' for them.
majani 6y ago
Excessive fines could bankrupt startups and even incentivize companies to hack their competition into bankruptcy.

dexen 6y ago

You are advocating creating perverse incentives. A specific branch of government, a select agency, to become a profit center through continuous finding and fining of ever more wrongdoings. All morally excused because the victims are faceless multinational corps. We all know how badly that goes with speed traps and red light cameras - instead of improving, the road conditions and sometimes even local rules are tweaked to maintain steady cashflow. Say no to revolving doors of regulators, say no to moral hazard of what effectively amounts to vice tax. Apply criminal penalties when reasonable, don't make data leaks & privacy breaches just another cost of doing business. -edit- Clarification: a fine works well when it's expected to be a rare penatly enacted on a singular player - as it makes that player noncompetitive in the market. Conversely, when fines are expected to apply regularly and at proportional rate to most, or all, players in a market, the fine no longer makes the player noncompetitive - it merely shifts the market. Perhaps some alternative markets (print? radio & TV?) would pick up some of the advertising slack, but largely it'd be a regular money transfer from corps to the government. And a "vice tax" like that is a clear moral hazard, with no natural end in sight.

6gvONxR4sf7o 6y ago
They’re advocating the removing perverse incentives, so that data leaks and privacy breaches are not “just the cost of doing business.”
Bluestein 6y ago
Fine. Slippery slope perhaps.- Make it a "third sector", properly audited NGO (watchdog, thinktank, foundation ...), with ties to some appropriate umbrella (UN, ICJ), that uses some sort of blockchain solution to fine as needed, and then allocate compensation from this to aggrieved parties, or social programs, compensating not only for loss of privacy, but for the other nasty effects (fake news, emotional distress, political polarization ...) that F'book is causing.- Otherwise, our souls are just another cost of doing business to them.-
- dexen 6y ago
  Now it makes more sense. Going a bit further you could perform it within the already existing framework: apply criminal penalties where sufficient threshold of harm have been reached. Perhaps even judicial doctrine a bit to better handle cases of large number of small, or statistical, harms - there are parallels to how we already tackle health hazards and other stochastic, broad harms. The key consideration is avoiding perverse incentives. A stellar example is how the GDPR disaster is unfolding: the smaller websites are still plastered with "cookie warnings" making them less usable, while the larger platforms - Youtube, Google - already pivoted the warning dialog into nagging for logging in, making anonymous browsing incrementally less practical. The difference in power lets the larger players use as a moat the regulation that's prima facie about privacy.
  - Bluestein 6y ago
    > there are parallels to how we already tackle health hazards and other stochastic, broad harms. I like your approach to these damages as stochastic, broad, ergo "actuarially" manageable ...
    - dexen 6y ago
      Thank you. We want to develop morals and jurisprudence around the subject for more reasons. Computerization, in particular networked computerization, has introduced problems like "wormable" devices - were impact of a single device or data item is tiny - however at scale they can quickly rack up considerable damages and losses.
ric2b 6y ago
> continuous finding and fining of ever more wrongdoings. How perverse indeed. > A specific branch of government, a select agency, to become a profit center So don't directly give them the money from the fines, simple.

1123581321 6y ago

If the value of data protection is that high then civil suit reform (lower overhead filing, improved class actions) should accomplish the same thing, and give the money to the owners of the data, without creating a massive defensive moat around the few companies that can afford the risk.

JoeAltmaier 6y ago

Its complicated. Some large companies make every effort, but are still plagued by lawsuits. Do everything to the best of your ability, still sometimes somebody will cut themselves shaving or whatever, and sue. I know of one that settles for anything under a quarter million without even determining merit. Because it never ends. I know, Facebook has made an egregious error. But overreacting (kill them all!) is not a good solution?

another-dave 6y ago
> Some large companies make every effort, but are still plagued by lawsuits. But that's clearly not what's happening in this case: > Facebook Inc did not notify the more than 530 million users whose details were obtained through the misuse of a feature before 2019 and recently made public in a database, and does not currently have plans to do so, a company spokesman said on Wednesday. ... > Ireland’s Data Protection Commission, the European Union’s lead regulator for Facebook, said on Tuesday it had contacted the company about the data leak. It said it received “no proactive communication from Facebook” but was now in contact. > The July 2019 FTC settlement requires Facebook to report details about unauthorized access to data on 500 or more users within 30 days of confirming an incident. I'm not sure how that can be categorised as making every effort? (EDIT: formatting)

haolez 6y ago

I have a strong suspicion that, if a government tried to fine a company in billions, that company would simply leave the country forever. I'm not saying that this is a good thing or a bad thing. It's just an intuition that I have.

junon 6y ago
And go... where?
- guram11 6y ago
  China seems like a place for big brother love
542458 6y ago
What do you mean? Companies have been fined multi-billion dollar amounts in the past. Withdrawing from the US market is simply not an option for many companies. I strongly suspect it wouldn’t be a realistic option for Facebook. That said, I think the parent comment that suggests “20-50B” fines is dramatically overestimating what it would take to promote more depositor behaviour here. Even much smaller fines with the threat of larger ones would likely be sufficient.
- buran77 6y ago
  On top of that, withdrawing from the country after breaking the law and being fined is like fleeing the country after being convicted of a crime. It's not a legal cover. The first move is usually to legally object to the fine if it's more than the cost of doing business, leading to years of back and forth. Look at the fine the EU imposed on Intel in 2009 which keeps getting contested and reexamined. Increasing the cost and friction for the ones trying to recoup the fine makes them more willing to negotiate a faster settlement (usually better deal for the company). It's a good bargaining chip for the company if they have very few assets under that jurisdiction or it's a market they can afford to lose. So the company pays some of the fine and then sees much stricter controls applied to them in particular, not via law but via the settlement. Finally the company is represented by a CEO and/or board and those are the people ultimately responsible for disregarding a court decision. There could be attempts to hold them responsible but the US is famous for protecting any CEO from prison time (inside or outside of US borders). The US has a history of refusing to extradite CEOs convicted simply because they can purchase their way out of any trouble, it's only a matter of price. So this last step is mostly symbolic, the CEO is convicted because justice has to be served in the accusing jurisdiction.

qudat 6y ago

If customers do not care enough to stop using the product then there is no harm. Put in another way: the people you are trying to protect don't want your protection, because they don't care enough about the breach to stop using the product. They shouldn't be learning about the breaches from the company that has been breached because that gives the company too much power. Instead we should empower watchdog organizations to be our source of news for data breaches.

danpalmer 6y ago
People don't care enough because it's a privacy inconvenience vs all their communication with their family and friends. There's little that will tip that scale. The answer is probably strong anti-competitive legislation that makes it easier to move service, easier to inter-operate between services, and making services more granular.
seveneightn9ne 6y ago
> If customers do not care enough to stop using the product then there is no harm. Facebook users (notably not customers) are the ones being harmed here, and they don't exactly have free reign to choose the platform their communities talk and organize on. If I choose not to use Facebook then I'm isolating myself from my community.
- trinsic-par 6y ago
  Relying on one irresponsible for-profit organization for your communications is a disaster waiting to happen. By using that service, you enable them to continue. It takes two to tango.
  - DerpyBaby123 6y ago
    You're ignoring the comment you're replying to. It's not 'two to tango', it's the network effect Facebook deliberately set up and perpetuates thru growth and acquisition.
  - briandear 6y ago

worker767424 6y ago

My only issues with this are that it's impractically hard to protect data to the extent necessary, and large fines become a lever for disgruntled employees to cause massive damage.

0x426577617265 6y ago
Don’t store data you can’t protect. Because something is ‘hard’ doesn’t mean it shouldn’t be done.
- worker767424 6y ago
  That's a great line for a stump speech, but try building this system yourself.
  - DerpyBaby123 6y ago
    Your argument doesn't hold water - lots of systems have users without collecting their phone numbers.
    - worker767424 6y ago
      It's not just phone numbers, though. It could be private messages, friends-only posts, IP address logs, physical addresses, SSNs--the list goes on. You'll quickly find that anything non-trivial will start collecting data users wouldn't want public.
      - DerpyBaby123 6y ago
        >Don’t store data you can’t protect. Services like social networks don't need to store physical addresses, SSNs, phone numbers, etc. Therefore, that data should be looked at like a liability rather than an asset. It shouldn't be collected in the first place. Data like private messages, friends-only posts, etc are needed for the features they want to provide, and they should only provide those features if they can protect that data. https://martinfowler.com/bliki/Datensparsamkeit.html https://martinfowler.com/bliki/Datensparsamkeit.html

whywhywhywhy 6y ago

I agree but where would the money go?

ixfo 6y ago
Keep the relevant enforcement agencies fed and watered for starters, and the rest goes to govt as a contribution towards the usual things that taxes pay for.
pmontra 6y ago
In this period? Helping business and people hit by lockdowns. Vaccines. The list is too long to fit in this page. If there ever was a time for governments to go after megacorps money, this is it.

xtracto 6y ago

Here in Mexico, in theory every person record that is leaked without the holder permission can get the company a $5000 fine. Given that this leak has at least 50,000 records from Mexicans, Facebook could be fined up to $250,000,000. I don't understand why the government doesn't go for these type of things. On one side... it is easy money for the federation. On the other side, in a "personal" level for the bureaucrats, it is at least some good money they can keep corruptly.

aksss 6y ago
When I think about a small, bootstrapped operation, that kind of fine would bankrupt them. When I think about Facebook, that kind of fine wouldn’t even bother them. Not sure what the answer there is. At some level a very harsh fine says, no matter the value of the product, if you screw up we shut you down, unless you’re big enough to not care at all.
- RankingMember 6y ago
  Perhaps the fine amount should be a function of market cap for public companies.
  - briandear 6y ago
    The fine should be proportional to the damage. A tiny medical startup that leaks psychotherapy records “hurts” more than a company that leaks your shoe size. Perhaps companies should buy insurance for this and then that would incentivize insurance companies to help protect their clients. Insurance requirements are a significant safety factor at many physical businesses. The law is important, but being denied insurance claims is a great private-sector solution. Or course for insurance to be meaningful, the penalties have to have significant teeth. However, a mega-Corp (by revenue) would likely self-insure, however they’d still have incentive to do right if the penalties were per record, not per breach. For HIPAA, there’s a fine of up to $10k per record for a breach. 10k times 200,000,000 users affected becomes real money even to Facebook. And, let’s make the fines payable to the user, not the government. The user is the one incurring the harm, not the government. The government still gets their slice since such awards are taxable.

at-fates-hands 6y ago

Or just break them up? Both parties in the US have spoken about breaking the "Big Tech" monopolies for a while now. Maybe some grass roots activism could finally get it some traction? We have a three strikes law in CA. I haven't done any research to find out how effective its been in reducing crime - but something similar for big companies like Facebook might be a way of dealing with this nonsense?

SN76477 6y ago

You are right. This should be a 25 billion dollar fine. For a business entity this is the only thing that will motivate them to try harder in the future.

Abishek_Muthian 6y ago

> every business school on the fucking planet will tell you do something if it’s cheaper. It is cheaper for them to not give a fuck, than to give one But Governments rarely have a fine based on the entity's revenue, let alone calculating fine based on the impact of the negligence like this. I guess FB has decided even if GDPR fine is triggered, paying that is better than reminding half-billion users that using their platform is dangerous. I've witnessed while literally getting sick due to the compliance burden when running the company as a single person i.e. in make sure I don't fall behind any of them; Large companies calculating the expenditure to 'fix the fine' if raised by the Govt. after several years and deciding NTGAF as the fine/fix is 'negligible' for them.

majani 6y ago

Excessive fines could bankrupt startups and even incentivize companies to hack their competition into bankruptcy.