9 ms·
Hackers post 25,971 files stolen from Broward schools
- black_puppydog 6y ago> Unfortunately, our website is currently unavailable in most European countries. We are engaged on the issue and committed to looking at options that support our full range of digital offerings to the EU market. We continue to identify technical compliance solutions that will provide all readers with our award-winning journalism. Fuck you too
- tomrod 6y agoCan you blame them? At least they are honest about their adherence instead of something like StackOverflow's "accept everything or die" banner ~~ads~~ pop-ups.
- eMGm4D0zgUAVXc7 6y agoThey're *NOT* honest: > We are engaged on the issue No you're not, the GDPR has been active for 3 years now, or 5 years if you include the time where it wasn't mandatory, if you were engaged it would have been fixed already. > and committed to looking at options that support our full range of digital offerings to the EU market. Yea, so how about the option of just disabling privacy invading code on your website, which would probably take much less than 3 years? > We continue to identify technical compliance solutions that will provide all readers with our award-winning journalism. More repetition of the same empty "we're DOING SO MUCH!". But well, at least it doesn't say "We care about our European readers" like most of such blocked websites say. That one usually makes my blood boil: You're not caring at all. If you were caring, you wouldn't lock out 448 million people for years!
- cortesoft 6y agoBut what is their incentive to do that work? They probably don’t make any money from European users, or at least not enough to make the effort worthwhile... so why should they do it?
- eMGm4D0zgUAVXc7 6y ago- It is called the "WORLD WIDE web", not the "local web". If you go to a place you ought to respect its fundamental purpose, no matter if it is a physical place or a virtual one. - We live in a highly globally interconnected society. Actions everywhere on the planet have consequences everywhere on the planet. If the US fabric of society blows up after their previous clinically insane president incited violence for years, that WILL have consequences for Europe. If only for the thousands of nukes they have and the trillions they spend on military and invading unstable regions. Also remember that we're being asked to spend tons of money on the NATO to aid in defending US interest. It is thus of very HIGH interest for me as a European to know WTF is going on in the US because it may end up killing us all, and even if not we still pay for their shenanigans. So denying us knowledge of affairs we're *very* involved in is rude. - My country's military has been in Afghanistan for 20 years because of the US invasion. Nobody knows for how long we will be target of terrorist attacks for that. And as a thank you for all of this, I can't even read your local news sites. I wonder how much the US would be enraged if that situation were reversed?
- RcouF1uZ4gsC 6y ago> It is called the "WORLD WIDE web", not the "local web". So who gave the EU the right to be making rules for the entire “WORLD WIDE” web? If the EU has the right to be making laws for their jurisdiction, then websites in other jurisdictions also have the right to ignore the EU laws and exclude EU members.
- eMGm4D0zgUAVXc7 6y agoWhy would they have to obey the laws if they're not part of the EU? They could just leave their website online as is, no need to block it if the laws don't apply to them anyway.
- black_puppydog 6y agoOf course I can blame them. More for being full of shit than anything else.
- devenblake 6y agoSite's covered in globs of advertisements and video anyway. You'd click off even if you could see it, don't worry.
- bigwavedave 6y ago> Fuck you too Maybe I'm wrong in this assumption, but to me the section you quoted sounds like they're saying "we're not GDPR compliant, so we can't participate in that market right now"; it's not a "fuck you, Europe" kind of thing. But hey, you know what they say about assumptions.
- ryandrake 6y agoOPs quote was full of the usual contentless corp-speak. "We are engaged on the issue...", "committed to looking at options..." and "We continue to identify..." These phrases are a nice, pleasant and important-sounding way of saying "We aren't actually doing anything at all, despite GDPR having been adopted over five years ago."
- whydoyoucare2 6y agoOk? It's a local newspaper from Florida, why should they be expected to do extra work to support Europeans? You're not entitled to access their site. These local papers are struggling to keep the lights on to serve their communities. YOUR government decided to make GDPR this stringent, and the European Parliament ignored warnings about exactly this happening. You can get your reporting second hand from a European source that follows your laws, at cost to you, or be left out of the loop because your continent expects the rest of the world to follow their laws. The choice was made in Europe. You reap what you sow.
- philjohn 6y agoIt's a local newspaper, but owned by the third largest newspaper publisher in the US and uses a shared CMS.
- simion314 6y agoI would be fine with a bit more sincerity, something like: "we don't care about privacy, so go somewhere else". Or if you want to translate it you can put a message like "the EU market is too small for us to even consider implementing non tracking ads, we are sorry we can't sell your data anymore!"
- meepmorp 6y agoIt's not unreasonable to want top avoid the regulatory compliance headache that is GDPR, especially for people who aren't likely to be regular users of the site.
- not1ofU 6y agoSolution - 1. FoxyProxy (firefox add-on). 2. Google for US free proxy (took about 5 minutes to find one). 3. Profit. As the others who responded to you have already pointed out, was probably not as interesting to you as the headline suggests.
- wayoutthere 6y agoLet’s be realistic here, EU users aren’t a core use case for a local newspaper in Florida. GDPR classification is not high up on the priority list for a local newspaper, so a risk averse lawyer says to just block the whole continent. It’s the worst of US and EU culture combined to achieve the worst possible outcome.
- black_puppydog 6y agoI never said I didn't understand their motivations. But that doesn't mean their conclusion (and formulation) doesn't come down to a "fuck you" in the end.
- HenryBemis 6y agoPlain and simple. Yes they do say '..... you'. I translate that as: we don't care about you. You don't bring any revenue. None of our advertisers care to advertise to an EU audience. Example: And why would a restaurant in Florida care to advertise to someone in Paris? What are the chances that someone in Paris will think "oh I need to eat that burger in XYZ Florida resto?" (ok my example for Paris-burger-Florida is semi-sarcastic - but true. what are the odds? - what is the cost vs potential benefit?)
- jacobsenscott 6y agoThe GDPR is an FU from EU bureaucrats to the world, not the other way around.
- levi-turner 6y agoI don't disagree to the conclusion but the Sun-Sentinel is owned by the Tribune Publishing Company, which is the third largest newspaper publisher in the US. Often the subsidiaries use the same core CMS / tech. Compare the Sun-Sentinel to another paper owned by Tribune: https://www.pilotonline.com/ https://www.pilotonline.com/ It seems a bit odd to not believe there is not only a way to handle this more gracefully but also that Tribune could handle this globally for all of their newspapers.
- 6y ago
- throwaway823882 6y agoIt's a website about Florida. They are doing you a favor.
- black_puppydog 6y agoSingle valid counter point here. :)
- yesenadam 6y agoPlease consider that on HN you not only get to vent, but other people have to read it. Scrolling onto your comment felt like coming across a dog poo on a walk in the park. Nothing good about it. I looked at a few pages of your comment history, and too many of them are like that. I'm sorry you have so much anger... Thanks.
- vmception 6y ago> found a few isolated incidents where confidential student or employee information was released, but none that contained Social Security numbers phew, close one
- weird-eye-issue 6y ago> A report about missing equipment includes a December 2018 letter from a mother whose son took a laptop from his class and switched the inventory tag from his computer after he broke his device. The names of the mother and student are included. This kid is going places. Possibly jail, but definitely places
- kolbe 6y agoThe key is to hire him before he steps over the line.
- philjohn 6y agoDepends - being gainfully employed didn't help Nick Leeson.
- arthurcolle 6y agoGood movie about that with Obi Wan Kenobi starring in it, "Rogue Trader"
- shaggyfrog 6y agoThe classic American story of condemning a child to a life of incarceration and criminality because a family is too poor to afford to replace an accidentally broken school laptop (and has no other computer)...
- userbinator 6y agoThere's something called honesty...
- capableweb 6y agoPeople end up in positions where they have to break their own moral compass all the time, even if they are generally honest people. I'm not condoning it but I do have some understanding of unfortunate situations.
- jsheard 6y agoMirror for those locked out by the sites GDPR policy: https://archive.is/tIsPd https://archive.is/tIsPd
- fouric 6y agoIs there a coherent argument for not making collectors of data (in this case, the Broward school district, but it could be Facebook, Equifax, whatever) liable for damage incurred due to data in their possession being stolen?
- thaumasiotes 6y agoNo way to measure the damages.
- alasdair_ 6y agoStatutory minimums would be possible. That being said, we’d need to also make it illegal (with a bigger fine) to not inform customers of the breach, and to provide reduced damages for companies that promptly inform users. Otherwise the “correct” approach for a company would be to ignore every hacking attempt and never investigate.
- thaumasiotes 6y ago> Statutory minimums would be possible. Sure, but fining someone for leaking data is a very different thing than making them liable for damages, even if you call the fine "statutory damages".
- throwaway823882 6y agoWho would get sued though? The school? So we'd be suing ourselves?
- bogwog 6y ago> The district’s Chief Information Officer Phil Dunn warned the School Board last week that a new cyber-attack could be devastating, affecting the district’s ability to pay employees or even keep schools open. He requested $20 million to enhance the district’s cyber-security efforts. The School Board plans to make a final decision in the coming weeks $20 million sounds like a lot to "improve cyber security", but I'm not involved in that industry. Can anyone with relevant experience share if that's a realistic budget?
- mywittyname 6y agoMr. Dunn's Brother-in-law is a foremost expert in the field of cybersecurity and his services don't come cheap. And why bother with a competitive bidding process when Mr. Dunn's BIL is peerless in his expertise? /s School boards are a special mix of corrupt and incompetent and it can be hard to tell which is the cause for any particular bad decision they make.
- mistrial9 6y agoI have seen this in action - it takes years to get it
- Veserv 6y agoThat is a pretty realistic budget if you are considering an entire school district. Broward County Public Schools has 327 schools with 271,517 students [1] and ~28,000 employees [2]. So, that is ~830 students/school and an ask for an extra ~$61k/school which is significantly less than one extra full time person per school. That is ~$73/student which is ~1% of the per-student expenditure of ~$7300/student [3]. However, cybersecurity spending is effectively worthless from an outcome perspective as even Fortune 500 companies allocating hundreds of millions of dollars per year to cybersecurity can not protect against attackers with ~$100k. Given that the hackers were demanding $40M, there is no commercial IT system in the world that would even claim to make such an attack unprofitable let alone actually be able to do so. The best systems are somewhere on the order of ~10% of that level, so we would need systems literally 10x better than the best currently available commercial IT systems for it to even be possible to get adequate cybersecurity against this attack. [1] https://en.wikipedia.org/wiki/Broward_County_Public_Schools https://en.wikipedia.org/wiki/Broward_County_Public_Schools [2] https://www.browardschools.com/cms/lib/FL01803656/Centricity/Domain/13447/FY21%20Budget%20Book%202nd%20Hearing%20V6%208-31-20_B.pdf https://www.browardschools.com/cms/lib/FL01803656/Centricity... Page 35 [3] https://www.browardschools.com/cms/lib/FL01803656/Centricity/Domain/13447/FY21%20Budget%20Book%202nd%20Hearing%20V6%208-31-20_B.pdf https://www.browardschools.com/cms/lib/FL01803656/Centricity... Page 36
- mike_d 6y agoThe transcript of the conversation with the hackers is great. They believe the district already holds millions in bitcoin and that children of a royal family(?) attend the school. https://www.documentcloud.org/documents/20535698-ransom-chat-full_redacted https://www.documentcloud.org/documents/20535698-ransom-chat...
- Uhhrrr 6y agoThat's wild. I wonder if they just always toss that in, in case they accidentally hook someone for whom that's true. A number of things they say indicate English isn't their first language: "We could wait you forever", "your revenue is more than 4 billions. So it is a possible amount for you."
- anonAndOn 6y agoWhat's the big reveal here? Did somebody get an extra set of whiteboard markers? From what I've seen, school districts have almost no discretionary cash and damn near every dollar is spoken for before it even gets spent. To wit, they're typically governed by collective bargaining agreements that have published pay scales. Nobody is getting a discretionary bonus... unless you count the $5 Starbucks gift card given at Xmas to the Principal's favorite teachers. If anybody finds out, they're screwed!
- rurban 5y agosun-sentinil is garbage, but their open colleagues reveil a bit more: https://www.wlrn.org/local-news/2021-04-21/fdle-arrests-broward-schools-superintendent-robert-runcie-on-perjury-charge https://www.wlrn.org/local-news/2021-04-21/fdle-arrests-brow... Eg the school principal is accused to be responsible for the 2018 parkland shooting, and several other financial misdeed related to safety measures after the shooting. And his base salary is 335.000. It's the 6th largest school district in the nation. It's annual budget is over 3 billion. "The charges involve a range of alleged crimes, from bribery and bid tampering to lying and leaking." The closest to any royal I could find is Marilyn Mansion as alumni. But they have many sports clubs with Royal in their name.