5 ms·

Is there a coherent argument for not making collectors of data (in this case, the Broward school district, but it could be Facebook, Equifax, whatever) liable f

by fouric 6y ago

Is there a coherent argument for not making collectors of data (in this case, the Broward school district, but it could be Facebook, Equifax, whatever) liable for damage incurred due to data in their possession being stolen?

thaumasiotes 6y ago
No way to measure the damages.
- alasdair_ 6y ago
  Statutory minimums would be possible. That being said, we’d need to also make it illegal (with a bigger fine) to not inform customers of the breach, and to provide reduced damages for companies that promptly inform users. Otherwise the “correct” approach for a company would be to ignore every hacking attempt and never investigate.
  - thaumasiotes 6y ago
    > Statutory minimums would be possible. Sure, but fining someone for leaking data is a very different thing than making them liable for damages, even if you call the fine "statutory damages".
  - throwaway823882 6y ago
    Who would get sued though? The school? So we'd be suing ourselves?
    - analog31 6y ago
      In a sense, we'd be suing ourselves over this incident, but at the same time the precedent would serve to discipline other school districts into erasing personal information stored in computer readable form before it can be stolen.
      - cortesoft 6y ago
        What does it mean to “discipline” a school district? Why would suing a school district incentivize them to change their behavior? They don’t personally have to pay the fine, the they would have to do the work for securing/deleting the data.
        analog31 6y ago
        The threat of being penalized through the tort system encourages public awareness and incentivizes districts to do the right thing. That's what I mean by discipline.
        bogwog 6y ago
        Are you kidding? A lawsuit is going to hit them where it hurts most: the budget. People will lose their jobs over it, so there is very strong incentive for the decision makers not to end up in that situation again.
        fn-mote 6y ago
        At least in some cases, when a school district breaks federal law and loses a lawsuit, the outcome is a consent decree with $__MM to be allocated for education about the law and rights. Police misconduct gives rise to lawsuits. I'm sure one of the hopes of the plantiffs is that they change the system. So, there is some precedent for lawsuits against public bodies in an attempt to change their behavior. I am somewhat skeptical about their utility in affecting institutional change, but there is definitely research on the subject and not just HN comments.
        alasdair_ 6y ago
        > What does it mean to “discipline” a school district? Fire the people responsible and make them unable to work for a district for five years.
  - thereddaikon 6y ago
    Fines for these kinds of things don't work. They just get factored in as overhead. Penalties should effect people not budgets. Nobody would be lax with security if administrators went to jail every time there was a data incident on their watch.
    - fennecfoxen 6y ago
      Great way to promote outsourcing to another jurisdiction.
    - zizee 6y ago
      Just imagine the quality of the candidates you'd have applying to admin jobs if they risked going to jail everytii there was a data incident. It's hard to imagine anyone with half a brain working under such conditions. It's also hard to imagine that putting such a measure in place would not result in data and systems being so locked down that they become unusable to most staff.
    - alasdair_ 6y ago
      I’m a pretty decent programmer and I like to think that I know a lot more about computer security than most developers. I know for certain that if a well funded nation state went after data on a system I built, they would likely get it, no matter how hard I tried to prevent it. There needs to be real audits, with teeth, of computer security stuff - audits run in an adversarial way without the issues involves in financial audits. If you pass the audit, the fines should be minimal in the event of a breach.
jacobsenscott 6y ago
I don't think so. If the school is forced to store their records outside in a cardboard box should they be liable when it is stolen? Because that's what we are essentially doing by under funding, under training, and not even providing secure software to begin with.
mike_d 6y ago
This was a public school district. You'd have to tax every resident of the county $20 to give them back $8 by the time the lawyers get it all sorted out.
jasonfarnon 6y ago
Of course there is an argument but it doesn't square with torts law in most states, at present. The main reason is that it is too hard to establish whatever harm you claim occurred is proximately caused by the breach. A more practical reason is that the harm provably caused is typically of minimal value, and the harm is of such a varied nature, that class actions never get certified for breaches, with a few exceptions like Equifax. Individual cases can of course proceed, but it's rare for the harm to be great enough to make legal fees worthwhile.

by fouric 6y ago

thaumasiotes 6y ago

No way to measure the damages.

alasdair_ 6y ago
Statutory minimums would be possible. That being said, we’d need to also make it illegal (with a bigger fine) to not inform customers of the breach, and to provide reduced damages for companies that promptly inform users. Otherwise the “correct” approach for a company would be to ignore every hacking attempt and never investigate.
- thaumasiotes 6y ago
  > Statutory minimums would be possible. Sure, but fining someone for leaking data is a very different thing than making them liable for damages, even if you call the fine "statutory damages".
- throwaway823882 6y ago
  Who would get sued though? The school? So we'd be suing ourselves?
  - analog31 6y ago
    In a sense, we'd be suing ourselves over this incident, but at the same time the precedent would serve to discipline other school districts into erasing personal information stored in computer readable form before it can be stolen.
    - cortesoft 6y ago
      What does it mean to “discipline” a school district? Why would suing a school district incentivize them to change their behavior? They don’t personally have to pay the fine, the they would have to do the work for securing/deleting the data.
      - analog31 6y ago
        The threat of being penalized through the tort system encourages public awareness and incentivizes districts to do the right thing. That's what I mean by discipline.
      - bogwog 6y ago
        Are you kidding? A lawsuit is going to hit them where it hurts most: the budget. People will lose their jobs over it, so there is very strong incentive for the decision makers not to end up in that situation again.
      - fn-mote 6y ago
        At least in some cases, when a school district breaks federal law and loses a lawsuit, the outcome is a consent decree with $__MM to be allocated for education about the law and rights. Police misconduct gives rise to lawsuits. I'm sure one of the hopes of the plantiffs is that they change the system. So, there is some precedent for lawsuits against public bodies in an attempt to change their behavior. I am somewhat skeptical about their utility in affecting institutional change, but there is definitely research on the subject and not just HN comments.
      - alasdair_ 6y ago
        > What does it mean to “discipline” a school district? Fire the people responsible and make them unable to work for a district for five years.
- thereddaikon 6y ago
  Fines for these kinds of things don't work. They just get factored in as overhead. Penalties should effect people not budgets. Nobody would be lax with security if administrators went to jail every time there was a data incident on their watch.
  - fennecfoxen 6y ago
    Great way to promote outsourcing to another jurisdiction.
  - zizee 6y ago
    Just imagine the quality of the candidates you'd have applying to admin jobs if they risked going to jail everytii there was a data incident. It's hard to imagine anyone with half a brain working under such conditions. It's also hard to imagine that putting such a measure in place would not result in data and systems being so locked down that they become unusable to most staff.
  - alasdair_ 6y ago
    I’m a pretty decent programmer and I like to think that I know a lot more about computer security than most developers. I know for certain that if a well funded nation state went after data on a system I built, they would likely get it, no matter how hard I tried to prevent it. There needs to be real audits, with teeth, of computer security stuff - audits run in an adversarial way without the issues involves in financial audits. If you pass the audit, the fines should be minimal in the event of a breach.

jacobsenscott 6y ago

I don't think so. If the school is forced to store their records outside in a cardboard box should they be liable when it is stolen? Because that's what we are essentially doing by under funding, under training, and not even providing secure software to begin with.

mike_d 6y ago

This was a public school district. You'd have to tax every resident of the county $20 to give them back $8 by the time the lawyers get it all sorted out.

jasonfarnon 6y ago

Of course there is an argument but it doesn't square with torts law in most states, at present. The main reason is that it is too hard to establish whatever harm you claim occurred is proximately caused by the breach. A more practical reason is that the harm provably caused is typically of minimal value, and the harm is of such a varied nature, that class actions never get certified for breaches, with a few exceptions like Equifax. Individual cases can of course proceed, but it's rare for the harm to be great enough to make legal fees worthwhile.