4 ms·

My favorite part of this system is when they give you a year of it as compensation for a data breach, saying it’s worth 12x its monthly fee (which they make up)

My favorite part of this system is when they give you a year of it as compensation for a data breach, saying it’s worth 12x its monthly fee (which they make up). That’s not even touching on the fact that their solution to losing your data is asking you for more of it. I’ve never been lucky enough to be compensated with such a service. But it wouldn’t surprise me if they were so helpful that they even auto-enroll you in another (paid) year at the end of your free trial! One also wonders why reforming the credit bureaus is not a bipartisan priority in Washington. Congress is apparently only interested in fighting over the issues that nobody can agree on. Don’t hold your breath for any progress fixing systems that anyone except a lobbyist can clearly point to as broken. The problems might get some attention if the corporate media chose to hype them, but guess who buys a bunch of advertisements on their news channels?

martinflack 6y ago
> One also wonders why reforming the credit bureaus is not a bipartisan concern in Washington. And one solution might be to simply create a statutory strict liability of $1000 per consumer per breach. The (possiblity of) class action lawsuits would do the rest to encourage correct behavior. (It might encourage cover-ups as well, but you could penalize that, and incentivize and protect whistleblowing and well-intentioned security research.)
- TechBro8615 6y ago
  I can’t wait to get 10 free years of credit monitoring!
hcurtiss 6y ago
I recently negotiated two service contracts, one for a company that helps administer employment verification (e.g., if an employee applies for a loan), and another with a company that handles COBRA documentation post-termination. Both of these require the service providers hold some confidential information concerning our employees. Both contracts explicitly provided (i) they will not indemnify me for state/federal penalties if they fail to do their job, and (ii) the only remedies they would provide following their data breach is one year of credit monitoring. I told them that was crazy, and if there's a breach they need to indemnify me for all losses and liability, full stop. Both companies refused so I had our broker approach different companies. Those companies proposed contracts with the same terms and also refused to change them. As the employer here merely contracting with service providers, I can't even find contractors who will take this liability on. I would 100% support legislation that would impose on these bastards penalties for the losses associated with their data breaches or failure to provide the services they say they are going to provide. I am also comfortable with the fact that may cost more, but at least then the costs will be internalized by the proper actor. And those who can efficiently provide secure services to me will get my business.
- throwaway2037 6y ago
  What a great story. Thank you to share you experience. I wonder if (i) is not enforceable. That said, it is the legal equivalent of David and Goliath to win that case. Even if the clause is legally enforceable, could you win a civil suit on the grounds of negligence (poor service)? Again, maybe, but probably very expensive to discover! I agree: These kinds of clauses should not be allowed. I cannot imagine this same thing happens in EU with GPDR.
  - zonethundery 6y ago
    (i) is enforceable. You could have a negligence claim, but customer (if a regulated entity) is generally required (on a principles basis, not necessarily prescriptive) to do their own due diligence on the adequacy of the vendor's security practices. The shift away from assigning liability to vendors was part of Dodd-Frank, and NYDFS has taken a similar tack with its cybersecurity rules.
- AnthonyMouse 6y ago
  > I am also comfortable with the fact that may cost more, but at least then the costs will be internalized by the proper actor. The problem with these situations is that liability would induce bankruptcy by a factor of a thousand. If one of these companies screws up, likely they did so for each of their customers, who each have their own customers. Plausibly millions of people, for vendors that aren't exactly Google-sized. So for any non-trivial damages they're out of business and you get three cents on the dollar of your indemnity because so did everybody else. Which is all but worthless. It doesn't even give them much incentive to not screw up, because they're only paying 3% of the damages before they file bankruptcy and start over, which itself only happens if they're unlucky. Plenty of companies would be willing to take those odds and they'll still be the ones with the lowest price. The only way for them to cover the full amount is to buy insurance, but then you have the liability on the wrong party again and they lose the entire incentive to avoid screwing up. We might like to believe that insurance companies have some magic to reduce claims, but mostly they don't and they just spread the cost of the liability across all their customers. So really all you're asking for is a law that forces you to pay extra in order to buy insurance. But can't you already buy insurance from an ordinary liability insurance company instead of the vendor?
rendall 6y ago
> One also wonders why reforming the credit bureaus is not a bipartisan priority in Washington. It struck me how reflexively cynical I have become, that reading this question surprised me. I hope my answer doesn't come off as snarky, but sincerely, there's a lot of good information here: https://duckduckgo.com/?q=credit+bureau+lobbyists&ia=web https://duckduckgo.com/?q=credit+bureau+lobbyists&ia=web
cortesoft 6y ago
> One also wonders why reforming the credit bureaus is not a bipartisan priority in Washington. This is a classic “concentrated benefits, disperse costs” problem that is really hard to solve in society. The three credit bureaus have a huge incentive to maintain the status quo, while millions of people have a small incentive to change it. The three credit bureaus are going to fight a lot harder to maintain the system than everyone else will fight to reform it. It is the same thing you see with our tax system. For individuals, it just isn’t worth it to try to change the system. The effort would cost more than the gain, but the overall cost to society is great.

martinflack 6y ago

> One also wonders why reforming the credit bureaus is not a bipartisan concern in Washington. And one solution might be to simply create a statutory strict liability of $1000 per consumer per breach. The (possiblity of) class action lawsuits would do the rest to encourage correct behavior. (It might encourage cover-ups as well, but you could penalize that, and incentivize and protect whistleblowing and well-intentioned security research.)

TechBro8615 6y ago
I can’t wait to get 10 free years of credit monitoring!

hcurtiss 6y ago

I recently negotiated two service contracts, one for a company that helps administer employment verification (e.g., if an employee applies for a loan), and another with a company that handles COBRA documentation post-termination. Both of these require the service providers hold some confidential information concerning our employees. Both contracts explicitly provided (i) they will not indemnify me for state/federal penalties if they fail to do their job, and (ii) the only remedies they would provide following their data breach is one year of credit monitoring. I told them that was crazy, and if there's a breach they need to indemnify me for all losses and liability, full stop. Both companies refused so I had our broker approach different companies. Those companies proposed contracts with the same terms and also refused to change them. As the employer here merely contracting with service providers, I can't even find contractors who will take this liability on. I would 100% support legislation that would impose on these bastards penalties for the losses associated with their data breaches or failure to provide the services they say they are going to provide. I am also comfortable with the fact that may cost more, but at least then the costs will be internalized by the proper actor. And those who can efficiently provide secure services to me will get my business.

throwaway2037 6y ago
What a great story. Thank you to share you experience. I wonder if (i) is not enforceable. That said, it is the legal equivalent of David and Goliath to win that case. Even if the clause is legally enforceable, could you win a civil suit on the grounds of negligence (poor service)? Again, maybe, but probably very expensive to discover! I agree: These kinds of clauses should not be allowed. I cannot imagine this same thing happens in EU with GPDR.
- zonethundery 6y ago
  (i) is enforceable. You could have a negligence claim, but customer (if a regulated entity) is generally required (on a principles basis, not necessarily prescriptive) to do their own due diligence on the adequacy of the vendor's security practices. The shift away from assigning liability to vendors was part of Dodd-Frank, and NYDFS has taken a similar tack with its cybersecurity rules.
AnthonyMouse 6y ago
> I am also comfortable with the fact that may cost more, but at least then the costs will be internalized by the proper actor. The problem with these situations is that liability would induce bankruptcy by a factor of a thousand. If one of these companies screws up, likely they did so for each of their customers, who each have their own customers. Plausibly millions of people, for vendors that aren't exactly Google-sized. So for any non-trivial damages they're out of business and you get three cents on the dollar of your indemnity because so did everybody else. Which is all but worthless. It doesn't even give them much incentive to not screw up, because they're only paying 3% of the damages before they file bankruptcy and start over, which itself only happens if they're unlucky. Plenty of companies would be willing to take those odds and they'll still be the ones with the lowest price. The only way for them to cover the full amount is to buy insurance, but then you have the liability on the wrong party again and they lose the entire incentive to avoid screwing up. We might like to believe that insurance companies have some magic to reduce claims, but mostly they don't and they just spread the cost of the liability across all their customers. So really all you're asking for is a law that forces you to pay extra in order to buy insurance. But can't you already buy insurance from an ordinary liability insurance company instead of the vendor?

rendall 6y ago

> One also wonders why reforming the credit bureaus is not a bipartisan priority in Washington. It struck me how reflexively cynical I have become, that reading this question surprised me. I hope my answer doesn't come off as snarky, but sincerely, there's a lot of good information here: https://duckduckgo.com/?q=credit+bureau+lobbyists&ia=web https://duckduckgo.com/?q=credit+bureau+lobbyists&ia=web

cortesoft 6y ago

> One also wonders why reforming the credit bureaus is not a bipartisan priority in Washington. This is a classic “concentrated benefits, disperse costs” problem that is really hard to solve in society. The three credit bureaus have a huge incentive to maintain the status quo, while millions of people have a small incentive to change it. The three credit bureaus are going to fight a lot harder to maintain the system than everyone else will fight to reform it. It is the same thing you see with our tax system. For individuals, it just isn’t worth it to try to change the system. The effort would cost more than the gain, but the overall cost to society is great.