5 ms·

They paid $5 million, if "it was cheaper for them," that's solid math that ignores some really important stuff though, LOL. What is the externalized cost of thi

by yebyen 5y ago

They paid $5 million, if "it was cheaper for them," that's solid math that ignores some really important stuff though, LOL. What is the externalized cost of this crisis on the entire country? The $5 million dollar ransom is a worse deal if you can convince your board to consider that externality. The criminal penalties for executives in leadership and board positions (and I'm not saying this is my preferred approach) would certainly go a long way toward changing the calculus of this exchange.

pixl97 5y ago
Which is also why they need a $15-50 million dollar fine on top this
- Jeff_Brown 5y ago
  I'm curious about the potential legal basis for such a fine.
  - dred_prte_rbrts 5y ago
    SOX. SOX mandates that you have reasonable controls to secure financial information and it appears they didn't. Every SOX audit I've been through has a IT security portion.
35fbe7d3d5b9 5y ago
> What is the externalized cost of this crisis on the entire country? If a business externalizes the cost, does it matter to them? Civil penalties levied by regulators will drive the change that matters.
- yebyen 5y ago
  > If a business externalizes the cost, does it matter to them? I mean, yes? Maybe not before next quarter's revenue statement, but eventually it will have to start to matter? If your dog goes and craps in the yard every day, you eventually have to clean it up or you will get flies in the yard, and if you have to open the door or leave the house at all then sooner or later you will have flies in the house, it matters, yes. It's really not any more complicated than that. If you are responsible for dumping toxic waste out the back door of your factory, it's only a matter of time before it's in your drinking water at your house, a couple of miles down the road. Externalizing a problem doesn't really get rid of it, just makes it someone else's problem (for now at least.) Those other people are real people, and they will find you.
  - Jeff_Brown 5y ago
    But if you're a monopoly (a competing pipeline isn't likely to spring into existence any time soon) and the courts aren't inclined to impose particularly harsh penalties, business as usual will remain your optimal moneymaking strategy.
Jeff_Brown 5y ago
> What is the externalized cost of this crisis on the entire country? One natural solution would be to subsidize cyberdefense. The political difficulty is that a rational subsidy would be proportional to the harm of an attack, which would mean giving the most money to the biggest corporations. The best solution would be for the firm to raise their prices the very small amount necessary to cover the expense, and for consumers to tolerate the expense because they know it's worth it. But a pipeline is a natural monopoly, presumably charging a monopoly-optimal price that (correctly) assumes a populace ignorant of such concerns until it's too late.

by yebyen 5y ago

pixl97 5y ago

Which is also why they need a $15-50 million dollar fine on top this

Jeff_Brown 5y ago
I'm curious about the potential legal basis for such a fine.
- dred_prte_rbrts 5y ago
  SOX. SOX mandates that you have reasonable controls to secure financial information and it appears they didn't. Every SOX audit I've been through has a IT security portion.

35fbe7d3d5b9 5y ago

> What is the externalized cost of this crisis on the entire country? If a business externalizes the cost, does it matter to them? Civil penalties levied by regulators will drive the change that matters.

yebyen 5y ago
> If a business externalizes the cost, does it matter to them? I mean, yes? Maybe not before next quarter's revenue statement, but eventually it will have to start to matter? If your dog goes and craps in the yard every day, you eventually have to clean it up or you will get flies in the yard, and if you have to open the door or leave the house at all then sooner or later you will have flies in the house, it matters, yes. It's really not any more complicated than that. If you are responsible for dumping toxic waste out the back door of your factory, it's only a matter of time before it's in your drinking water at your house, a couple of miles down the road. Externalizing a problem doesn't really get rid of it, just makes it someone else's problem (for now at least.) Those other people are real people, and they will find you.
- Jeff_Brown 5y ago
  But if you're a monopoly (a competing pipeline isn't likely to spring into existence any time soon) and the courts aren't inclined to impose particularly harsh penalties, business as usual will remain your optimal moneymaking strategy.

Jeff_Brown 5y ago

> What is the externalized cost of this crisis on the entire country? One natural solution would be to subsidize cyberdefense. The political difficulty is that a rational subsidy would be proportional to the harm of an attack, which would mean giving the most money to the biggest corporations. The best solution would be for the firm to raise their prices the very small amount necessary to cover the expense, and for consumers to tolerate the expense because they know it's worth it. But a pipeline is a natural monopoly, presumably charging a monopoly-optimal price that (correctly) assumes a populace ignorant of such concerns until it's too late.