9 ms·

I'd rather not see taxpayers have to foot the bill for the profit of megacorps neglecting proper cybersecurity while sitting on mountains of tax-evaded offshore

by axlee 5y ago

I'd rather not see taxpayers have to foot the bill for the profit of megacorps neglecting proper cybersecurity while sitting on mountains of tax-evaded offshore cash, thank you. The industry should be magnitudes larger than it is currently, and we shouldn't encourage corporate recklessness by socializing the costs.

cpncrunch 5y ago
The ones sitting on that cash (MS, Apple, Google) arent at risk.
paxys 5y ago
In a lot of cases along with the "megacorps" there is also critical national infrastructure going down.
papito 5y ago
Sure, but they are up against state-sponsored, highly trained actors, and that's not a fair fight. This requires the resources of the US Government as their bodyguard.
- ddingus 5y ago
  Then it is also time to pay a lot more in taxes and keep less in the bank too Which is it?
  - papito 5y ago
    Well, obviously.
    - ddingus 5y ago
      Oh I think so too, but I really don't think that's obvious too many of the people impacted by all of this.
  - throwaway3699 5y ago
    Not really, the US military in particular has a lot of slack that could easily be funded into cyber stuff. I would bet there's plenty of (digital) offensive capability in the US so maybe it should be used?
    - ddingus 5y ago
      If it is about warfare, sure! Lots of money and resources are available. This discussion is more policing, which is out of scope.
meetups323 5y ago
If other States sent proper Armies over to attack critical infrastructure the US government would surely foot the bill to aid in security. Why should cyberarmies be treated more leaniently?
- Siira 5y ago
  Physical security is a public good, while computer security is a private good. (Websearch the definitions if you don’t know them already.) The economics just don’t match up.
- axlee 5y ago
  Because proper cybersecurity should be treated as a cost of business, unlike the use of force which is an exclusive prerogative of the state. If large companies want the state to step in to absorb some of their costs, they should stop trying to avoid contributing to said state at every step of the way. If said public involvement came at the cost of partial ownership of companies requiring it, with complete disclosure of their financials including offshore, I would not mind at all. I am simply extremely tired of corporations running to daddy at every inconvenience - sometimes of their own doing - while actively trying to crash the whole system into the ground by starving it. You can't have your cake and eat it too.
  - 3GuardLineups 5y ago
    public ownership of tech companies is the last thing we need. I'm with you on paying their taxes, but partial public ownership is a bridge too far
  - ineedasername 5y ago
    That assumes all cyber threats can be averted by private corporations. It's difficult for a company to play effective defense against nation-state levels of cyber attack R&D. Yes, companies need better security than they have now, but they cant do it without help.
    - axlee 5y ago
hatchnyc 5y ago
This is well within the scope of what the government should be doing--just as a country's navy protects merchant ships from pirates and the police protect shopkeepers from burglary. If a foreign military were launching physical attacks on your business we'd expect any government in the world to intervene. Realistically even with government support, effective cybersecurity is going to require significant private effort and investment as well.
- axlee 5y ago
  Should our society collectively pay for walls, doors and locks for every company in the country? How about paying for private security on every site? How about paying for personal bodyguards for every CEO? How about we all chip in to buy a password manager subscription for every private employee in the country? We should regulate and punish, not subsidize. The same way we have dealth with corporate recklessness for decades.
  - hatchnyc 5y ago
    I'm not sure what specifically is being proposed here. I gave some specific examples of government actions to protect its citizens engaging in commerce going back hundreds if not thousands of years. I'm not aware of any government which has paid for doors, locks, or walls for every company in their country, I suspect any action taken by the NSA would be guided by similar restraint. As the parent comment said, I'd like to see the NSA working to get zero day vulnerabilities fixed as opposed to hoarding them for future exploitation. At least this is my perception, to be honest aside from a few examples I've heard of I don't actually know whether I've correctly characterized their activities, they may already be doing this.
  - gary_0 5y ago
    > We should regulate and punish, not subsidize. I agree to a point, but to continue the physical-security analogy: while private businesses should not be negligent in securing their property, a patrolling police force should also exist to discourage theft and vandalism at large. I think the private and public sector have both been negligent when it comes to cybersecurity. Both need to improve. (Like you, I'm willing to bet the private sector is hoping to sit back and let the taxpayer foot the bill for everything. This is a problem too.)
pasabagi 5y ago
The costs are already socialized - it's our data that gets stolen in hacks. The problem is, the megacorps who lose it must only pay a negligible reputational penalty. If you could claim compensation for data lost, if businesses had to foot the bill for everybody who's security and privacy is impacted by data breaches, then it would quickly become something they would have to insure against, then the insurers would demand they take reasonable precautions. A system of fines would work well, for instance - an aggressive enforcement of the GDPR or similar, for instance, could create this kind of virtuous circle.
deleted 5y ago
[deleted]
JoshTko 5y ago
You can't expect a regional coal plan to be ready for a nation state backed attack.
mc32 5y ago
Not all corps are mega corps. Some might be mom and pop, your corner grocery, mechanics shop, tailor, dog groomer, etc.
DowsingSpoon 5y ago
Or, alternatively, the NSA could be tasked with constantly pen testing US companies' computer security. If they find a problem then they would mandate fixes and assess a hefty fine. The fine would be used to cover the NSA's costs and to pay a bounty to the individual who discovered the weakness.
mywacaday 5y ago
Corporations pay tax too, if I was an American shareholder of a company that went to the wall due to a 0 day vulnerability that was known by the NSA I would not be happy. Imagine if you found out that the NSA knew about COVID but didn't develop or release a vaccine because they wanted to use it themselves, why is it really and different if corporations are people too?
- Ronson 5y ago
  Modern Corporations don't pay reasonable tax though. For NSA to know about covid, and for that vaccine to be developed requires that there are thousands of people educated, mainly from public schools to which they aren't paying anything towards nurturing by avoiding tax in the first place.
fbelzile 5y ago
Police forces are paid for with taxes and respond to private businesses. What if publicly funded cybersecurity ends up costing everyone less money over the long term? Tax laws are a different issue, even though I agree some megacorps aren't paying their fair share of "private security" right now.

by axlee 5y ago

cpncrunch 5y ago

The ones sitting on that cash (MS, Apple, Google) arent at risk.

paxys 5y ago

In a lot of cases along with the "megacorps" there is also critical national infrastructure going down.

papito 5y ago

Sure, but they are up against state-sponsored, highly trained actors, and that's not a fair fight. This requires the resources of the US Government as their bodyguard.

ddingus 5y ago
Then it is also time to pay a lot more in taxes and keep less in the bank too Which is it?
- papito 5y ago
  Well, obviously.
  - ddingus 5y ago
    Oh I think so too, but I really don't think that's obvious too many of the people impacted by all of this.
- throwaway3699 5y ago
  Not really, the US military in particular has a lot of slack that could easily be funded into cyber stuff. I would bet there's plenty of (digital) offensive capability in the US so maybe it should be used?
  - ddingus 5y ago
    If it is about warfare, sure! Lots of money and resources are available. This discussion is more policing, which is out of scope.

meetups323 5y ago

If other States sent proper Armies over to attack critical infrastructure the US government would surely foot the bill to aid in security. Why should cyberarmies be treated more leaniently?

Siira 5y ago
Physical security is a public good, while computer security is a private good. (Websearch the definitions if you don’t know them already.) The economics just don’t match up.
axlee 5y ago
Because proper cybersecurity should be treated as a cost of business, unlike the use of force which is an exclusive prerogative of the state. If large companies want the state to step in to absorb some of their costs, they should stop trying to avoid contributing to said state at every step of the way. If said public involvement came at the cost of partial ownership of companies requiring it, with complete disclosure of their financials including offshore, I would not mind at all. I am simply extremely tired of corporations running to daddy at every inconvenience - sometimes of their own doing - while actively trying to crash the whole system into the ground by starving it. You can't have your cake and eat it too.
- 3GuardLineups 5y ago
  public ownership of tech companies is the last thing we need. I'm with you on paying their taxes, but partial public ownership is a bridge too far
- ineedasername 5y ago
  That assumes all cyber threats can be averted by private corporations. It's difficult for a company to play effective defense against nation-state levels of cyber attack R&D. Yes, companies need better security than they have now, but they cant do it without help.
  - axlee 5y ago

hatchnyc 5y ago

This is well within the scope of what the government should be doing--just as a country's navy protects merchant ships from pirates and the police protect shopkeepers from burglary. If a foreign military were launching physical attacks on your business we'd expect any government in the world to intervene. Realistically even with government support, effective cybersecurity is going to require significant private effort and investment as well.

axlee 5y ago
Should our society collectively pay for walls, doors and locks for every company in the country? How about paying for private security on every site? How about paying for personal bodyguards for every CEO? How about we all chip in to buy a password manager subscription for every private employee in the country? We should regulate and punish, not subsidize. The same way we have dealth with corporate recklessness for decades.
- hatchnyc 5y ago
  I'm not sure what specifically is being proposed here. I gave some specific examples of government actions to protect its citizens engaging in commerce going back hundreds if not thousands of years. I'm not aware of any government which has paid for doors, locks, or walls for every company in their country, I suspect any action taken by the NSA would be guided by similar restraint. As the parent comment said, I'd like to see the NSA working to get zero day vulnerabilities fixed as opposed to hoarding them for future exploitation. At least this is my perception, to be honest aside from a few examples I've heard of I don't actually know whether I've correctly characterized their activities, they may already be doing this.
- gary_0 5y ago
  > We should regulate and punish, not subsidize. I agree to a point, but to continue the physical-security analogy: while private businesses should not be negligent in securing their property, a patrolling police force should also exist to discourage theft and vandalism at large. I think the private and public sector have both been negligent when it comes to cybersecurity. Both need to improve. (Like you, I'm willing to bet the private sector is hoping to sit back and let the taxpayer foot the bill for everything. This is a problem too.)

pasabagi 5y ago

The costs are already socialized - it's our data that gets stolen in hacks. The problem is, the megacorps who lose it must only pay a negligible reputational penalty. If you could claim compensation for data lost, if businesses had to foot the bill for everybody who's security and privacy is impacted by data breaches, then it would quickly become something they would have to insure against, then the insurers would demand they take reasonable precautions. A system of fines would work well, for instance - an aggressive enforcement of the GDPR or similar, for instance, could create this kind of virtuous circle.

deleted 5y ago

[deleted]

JoshTko 5y ago

You can't expect a regional coal plan to be ready for a nation state backed attack.

mc32 5y ago

Not all corps are mega corps. Some might be mom and pop, your corner grocery, mechanics shop, tailor, dog groomer, etc.

DowsingSpoon 5y ago

Or, alternatively, the NSA could be tasked with constantly pen testing US companies' computer security. If they find a problem then they would mandate fixes and assess a hefty fine. The fine would be used to cover the NSA's costs and to pay a bounty to the individual who discovered the weakness.

mywacaday 5y ago

Corporations pay tax too, if I was an American shareholder of a company that went to the wall due to a 0 day vulnerability that was known by the NSA I would not be happy. Imagine if you found out that the NSA knew about COVID but didn't develop or release a vaccine because they wanted to use it themselves, why is it really and different if corporations are people too?

Ronson 5y ago
Modern Corporations don't pay reasonable tax though. For NSA to know about covid, and for that vaccine to be developed requires that there are thousands of people educated, mainly from public schools to which they aren't paying anything towards nurturing by avoiding tax in the first place.

fbelzile 5y ago

Police forces are paid for with taxes and respond to private businesses. What if publicly funded cybersecurity ends up costing everyone less money over the long term? Tax laws are a different issue, even though I agree some megacorps aren't paying their fair share of "private security" right now.