6 ms·

This should result in the corporate death penalty but won't so will keep happening. If you zeroed out all of the investors this type of mass compromise would im

This should result in the corporate death penalty but won't so will keep happening. If you zeroed out all of the investors this type of mass compromise would immediately cease. As long as -- cost of compromise < cost of security -- on and on this will go.

mdoms 5y ago
> If you zeroed out all of the investors this type of mass compromise would immediately cease. It absolutely would not. Yes we would see greater investment in cyber security and it would pay dividends, but the idea that we can totally eliminate data breaches if we just try really super hard is unrealistic.
- Teever 5y ago
  This is absurd. There is a simple way to eliminate data breaches -- Don't keep data. Humans have been conducting businesses for thousands of years without the need to hoard large quantities of personal data. If there was sufficient regulatory force to induce companies to make the choice between not hoarding data or not existing then I'm sure that business would carry on as it has for millennia.
  - warkdarrior 5y ago
    Businesses have not reached economies of scale until recently, and economies of scale are supported by data.
yzmtf2008 5y ago
This doesn't make any sense. Capital punishment has existed since forever - yet the fact that they are still carried out means that they are not stopping all of the crimes punishable by death.
- dstick 5y ago
  It does make sense. You're confusing corporate liability with personal liability. The parent's point is that if the investors / shareholders would be responsible. Stuff like this would be severely reduced because resources would be allocated to prevent it. Right now, the only damage is a financial one. And as long as the damage is lower than the cost of prevention, hacks like this will continue to happen.
  - ghayes 5y ago
    So isn't the solution here to up the penalties, specifically with codified minimums ($X per leaked phone number, $Y for leaked SSN, etc)? The corporate death penalty would end up hurting the consumers significantly more than this method, which would primarily hurt the share/debt-holders, which is the intent. Corporate dissolution seems like a concern when fraud or malfeasance is specifically involved. For context, I'm very likely in this breach, but it wouldn't make me any happier to hear T-Mobile was shut-down tomorrow.
    - gibba999 5y ago
      Yes, the solution are astronomical penalties. And a corporate dissolution isn't the outcome. The outcome is that T-Mobile goes into bankruptcy, with its customers as the debtors. The outcome of that is that a bankruptcy court divides up the assets to maximize payout to you. Most likely, this means: - T-Mobile, as an entity continues to exist, as-is.. - Shareholder value is wiped out... - And handed to customers, as the customers become shareholders. T-Mobile has a 180B market cap, which probably means you acquire stock worth a grand or so.
    - dstick 5y ago
      No that wasn’t the point at all. Corporate death penalty was a completely overblown analogy by someone else. What this is about is that a manager / CEO / shareholder can be held personally accountable with punishment that could include jail time. As a deterrent. Right now only the company is accountable as if it’s some sort of living creature, and the penalty is always money. Which as you aptly put, they have in abundance!
- Zelphyr 5y ago
  A lot of people fear losing their money more than they fear death. I think corporate capital punishment, in theory, could work. The other side of that coin, however, is the number of people put out of work if that were to happen. Either way, there needs to be far stiffer penalties levied against companies who don't secure their systems better and lose sensitive customer data.
- weimerica 5y ago
  If punishment for murder was sitting in a luxury European prison with a vintage PS3[0] and not death or life, I’d have whacked my former con-artist business partner years ago and likely be out by now. Let’s not pretend there isn’t a deterrent. [0] - https://www.google.com/amp/s/www.businessinsider.com/breivik-suing-norway-over-his-luxurious-prison-conditions-2016-3%3famp https://www.google.com/amp/s/www.businessinsider.com/breivik...
cortesoft 5y ago
If any compromise wipes out a company automatically, you suddenly increase the incentive to hack a company by a huge amount. That doesn't seem like a good way to increase security.
- gruez 5y ago
  1. short company 2. hire cyber-mercenaries to hack company 3. ??? 4. profit
chrisbolt 5y ago
Just because the problem is that cost of compromise < cost of security, the solution is not to raise the cost of compromise to infinity. That’s treating it in a very black and white, binary way. It also increases the incentive to spend more on covering up any compromise.
deleted 5y ago
[deleted]
gruez 5y ago
I agree with the principle of raising the cost of compromise, but disagree with your proposal of raising it to infinity (which is effectively what happens when you wipe out the shareholders). Getting hacked sucks, but surely consumers aren't experiencing infinite losses when that happens?
- dave5104 5y ago
  Feels like a better idea might be legally forcing some top X levels of management out as a form of corporate death, invalidating any golden parachutes on the way out too.
- pama 5y ago
  I’m this case, if the breach data is true, customers need to buy new phones, get new SSN, (and possibly change name) to have any sense of safety in the future. I wouldn’t use a compromised IMEI phone for 2FA anymore but most people would and it is not clear if the potential losses from the selling of this information have any real limit.
  - gruez 5y ago
    >customers need to buy new phones >and possibly change name >I wouldn’t use a compromised IMEI phone for 2FA Why? >get new SSN That might be prudent to do, but at worse it's a few hours of hassle. I searched around and it looks like all you have to do is fill in a form (https://www.ssa.gov/forms/ss-5.pdf https://www.ssa.gov/forms/ss-5.pdf) and supply the required documents. At US median wages it's a few hundred dollars, max. >the potential losses from the selling of this information have any real limit. Well not really? Suppose someone crashed into your house, making a hole in the wall that allows thieves to steal potentially unlimited amounts of goods from your house. Should the driver be liable for all thefts from your house in perpetuity? Or only between the time of the crash and when you can reasonably get the wall fixed (or in the case of identity theft, changed your SSN)?
    - meowster 5y ago
      That form does not indicate that it's used to change a SSN. Even if you do get a new SSN I wonder what the process is for changing it with the credit bureaus.
deleted 5y ago
[deleted]
bpodgursky 5y ago
Executing one of the few large US mobile providers will do nothing except raise prices by eliminating even the marginal remaining competition.
- missedthecue 5y ago
  Want a monopoly? Hire the best hackers to destroy all your competition.
notJim 5y ago
I'm curious for folks who like solutions like this, have you ever had a vulnerability in production? I would be shocked if most software engineers haven't had at least one outdated package, or one line of poorly-escaped javascript or similar at some point. It seems like luck (and maybe being a poor target) that these things are usually found before they are exploited. Should the companies we all work for cease to exist? I agree broadly with regulations designed to raise the cost of security flaws and so on, but I feel like there's this expectation that if we make the punishment extreme enough, people will begin writing perfect software and operating perfect servers, and I just don't buy it. It seems sort of like saying if someone causes a production issue or accidentally leaks a database, they should be summarily fired. More likely it was a mistake, and we should understand why it happened so we can prevent it in the future.
- amelius 5y ago
  Being a large company, they should at least demonstrate that they took appropriate measures. E.g. show the reports written by the pen-testers they hired.
  - amelius 5y ago
    I'm being downvoted without argumentation, but how will security ever be taken seriously if these measures don't become the norm?
- koolba 5y ago
  If you’re billion dollar company’s application architecture is such that any one compromised system leaks the entirety of your customer data then you’re definitely doing it wrong. It’s not just a matter of one compromised package being able to wreak havoc, it’s the scale and blast radius of the havoc.
  - oyashirochama 5y ago
    Also lack of isolation of critical systems, the biggest fault honestly. Basically isolate all PII and other systems from each other.
refurb 5y ago
Couple that with making engineers liable for what they build. Just like we do with physical engineering - build something that knowingly harms people? Get sued.
- nogbit 5y ago
  Knowingly is the key word here. The physical world is much easier to know and account for in engineering. Not so much for digital which is why security is a system of defense in depth via layers and nothing ever is 100% secure.
vmception 5y ago
On the contrary, I think the settlements should result in shares transferred and board seats added Instead of just cash Then management gets replaced
YeBanKo 5y ago
It depends on the level of incompetence or negligence. There is a difference between premeditated murder and negligent homicide. But there must be a framework, that determines the punishment based on the impact and level of negligence. > The trove includes not only names, phone numbers, and physical addresses but also more sensitive data like social security numbers, driver's license information, and IMEI numbers, unique identifiers tied to each mobile device. Now, this seems like a lot. I hope we will see a detailed technical analysis of the break eventually.
stjohnswarts 5y ago
There is a million ways to keep critical data away from public (mostly) data like Name and Address. Seems like they weren't even doing the most basic separation of concerns here.

mdoms 5y ago

> If you zeroed out all of the investors this type of mass compromise would immediately cease. It absolutely would not. Yes we would see greater investment in cyber security and it would pay dividends, but the idea that we can totally eliminate data breaches if we just try really super hard is unrealistic.

Teever 5y ago
This is absurd. There is a simple way to eliminate data breaches -- Don't keep data. Humans have been conducting businesses for thousands of years without the need to hoard large quantities of personal data. If there was sufficient regulatory force to induce companies to make the choice between not hoarding data or not existing then I'm sure that business would carry on as it has for millennia.
- warkdarrior 5y ago
  Businesses have not reached economies of scale until recently, and economies of scale are supported by data.

yzmtf2008 5y ago

This doesn't make any sense. Capital punishment has existed since forever - yet the fact that they are still carried out means that they are not stopping all of the crimes punishable by death.

dstick 5y ago
It does make sense. You're confusing corporate liability with personal liability. The parent's point is that if the investors / shareholders would be responsible. Stuff like this would be severely reduced because resources would be allocated to prevent it. Right now, the only damage is a financial one. And as long as the damage is lower than the cost of prevention, hacks like this will continue to happen.
- ghayes 5y ago
  So isn't the solution here to up the penalties, specifically with codified minimums ($X per leaked phone number, $Y for leaked SSN, etc)? The corporate death penalty would end up hurting the consumers significantly more than this method, which would primarily hurt the share/debt-holders, which is the intent. Corporate dissolution seems like a concern when fraud or malfeasance is specifically involved. For context, I'm very likely in this breach, but it wouldn't make me any happier to hear T-Mobile was shut-down tomorrow.
  - gibba999 5y ago
    Yes, the solution are astronomical penalties. And a corporate dissolution isn't the outcome. The outcome is that T-Mobile goes into bankruptcy, with its customers as the debtors. The outcome of that is that a bankruptcy court divides up the assets to maximize payout to you. Most likely, this means: - T-Mobile, as an entity continues to exist, as-is.. - Shareholder value is wiped out... - And handed to customers, as the customers become shareholders. T-Mobile has a 180B market cap, which probably means you acquire stock worth a grand or so.
  - dstick 5y ago
    No that wasn’t the point at all. Corporate death penalty was a completely overblown analogy by someone else. What this is about is that a manager / CEO / shareholder can be held personally accountable with punishment that could include jail time. As a deterrent. Right now only the company is accountable as if it’s some sort of living creature, and the penalty is always money. Which as you aptly put, they have in abundance!
Zelphyr 5y ago
A lot of people fear losing their money more than they fear death. I think corporate capital punishment, in theory, could work. The other side of that coin, however, is the number of people put out of work if that were to happen. Either way, there needs to be far stiffer penalties levied against companies who don't secure their systems better and lose sensitive customer data.
weimerica 5y ago
If punishment for murder was sitting in a luxury European prison with a vintage PS3[0] and not death or life, I’d have whacked my former con-artist business partner years ago and likely be out by now. Let’s not pretend there isn’t a deterrent. [0] - https://www.google.com/amp/s/www.businessinsider.com/breivik-suing-norway-over-his-luxurious-prison-conditions-2016-3%3famp https://www.google.com/amp/s/www.businessinsider.com/breivik...

cortesoft 5y ago

If any compromise wipes out a company automatically, you suddenly increase the incentive to hack a company by a huge amount. That doesn't seem like a good way to increase security.

gruez 5y ago
1. short company 2. hire cyber-mercenaries to hack company 3. ??? 4. profit

chrisbolt 5y ago

Just because the problem is that cost of compromise < cost of security, the solution is not to raise the cost of compromise to infinity. That’s treating it in a very black and white, binary way. It also increases the incentive to spend more on covering up any compromise.

deleted 5y ago

[deleted]

gruez 5y ago

I agree with the principle of raising the cost of compromise, but disagree with your proposal of raising it to infinity (which is effectively what happens when you wipe out the shareholders). Getting hacked sucks, but surely consumers aren't experiencing infinite losses when that happens?

dave5104 5y ago
Feels like a better idea might be legally forcing some top X levels of management out as a form of corporate death, invalidating any golden parachutes on the way out too.
pama 5y ago
I’m this case, if the breach data is true, customers need to buy new phones, get new SSN, (and possibly change name) to have any sense of safety in the future. I wouldn’t use a compromised IMEI phone for 2FA anymore but most people would and it is not clear if the potential losses from the selling of this information have any real limit.
- gruez 5y ago
  >customers need to buy new phones >and possibly change name >I wouldn’t use a compromised IMEI phone for 2FA Why? >get new SSN That might be prudent to do, but at worse it's a few hours of hassle. I searched around and it looks like all you have to do is fill in a form (https://www.ssa.gov/forms/ss-5.pdf https://www.ssa.gov/forms/ss-5.pdf) and supply the required documents. At US median wages it's a few hundred dollars, max. >the potential losses from the selling of this information have any real limit. Well not really? Suppose someone crashed into your house, making a hole in the wall that allows thieves to steal potentially unlimited amounts of goods from your house. Should the driver be liable for all thefts from your house in perpetuity? Or only between the time of the crash and when you can reasonably get the wall fixed (or in the case of identity theft, changed your SSN)?
  - meowster 5y ago
    That form does not indicate that it's used to change a SSN. Even if you do get a new SSN I wonder what the process is for changing it with the credit bureaus.

deleted 5y ago

[deleted]

bpodgursky 5y ago

Executing one of the few large US mobile providers will do nothing except raise prices by eliminating even the marginal remaining competition.

missedthecue 5y ago
Want a monopoly? Hire the best hackers to destroy all your competition.

notJim 5y ago

I'm curious for folks who like solutions like this, have you ever had a vulnerability in production? I would be shocked if most software engineers haven't had at least one outdated package, or one line of poorly-escaped javascript or similar at some point. It seems like luck (and maybe being a poor target) that these things are usually found before they are exploited. Should the companies we all work for cease to exist? I agree broadly with regulations designed to raise the cost of security flaws and so on, but I feel like there's this expectation that if we make the punishment extreme enough, people will begin writing perfect software and operating perfect servers, and I just don't buy it. It seems sort of like saying if someone causes a production issue or accidentally leaks a database, they should be summarily fired. More likely it was a mistake, and we should understand why it happened so we can prevent it in the future.

amelius 5y ago
Being a large company, they should at least demonstrate that they took appropriate measures. E.g. show the reports written by the pen-testers they hired.
- amelius 5y ago
  I'm being downvoted without argumentation, but how will security ever be taken seriously if these measures don't become the norm?
koolba 5y ago
If you’re billion dollar company’s application architecture is such that any one compromised system leaks the entirety of your customer data then you’re definitely doing it wrong. It’s not just a matter of one compromised package being able to wreak havoc, it’s the scale and blast radius of the havoc.
- oyashirochama 5y ago
  Also lack of isolation of critical systems, the biggest fault honestly. Basically isolate all PII and other systems from each other.

refurb 5y ago

Couple that with making engineers liable for what they build. Just like we do with physical engineering - build something that knowingly harms people? Get sued.

nogbit 5y ago
Knowingly is the key word here. The physical world is much easier to know and account for in engineering. Not so much for digital which is why security is a system of defense in depth via layers and nothing ever is 100% secure.

vmception 5y ago

On the contrary, I think the settlements should result in shares transferred and board seats added Instead of just cash Then management gets replaced

YeBanKo 5y ago

It depends on the level of incompetence or negligence. There is a difference between premeditated murder and negligent homicide. But there must be a framework, that determines the punishment based on the impact and level of negligence. > The trove includes not only names, phone numbers, and physical addresses but also more sensitive data like social security numbers, driver's license information, and IMEI numbers, unique identifiers tied to each mobile device. Now, this seems like a lot. I hope we will see a detailed technical analysis of the break eventually.

stjohnswarts 5y ago

There is a million ways to keep critical data away from public (mostly) data like Name and Address. Seems like they weren't even doing the most basic separation of concerns here.