3 ms·

Until CEOs start going to jail for this stuff, it's prudent to expect every company you do business with will soon lose all your personal information to a bad g

Until CEOs start going to jail for this stuff, it's prudent to expect every company you do business with will soon lose all your personal information to a bad guy. If the company makes an especially big deal about "protecting your personal information," expect it to happen even sooner.

vlovich123 5y ago
I don’t think that’s a good answer. It “feels good” but won’t solve any problem - do you really think security breaches will vanish because we will send the CEO to jail? I think instead what we need to do is: A) have “egregious” problem multipliers that stack. Using outdated cryptographic designs? 10x damages multiplier. Using software with known vulnerabilities that was part of the breach? 100x multiplier. Not encrypting data at rest? 1000x multiplier. Etc etc. B) develop a standard whereby my PII is not allowed to be stored and you only get access to it at time of use (this would also largely solve the problem of the shadow data marketplace). Even with all that, you could have a security breach where someone has a Trojan spying on all traffic live on the system and stealing that PII once it’s decrypted. So the problem isn’t solvable but maybe these kinds of steps might raise the bar.
throwawayboise 5y ago
Basically, anyone who maintains a database of information needs to be liable for damages due to the disclosure and/or inaccuracy of that information. Trial lawyers will take care of the rest.
bigyellow 5y ago
The whole point of incorporating is to limit personal liability. This vengeful "put CEOs in jail" attitude flies in the face of law and even common sense, and doesn't address the root of the problem, which is tech-illiteracy in the general population, not evil men in white collars.
- torstenvl 5y ago
  Incorporation limits liability of the shareholders. Nobody is talking about liability for shareholders.
- unpolloloco 5y ago
  And all this would do is make the CEO a sacrificial position. Cheaper to pay someone to go to jail than it is to fix the problem

vlovich123 5y ago

I don’t think that’s a good answer. It “feels good” but won’t solve any problem - do you really think security breaches will vanish because we will send the CEO to jail? I think instead what we need to do is: A) have “egregious” problem multipliers that stack. Using outdated cryptographic designs? 10x damages multiplier. Using software with known vulnerabilities that was part of the breach? 100x multiplier. Not encrypting data at rest? 1000x multiplier. Etc etc. B) develop a standard whereby my PII is not allowed to be stored and you only get access to it at time of use (this would also largely solve the problem of the shadow data marketplace). Even with all that, you could have a security breach where someone has a Trojan spying on all traffic live on the system and stealing that PII once it’s decrypted. So the problem isn’t solvable but maybe these kinds of steps might raise the bar.

throwawayboise 5y ago

Basically, anyone who maintains a database of information needs to be liable for damages due to the disclosure and/or inaccuracy of that information. Trial lawyers will take care of the rest.

bigyellow 5y ago

The whole point of incorporating is to limit personal liability. This vengeful "put CEOs in jail" attitude flies in the face of law and even common sense, and doesn't address the root of the problem, which is tech-illiteracy in the general population, not evil men in white collars.

torstenvl 5y ago
Incorporation limits liability of the shareholders. Nobody is talking about liability for shareholders.
unpolloloco 5y ago
And all this would do is make the CEO a sacrificial position. Cheaper to pay someone to go to jail than it is to fix the problem