My issue is with you saying: > legislative changes in order prevent that worse version from happening in the future. I’m not convinced legislation achieve you

My issue is with you saying: > legislative changes in order prevent that worse version from happening in the future. I’m not convinced legislation achieve your goal having already seen HIPAA in action in law, the systems behind the scene, and the ways in which compliance works. Is it better than nothing? Sure! Does it actually create truly secure systems? I don’t think so. If liabilities are severe where companies could go under or people go to jail, then I’m still not sure that would be enough to secure systems because you’re always a 0-day away from breach. But if the result is twitter going under or their CSO jailed, all I think that happens is you remove global competitiveness. I agree with you more should be done. But perhaps in different ways. For example, requiring everyone to take basic security classes before you can be a software engineer might help. Creating societal incentives where bug bounties are required, white hats cannot go to jail or be sued, DARPA spends big on defensive security strategies, and stating the US will take cyber attacks the same as physical attacks are ways that I think would produce better outcomes (but would risk war).