4 ms·

Corporate fines make a lot more sense once you understand they're not there to stop the behavior, they're there to make sure the shakedown ensures the state get

Corporate fines make a lot more sense once you understand they're not there to stop the behavior, they're there to make sure the shakedown ensures the state gets their cut. They don't actually want to destroy the company, they want their piece of the action by proxy.

hbrn 4y ago
That sounds like a conspiracy theory, how would that work in practice, where are the incentives? Does attorney general get a cut of the fine?
- johncessna 4y ago
  The existence of an agency designed just to root out this behavior provides a lot of incentive. The folks who create the agency get say they're doing something about the problem and look good. The folks in the agency get jobs and all that entails.
  - deleted 4y ago
    [deleted]
  - hbrn 4y ago
    Doctors want people to be sick, police wants people to commit crimes, military wants wars. This is a dangerous mindset. Did they improve their practices after the breach? Sounds like they did: "Zoetop became independently certified as PCI DSS compliant in April 2019 and has remained so since." Now I know that PCI DSS is a complete shit, but that's the only tool they have. I'm all for criticizing the state, but sounds like in this case they did their job just fine.
- deleted 4y ago
  [deleted]
- richbell 4y ago
  This post is apropos: https://news.ycombinator.com/item?id=33215316 https://news.ycombinator.com/item?id=33215316
ceejayoz 4y ago
> They don't actually want to destroy the company... Sure, just like a speeding ticket doesn't get punished with the death penalty. Of course that's not the goal of the fines. Why would you expect it to be?
- paxys 4y ago
  My college campus had a huge parking problem. One time I got a ride from a classmate, and he rolled up and parked in a clear no parking zone. When I pointed it out, he said "oh I'll just pay the $50 (or whatever) ticket. I always do it when I'm running late for class." Parking enforcement was happy since they made a bit of money. The student was happy because he got to park in a prime spot for a fee that was insignificant for him. However, if the goal was to stop people from parking in certain areas, the policy failed miserably. Corporate fines work the same way. If they make $10 from an illegal action and are fined $1 for it, it isn't a deterrence, just a good investment opportunity.
  - speeder 4y ago
    When I was a little kid, I had to go the airport with some distant relatives. One of them parked right next to a "forbidden parking" sign. So I went up to the owner of the car, and asked, she then cheerfully replied: "Oh, the parking lot charges 40, the fine is 5, I prefer to pay the fine since it is cheaper!"
    - NullPrefix 4y ago
      Always a chance the car will be towed
  - ceejayoz 4y ago
    This is a solvable problem. Finland's approach is good here; fines are income-based (https://www.theatlantic.com/business/archive/2015/03/finland-home-of-the-103000-speeding-ticket/387484/ https://www.theatlantic.com/business/archive/2015/03/finland...). The GDPR similarly imposes a penalty in terms of "percent of annual global revenue". The point: the goal isn't a corporate death penalty in these sorts of cases.

hbrn 4y ago

That sounds like a conspiracy theory, how would that work in practice, where are the incentives? Does attorney general get a cut of the fine?

johncessna 4y ago
The existence of an agency designed just to root out this behavior provides a lot of incentive. The folks who create the agency get say they're doing something about the problem and look good. The folks in the agency get jobs and all that entails.
- deleted 4y ago
  [deleted]
- hbrn 4y ago
  Doctors want people to be sick, police wants people to commit crimes, military wants wars. This is a dangerous mindset. Did they improve their practices after the breach? Sounds like they did: "Zoetop became independently certified as PCI DSS compliant in April 2019 and has remained so since." Now I know that PCI DSS is a complete shit, but that's the only tool they have. I'm all for criticizing the state, but sounds like in this case they did their job just fine.
deleted 4y ago
[deleted]
richbell 4y ago
This post is apropos: https://news.ycombinator.com/item?id=33215316 https://news.ycombinator.com/item?id=33215316

ceejayoz 4y ago

> They don't actually want to destroy the company... Sure, just like a speeding ticket doesn't get punished with the death penalty. Of course that's not the goal of the fines. Why would you expect it to be?

paxys 4y ago
My college campus had a huge parking problem. One time I got a ride from a classmate, and he rolled up and parked in a clear no parking zone. When I pointed it out, he said "oh I'll just pay the $50 (or whatever) ticket. I always do it when I'm running late for class." Parking enforcement was happy since they made a bit of money. The student was happy because he got to park in a prime spot for a fee that was insignificant for him. However, if the goal was to stop people from parking in certain areas, the policy failed miserably. Corporate fines work the same way. If they make $10 from an illegal action and are fined $1 for it, it isn't a deterrence, just a good investment opportunity.
- speeder 4y ago
  When I was a little kid, I had to go the airport with some distant relatives. One of them parked right next to a "forbidden parking" sign. So I went up to the owner of the car, and asked, she then cheerfully replied: "Oh, the parking lot charges 40, the fine is 5, I prefer to pay the fine since it is cheaper!"
  - NullPrefix 4y ago
    Always a chance the car will be towed
- ceejayoz 4y ago
  This is a solvable problem. Finland's approach is good here; fines are income-based (https://www.theatlantic.com/business/archive/2015/03/finland-home-of-the-103000-speeding-ticket/387484/ https://www.theatlantic.com/business/archive/2015/03/finland...). The GDPR similarly imposes a penalty in terms of "percent of annual global revenue". The point: the goal isn't a corporate death penalty in these sorts of cases.