3 ms·

This seems pretty risky from an economic incentives POV, because it'd create a strong incentive for companies to not report security breaches if it opens them u

This seems pretty risky from an economic incentives POV, because it'd create a strong incentive for companies to not report security breaches if it opens them up to hundreds of millions in customer liability. Right now when there's a major breach, companies typically work with law enforcement to mitigate it, go after the perpetrators, and notify affected parties; if those affected parties can sue, there's a strong incentive not to. Meanwhile I doubt it would change company cybersecurity practices much, because of principal-agent problems within the company. The time lag between a vulnerability being introduced and it being revealed is usually measured in years. Oftentimes, the entire management chain responsible will have moved on to bigger and better roles by then, and the ramifications on their personal career growth will be zero. So they still have no incentive to prioritize security, and it's likely to get lost in the mess of competing priorities. The company might suffer, but the individual agents who make decisions for the company won't.

rapjr9 4y ago
If there is a major breach it seems likely that it is going to become known in time, whether it is reported or not. Not reporting it gets the company in even worse trouble. Principal agents do not avoid legal liability by changing jobs. The plan is something of a high level wish list, but the intent seems to be to make larger companies and states get more serious about security. If they take on that responsibility they probably have little to worry about, though likely some higher expenses. The international aspect and making it a national security problem and the critical infrastructure aspect seem long overdue to be addressed. Who wants that chemical plant at the edge of town to blow up? Or all the chemical plants across the country to blow up.

rapjr9 4y ago

If there is a major breach it seems likely that it is going to become known in time, whether it is reported or not. Not reporting it gets the company in even worse trouble. Principal agents do not avoid legal liability by changing jobs. The plan is something of a high level wish list, but the intent seems to be to make larger companies and states get more serious about security. If they take on that responsibility they probably have little to worry about, though likely some higher expenses. The international aspect and making it a national security problem and the critical infrastructure aspect seem long overdue to be addressed. Who wants that chemical plant at the edge of town to blow up? Or all the chemical plants across the country to blow up.