3 ms·

Nothing of note happened to Equifax for credit data, who wants to bet these guys face some serious repercussions for exposing data of the ruling class?

by sekh60 4y ago

toomuchtodo 4y ago
Maybe! https://en.wikipedia.org/wiki/Video_Privacy_Protection_Act https://en.wikipedia.org/wiki/Video_Privacy_Protection_Act
lockhouse 4y ago
Personally I’d prefer they find the hackers and people that sell information like this and throw them in prison for a few decades as a deterrent to others.
- hansvm 4y ago
  Sarcasm? Would you like to debate that idea?
  - lockhouse 4y ago
    Why would that be sarcasm and what’s to debate? Who actually committed a crime? The person that forgot to lock the door, the person that illegally entered and stole stuff, or the person who sold the known to be stolen goods?
    - hansvm 4y ago
      The problem is that several disjoint ideas are being entangled. We (1) have laws about data theft (which may or may not be relevant here), we (2) have an understanding that some uses of the data are dangerous/illegal, and we (3) know that the data in the wrong hands inevitably leads to those bad uses. By framing the issue as just needing to come down hard on (1) we don't actually solve problem (3). That data is already legal to buy, own, profit from, sell, and publish online with only minor restrictions on how those things happen and who can do them. Two employers ago they sold my detailed paystubs to Equifax, and one employer ago bought that data from Equifax to lowball my offer as much as possible. That's totally legal (USA-centric view). Nefarious actors can also buy my paystubs, purchase history, social, list of addresses, .... It's legal for them to buy and own it, just not to use it for identity theft and whatnot. Using data illegally is ... already illegal, but there is still personal risk to it being exposed because our core systems aren't very well thought out. A response focusing on the theft of the data runs the risk of blinding you to the fact that you are still vulnerable to bad actors and that in general we need stronger privacy laws (as opposed to general hacking laws) and more resilient systems to change that status quo. Separately there is the idea of (1) data theft itself. In the abstract I'm not opposed to prosecution for theft and sale of stolen goods, but it's not that clear-cut for generic internet traffic (and I don't have details on exactly what the "breach" entailed for this specific article, so nothing I say here necessarily applies to TFA): (a) The web is fundamentally a public entity, with the default assumption for servers being less that it's a house you're walking into and more that it's a set of billboards and signs in a city center that you're able to read, especially if you're not behind a login or paywall. When I ask for a page, I don't get to choose what the server sends me, and criminalizing me based on that content is ridiculous. At that point, any law criminalizing that sort of breach must necessarily include some combination of intent to cause harm and specifics about which data is actually criminal for it to hold up. Which isn't untenable, but it makes "illegally entering and stealing stuff" hard to prosecute on its own if there wasn't actual hacking involved; at best it'd be a rider tacked onto the real charge relating to the actual damage done. (b) Even with the current set of laws and customs we have around hacking, it's too easy to ruin somebody's life for well intentioned non-hacking activities. The fact that the Josh Renaud / MO story got as far as it did is terrifying, and plenty of other innocent or nearly innocent people have been jailed most of their adult lives (thankfully it looks like the CFAA is losing some of its teeth). (c) Since most of this data is legal to buy/own/sell, if you in good faith believe the source was legitimate then the extend of your liability is "returning the stolen goods" (deleting the files). Much like reading a public website sometimes being theft, this becomes hard to prosecute except in obvious cases or as riders to other offenses.

Nothing of note happened to Equifax for credit data, who wants to bet these guys face some serious repercussions for exposing data of the ruling class?

by sekh60 4y ago

Nothing of note happened to Equifax for credit data, who wants to bet these guys face some serious repercussions for exposing data of the ruling class?

toomuchtodo 4y ago

Maybe! https://en.wikipedia.org/wiki/Video_Privacy_Protection_Act https://en.wikipedia.org/wiki/Video_Privacy_Protection_Act

lockhouse 4y ago

Personally I’d prefer they find the hackers and people that sell information like this and throw them in prison for a few decades as a deterrent to others.

hansvm 4y ago
Sarcasm? Would you like to debate that idea?
- lockhouse 4y ago
  Why would that be sarcasm and what’s to debate? Who actually committed a crime? The person that forgot to lock the door, the person that illegally entered and stole stuff, or the person who sold the known to be stolen goods?
  - hansvm 4y ago
    The problem is that several disjoint ideas are being entangled. We (1) have laws about data theft (which may or may not be relevant here), we (2) have an understanding that some uses of the data are dangerous/illegal, and we (3) know that the data in the wrong hands inevitably leads to those bad uses. By framing the issue as just needing to come down hard on (1) we don't actually solve problem (3). That data is already legal to buy, own, profit from, sell, and publish online with only minor restrictions on how those things happen and who can do them. Two employers ago they sold my detailed paystubs to Equifax, and one employer ago bought that data from Equifax to lowball my offer as much as possible. That's totally legal (USA-centric view). Nefarious actors can also buy my paystubs, purchase history, social, list of addresses, .... It's legal for them to buy and own it, just not to use it for identity theft and whatnot. Using data illegally is ... already illegal, but there is still personal risk to it being exposed because our core systems aren't very well thought out. A response focusing on the theft of the data runs the risk of blinding you to the fact that you are still vulnerable to bad actors and that in general we need stronger privacy laws (as opposed to general hacking laws) and more resilient systems to change that status quo. Separately there is the idea of (1) data theft itself. In the abstract I'm not opposed to prosecution for theft and sale of stolen goods, but it's not that clear-cut for generic internet traffic (and I don't have details on exactly what the "breach" entailed for this specific article, so nothing I say here necessarily applies to TFA): (a) The web is fundamentally a public entity, with the default assumption for servers being less that it's a house you're walking into and more that it's a set of billboards and signs in a city center that you're able to read, especially if you're not behind a login or paywall. When I ask for a page, I don't get to choose what the server sends me, and criminalizing me based on that content is ridiculous. At that point, any law criminalizing that sort of breach must necessarily include some combination of intent to cause harm and specifics about which data is actually criminal for it to hold up. Which isn't untenable, but it makes "illegally entering and stealing stuff" hard to prosecute on its own if there wasn't actual hacking involved; at best it'd be a rider tacked onto the real charge relating to the actual damage done. (b) Even with the current set of laws and customs we have around hacking, it's too easy to ruin somebody's life for well intentioned non-hacking activities. The fact that the Josh Renaud / MO story got as far as it did is terrifying, and plenty of other innocent or nearly innocent people have been jailed most of their adult lives (thankfully it looks like the CFAA is losing some of its teeth). (c) Since most of this data is legal to buy/own/sell, if you in good faith believe the source was legitimate then the extend of your liability is "returning the stolen goods" (deleting the files). Much like reading a public website sometimes being theft, this becomes hard to prosecute except in obvious cases or as riders to other offenses.