5 ms·

I've said it before and I'll say it again: - Companies should suffer massive fines / damages / criminal charges when they leak the personal data of millions of

I've said it before and I'll say it again: - Companies should suffer massive fines / damages / criminal charges when they leak the personal data of millions of customers. - I think EULAs are a ridiculous run-around the law. They should be non-enforceable. Its far from perfect, but case law is pretty clear that people and companies are liable for damages due to foreseeable harm that they cause. (Except EULAs dodge this.) (I am not a lawyer, this is not legal advice.) Software engineers & security engineers can make just about anything secure. But we can only do so if we're given time and money to hire the expertise when needed. We need to make it incredibly expensive for companies to lose personal data like this. Management teams should be clamoring to hire the best security engineers. But they'll only do so if they're sufficiently motivated. The risk of massive liability is the right incentive to convince companies to invest in getting information security right. The current status quo is ridiculous.

echelon 4y ago
> I've said it before and I'll say it again Don't tell us, tell your legislators. Ideally with some kind of narrative that ties to a financial incentive for the lawmaker and his or her constituents. If the security industry got together and lobbied for this as both a jobs program (security companies offering services to tech companies) and as a means of protecting Americans/constituents, then it might get somewhere.
- InCityDreams 4y ago
  >Ideally with some kind of narrative that ties to a financial incentive for the lawmaker and his or her constituents. Absofuckinglutely. Never talk to a politician without remembering that if they don't get a cut...
  - JumpCrisscross 4y ago
    > never talk to a politician without remembering that if they don't get a cut Most voters don't care about digital security. That means most politicians, reasonably, don't care either. Most voters do care about their economies. So linking what you're talking about to talking points the political can use is helpful. Not because they're going to get a cut.
Gasp0de 4y ago
This. It would have been (relatively) easy for Ring to encrypt the video data so that they themselves can't access it. Obviously I don't wish it upon the individuals that use these cameras but I would probably smirk if data gets leaked and Amazon gets sued into the ground.
- sasas 4y ago
  E2E encryption is supported with Ring. You have to enable it yourself. Only discovered this a few weeks ago and immediately enabled it [1] This doesn't protect your PII data though. This is not a good situation at all. [1] https://support.ring.com/hc/en-us/articles/360054941511-Understanding-Video-End-to-End-Encryption-E2EE https://support.ring.com/hc/en-us/articles/360054941511-Unde...
  - phpisthebest 4y ago
    There are also some pretty extreme feature downgrades to enabling it. Main ones for me if I was a customer would be Limited notifications,.loss of timeline feature, inaccessible on desktop and other non-mobile platform
    - sasas 4y ago
      Definitely some tradeoffs there. I recall going back and forth in my head "I'm paranoid, I don't need to enable this" to "what if there was a breach..". and well.. here we are.
      - ratg13 4y ago
        E2E encryption only protects the data while it is in transmission. If there is a breach, all of your data is accessible because it is decrypted at the endpoint.
        josephg 4y ago
        Thats not what E2E encryption means. Encryption during transmission is called transport layer encryption (eg via TLS). E2E (end to end) encryption is encryption where the data is encrypted in transit and at rest. Generally E2E systems only have the keys to decrypt the data on the user's (endpoint) device.
pipo234 4y ago
Yes. Also, this time it's a consumer grade surveillance, but the same goes for security cams in prisons or nuclear facilities: hoarding information (sensitive or not) does not translate 1:1 to increasing security. This should be obvious, still we feel more, not less, safe with our house surveilled with technology.
anonymous_sorry 4y ago
Apart from leaks harming the privacy of customers, paying ransoms does social harm by providing an income and incentive to criminals. I found leaked details of Royal Mail's negotiations with their attackers fascinating [0]. I'm not sure it's practical to outlaw the payment of ransoms, but it should at least be heavily taxed (say, 100%). Naively, I would expect this to cut by half the amount that can be extorted through ransomware attacks, making countries that implement such a tax less attractive targets. [0] https://www.theguardian.com/business/2023/feb/15/under-no-circumstances-will-we-pay-that-absurd-amount-royal-mail-tells-hackers https://www.theguardian.com/business/2023/feb/15/under-no-ci...
- TylerE 4y ago
  It’s been tried. Laws against paying just make people not report to the police at all.
  - yellowsir 4y ago
    well, i guess laws against murder, makes murder no report them self...
    - JumpCrisscross 4y ago
      > laws against murder, makes murder no report them self One of these is more universally repulsive than the other. Were it illegal, I'm not sure I could be bothered to blow a whistle on a company paying a cyberransom. That's obviously different for murder.
    - thombat 4y ago
      The analogy is closer to being: the state will prosecute the murder victim's family for failing to properly protect them AND won't be able to locate or punish the true murderer. So in this situation, what's the family going to do? Mourn in private and not report the crime, maybe try for vigilante justice if they think they've identified the murderer.
      - 4y ago
theK 4y ago
I am very much with you on this but I think the biggest hurdle in this theory is that introducing such regulation would create a de-facto hostile innovation environment in that jurisdiction. And no regulator will lightheartedly put themselves into the position of being the guy that “drove away all the innovators/startups/research/business”
- komali2 4y ago
  Some would say the most fertile ground for "business innovation" is a country with no labor protection laws. I think innovation will happen regardless and I'm kinda tired of fear mongering around "throttling innovation" whenever people talk about making our world better for people.
  - deleted 4y ago
    [deleted]
- remus 4y ago
  > I am very much with you on this but I think the biggest hurdle in this theory is that introducing such regulation would create a de-facto hostile innovation environment in that jurisdiction. Personally I think that is a price worth paying. Laws like the parent are suggesting are about having a standard that companies need to meet if they want to operate in a given space, and currently it is clear that companies will not meet these standards unless they are legally obliged to do so.
- tspace2k 4y ago
  [dead]
wruza 4y ago
In the next episodes: - Why so expensive? - Where did all businesses go? - Let’s create a certified secure data enclave companies! - Why so expensive still? - We can’t charge a certified company because it would damage half the economy!
- ajsnigrutin 4y ago
  You can translate this to any kind of regulation. Want cars not to explode when slightly rear-ended? Why are they so expensive now? Where did the car businesses go? Let's create car security companies! Why so expensive still? ...
  - yonixw 4y ago
    I think your example just fortified his comment. I can't make a car company. I can make a webcam on doors company. And you might say it is about raw materials. But I can buy enough materials for one car and one webcam door. I can't put the car on the road (as much as it make sense) only because of the sheer amount of cost required to pass regulations. So while regulation is something we want as costumers. I think we'd prefer to not have it become a obstacle in the software sector to the point it exist elsewhere. That is why I think the GDPR is great since it applies to companies with 250+ employs.
    - sofixa 4y ago
      >So while regulation is something we want as costumers. I think we'd prefer to not have it become a obstacle in the software sector to the point it exist elsewhere. Alternatively looked in the metaphor, cars are dangerous things - for the passengers and civilians nearby. We as a society don't want any random vehicle to be on the road due to the risks involved. A webcam door doesn't have this type of risk associated, so it's fine to DIY and whatever. However there are still risks, like PII leaks, so these they need to be mitigated too. > That is why I think the GDPR is great since it applies to companies with 250+ employs. No it doesn't? It applies to any company that holds EU citizens' PII.
      - 4y ago
JumpCrisscross 4y ago
> companies should suffer massive fines / damages / criminal charges when they leak the personal data of millions of customers This is zealous. If consumers don't care, and nobody can show tangible damages, "massive fines" and "criminal charges" are closer to moral outrage than prudent lawmaking.
- ajsnigrutin 4y ago
  Noone cares about anything, unless they're the one affected by this. I don't care if people around me don't have car insurance, but once one of them crashes into my car, i sure want them to have one, while the rest will continue not caring. So yes, requiring companies to safeguard data, even if that means fines and criminal charges for responsible people is important.
- mtlmtlmtlmtl 4y ago
  What's your basis for assuming customers don't care? I think there are those who don't care, and those who care but don't know better in the face of misleading marketing.
mnd999 4y ago
I kinda agree with you but it’s a tough one because what you’re describing is fining the victims of a crime. We don’t fine homeowners who fit cheap locks and get burgled do we. Pragmatically, it might be the right thing to do, but it feels wrong. Would you consider a due diligence to security threshold? That would certainly make it easier the well resourced to weasel out of fines, but when a small startup comes up against a well resourced nation state level hackers with a catalogue of 0days what are they supposed to do? Just go out of business?
- chrisandchris 4y ago
  We don't fine them, but homeowners usually don't have million of records of private data at home. Wouldn't you want your bank get fined if they aren't secure enough and loose your money? Or your local government if they loose your tax records because they think they don't need to lock their door? The hard part will be determining whether the company could have done something about it (like locking the doors or the windows). If they could, they for sure should get a fine if they didn't.
- _8j50 4y ago
  It would be like fining the victim of home burglary who stores data about their neighbors for profit. Mandatory business data leak should be exempt but everything else should be a liability. If they save cc info by default (opt-out) that should be a major liability.
- proto_lambda 4y ago
  We absolutely do fine/convict homeowners if, in a burglary, their improperly secured gun is stolen. The fines aren't for being hacked, they're for not adequately securing user data; ownership of which is a conscious decision.
- v3x3366 4y ago
  > We don’t fine homeowners who fit cheap locks and get burgled do we This isn't an appropriate comparison. I'm not a lawyer but I would imagine this would fall under negligence. Businesses are liable for improperly securing dangerous materials in the physical world.

echelon 4y ago

> I've said it before and I'll say it again Don't tell us, tell your legislators. Ideally with some kind of narrative that ties to a financial incentive for the lawmaker and his or her constituents. If the security industry got together and lobbied for this as both a jobs program (security companies offering services to tech companies) and as a means of protecting Americans/constituents, then it might get somewhere.

InCityDreams 4y ago
>Ideally with some kind of narrative that ties to a financial incentive for the lawmaker and his or her constituents. Absofuckinglutely. Never talk to a politician without remembering that if they don't get a cut...
- JumpCrisscross 4y ago
  > never talk to a politician without remembering that if they don't get a cut Most voters don't care about digital security. That means most politicians, reasonably, don't care either. Most voters do care about their economies. So linking what you're talking about to talking points the political can use is helpful. Not because they're going to get a cut.

Gasp0de 4y ago

This. It would have been (relatively) easy for Ring to encrypt the video data so that they themselves can't access it. Obviously I don't wish it upon the individuals that use these cameras but I would probably smirk if data gets leaked and Amazon gets sued into the ground.

sasas 4y ago
E2E encryption is supported with Ring. You have to enable it yourself. Only discovered this a few weeks ago and immediately enabled it [1] This doesn't protect your PII data though. This is not a good situation at all. [1] https://support.ring.com/hc/en-us/articles/360054941511-Understanding-Video-End-to-End-Encryption-E2EE https://support.ring.com/hc/en-us/articles/360054941511-Unde...
- phpisthebest 4y ago
  There are also some pretty extreme feature downgrades to enabling it. Main ones for me if I was a customer would be Limited notifications,.loss of timeline feature, inaccessible on desktop and other non-mobile platform
  - sasas 4y ago
    Definitely some tradeoffs there. I recall going back and forth in my head "I'm paranoid, I don't need to enable this" to "what if there was a breach..". and well.. here we are.
    - ratg13 4y ago
      E2E encryption only protects the data while it is in transmission. If there is a breach, all of your data is accessible because it is decrypted at the endpoint.
      - josephg 4y ago
        Thats not what E2E encryption means. Encryption during transmission is called transport layer encryption (eg via TLS). E2E (end to end) encryption is encryption where the data is encrypted in transit and at rest. Generally E2E systems only have the keys to decrypt the data on the user's (endpoint) device.

pipo234 4y ago

Yes. Also, this time it's a consumer grade surveillance, but the same goes for security cams in prisons or nuclear facilities: hoarding information (sensitive or not) does not translate 1:1 to increasing security. This should be obvious, still we feel more, not less, safe with our house surveilled with technology.

anonymous_sorry 4y ago

Apart from leaks harming the privacy of customers, paying ransoms does social harm by providing an income and incentive to criminals. I found leaked details of Royal Mail's negotiations with their attackers fascinating [0]. I'm not sure it's practical to outlaw the payment of ransoms, but it should at least be heavily taxed (say, 100%). Naively, I would expect this to cut by half the amount that can be extorted through ransomware attacks, making countries that implement such a tax less attractive targets. [0] https://www.theguardian.com/business/2023/feb/15/under-no-circumstances-will-we-pay-that-absurd-amount-royal-mail-tells-hackers https://www.theguardian.com/business/2023/feb/15/under-no-ci...

TylerE 4y ago
It’s been tried. Laws against paying just make people not report to the police at all.
- yellowsir 4y ago
  well, i guess laws against murder, makes murder no report them self...
  - JumpCrisscross 4y ago
    > laws against murder, makes murder no report them self One of these is more universally repulsive than the other. Were it illegal, I'm not sure I could be bothered to blow a whistle on a company paying a cyberransom. That's obviously different for murder.
  - thombat 4y ago
    The analogy is closer to being: the state will prosecute the murder victim's family for failing to properly protect them AND won't be able to locate or punish the true murderer. So in this situation, what's the family going to do? Mourn in private and not report the crime, maybe try for vigilante justice if they think they've identified the murderer.
    - 4y ago

theK 4y ago

I am very much with you on this but I think the biggest hurdle in this theory is that introducing such regulation would create a de-facto hostile innovation environment in that jurisdiction. And no regulator will lightheartedly put themselves into the position of being the guy that “drove away all the innovators/startups/research/business”

komali2 4y ago
Some would say the most fertile ground for "business innovation" is a country with no labor protection laws. I think innovation will happen regardless and I'm kinda tired of fear mongering around "throttling innovation" whenever people talk about making our world better for people.
- deleted 4y ago
  [deleted]
remus 4y ago
> I am very much with you on this but I think the biggest hurdle in this theory is that introducing such regulation would create a de-facto hostile innovation environment in that jurisdiction. Personally I think that is a price worth paying. Laws like the parent are suggesting are about having a standard that companies need to meet if they want to operate in a given space, and currently it is clear that companies will not meet these standards unless they are legally obliged to do so.
tspace2k 4y ago
[dead]

wruza 4y ago

In the next episodes: - Why so expensive? - Where did all businesses go? - Let’s create a certified secure data enclave companies! - Why so expensive still? - We can’t charge a certified company because it would damage half the economy!

ajsnigrutin 4y ago
You can translate this to any kind of regulation. Want cars not to explode when slightly rear-ended? Why are they so expensive now? Where did the car businesses go? Let's create car security companies! Why so expensive still? ...
- yonixw 4y ago
  I think your example just fortified his comment. I can't make a car company. I can make a webcam on doors company. And you might say it is about raw materials. But I can buy enough materials for one car and one webcam door. I can't put the car on the road (as much as it make sense) only because of the sheer amount of cost required to pass regulations. So while regulation is something we want as costumers. I think we'd prefer to not have it become a obstacle in the software sector to the point it exist elsewhere. That is why I think the GDPR is great since it applies to companies with 250+ employs.
  - sofixa 4y ago
    >So while regulation is something we want as costumers. I think we'd prefer to not have it become a obstacle in the software sector to the point it exist elsewhere. Alternatively looked in the metaphor, cars are dangerous things - for the passengers and civilians nearby. We as a society don't want any random vehicle to be on the road due to the risks involved. A webcam door doesn't have this type of risk associated, so it's fine to DIY and whatever. However there are still risks, like PII leaks, so these they need to be mitigated too. > That is why I think the GDPR is great since it applies to companies with 250+ employs. No it doesn't? It applies to any company that holds EU citizens' PII.
    - 4y ago

JumpCrisscross 4y ago

> companies should suffer massive fines / damages / criminal charges when they leak the personal data of millions of customers This is zealous. If consumers don't care, and nobody can show tangible damages, "massive fines" and "criminal charges" are closer to moral outrage than prudent lawmaking.

ajsnigrutin 4y ago
Noone cares about anything, unless they're the one affected by this. I don't care if people around me don't have car insurance, but once one of them crashes into my car, i sure want them to have one, while the rest will continue not caring. So yes, requiring companies to safeguard data, even if that means fines and criminal charges for responsible people is important.
mtlmtlmtlmtl 4y ago
What's your basis for assuming customers don't care? I think there are those who don't care, and those who care but don't know better in the face of misleading marketing.

mnd999 4y ago

I kinda agree with you but it’s a tough one because what you’re describing is fining the victims of a crime. We don’t fine homeowners who fit cheap locks and get burgled do we. Pragmatically, it might be the right thing to do, but it feels wrong. Would you consider a due diligence to security threshold? That would certainly make it easier the well resourced to weasel out of fines, but when a small startup comes up against a well resourced nation state level hackers with a catalogue of 0days what are they supposed to do? Just go out of business?

chrisandchris 4y ago
We don't fine them, but homeowners usually don't have million of records of private data at home. Wouldn't you want your bank get fined if they aren't secure enough and loose your money? Or your local government if they loose your tax records because they think they don't need to lock their door? The hard part will be determining whether the company could have done something about it (like locking the doors or the windows). If they could, they for sure should get a fine if they didn't.
_8j50 4y ago
It would be like fining the victim of home burglary who stores data about their neighbors for profit. Mandatory business data leak should be exempt but everything else should be a liability. If they save cc info by default (opt-out) that should be a major liability.
proto_lambda 4y ago
We absolutely do fine/convict homeowners if, in a burglary, their improperly secured gun is stolen. The fines aren't for being hacked, they're for not adequately securing user data; ownership of which is a conscious decision.
v3x3366 4y ago
> We don’t fine homeowners who fit cheap locks and get burgled do we This isn't an appropriate comparison. I'm not a lawyer but I would imagine this would fall under negligence. Businesses are liable for improperly securing dangerous materials in the physical world.