4 ms·

I kinda agree with you but it’s a tough one because what you’re describing is fining the victims of a crime. We don’t fine homeowners who fit cheap locks and ge

by mnd999 4y ago

I kinda agree with you but it’s a tough one because what you’re describing is fining the victims of a crime. We don’t fine homeowners who fit cheap locks and get burgled do we. Pragmatically, it might be the right thing to do, but it feels wrong. Would you consider a due diligence to security threshold? That would certainly make it easier the well resourced to weasel out of fines, but when a small startup comes up against a well resourced nation state level hackers with a catalogue of 0days what are they supposed to do? Just go out of business?

chrisandchris 4y ago
We don't fine them, but homeowners usually don't have million of records of private data at home. Wouldn't you want your bank get fined if they aren't secure enough and loose your money? Or your local government if they loose your tax records because they think they don't need to lock their door? The hard part will be determining whether the company could have done something about it (like locking the doors or the windows). If they could, they for sure should get a fine if they didn't.
_8j50 4y ago
It would be like fining the victim of home burglary who stores data about their neighbors for profit. Mandatory business data leak should be exempt but everything else should be a liability. If they save cc info by default (opt-out) that should be a major liability.
proto_lambda 4y ago
We absolutely do fine/convict homeowners if, in a burglary, their improperly secured gun is stolen. The fines aren't for being hacked, they're for not adequately securing user data; ownership of which is a conscious decision.
v3x3366 4y ago
> We don’t fine homeowners who fit cheap locks and get burgled do we This isn't an appropriate comparison. I'm not a lawyer but I would imagine this would fall under negligence. Businesses are liable for improperly securing dangerous materials in the physical world.
iamacyborg 4y ago
> We don’t fine homeowners who fit cheap locks and get burgled do we. The type of locks you have affect the price of your home insurance, in the UK at least.

by mnd999 4y ago

chrisandchris 4y ago

We don't fine them, but homeowners usually don't have million of records of private data at home. Wouldn't you want your bank get fined if they aren't secure enough and loose your money? Or your local government if they loose your tax records because they think they don't need to lock their door? The hard part will be determining whether the company could have done something about it (like locking the doors or the windows). If they could, they for sure should get a fine if they didn't.

_8j50 4y ago

It would be like fining the victim of home burglary who stores data about their neighbors for profit. Mandatory business data leak should be exempt but everything else should be a liability. If they save cc info by default (opt-out) that should be a major liability.

proto_lambda 4y ago

We absolutely do fine/convict homeowners if, in a burglary, their improperly secured gun is stolen. The fines aren't for being hacked, they're for not adequately securing user data; ownership of which is a conscious decision.

v3x3366 4y ago

> We don’t fine homeowners who fit cheap locks and get burgled do we This isn't an appropriate comparison. I'm not a lawyer but I would imagine this would fall under negligence. Businesses are liable for improperly securing dangerous materials in the physical world.

iamacyborg 4y ago

> We don’t fine homeowners who fit cheap locks and get burgled do we. The type of locks you have affect the price of your home insurance, in the UK at least.