4 ms·

> You should never get discount with crimes, but the penalties should always scale linearly with amount of damage or importance. I think "damage" and "importan

> You should never get discount with crimes, but the penalties should always scale linearly with amount of damage or importance. I think "damage" and "importance" are important distinctions. I'd find it worse if a person non-violently stole $100 worth of goods from the homes of 50,000 people than stealing a Van Gogh from the home of one person. And I'd find the Van Gogh theft a bit worse than an equivalent theft from a bank. This is one case of negligence that led to the theft of all of these records. It also seems, at worst, negligence that led to the theft, not a purposeful disclosure. And not negligence in their license specialty (law), but IT negligence. Did Redmond take affirmative action to ensure all instances of its server software was patched? Redmond knows who it sold software to. Why would they not also be at fault? Servers are their specialty. Harsh penalties for negligence, even for serious events such as human death, should probably be limited to negligence within the scope of a person's or business' specialty. With less harsh penalties for incidental negligence.

throwaway426079 4y ago
If your bank lost your money due to getting hacked would you just shrug and accept that they do money, not IT security and therefore it's outside scope for a negligence claim?
- anonymouskimmer 4y ago
  If the negligence directly led to provable harm to me (such as getting evicted because I couldn't make rent), then I would want a negligence suit. If it didn't cause provable harm to me, merely some annoyance, and I got all of my money back from FDIC insurance, then I believe any negligence claim should be greatly limited, or even outside of scope, yes. If probable harm happens to people because of these record leaks I believe the law firm should be part of the joint liability to make that harm as financially whole as possible. But that's what a civil suit is for, not a DA enforcement.
  - throwaway426079 4y ago
    Negligence doesn't work the way you describe with potential to be out of scope. It is a finding of fact: there was negligence or there was not. The law has a separate mechanism for situations that you might call 'out of scope' which is to award zero damages.
    - anonymouskimmer 4y ago
      I understand that. You were the one who chose "scope" as the word to use to describe this and I was just using your word in order to facilitate conversation between us.
albntomat0 4y ago
I have to imagine a full time IT person was running the Exchange server, not a lawyer. This was a highly publicized vulnerability, with a patch readily available. There are degrees to negligence, and this one is only slightly better than literally leaving the door to their office open at night.
- anonymouskimmer 4y ago
  Then a class-action lawsuit may be able to get a lot of money out of them in addition to this fine.
- rejectfinite 4y ago
  And as you see here it is not easy to even patch Exchange nevermind migrating/upgrading to a newer version or migrating to Office 365. It can be done of course but maybe management did not sign off on it due to risks or downtime. Sometimes IT cannot make decisions like that especially if there is a licence cost involved that the company does not want to pay! https://web.archive.org/web/20220930183225/https://threadreaderapp.com/thread/1575865934429900801.html https://web.archive.org/web/20220930183225/https://threadrea... They could very well have ran on-prem Exchange and standalone/boxed copies of Office 2013, paid for once long ago. Now come and say >"oh you have to pay again for newer versions or pay for per-user Office 365" >"why? what we have works fine, we dont need the new features" >"for security" >"thats your job" etc ect You have only worked with certain clients I hear.
  - technion 4y ago
    I can absolutely confirm that blog describes a pretty typical experience for patching exchange.
  - albntomat0 4y ago
    The parent comment was saying that they thought the IT systems for a law firm were managed by a lawyer in their spare time, which is different from this case you describe. Maybe the IT folks properly and accurately described the risk, and were stopped by non-IT management. Alternatively, maybe IT didn't push as hard, describe the risk properly, or want to deal with an annoying patching process. Microsoft also deserves blame for the difficult of patching, as your link describes. Either way, the real victims are the 114,979 folks who had their information stolen. If a bank gets robbed because they didn't do basic things like locking the doors or hiring a security guard, they don't get to raise their hands and say "BuT cRiMInAlS". This is literally the same as what IT does whenever they get hit by a highly publicized exploit that's had a patch for months.
lostlogin 4y ago
> I'd find it worse if a person non-violently stole $100 worth of goods from the homes of 50,000 people than stealing a Van Gogh from the home of one person. A $5 million Van Gogh would be a very bad one. You can keep it.
- anonymouskimmer 4y ago
  I purposefully didn't price the Van Gogh, and assumed its value was much more than $5 million.
Ekaros 4y ago
Ofc, you should be punished for both. The number of crimes and the amount stolen in each. Just add everything up and come to some nice number. Like with 50000 homes something like 50000-150000 months and then 50000 days as 1 day per 100$. And for Van Gogh the 1-3 month and then price divided by 100$ for extra days.
rejectfinite 4y ago
Microsoft does not ensure the operation or patch levels of on-prem Exchange or Windows Server. Where did you get this from? That is up to the IT of the server/company.
- anonymouskimmer 4y ago
  I didn't realize "Redmond" was slang for MS.

throwaway426079 4y ago

If your bank lost your money due to getting hacked would you just shrug and accept that they do money, not IT security and therefore it's outside scope for a negligence claim?

anonymouskimmer 4y ago
If the negligence directly led to provable harm to me (such as getting evicted because I couldn't make rent), then I would want a negligence suit. If it didn't cause provable harm to me, merely some annoyance, and I got all of my money back from FDIC insurance, then I believe any negligence claim should be greatly limited, or even outside of scope, yes. If probable harm happens to people because of these record leaks I believe the law firm should be part of the joint liability to make that harm as financially whole as possible. But that's what a civil suit is for, not a DA enforcement.
- throwaway426079 4y ago
  Negligence doesn't work the way you describe with potential to be out of scope. It is a finding of fact: there was negligence or there was not. The law has a separate mechanism for situations that you might call 'out of scope' which is to award zero damages.
  - anonymouskimmer 4y ago
    I understand that. You were the one who chose "scope" as the word to use to describe this and I was just using your word in order to facilitate conversation between us.

albntomat0 4y ago

I have to imagine a full time IT person was running the Exchange server, not a lawyer. This was a highly publicized vulnerability, with a patch readily available. There are degrees to negligence, and this one is only slightly better than literally leaving the door to their office open at night.

anonymouskimmer 4y ago
Then a class-action lawsuit may be able to get a lot of money out of them in addition to this fine.
rejectfinite 4y ago
And as you see here it is not easy to even patch Exchange nevermind migrating/upgrading to a newer version or migrating to Office 365. It can be done of course but maybe management did not sign off on it due to risks or downtime. Sometimes IT cannot make decisions like that especially if there is a licence cost involved that the company does not want to pay! https://web.archive.org/web/20220930183225/https://threadreaderapp.com/thread/1575865934429900801.html https://web.archive.org/web/20220930183225/https://threadrea... They could very well have ran on-prem Exchange and standalone/boxed copies of Office 2013, paid for once long ago. Now come and say >"oh you have to pay again for newer versions or pay for per-user Office 365" >"why? what we have works fine, we dont need the new features" >"for security" >"thats your job" etc ect You have only worked with certain clients I hear.
- technion 4y ago
  I can absolutely confirm that blog describes a pretty typical experience for patching exchange.
- albntomat0 4y ago
  The parent comment was saying that they thought the IT systems for a law firm were managed by a lawyer in their spare time, which is different from this case you describe. Maybe the IT folks properly and accurately described the risk, and were stopped by non-IT management. Alternatively, maybe IT didn't push as hard, describe the risk properly, or want to deal with an annoying patching process. Microsoft also deserves blame for the difficult of patching, as your link describes. Either way, the real victims are the 114,979 folks who had their information stolen. If a bank gets robbed because they didn't do basic things like locking the doors or hiring a security guard, they don't get to raise their hands and say "BuT cRiMInAlS". This is literally the same as what IT does whenever they get hit by a highly publicized exploit that's had a patch for months.

lostlogin 4y ago

> I'd find it worse if a person non-violently stole $100 worth of goods from the homes of 50,000 people than stealing a Van Gogh from the home of one person. A $5 million Van Gogh would be a very bad one. You can keep it.

anonymouskimmer 4y ago
I purposefully didn't price the Van Gogh, and assumed its value was much more than $5 million.

Ekaros 4y ago

Ofc, you should be punished for both. The number of crimes and the amount stolen in each. Just add everything up and come to some nice number. Like with 50000 homes something like 50000-150000 months and then 50000 days as 1 day per 100$. And for Van Gogh the 1-3 month and then price divided by 100$ for extra days.

rejectfinite 4y ago

Microsoft does not ensure the operation or patch levels of on-prem Exchange or Windows Server. Where did you get this from? That is up to the IT of the server/company.

anonymouskimmer 4y ago
I didn't realize "Redmond" was slang for MS.