3 ms·

Genuine question: FTC is saying a "bug" caused the violation of the consent decree. How can a company ensure bugs don't happen that violate a commitment? I don

Genuine question: FTC is saying a "bug" caused the violation of the consent decree. How can a company ensure bugs don't happen that violate a commitment? I don't think that's possible. I'd assume the decree should ensure they don't INTENTIONALLY violate it.

majormajor 3y ago
More testing, more rigor, more review, etc. So even if a bug happens, you don't let it linger without spotting or fixing it for over a year, from "late 2017 until mid-2019".
- johndhi 3y ago
  Well, the consent decree should then say: you need to do X testing, Y review. If they did that, it's still not a violation.
  - johndhi 3y ago
    You can read the text of the consent decree here [1]. Looks like it just generally required them to have a 'privacy program' and to monitor and test their vendors. [1] https://www.ftc.gov/system/files/ftc_gov/pdf/c4365facebookproposedmodifieddecisionandorder.pdf https://www.ftc.gov/system/files/ftc_gov/pdf/c4365facebookpr...
  - dragonwriter 3y ago
    > Well, the consent decree should then say: you need to do X testing, Y review. The consent decree can just say you have to not do Z. You take whatever steps are necessary to avoid that. If you do it “accidentally” that’s a violation. The point of a consent decree, from the point of viee of the regulatort agency, is generally to eliminate excuses for a party already seen as a violator as a condition to hold off on an existing enforcement action for the violation. Creating opportunities for technical compliancd while the problem sought to be avoided still occurs is an explicit non-goal. (From the non-government side, the point is to avoid greater penalties now by accepting some obligations and limitations going forward.)
dragonwriter 3y ago
> How can a company ensure bugs don't happen that violate a commitment? I don't think that's possible. If they aren’t willing to take active steps to prevent it even accidentally, they shouldn’t agree to terms that require that. A consent decree is the negotiated settlement of a lawsuit between a regulatory agency and a party accused of noncompliance.

majormajor 3y ago

More testing, more rigor, more review, etc. So even if a bug happens, you don't let it linger without spotting or fixing it for over a year, from "late 2017 until mid-2019".

johndhi 3y ago
Well, the consent decree should then say: you need to do X testing, Y review. If they did that, it's still not a violation.
- johndhi 3y ago
  You can read the text of the consent decree here [1]. Looks like it just generally required them to have a 'privacy program' and to monitor and test their vendors. [1] https://www.ftc.gov/system/files/ftc_gov/pdf/c4365facebookproposedmodifieddecisionandorder.pdf https://www.ftc.gov/system/files/ftc_gov/pdf/c4365facebookpr...
- dragonwriter 3y ago
  > Well, the consent decree should then say: you need to do X testing, Y review. The consent decree can just say you have to not do Z. You take whatever steps are necessary to avoid that. If you do it “accidentally” that’s a violation. The point of a consent decree, from the point of viee of the regulatort agency, is generally to eliminate excuses for a party already seen as a violator as a condition to hold off on an existing enforcement action for the violation. Creating opportunities for technical compliancd while the problem sought to be avoided still occurs is an explicit non-goal. (From the non-government side, the point is to avoid greater penalties now by accepting some obligations and limitations going forward.)

dragonwriter 3y ago

> How can a company ensure bugs don't happen that violate a commitment? I don't think that's possible. If they aren’t willing to take active steps to prevent it even accidentally, they shouldn’t agree to terms that require that. A consent decree is the negotiated settlement of a lawsuit between a regulatory agency and a party accused of noncompliance.