3 ms·
How do you figure that?
by da_chicken 3y ago
How do you figure that?
- ceejayoz 3y agoThere's almost certainly ITAR-subject data in a Boeing data dump of this size; I'm curious as to whether not paying a ransom counts as releasing it.
- lesuorac 3y agoI'm more curious why failing to secure it doesn't count as a ITAR violation.
- kenjackson 3y agoI think you need to do reasonable effort. Perfect security doesn’t exist.
- hiharryhere 3y agoI doubt it. Here in Australia at least companies with large gov contracts are prevented by gov policy from paying ransoms.
- ceejayoz 3y agoIt wouldn't be the first catch-22 scenario caused by conflicting laws.
- jacquesm 3y agoThe 'easy' solution is not to let your data leak.
- generic92034 3y agoCertainly different companies put a different effort into their IT security measures, but I doubt any of them would claim that their system is "unhackable". So, I am not sure that not letting your data leak is an option you can really choose. You might be able to influence the probability of a hack, though.
- tsujamin 3y agoOut of curiosity what's the source on that? AFAICS there's no clear legislation restricting it (although a lot of talk about such a bill in the future). It is in standard contract terms?
- hiharryhere 3y agoSource is a close relative involved in responding to a recent, well publicised data breach. They service several large commonwealth departments and were instructed by them not to pay.
- hug 3y agoThey instruct you not to pay, but that instruction has absolutely no binding. The Australian orgs I have deal with in large compromises have universally opted to pay to prevent release, where it was financially feasible.
- deleted 3y ago[deleted]
- brookst 3y agoI think ITAR covers exporting, which is necessarily intentional. At least I'm not aware of any espionage victim also being subject to ITAR prosecution.
- annoyingnoob 3y agoIn the case of ITAR, not exporting means limiting access to US persons only. I suspect this could be a violation, even if unintended.
- kevin_thibedeau 3y agoIt also covers reexporting. You're still responsible for ITAR and EAR articles after they've been exported and the recipient wants to transfer them somewhere else.
- dymk 3y agoSize of the dump means nothing, on one extreme it's a single 45GB video file of a security camera looking at nothing.
- tgsovlerkhgsel 3y agoLetting it get stolen in the first place might count, I highly doubt not paying the ransom counts.
- estiaan 3y agoI really hope this is not the case. Paying randsome is unethical, in some cases it’s also illegal. At best you’re funding a criminal organisation, at worst you’re in collaboration with a criminal organisation. In the case of digital files there is absolutely no guarantee that they delete the file, it’s like paying someone to go back in time. The act has been done, the data is stolen, your negligence and wrongdoing is in the past and the only ethical option is to not fund the bad actors who are actually primarily responsible.