4 ms·

"Appreciation letter" is why most of these vulnerabilities are not reported or disclosed by whitehats and are actively exploited by hackers. There should be a

by lxe 3y ago

"Appreciation letter" is why most of these vulnerabilities are not reported or disclosed by whitehats and are actively exploited by hackers. There should be a legal framework that holds companies liable for certain level of security mishandling when it comes to private customer data.

ahoka 3y ago
There is one in Europe, it’s called GDPR.
- albert180 3y ago
  [flagged]
  - cnewey 3y ago
    Do you have a… less visceral metaphor? Or some information I can read about? I’m curious.
    - anon456846 3y ago
      https://en.wikipedia.org/wiki/Data_Protection_Commissioner#Investigation_of_complaints https://en.wikipedia.org/wiki/Data_Protection_Commissioner#I...
      - cnewey 3y ago
        > In January 2023, DPC was forced to increase the fine issued to Meta Platforms after a review by European Data Protection Board found that the initial fine was insufficient.[12] European Data Protection Board determined that DPC has failed to perform its enforcement responsibility with "due diligence". The critics have pointed out that 7 out of 8 decisions handed down by European Data Protection Board were against the Irish DPC, and that the DPC "always choose the most tortuous, lengthy and expensive legal route to a decision rather than a simple application of EU law".[13] Interesting.
        albert180 3y ago
        Not very surprising. Ireland's entire economy is being based on being a cheap low tax mailbox provider for US Multinationals, trying to bend laws as much as possible in their favor just fits in there That's why there is a big push on minimum tax rates in the European Union, nobody wants that race to the bottom
    - rootveg 3y ago
      https://www.euractiv.com/section/data-protection/news/irish-data-protection-authority-under-fire-over-facebook-case/ https://www.euractiv.com/section/data-protection/news/irish-...
  - stcredzero 3y ago
    I wouldn't be surprised if this later turned out to be by design.
    - anon456846 3y ago
      [flagged]
- graemep 3y ago
  Yes and no. AFAIK it provides controls to ensure a certain level of privacy (with serious flaws IMO). AFAIK it does not do much, if anything to punish breaches caused by incompetence. I have not heard of of any cases where companies were fined for breaches. Not the whole of Europe. The EEA and the UK has legislation based on it what has not yet diverged significantly.
  - TrickyRick 3y ago
    https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ Here's a long list of them
    - graemep 3y ago
      Not really. That links to a list of all enforcement actions. If you search for "technical" you get "organisational and technical measures", and most are organisational rather than technical. If you search by the word "hack" which seems to be the seems to be the usual terminology used there for vulnerabilities being exploited. There are 18 of these of 2182 entries. Not even one per EU country since 2018. Given how common data breaches are it is a tiny number. Most of them do not give details, but those that do suggest the fines are levied only in extreme cases (for example allowing unauthenticated internet access to medical data: https://www.enforcementtracker.com/ETid-1015 https://www.enforcementtracker.com/ETid-1015 ) or for certain types of failure (e.g. not having MFA). Most do not give details. its better than I thought, but still far too little, and all the cases where any details are given it is for only a very narrow range of failures.
      - TrickyRick 3y ago
        The search function isn't that good, "Insufficient technical and organisational measures to ensure information security" are basically all data leaks. Here's a few famous ones, most of which are of course a few years old since government agencies tend to move slow but more recent ones will get what's coming for them. https://www.theguardian.com/technology/2022/nov/28/meta-fined-265m-over-data-breach-affecting-more-than-500m-users https://www.theguardian.com/technology/2022/nov/28/meta-fine... https://ico.org.uk/media/action-weve-taken/mpns/2618524/marriott-international-inc-mpn-20201030.pdf https://ico.org.uk/media/action-weve-taken/mpns/2618524/marr... https://en.wikipedia.org/wiki/British_Airways_data_breach#Consequences_for_British_Airways https://en.wikipedia.org/wiki/British_Airways_data_breach#Co... https://www.bbc.com/news/technology-54931873 https://www.bbc.com/news/technology-54931873

by lxe 3y ago

ahoka 3y ago

There is one in Europe, it’s called GDPR.

albert180 3y ago
[flagged]
- cnewey 3y ago
  Do you have a… less visceral metaphor? Or some information I can read about? I’m curious.
  - anon456846 3y ago
    https://en.wikipedia.org/wiki/Data_Protection_Commissioner#Investigation_of_complaints https://en.wikipedia.org/wiki/Data_Protection_Commissioner#I...
    - cnewey 3y ago
      > In January 2023, DPC was forced to increase the fine issued to Meta Platforms after a review by European Data Protection Board found that the initial fine was insufficient.[12] European Data Protection Board determined that DPC has failed to perform its enforcement responsibility with "due diligence". The critics have pointed out that 7 out of 8 decisions handed down by European Data Protection Board were against the Irish DPC, and that the DPC "always choose the most tortuous, lengthy and expensive legal route to a decision rather than a simple application of EU law".[13] Interesting.
      - albert180 3y ago
        Not very surprising. Ireland's entire economy is being based on being a cheap low tax mailbox provider for US Multinationals, trying to bend laws as much as possible in their favor just fits in there That's why there is a big push on minimum tax rates in the European Union, nobody wants that race to the bottom
  - rootveg 3y ago
    https://www.euractiv.com/section/data-protection/news/irish-data-protection-authority-under-fire-over-facebook-case/ https://www.euractiv.com/section/data-protection/news/irish-...
- stcredzero 3y ago
  I wouldn't be surprised if this later turned out to be by design.
  - anon456846 3y ago
    [flagged]
graemep 3y ago
Yes and no. AFAIK it provides controls to ensure a certain level of privacy (with serious flaws IMO). AFAIK it does not do much, if anything to punish breaches caused by incompetence. I have not heard of of any cases where companies were fined for breaches. Not the whole of Europe. The EEA and the UK has legislation based on it what has not yet diverged significantly.
- TrickyRick 3y ago
  https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ Here's a long list of them
  - graemep 3y ago
    Not really. That links to a list of all enforcement actions. If you search for "technical" you get "organisational and technical measures", and most are organisational rather than technical. If you search by the word "hack" which seems to be the seems to be the usual terminology used there for vulnerabilities being exploited. There are 18 of these of 2182 entries. Not even one per EU country since 2018. Given how common data breaches are it is a tiny number. Most of them do not give details, but those that do suggest the fines are levied only in extreme cases (for example allowing unauthenticated internet access to medical data: https://www.enforcementtracker.com/ETid-1015 https://www.enforcementtracker.com/ETid-1015 ) or for certain types of failure (e.g. not having MFA). Most do not give details. its better than I thought, but still far too little, and all the cases where any details are given it is for only a very narrow range of failures.
    - TrickyRick 3y ago
      The search function isn't that good, "Insufficient technical and organisational measures to ensure information security" are basically all data leaks. Here's a few famous ones, most of which are of course a few years old since government agencies tend to move slow but more recent ones will get what's coming for them. https://www.theguardian.com/technology/2022/nov/28/meta-fined-265m-over-data-breach-affecting-more-than-500m-users https://www.theguardian.com/technology/2022/nov/28/meta-fine... https://ico.org.uk/media/action-weve-taken/mpns/2618524/marriott-international-inc-mpn-20201030.pdf https://ico.org.uk/media/action-weve-taken/mpns/2618524/marr... https://en.wikipedia.org/wiki/British_Airways_data_breach#Consequences_for_British_Airways https://en.wikipedia.org/wiki/British_Airways_data_breach#Co... https://www.bbc.com/news/technology-54931873 https://www.bbc.com/news/technology-54931873