5 ms·

Classic 'two steps removed' syndrome. "I told X to get it done. What X did to get it done is not my fault/responsibility."

by Arrath 2y ago

beaeglebeachh 2y ago
If it's possible to accidentally pay north Korea that should be the fault of whatever financial institution (which is held to far more KYC and AML than animators) caused that to happen, presuming it went through the financial system. HBO likely had no mens rea beyond cash flow out animation flow in. If I can't trust the bank to know more about the UBO of some rando after KYC what the hell are we doing this for?
- acdha 2y ago
  That’s kind of the point: these companies are using outsourcing to avoid the expense of obligations they would have if they did things in house. It’s the same way we end up seeing workers being mistreated or placed in risky situations on behalf of major American companies who would never risk that in a domestic factory with their name on it. A good outcome of this would be more restrictions on outsourcing to China since it’s been repeatedly shown that they will not maintain meaningful restrictions on North Korea, Russia, Iran, etc.: > All three cities are known to have many North Korean-operated businesses and are main centers for North Korea’s IT workers who live overseas.
  - beaeglebeachh 2y ago
    Hell don't stop there. You pay HBO for a subscription? Sanction violation, should have known, straight to jail.
Yeul 2y ago
The EU recently introduced a law to counter that. Companies are responsible for their entire production chain.
carlosjobim 2y ago
What do you mean with "syndrome"? Of course business customers can not be held responsible for what other businesses do. If Amazon buys floor tiles for their factories from a company that provides floor tiles to many other companies, how can Amazon be held responsible for any of their unethical practices? Or is it the faith of hackers that any misdoing in the world should always be traced back and blamed on a tech giant? From the article: "There is no evidence to suggest that the companies identified in the images had any knowledge that a part of their project had been subcontracted to North Korean animators." If it's a subsidiary, that's another case.
- kalleboo 2y ago
  If Amazon sells me floor tiles full of asbestos, they should sure as hell be held responsible, they can't just absolve it with "oh but we bought it from another company, go complain to them" So why is it different if they sell me floor tiles made with slave labor? Global retailers like H&M and IKEA do do audits of their supply chain to try to stop labor abuse (although how effective they are at that is up to debate)
  - carlosjobim 2y ago
    That's a completely different thing. But if you unknowingly buy floor tiles that have been made with unethical practices, should you be held responsible as a customer? Of course not.
godelski 2y ago
You're oversimplifying the issue, which does nothing to bring us closer to a solution. If you tell X to get something done and ALSO give X rules that they must follow and X gets the thing done but __breaks the rules__ then this is different. It is also different if you have reasonable suspicion to expect them to break the rules or are using subversive language to tell them to break the rules. These are different things and have different consequences. If you are truely acting in good faith, then yes, it is a defense. But determining if that's true is not an easy task. There is good faith, coercion, negligence, and willful negligence. These are different things.
- yxwvut 2y ago
  I'd go further to say that rules without any verification aren't really rules. You don't make a rule without the suspicion that it'd be more efficient to break them, and if you're not verifying their adherence to those rules, your rule is meaningless. This is the iterated game that morally bankrupt manufacturers (IE the vast majority) play to insulate themselves in these sort of scandals: - First, they get caught doing A,B,C, so they pass rules about A,B,C - Then they outsource to someone who is willing to do A,B,C, then they get caught outsourcing to violators - Then, they impose rules about A,B,C on these firms, but do no verification of the firms adherence to those rules. It insulates them of liability without ever increasing costs (because the firms still get to break the rules and the company gets to say "I'm Shocked! I told you not to do that!")
  - godelski 2y ago
    I'm more of the position of "trust but verify." The verification process is exceptionally difficult. We're on HN and I think it should be rather common knowledge that attackers almost always beat defenders because the game is asymmetric. Attackers only need to find a single flaw while defenders need to find a large number of defenses. There is a huge difference in the resource expenditures between these two groups. This is related to the reasons why one single person can fuck shit up (e.g. a bad driver can impact tens of thousands of other drivers) but it is difficult for a single person to fix things. It is the nature of unstable equilibria. A society, of any form, depends on trust. Like it or not, there are no trustless systems available to us. Certainly not at any meaningful scale. This does not mean one should be negligent, but rather I'm saying that it isn't easy and the best intentioned can still be taken advantage of. We should recognize this and accommodate this fact when approaching solutions or we will end up with many undesired results.

Classic 'two steps removed' syndrome. "I told X to get it done. What X did to get it done is not my fault/responsibility."

by Arrath 2y ago

Classic 'two steps removed' syndrome. "I told X to get it done. What X did to get it done is not my fault/responsibility."

beaeglebeachh 2y ago

If it's possible to accidentally pay north Korea that should be the fault of whatever financial institution (which is held to far more KYC and AML than animators) caused that to happen, presuming it went through the financial system. HBO likely had no mens rea beyond cash flow out animation flow in. If I can't trust the bank to know more about the UBO of some rando after KYC what the hell are we doing this for?

acdha 2y ago
That’s kind of the point: these companies are using outsourcing to avoid the expense of obligations they would have if they did things in house. It’s the same way we end up seeing workers being mistreated or placed in risky situations on behalf of major American companies who would never risk that in a domestic factory with their name on it. A good outcome of this would be more restrictions on outsourcing to China since it’s been repeatedly shown that they will not maintain meaningful restrictions on North Korea, Russia, Iran, etc.: > All three cities are known to have many North Korean-operated businesses and are main centers for North Korea’s IT workers who live overseas.
- beaeglebeachh 2y ago
  Hell don't stop there. You pay HBO for a subscription? Sanction violation, should have known, straight to jail.

Yeul 2y ago

The EU recently introduced a law to counter that. Companies are responsible for their entire production chain.

carlosjobim 2y ago

What do you mean with "syndrome"? Of course business customers can not be held responsible for what other businesses do. If Amazon buys floor tiles for their factories from a company that provides floor tiles to many other companies, how can Amazon be held responsible for any of their unethical practices? Or is it the faith of hackers that any misdoing in the world should always be traced back and blamed on a tech giant? From the article: "There is no evidence to suggest that the companies identified in the images had any knowledge that a part of their project had been subcontracted to North Korean animators." If it's a subsidiary, that's another case.

kalleboo 2y ago
If Amazon sells me floor tiles full of asbestos, they should sure as hell be held responsible, they can't just absolve it with "oh but we bought it from another company, go complain to them" So why is it different if they sell me floor tiles made with slave labor? Global retailers like H&M and IKEA do do audits of their supply chain to try to stop labor abuse (although how effective they are at that is up to debate)
- carlosjobim 2y ago
  That's a completely different thing. But if you unknowingly buy floor tiles that have been made with unethical practices, should you be held responsible as a customer? Of course not.

godelski 2y ago

You're oversimplifying the issue, which does nothing to bring us closer to a solution. If you tell X to get something done and ALSO give X rules that they must follow and X gets the thing done but __breaks the rules__ then this is different. It is also different if you have reasonable suspicion to expect them to break the rules or are using subversive language to tell them to break the rules. These are different things and have different consequences. If you are truely acting in good faith, then yes, it is a defense. But determining if that's true is not an easy task. There is good faith, coercion, negligence, and willful negligence. These are different things.

yxwvut 2y ago
I'd go further to say that rules without any verification aren't really rules. You don't make a rule without the suspicion that it'd be more efficient to break them, and if you're not verifying their adherence to those rules, your rule is meaningless. This is the iterated game that morally bankrupt manufacturers (IE the vast majority) play to insulate themselves in these sort of scandals: - First, they get caught doing A,B,C, so they pass rules about A,B,C - Then they outsource to someone who is willing to do A,B,C, then they get caught outsourcing to violators - Then, they impose rules about A,B,C on these firms, but do no verification of the firms adherence to those rules. It insulates them of liability without ever increasing costs (because the firms still get to break the rules and the company gets to say "I'm Shocked! I told you not to do that!")
- godelski 2y ago
  I'm more of the position of "trust but verify." The verification process is exceptionally difficult. We're on HN and I think it should be rather common knowledge that attackers almost always beat defenders because the game is asymmetric. Attackers only need to find a single flaw while defenders need to find a large number of defenses. There is a huge difference in the resource expenditures between these two groups. This is related to the reasons why one single person can fuck shit up (e.g. a bad driver can impact tens of thousands of other drivers) but it is difficult for a single person to fix things. It is the nature of unstable equilibria. A society, of any form, depends on trust. Like it or not, there are no trustless systems available to us. Certainly not at any meaningful scale. This does not mean one should be negligent, but rather I'm saying that it isn't easy and the best intentioned can still be taken advantage of. We should recognize this and accommodate this fact when approaching solutions or we will end up with many undesired results.