16 ms·

AT&T has 110 million customers. Let's be optimistic and assume that each customer only has to spend one minute of extra time managing their account due to the b

• pcblues 2y ago
  Personal data cannot be secured. The only way is to not store it. That will (imaginationaly) cost companies in lost revenue for being unable to mine and sell it. Only government can make laws against a company taking your personal information and selling it. Even passwords shouldn't be stored by a company. The years of lost time argument is disingenuous. Over that number of people, 209 years of lost time from 700 million years of lives is nothing.
  • compootr 2y ago
    Whether or not it's disingenuous, it's our time that didn't need to be wasted in the first place by them not storing phone records
    • pcblues 2y ago
      I agree with that. I just don't like big numbers being used to cause emotional responses without proper context. Probably on a spectrum, but it's my beef :)
  • dopylitty 2y ago
    I’d take it a step further. If a technology is impossible to secure it shouldn’t be used. Maybe it’s time to rethink all the parts of our lives we’ve handed over to software.
    • AgentOrange1234 2y ago
      What current technologies do you believe are possible to secure? I am sympathetic to the overall sentiment here, but between any web browser + server stack you are looking at hundreds of millions of lines of code written in unsafe languages. Add on the human factor and there is just no hope of really securing this.
      • kragen 2y ago
        sel4, tweetnacl on an avr, pdf/a, html3, gzip, lwip, etc., running on purpose-built hardware. too bad it's not self-hosting yet
  • tomComb 2y ago
    There are lots of companies that take security seriously and don’t lose their customers data. Which is good, because there are companies that need to hold customer data. Companies that don’t take security seriously and lose peoples data should be punished accordingly. Companies that sell customers data should be identified. But if we treat them all the same, then we let the bad companies off the hook, and punish the responsible companies unfairly.
    • kragen 2y ago
      there are companies that have already had their customers' data exfiltrated and will have it exfiltrated in the future, companies that will only have it exfiltrated in the future, and companies that are about to be dissolved. there is no fourth category. computer security is not currently achievable; the best we can hope for is to contain the damage from the inevitable breaches and reduce their frequency new security holes get introduced faster than old ones get patched, and that will remain true for the foreseeable future
• voisin 2y ago
  But hey, in 5-7 years there will be a settlement to the inevitable class action lawsuit and each of these customers (that fills in a form, ensuring only a small fraction actually do) gets a $3.75 credit on their next bill. The lawyers will get 30% of the settlement and each walk away with several million dollars. Justice! chef’s kiss
  • mandmandam 2y ago
    Idk man, the lawyers who made the rules say it's a great system. Like, it might be an unending atrocity beyond all human comprehension, but, $666/hr soothes a lot of conscience and quiets a lot of tongues.
  • fshbbdssbbgdd 2y ago
    If we go with the logic of the grandparent comment, where were can measure the harm by adding up a minute of time wasted across millions of people to get a big amortized number, it seems commensurate that each of those people can be compensated for their minute of wasted time with a few dollars.
  • banku_brougham 2y ago
    This is deeply accurate
  • qingcharles 2y ago
    This is from an email I got yesterday from PayPal: "Google Referrer Header Privacy Settlement has sent you $0.11 USD."
• wkcheng 2y ago
  Yeah, you're right. Data breaches are essentially just slaps on the wrist to companies like AT&T. Maybe it's possible to fine them based on the proportion of the userbase that was affected and the profits they generated for a certain time period. I wonder if this will push companies to stop using external vendors to store and process data. If companies stored all of their info in house, it would prevent the case where compromising one vendor compromises everyone's data. But it would also mean that each individual company needs to do a good job securing their data, which seems like a tall ask.
  • hnlmorg 2y ago
    The reason some companies use external vendors is to outsource the risk.
  • ungreased0675 2y ago
    I propose that the fines should be based on what the data would be sold for on a dark web forum. These breaches should be exponentially more expensive, which would incentivize companies to retain less sensitive data.
• choppaface 2y ago
  The AT&T app and website are so bad it takes way longer than 1 minute to log in to e.g. pay your bill. The United States needs to raise the bar for large-cap negligent operators and fine the company enough to make shareholders listen.
  • AnthonyMouse 2y ago
    In approximately 100% of cases, if your intuition is to say "this company is too large should be fined/regulated more," what you should actually say is "this company is too large and should be broken into many smaller entities."
    • physhster 2y ago
      We should break down AT&T. Oh wait. We tried already and re-consolidated? Ow.
      • AnthonyMouse 2y ago
        Part of breaking them up is supposed to be not letting them re-consolidate. Mergers involving any entity that already has 15% market share should just be flatly disallowed.
        • anotheruser13 2y ago
          This is not the AT&T Judge Harry Greene broke up. This AT&T is a roll up of most of the RBOCs the breakup created.
          • mandmandam 2y ago
            Yes, a man never steps in the same river twice. Not really the point though, is it.
    • choppaface 2y ago
      Or nationalize parts of it, as has been done for electricity, water, and the courts.
• edanm 2y ago
  > Laws related to data breaches need to have much sharper teeth. Companies are going to do the bare minimum when it comes to securing data as long as breaches have almost no real consequences. Maybe pierce the corporate veil and criminally prosecute those whose negligence made this possible. Maybe have fines that are so massive that company leadership and stockholders face real consequences. I really dislike this attitude. AT&T were attacked, by criminals. The criminals are the ones who did something wrong, but here you are immediately blaming the victim. You're assuming negligence on the part of AT&T, and to the extent you're right, then I agree that they should be fined in a bigger manner. But the truth is, given the size and international nature of the internet, there are effectively armies of criminals, sometimes actually linked to governments, that have incredible incentives to breach organizations. It doesn't require negligence for a data breach to occur - with enough resources, almost any organization can be breached. Put another way - you trust a classical bank, with a money, to secure your money from criminals. But you don't expect it to protect your money in the case of an army attacking it. But that's exactly the situation these organizations are in - anyone on Earth can attack them, very much including basically armies. We cannot expect organizations to be able to defend themselves forever, it is an impossible ask in the long run. This has to be solved by the equivalent of a standing army protecting a country, and by going after the criminals who do these breaches.
  • dwattttt 2y ago
    In this analysis, the effort the bank puts towards defending themselves is relevant. We wouldn't blame the bank for an army attacking them, but if they left the door unlocked and the neighbours kids made off with your money you very rightly would feel differently.
    • Kailhus 2y ago
      Which does make me wonder why we never really hear of banks being attacked and robbed in such a way? One would think they would be the most obvious targets to throw an army of criminals at.
      • edanm 2y ago
• abdullahkhalids 2y ago
  The correct way is to follow what all other engineering and trade (medicine/law) already follow. Some software engineers are licensed. A company must hire these software engineers, and any changes to what data is saved or how is saved must be signed by these engineers. If a breach occurs, an investigation occurs and if these licensed software engineers are found to be negligent, they lose their license. If they are found to be at fault, they get criminal penalties. This, of course, must be coupled with penalties for management personals as well.
  • AnthonyMouse 2y ago
    This kind of system has consistent led to regulatory capture by the licensed industry. Even the mechanism of operation de facto assumes a significant gatekeeping barrier to getting a license, since otherwise companies would just pick one most willing to cut corners to save costs, or pay the license fee to get greenhorns certified because that costs less than adding two years to the development schedule to do it well. Making everything cost quadratically more than it already does is not a good solution. What you want here is for them not to be holding the data to begin with. The solution to which is to just let customers sue them. Not for $0.30 and "free credit monitoring" but for actual money. Then companies can choose whether they want to mitigate their risk by doing actual security or by not storing the data to begin with, but most likely the second one is their better option.
    • abdullahkhalids 2y ago
      > This kind of system has consistent led to regulatory capture by the licensed industry. That is indeed the intention. To counteract the financial incentives of shareholders (which result in bridges collapsing or data breaches) with the financial and legal incentives of a special class of employees - licensed engineers. The reasons this works better than letting people sue after the accident has already happened [1] is because that it gets the incentives right. In sue-after model the responsibility before an accident has happened to make the product safe is quite diffuse across the whole organization, and the decision makers (C-suite) do not in fact have the expertise to determine if the product is unsafe. Giving licensed engineers veto powers over the entire C-suite and the shareholders is indeed how you concentrate responsibility at a single point. This type of licensing model has worked wonders in civil engineering, electronics engineering, law, medicine etc in improving safety standards for the public. Software engineering is not special. [1] Think letting the victims of the bridge collapse suing as the only method of preventing bridge collapses. This is not how things operate.
• yummypaint 2y ago
  Hurting the shareholder is the only option to actually fix anything. Until the C-suite and board are forced to face the music caused by rich people being parted from their money, they'll just continue patting themselves on the back and giving themselves bonuses.
  • robocat 2y ago
    If bankruptcy can clear liabilities then your suggestion won't help. The shareholders are usually gone by the time the bill comes due: it's often cheaper to go bankrupt. And there's a whole private equity industry revolving around taking dirty liabilities and slowly bankrupting a company to squeeze the last dollar out before shutting down. Look at the same problem with environmental disasters that were created by corporations. The problem with security liabilities is similar? Externalities are hard to get shareholders to pay for.
    • Nasrudith 2y ago
      You don't need to try to seek value from the shareholders in a bankruptcy to hurt them. (Doing so would be going against rule of law and as for changing the law, well do you hear that giant sucking sound of funds fleeing your economy?) Just having their holding's value go to zero is sufficient.
      • robocat 2y ago
        Maybe irrelevant for security flaws, but the point is that externalities can easily exceed market capitalisation. Trading while insolvent is illegal, but that is hard to judge with liabilities. Examples are Johnson&Johnson (public) and Purdue Pharma (private).
  • frogeyedpeas 2y ago
    I agree. Shareholders can vote and decide the direction of a company. They should also be held liable for any problems the company causes. If the company is fined it should come out of company and then shareholder pockets. I might even add courts should be able to award damages by directly fining share holders. If a company does something severely illegal then very large shareholders should risk jail time. It’s your company after all as a shareholder. You own it. It’s no different if your dog bites someone or child breaks the law. You have to pay the fines.
• gaze 2y ago
  Everyone says what needs to happen. Every thread has this same exact post. We all know what needs to happen. How _would_ this ever happen? This is a board of innovators -- innovate!
  • geraldwhen 2y ago
    No one here can force AT&T to spend more money on IT. If they do, even briefly, everyone involved will be laid off and outsourced within a few years.
  • kragen 2y ago
    we all know this does not need to happen, if 'we' are people familiar with the quality of software in already-regulated environments
  • deleted 2y ago
    [deleted]
• devinplatt 2y ago
  Penalties would also incentivise businesses to hide data breaches.
  • groby_b 2y ago
    That is the worst case outcome of penalties, and it carries significant risk of whistle blowing. The default case will be compliance, because compliance is simply cost of business, something businesses understand well. Meanwhile, currently businesses are doing shit all about data breaches except handing out the absolutely useless "2 years identity monitoring", so from a consumer view it really can't get much worse. In general, the idea that penalties make people hide their bad behavior, so we shouldn't penalize bad behavior, is just extremely misguided. Because without penalties, we normalize bad behavior.
    • doctor_eval 2y ago
      Are strong whistleblower protections what’s needed to balance this? As an Australian I am absolutely horrified that we continue to put people in jail who have blown the whistle on the government here, and it makes me think that large organisations are absolutely terrified about strong whistleblowing protections. This all suggests to me that whistleblower laws would be very effective.
      • sethrin 2y ago
        Whistleblower is a very revealing thing to call Mr. Assange.
        • yupyupyups 2y ago
          Another example would be David McBride who was in the Australian military and blew the whistle on war crimes. He recently got sentenced to jail while actual exposed war criminals are free.
        • doctor_eval 2y ago
          I understand that Wikileaks is controversial but I don't think there is any dispute that he has acted in the role of whistleblower to some extent. But that's not really the point I'm trying to make, so I've removed the reference.
• lumb63 2y ago
  The people “whose negligence made this possible” are probably just rank-and-file employees. Careful what you wish for. I know I sure wouldn’t want to be legally liable if my software were vulnerable to something I didn’t know about. Maybe a reasonable first step is third-party standards, audits, and certifications around data security to make privacy- and security-conscious consumers aware of what a company is doing. If consumers really find value in that, then they will preferentially deal with that company, and other companies will follow suit.
  • advael 2y ago
    Nonsense. The people who should hold responsibility are the people who have decision-making power and derive financial benefit from these choices. A rank-and-file employee is a scapegoat given the incentives at play in the system, even if they nominally wrote the vulnerable code
  • pjbeam 2y ago
    My read of responsible people are corporate officers and executives--people who actually choose what to work on and are substantially rewarded by the corporation.
  • packetlost 2y ago
    No, the people whose name is attached to budget decisions and higher level company direction that leads to this are the ones who are responsible.
  • eldaisfish 2y ago
    this is already an established principle in other engineering fields. If a civil engineer screws up and a building collapses, both that engineer and the engineering firm are liable. Why should the software industry be any different?
    • globalnode 2y ago
      because software developers aren't engineers? -- elephant in the room.
• dheera 2y ago
  Alternatively, we need sharper teeth around the consequences of this data breath. Why are we using SMS for 2FA everywhere? Why does AT&T have to have residential addresses and KYC for all of its customers? These are the things that should be banned. The government official that mandated all this crap should be forced to sleep with scorpions for 9 years and stink bugs for 3 more years. If so the leak would be of much less consequence.
• trompetenaccoun 2y ago
  It surprises me that there isn't a single comment pointing out that corporations like AT&T don't collect all that data for fun. This actually costs them a lot of money, but they're legally required by the government. While everyone is blaming the company, did you not take a second and contemplate how weird it is that you're fine with the government (and now everyone else es well) getting a record of all your phone activity? I'm old, back in my youth we'd have referred to that as a dystopian surveillance state.
  • 23B1 2y ago
    Pish posh. They also sell that data at an increidble markup – and without the knowledge of their customers – to anyone who'll pay, including governments and their cutouts.
  • Calvin02 2y ago
    Banks are required to maintain financial transaction records. Is the argument that governments don't have a good reason to mandate record collection? Why can't I ask my government to keep me safe from terrorists but also expect that companies will not just be careless with the data they collect as part of that?
    • oxide 2y ago
      I agree. I think it's reasonable to expect companies to safeguard that information from malicious actors.
      • SoftTalker 2y ago
        I don't agree. I don't think it's reasonable to expect it, because companies show over and over that they cannot do it. And let's face it, the only reason your company hasn't fallen victim to a data breach or ransomware is that you haven't been seriously targeted yet. We need to change our approach. We need to look at why these kinds of data are valuable, and then make them not valuable. Then nobody will bother with hacking to get it.
• downWidOutaFite 2y ago
  The law that would have prevented this breach would be to make it illegal for telcos to sell customer data. The reason AT&T was feeding ALL the data to Snowflake was to sell their customer's location and social graph to marketers. It is unconscionable to me that this in not currently the law.
  • hanspeter 2y ago
    Do you have a source for that claim?
    • hipadev23 2y ago
      * https://www.fcc.gov/document/fcc-fines-largest-wireless-carriers-sharing-location-data https://www.fcc.gov/document/fcc-fines-largest-wireless-carr... * https://www.vice.com/en/article/nepxbz/i-gave-a-bounty-hunter-300-dollars-located-phone-microbilt-zumigo-tmobile https://www.vice.com/en/article/nepxbz/i-gave-a-bounty-hunte... * https://www.vice.com/en/article/m7vqkv/how-fbi-gets-phone-data-att-tmobile-verizon https://www.vice.com/en/article/m7vqkv/how-fbi-gets-phone-da... * https://www.vice.com/en/article/3a87bv/fcc-propose-fines-verizon-att-sprint-tmobile-selling-location-data https://www.vice.com/en/article/3a87bv/fcc-propose-fines-ver... * https://krebsonsecurity.com/2024/04/fcc-fines-major-u-s-wireless-carriers-for-selling-customer-location-data/ https://krebsonsecurity.com/2024/04/fcc-fines-major-u-s-wire... Joseph Cox is basically the only investigative journalist that digs into constant PII violations before the leaks happen.
      • hanspeter 2y ago
        Thanks!
    • downWidOutaFite 2y ago
      Here's Snowflake bragging about helping telcos sell location data: https://www.snowflake.com/blog/telecom-data-partnerships/ https://www.snowflake.com/blog/telecom-data-partnerships/
      • 2y ago
• knodi123 2y ago
  33% of all living americans? how can it be that much?
  • grumple 2y ago
    There are basically 3 carriers in the US, AT&T, T-Mobile, and Verizon; other carriers use the networks of those 3.
    • greenavocado 2y ago
      Recount
• nilamo 2y ago
  Nothing happened to Experian, and those clowns have beaches every year. The USA has so far proved that we don't care about privacy and don't believe data is real.
  • ClumsyPilot 2y ago
    > don't believe data is real. Oh but they do, try taking some data that belongs to a corporation and see how quickly law enforcement responds. Aaron Swartz found out the hard way It’s only when you steal personal data that nobody cares.
• 1vuio0pswjnm7 2y ago
  The breach here was not against AT&T but against a cloud computing company called Snowflake. Cloud computing companies, so-called "tech" companies, and the people who work for them, including many HN commenters, advise the public to store data "in the cloud". They encourage the public, whether companies or individuals, to store their data on someone else's computer that is connected to the open internet 24/7 instead of their own, nevermind offline storage media. Countless times in HN threads readers are assured by commenters that storing data on someone else's computer is a good idea because "cloud" and "_____ as a service". Silicon Valley VC marketing BS. "Maybe pierce the corporate veil and criminally prosecute those whose negligence made this possible." Piercing the veil refers to piercing limited liability, i.e., financial liability. Piercing the veil for crimes is relatively rare. Contract or tort claims are the most common causes of action where it is permitted. There is generally no such thing as "criminal negligence" under US law. Negligence is generally a tort. As for fines, if there were a statute imposing them, how high would these need to be to make Amazon, Google, Microsoft or Apple employees and shareholders face "real consequences". Is it negligent for AT&T to decide to give data to a cloud computing company such as Snowflake? HN commenters will relentlessly claim that storing data on someone else's computers that are online 24/7 as a "service", so-called cloud computing, is a sensible choice. Data centers are an environmental hazard in a time when the environment is becoming less habitable, they are grossly diminishing supplies of clean water when it is becoming scarce, and these so-called "tech" companies are building them anyway. Data centers are needed so the world can have more data breaches. Enjoy.
  • Johnny555 2y ago
    >The breach here was not against AT&T but against a cloud computing company called Snowflake. It wasn't really a Snowflake breach, if it's like the other Snowflake data leaks, AT&T didn't set up MFA for a privileged account and someone got in with a password compromised by other means. For smaller companies I'd be willing to put more blame on Snowflake for not requiring MFA, but AT&T is large enough to have their own security team that should know what they are doing. This is yet another wakeup call for all companies - passwords are not secure by themselves because there are so many ways for passwords to be leaked. Even though SMS MFA is weak, it's far better than a password alone.
• dreamcompiler 2y ago
  Exactly. There is currently no meaningful penalty when a company fails to protect private data or violates its own privacy policies, so of course they continue to do these things because each either makes them more money or costs them less money. Prison time being on the table for officers of the corporation is the only thing that will change this behavior.
• TechDebtDevin 2y ago
  At&t is up there with defense contractors with how intertwined their businesses are with the DoD. They're basically an extension of the intelligence agencies here in the US. They don't have consequences, much like Boeing.
• highwaylights 2y ago
  Genuinely chonky fines seems to be the answer to this problem, as it aligns incentives with rewards/penalties (if you’re lax about how your company approaches user data then you’ll be at financial risk). Piercing the veil to prosecute those “responsible” seems like it would just incentivise the business to carry on as normal but with employees that are contractually designated (i.e. forced) to be fall guys if anything goes wrong.
  • hedora 2y ago
    If PG&E has taught us anything, utility companies can literally blow up and burn down cities and no amount of fines or paying for the damages done will matter to them. Monopolies can always just pass the cost of the fine to their customers.
• hedora 2y ago
  Imagine a world where suffering a data breach meant you could no longer collect, let alone hold or sell that class of data for a decade, and this rule preempted laws that required data gathering. AT&T would be nearly equivalent to an E2E service overnight. The lines wouldn’t be encrypted, so the NSA would still tap them, but at least there would be zero mutable storage in the AT&T data centers (except boot drives, SMS message queues, and a mapping between authorized sims and phone numbers). In this day and age, why do they even maintain call records? They don’t need them for billing purposes, which was the original purpose of keeping them.
• batch12 2y ago
  That's quite a CPNI incident. Wonder what their fine will be. [0] [0] https://www.tlp.law/2023/08/01/fcc-proposes-20-million-fine-for-cpni-violations/#:~:text=The%20FCC's%20rules%20do%20not,affected%20by%20the%20Companies'%20practices https://www.tlp.law/2023/08/01/fcc-proposes-20-million-fine-....
• rbetts 2y ago
  Who is ultimately responsible, though when data is stolen in this fashion? The analyst who ETL'd this to Snowflake without MFA enabled? Or maybe the employee who inadvertently installed a data sniffer that captured usernames and passwords? Really want to send your coworkers to jail for falling for a phishing attack? If you want corporate-death-sentence level fines, are you willing to work in environment with exceedingly strict regulatory oversight? Will you work from an office where the computing infrastructure is strictly controlled? Where you can't bring personal devices to work? Where you have no privileges to alter your work station without a formal security review? Why not advocate for more resources to capture and try the actual criminals? Or, as elsewhere in this thread, simply make this kind of data collection illegal?
  • axus 2y ago
    If the data collection becomes illegal, what's the penalty for breaking that law? We're back to figuring out an appropriate punishment.
  • inetknght 2y ago
    > If you want corporate-death-sentence level fines, are you willing to work in environment with exceedingly strict regulatory oversight? Will you work from an office where the computing infrastructure is strictly controlled? Where you can't bring personal devices to work? Where you have no privileges to alter your work station without a formal security review? If it means that privacy and safety is actually respected then yes. Working in an environment with "exceedingly strict" regulatory oversight would be a reassurance that observed violations will be dealt with in a timely fashion instead of put in the backlog and never addressed. > Why not advocate for more resources to capture and try the actual criminals? Yes, why not? While we're at it, let's try and capture the easily-spotted criminals who perform the most trivial of attacks to servers. Just open up your SSH server logs and start going after and preventing the fecktons of log spam that hide real attacks. > Or, as elsewhere in this thread, simply make this kind of data collection illegal? Making something illegal is great! Unfortunately it doesn't really do anything to help people after it's been stolen a second time (first time was by AT&T if it were illegal).
• c22 2y ago
  If you're going to start holding companies accountable for wasting people's time then AT&T has a lot more to answer for than this one little event.