17 ms·

It surprises me that there isn't a single comment pointing out that corporations like AT&T don't collect all that data for fun. This actually costs them a lot o

It surprises me that there isn't a single comment pointing out that corporations like AT&T don't collect all that data for fun. This actually costs them a lot of money, but they're legally required by the government. While everyone is blaming the company, did you not take a second and contemplate how weird it is that you're fine with the government (and now everyone else es well) getting a record of all your phone activity? I'm old, back in my youth we'd have referred to that as a dystopian surveillance state.

23B1 2y ago
Pish posh. They also sell that data at an increidble markup – and without the knowledge of their customers – to anyone who'll pay, including governments and their cutouts.
Calvin02 2y ago
Banks are required to maintain financial transaction records. Is the argument that governments don't have a good reason to mandate record collection? Why can't I ask my government to keep me safe from terrorists but also expect that companies will not just be careless with the data they collect as part of that?
- oxide 2y ago
  I agree. I think it's reasonable to expect companies to safeguard that information from malicious actors.
  - SoftTalker 2y ago
    I don't agree. I don't think it's reasonable to expect it, because companies show over and over that they cannot do it. And let's face it, the only reason your company hasn't fallen victim to a data breach or ransomware is that you haven't been seriously targeted yet. We need to change our approach. We need to look at why these kinds of data are valuable, and then make them not valuable. Then nobody will bother with hacking to get it.
    - simfree 2y ago
      This data is valuable primarily for spam mitigation and perhaps customer profiling. Expect every SMS and MMS sent or received to be part of a spam mitigation and profiling program where it's stored indefinitely. Apple not encrypting RCS is likely due to similar factors, where they have seen existing spam problems on RCS that are much harder to root out when you have end-to-end encryption.
      - pooper 2y ago
        In my not so humble opinion, the biggest problem with phone numbers in general is the general ability to spoof any number. Please correct me if I am wrong but stir/shaken is only available on the new stuff and even then there is no good way to track the origin of a phone call. This is beyond ridiculous and clearly leadership is asleep at the wheel. There needs to be a firm timeline -- maybe a year maybe a decade, I don't know the details but something that allows customers to transition to a system where all calls can be traced through the network with 100% guarantee. Step zero is actually having a process/protocol where any phone is tamper evident meaning we can tell 100% that this call came from this operator and the operator knows the call came from this user. Perhaps the first phase allows individual users to opt in. So we would ask our operators to only route us calls and texts that positively identify themselves as fully traced with whatever the new protocol is that will replace SS7/sigtran so the origin of a call or text is positively identified. If this guarantee is not available, route the call to spam inbox somehow. Then the hard part I'm guessing is fixing all the defects? The second phase is to say after this date, no operator in the US is allowed to relay calls that are from legacy systems. This will likely take many years as I don't know how we will handle international calls and texts. But at some point we have to put our foot down and say enough is enough.
        miki123211 2y ago
        > Step zero is actually having a process/protocol where any phone is tamper evident meaning we can tell 100% that this call came from this operator and the operator knows the call came from this user. This basically doesn't work because the mapping between phone numbers, users and operators isn't exactly 1:1:1. Some businesses have a single number that they use as Caller ID on all their calls , despite having one corporate HQ in New York, one branch in New Orleans and one customer support callcenter in New Delhi. All of these use different carriers and are based in different countries, yet they're all legally authorized to use that number. If you want to read more about why this is such a hard problem to solve, see https://computer.rip/2023-08-07-STIRred-AND-SHAKEN.html https://computer.rip/2023-08-07-STIRred-AND-SHAKEN.html
  - phito 2y ago
    I don't think it is. I assume everyone gets hacked eventually. It's really hard (I would argue impossible) to make a 100% secure computer system, and if they're operated by people, you're terribly vulnerable.
- feedmetrash 2y ago
  [dead]
- kbolino 2y ago
  The government can't keep its own data safe, as the OPM breach showed. Apart from some resignations, nobody faced any serious consequences for that either.
  - Angostura 2y ago
    Even more reason for regulatory requirements covering data security for all organisations- both private and public sector
- kaliqt 2y ago
  Government has no right to track that either, they themselves launder trillions, start wars and massacre millions, even a drug lord is a petty criminal compared to them, and it's clear their tracking of any and all records of any type is more about control than safety, thus it should be disregarded as an argument and be done away with entirely.
  - JumpCrisscross 2y ago
    > they themselves launder trillions, start wars and massacre millions, even a drug lord is a petty criminal compared to them And then people wonder why privacy has a difficult time getting public support.
    - Nasrudith 2y ago
      No, we already know it is because people are complete idiots who not only fall for 'tiger repelling rocks' but actively demand them.
- xkcd1963 2y ago
  You are more likely striken by lightning than coming in contact with terrorism whatsoever
- elric 2y ago
  Many (all?) banks keep financial transaction records for way longer than what is legally required. Thankfully, most banks are technically incompetent and are unable to easily use data that is not relatively recent. In fact, one bank I worked for had to load transactions from a CD-ROM archive which contained all the transactions in a printable text format (the same format as their printed bank statements). Multiple CDs per day, with no indexing or identification beyond the date. Trying to find a specific 10 year old transaction was very hard work indeed.
yupyupyups 2y ago
That's a good point. Had they valued the citizens' privacy they would have done the opposite, that is make it illegal for network providers to store customer data that is not essential for them providing the services. But I guess creating a dystopian surveillance state is more of a priority.
hluska 2y ago
Why they hold it and how they protect it are valuable conversations. But their customers deserve something akin to security regardless of the why.
- simfree 2y ago
  Spam mitigation and management is a huge bugaboo in wireless networks today. The big three wireless carriers in the USA today formed a cartel called The Campaign Registry that seeks out TINs/EINs and the SSNs of the owners of Sole Proprietorships and LLCs as part of a lengthy approval process to be allowed to send texts. It's a great extra judicial rent seeking machine that bans any SHAFT content (sex hate alcohol, tobacco, firearms and anything tangentially related) along with hefty fines for anyone that they feel has crossed said boundaries. Letting the morality police run amok on our Telecom networks here in the USA is happening, and they also want all the data they can get along with bribes from businesses. Ajit Pai created the opening for this mess, and the current FCC has done nothing to clean this up (though given recent SCOTUS rulings, who knows if they ever had the authority...)
  - nazgul17 2y ago
    Tangent, but it's ridiculous that sex is in the same group of undesirables such as firearms, alcohol, tobacco and hate.
    - simfree 2y ago
      That T-Mobile is out here slapping spam mitigation blocks on phone numbers who received SHAFT content from numbers on T-Mobile's network is pretty ridiculous, but silently blocking and providing no appeal or escalation path is just how we let companies operate these days.
rsingel 2y ago
There's no federal law requiring AT&T to hold onto this data. There's possibly a FISA court requirement (too secret to reveal), but AT&T has long been an exceedingly willing part of the gov's spying apparatus. It fed these records and Internet data to the feds without any court order, and only escaped legal troubles when Obama, contrary to his campaign promises, gave AT&T, Verizon and more retroactive immunity
- imroot 2y ago
  I'm no longer under this specific NDA, so, I can talk a bit about this. It was well known in the wireless industry that ATT collected and kept the most data on all of the carriers: 7 years for text metadata, "7 years" for call history (I put that in quotations because it was rumored that ATT kept them indefinitely, but, there were technical limitations for restoring data that far back), and 7 years for the contents of the text messages themselves. Verizon was up there as well, but, I don't remember specifics. The carrier that I worked with kept only 3 days content of the actual messages, 28 days for the text message metadata, and 28 days for the call records for their enforcement database, but, they could get calling records and sms envelope information for billing back 7 years, and at the time, we had to implement sharding at the database layer that maintained the warrant database due to the amount of traffic that we were receiving from the calling systems and the amount of queries/data that we were sending out, in near realtime, to law enforcement users who paid $10,000/month for access to that data. AT&T wasn't storing this data out of the kindness of their heart, it was a (probably small) revenue stream for them.
  - mozman 2y ago
    Ah, back in the day the FBI would pay our CTO $5000/hr to talk to and work with him. On top of that we would charge them a monthly colo fee for their equipment that collected data of customers. Sometimes they had warrants, but mostly just bought the data. A year or so after 9/11 and that relationship lasted years.
    - niutech 2y ago
      Welcome to the US - claimed "praiser" of freedom, but with no respect for privacy. Even the EU is better at maintaining privacy than the US.
bastawhiz 2y ago
Being required to do something doesn't justify doing it poorly. AT&T brought in over $3 billion with a B of profit with a P in Q1 2024. They have more than enough money to secure their systems. They're not struggling. In March of this year they bought back 157M of their stock. They could have instead put that money towards security, but they didn't: they put it towards enriching shareholders.
- stickfigure 2y ago
  Money can't buy competence, at least not at organizational scale.
  - cqqxo4zV46cp 2y ago
    Sure, but “incentivise a business to do something, and they’re more likely to do it” is still true.
  - janalsncm 2y ago
    Fine, but they can clearly afford to pay for a lack of it.
    - vuln 2y ago
      Fine is cheaper than solving compliance issues. Many such cases unfortunately.
  - bastawhiz 2y ago
    Maybe not for execs, but if not for money you literally couldn't hire competent security folks
- mozman 2y ago
  Enriching shareholders is exactly what they are required to do. What, nobody is allowed to make money anymore?
  - Slyfox33 2y ago
0xcde4c3db 2y ago
I've never heard of this, and cursory web searches don't seem to be turning up anything relevant (although that's admittedly not saying much with the state of search lately). Can you explain how the law requires this level of data retention?
- incompatible 2y ago
  Apparently they'd uploaded their customer data into something called Snowflake to do some kind of analysis on it, but it wasn't particularly well secured. They haven't said why they were analysing the data, but there's no indication that it had anything to do with government demands.
sp312tol 2y ago
> how weird it is that you're fine with the government getting a record of all your phone activity I don't like it, but accept it as the lesser evil. I'm from Europe and I believe the number of reported prevented terror attacks. The agencies need data access for that. Not good, but necessary. But are you aware that Meta, Google, Apple, MS, etc. collect every kind of information about every user of Android, iPhone or WhatsApp, Insta, Facebook, Windows? Phone manufacturer, huge apps like TicToc as well. The kind and size of that data is crazy beyond imagination. I don't care if the government can get access to my WhatsApp messages when some of the most irresponsible companies, collect and use everything to their advantage. Are you really that naive and think that Meta doesn't analyse their gigantic data lake including billions of WhatsApp messages to predict the results of elections? That is the real danger to democracy.
- hellojesus 2y ago
  > I don't care if the government can get access to my WhatsApp messages when some of the most irresponsible companies, collect and use everything to their advantage. This is all voluntary. You give those companies your data. You don't have to. I use grapheneos and do not use any of those socials, for example.
  - saurik 2y ago
    The problem comes as people start shoving more and more DRM around, whether it be Google Play Protect, the new Android WebView Media Integrity API, or an eventual reboot of the Web Environment Integrity proposal.
    - hellojesus 2y ago
      I understand, but I also won't participate in those and will actively work to undermine them.
xethos 2y ago
Sure - pretty well every corporation you purchase a service from is required to store your credit card information as well. But there are stiff penalties from the government and credit card processors for unauthorized access to that information; consequently, it's rarely stolen. Your address, cell metadata, phone number, email address, and passwords are leaked pretty well contsantly though. It's not that corporations are incompetent. The laws and regulations mean it's not worth the cost to treat your personal information with any real respect.
- Terretta 2y ago
  > store your credit card information ... but there are stiff penalties from the government and credit card processors for unauthorized access to that information; consequently, it's rarely stolen Citation: The Onion? The Payment Card Industry Data Security Standard (PCI DSS) is the main information security standard for organizations that process credit or debit card information must abide by. The guidelines established in PCI DSS cover how to secure data handling processes. So here are the top 5 info breaches: https://www.goanywhere.com/blog/the-5-biggest-pci-compliance-breaches https://www.goanywhere.com/blog/the-5-biggest-pci-compliance... To be fair, if what happened to Heartland happened more often, PCI compliance would be taken more seriously, and breached less often.
  - xethos 2y ago
    I'm not saying it doesn't happen. Credit card data is too valuable to never be stolen. I am saying that ~37 to >500 is a hell of a difference in how frequently things are stolen [0] You pointed out how there are guidelines for holding that information, I'm saying there are consequences [1]. I'm following that up by saying that the consequences for mishandling customer information are not nearly as severe. They do not result in 6 figure fines. I'm saying the severe consequences to mishandling CC data have led to the incredible disparity shown in the first paragraph [0] https://haveibeenpwned.com/PwnedWebsites https://haveibeenpwned.com/PwnedWebsites [1] https://resourcehub.bakermckenzie.com/en/resources/global-data-privacy-and-cybersecurity-handbook/north-america/canada/topics/penalties-for-non-compliance https://resourcehub.bakermckenzie.com/en/resources/global-da...
Aeolun 2y ago
The government isn’t distributing my data to everyone else (so far). For profit companies have a pretty massive list of breaches so far.
- t0bia_s 2y ago
  You are forced to give your personal data to government. You don't have to give your data to any company. That's huge difference.
  - chopin 2y ago
    Only if you cut all ties with civil society and live solitary.
    - t0bia_s 2y ago
      Only dead fishes flow with the stram.
wraptile 2y ago
"legally required by the government" to keep securely. If you can't keep to the rules don't play the game. I'm sure any other telecom would be glad to get the market share.
sulandor 2y ago
do yourself a favor and accept that phone records have never not been recorded and the data is mostly available for purchase. the company is to blame because they are complicit or negligent in the bespoke surveillance state, probably both.
xyst 2y ago
welcome to a post 9/11 world. privacy has been dying for a long time. the general population doesn't care anymore. they freely give up everything to big tech anyways.

23B1 2y ago

Pish posh. They also sell that data at an increidble markup – and without the knowledge of their customers – to anyone who'll pay, including governments and their cutouts.

Calvin02 2y ago

Banks are required to maintain financial transaction records. Is the argument that governments don't have a good reason to mandate record collection? Why can't I ask my government to keep me safe from terrorists but also expect that companies will not just be careless with the data they collect as part of that?

oxide 2y ago
I agree. I think it's reasonable to expect companies to safeguard that information from malicious actors.
- SoftTalker 2y ago
  I don't agree. I don't think it's reasonable to expect it, because companies show over and over that they cannot do it. And let's face it, the only reason your company hasn't fallen victim to a data breach or ransomware is that you haven't been seriously targeted yet. We need to change our approach. We need to look at why these kinds of data are valuable, and then make them not valuable. Then nobody will bother with hacking to get it.
  - simfree 2y ago
    This data is valuable primarily for spam mitigation and perhaps customer profiling. Expect every SMS and MMS sent or received to be part of a spam mitigation and profiling program where it's stored indefinitely. Apple not encrypting RCS is likely due to similar factors, where they have seen existing spam problems on RCS that are much harder to root out when you have end-to-end encryption.
    - pooper 2y ago
      In my not so humble opinion, the biggest problem with phone numbers in general is the general ability to spoof any number. Please correct me if I am wrong but stir/shaken is only available on the new stuff and even then there is no good way to track the origin of a phone call. This is beyond ridiculous and clearly leadership is asleep at the wheel. There needs to be a firm timeline -- maybe a year maybe a decade, I don't know the details but something that allows customers to transition to a system where all calls can be traced through the network with 100% guarantee. Step zero is actually having a process/protocol where any phone is tamper evident meaning we can tell 100% that this call came from this operator and the operator knows the call came from this user. Perhaps the first phase allows individual users to opt in. So we would ask our operators to only route us calls and texts that positively identify themselves as fully traced with whatever the new protocol is that will replace SS7/sigtran so the origin of a call or text is positively identified. If this guarantee is not available, route the call to spam inbox somehow. Then the hard part I'm guessing is fixing all the defects? The second phase is to say after this date, no operator in the US is allowed to relay calls that are from legacy systems. This will likely take many years as I don't know how we will handle international calls and texts. But at some point we have to put our foot down and say enough is enough.
      - miki123211 2y ago
        > Step zero is actually having a process/protocol where any phone is tamper evident meaning we can tell 100% that this call came from this operator and the operator knows the call came from this user. This basically doesn't work because the mapping between phone numbers, users and operators isn't exactly 1:1:1. Some businesses have a single number that they use as Caller ID on all their calls , despite having one corporate HQ in New York, one branch in New Orleans and one customer support callcenter in New Delhi. All of these use different carriers and are based in different countries, yet they're all legally authorized to use that number. If you want to read more about why this is such a hard problem to solve, see https://computer.rip/2023-08-07-STIRred-AND-SHAKEN.html https://computer.rip/2023-08-07-STIRred-AND-SHAKEN.html
- phito 2y ago
  I don't think it is. I assume everyone gets hacked eventually. It's really hard (I would argue impossible) to make a 100% secure computer system, and if they're operated by people, you're terribly vulnerable.
feedmetrash 2y ago
[dead]
kbolino 2y ago
The government can't keep its own data safe, as the OPM breach showed. Apart from some resignations, nobody faced any serious consequences for that either.
- Angostura 2y ago
  Even more reason for regulatory requirements covering data security for all organisations- both private and public sector
kaliqt 2y ago
Government has no right to track that either, they themselves launder trillions, start wars and massacre millions, even a drug lord is a petty criminal compared to them, and it's clear their tracking of any and all records of any type is more about control than safety, thus it should be disregarded as an argument and be done away with entirely.
- JumpCrisscross 2y ago
  > they themselves launder trillions, start wars and massacre millions, even a drug lord is a petty criminal compared to them And then people wonder why privacy has a difficult time getting public support.
  - Nasrudith 2y ago
    No, we already know it is because people are complete idiots who not only fall for 'tiger repelling rocks' but actively demand them.
xkcd1963 2y ago
You are more likely striken by lightning than coming in contact with terrorism whatsoever
elric 2y ago
Many (all?) banks keep financial transaction records for way longer than what is legally required. Thankfully, most banks are technically incompetent and are unable to easily use data that is not relatively recent. In fact, one bank I worked for had to load transactions from a CD-ROM archive which contained all the transactions in a printable text format (the same format as their printed bank statements). Multiple CDs per day, with no indexing or identification beyond the date. Trying to find a specific 10 year old transaction was very hard work indeed.

yupyupyups 2y ago

That's a good point. Had they valued the citizens' privacy they would have done the opposite, that is make it illegal for network providers to store customer data that is not essential for them providing the services. But I guess creating a dystopian surveillance state is more of a priority.

hluska 2y ago

Why they hold it and how they protect it are valuable conversations. But their customers deserve something akin to security regardless of the why.

simfree 2y ago
Spam mitigation and management is a huge bugaboo in wireless networks today. The big three wireless carriers in the USA today formed a cartel called The Campaign Registry that seeks out TINs/EINs and the SSNs of the owners of Sole Proprietorships and LLCs as part of a lengthy approval process to be allowed to send texts. It's a great extra judicial rent seeking machine that bans any SHAFT content (sex hate alcohol, tobacco, firearms and anything tangentially related) along with hefty fines for anyone that they feel has crossed said boundaries. Letting the morality police run amok on our Telecom networks here in the USA is happening, and they also want all the data they can get along with bribes from businesses. Ajit Pai created the opening for this mess, and the current FCC has done nothing to clean this up (though given recent SCOTUS rulings, who knows if they ever had the authority...)
- nazgul17 2y ago
  Tangent, but it's ridiculous that sex is in the same group of undesirables such as firearms, alcohol, tobacco and hate.
  - simfree 2y ago
    That T-Mobile is out here slapping spam mitigation blocks on phone numbers who received SHAFT content from numbers on T-Mobile's network is pretty ridiculous, but silently blocking and providing no appeal or escalation path is just how we let companies operate these days.

rsingel 2y ago

There's no federal law requiring AT&T to hold onto this data. There's possibly a FISA court requirement (too secret to reveal), but AT&T has long been an exceedingly willing part of the gov's spying apparatus. It fed these records and Internet data to the feds without any court order, and only escaped legal troubles when Obama, contrary to his campaign promises, gave AT&T, Verizon and more retroactive immunity

imroot 2y ago
I'm no longer under this specific NDA, so, I can talk a bit about this. It was well known in the wireless industry that ATT collected and kept the most data on all of the carriers: 7 years for text metadata, "7 years" for call history (I put that in quotations because it was rumored that ATT kept them indefinitely, but, there were technical limitations for restoring data that far back), and 7 years for the contents of the text messages themselves. Verizon was up there as well, but, I don't remember specifics. The carrier that I worked with kept only 3 days content of the actual messages, 28 days for the text message metadata, and 28 days for the call records for their enforcement database, but, they could get calling records and sms envelope information for billing back 7 years, and at the time, we had to implement sharding at the database layer that maintained the warrant database due to the amount of traffic that we were receiving from the calling systems and the amount of queries/data that we were sending out, in near realtime, to law enforcement users who paid $10,000/month for access to that data. AT&T wasn't storing this data out of the kindness of their heart, it was a (probably small) revenue stream for them.
- mozman 2y ago
  Ah, back in the day the FBI would pay our CTO $5000/hr to talk to and work with him. On top of that we would charge them a monthly colo fee for their equipment that collected data of customers. Sometimes they had warrants, but mostly just bought the data. A year or so after 9/11 and that relationship lasted years.
  - niutech 2y ago
    Welcome to the US - claimed "praiser" of freedom, but with no respect for privacy. Even the EU is better at maintaining privacy than the US.

bastawhiz 2y ago

Being required to do something doesn't justify doing it poorly. AT&T brought in over $3 billion with a B of profit with a P in Q1 2024. They have more than enough money to secure their systems. They're not struggling. In March of this year they bought back 157M of their stock. They could have instead put that money towards security, but they didn't: they put it towards enriching shareholders.

stickfigure 2y ago
Money can't buy competence, at least not at organizational scale.
- cqqxo4zV46cp 2y ago
  Sure, but “incentivise a business to do something, and they’re more likely to do it” is still true.
- janalsncm 2y ago
  Fine, but they can clearly afford to pay for a lack of it.
  - vuln 2y ago
    Fine is cheaper than solving compliance issues. Many such cases unfortunately.
- bastawhiz 2y ago
  Maybe not for execs, but if not for money you literally couldn't hire competent security folks
mozman 2y ago
Enriching shareholders is exactly what they are required to do. What, nobody is allowed to make money anymore?
- Slyfox33 2y ago

0xcde4c3db 2y ago

I've never heard of this, and cursory web searches don't seem to be turning up anything relevant (although that's admittedly not saying much with the state of search lately). Can you explain how the law requires this level of data retention?

incompatible 2y ago
Apparently they'd uploaded their customer data into something called Snowflake to do some kind of analysis on it, but it wasn't particularly well secured. They haven't said why they were analysing the data, but there's no indication that it had anything to do with government demands.

sp312tol 2y ago

> how weird it is that you're fine with the government getting a record of all your phone activity I don't like it, but accept it as the lesser evil. I'm from Europe and I believe the number of reported prevented terror attacks. The agencies need data access for that. Not good, but necessary. But are you aware that Meta, Google, Apple, MS, etc. collect every kind of information about every user of Android, iPhone or WhatsApp, Insta, Facebook, Windows? Phone manufacturer, huge apps like TicToc as well. The kind and size of that data is crazy beyond imagination. I don't care if the government can get access to my WhatsApp messages when some of the most irresponsible companies, collect and use everything to their advantage. Are you really that naive and think that Meta doesn't analyse their gigantic data lake including billions of WhatsApp messages to predict the results of elections? That is the real danger to democracy.

hellojesus 2y ago
> I don't care if the government can get access to my WhatsApp messages when some of the most irresponsible companies, collect and use everything to their advantage. This is all voluntary. You give those companies your data. You don't have to. I use grapheneos and do not use any of those socials, for example.
- saurik 2y ago
  The problem comes as people start shoving more and more DRM around, whether it be Google Play Protect, the new Android WebView Media Integrity API, or an eventual reboot of the Web Environment Integrity proposal.
  - hellojesus 2y ago
    I understand, but I also won't participate in those and will actively work to undermine them.

xethos 2y ago

Sure - pretty well every corporation you purchase a service from is required to store your credit card information as well. But there are stiff penalties from the government and credit card processors for unauthorized access to that information; consequently, it's rarely stolen. Your address, cell metadata, phone number, email address, and passwords are leaked pretty well contsantly though. It's not that corporations are incompetent. The laws and regulations mean it's not worth the cost to treat your personal information with any real respect.

Terretta 2y ago
> store your credit card information ... but there are stiff penalties from the government and credit card processors for unauthorized access to that information; consequently, it's rarely stolen Citation: The Onion? The Payment Card Industry Data Security Standard (PCI DSS) is the main information security standard for organizations that process credit or debit card information must abide by. The guidelines established in PCI DSS cover how to secure data handling processes. So here are the top 5 info breaches: https://www.goanywhere.com/blog/the-5-biggest-pci-compliance-breaches https://www.goanywhere.com/blog/the-5-biggest-pci-compliance... To be fair, if what happened to Heartland happened more often, PCI compliance would be taken more seriously, and breached less often.
- xethos 2y ago
  I'm not saying it doesn't happen. Credit card data is too valuable to never be stolen. I am saying that ~37 to >500 is a hell of a difference in how frequently things are stolen [0] You pointed out how there are guidelines for holding that information, I'm saying there are consequences [1]. I'm following that up by saying that the consequences for mishandling customer information are not nearly as severe. They do not result in 6 figure fines. I'm saying the severe consequences to mishandling CC data have led to the incredible disparity shown in the first paragraph [0] https://haveibeenpwned.com/PwnedWebsites https://haveibeenpwned.com/PwnedWebsites [1] https://resourcehub.bakermckenzie.com/en/resources/global-data-privacy-and-cybersecurity-handbook/north-america/canada/topics/penalties-for-non-compliance https://resourcehub.bakermckenzie.com/en/resources/global-da...

Aeolun 2y ago

The government isn’t distributing my data to everyone else (so far). For profit companies have a pretty massive list of breaches so far.

t0bia_s 2y ago
You are forced to give your personal data to government. You don't have to give your data to any company. That's huge difference.
- chopin 2y ago
  Only if you cut all ties with civil society and live solitary.
  - t0bia_s 2y ago
    Only dead fishes flow with the stram.

wraptile 2y ago

"legally required by the government" to keep securely. If you can't keep to the rules don't play the game. I'm sure any other telecom would be glad to get the market share.

sulandor 2y ago

do yourself a favor and accept that phone records have never not been recorded and the data is mostly available for purchase. the company is to blame because they are complicit or negligent in the bespoke surveillance state, probably both.

xyst 2y ago

welcome to a post 9/11 world. privacy has been dying for a long time. the general population doesn't care anymore. they freely give up everything to big tech anyways.