3 ms·

It’s a control failure, not a breach. It would also be an incident, one that could result in a subsequent breach, or one that warrants some work to be done to e

It’s a control failure, not a breach. It would also be an incident, one that could result in a subsequent breach, or one that warrants some work to be done to ensure it does not turn into a breach. But it has not resulted in an unauthorised party gaining access to the data, and is therefor not a breach.

ethbr1 2y ago
I think it's impossible to say there was no breach, given they were exposed for 7 years.
- AmericanChopper 2y ago
  I would agree. Which is why I’m suggesting that the Irish Data Protection Commission and Engadget should refrain from saying that. It’s also impossible to say that I am not responsible for a breach of your private data either. How much should the Irish Data Protection Commission fine me?
  - ethbr1 2y ago
    "Potentially breached" would probably be an accurate phrasing. If you had my private data written in the back of a notebook, that you carried around with you to coffee shops, for a few days, I'd feel substantially better than if you did it for a few years. Likelihood that someone peeked scales with time.
    - AmericanChopper 2y ago
      Sure, and I don’t disagree that it’s a bad situation for Meta to have created. It’s being fined for “potentially violating” a statute that I find objectionable. Being breached implies that some harm befell consumers, this article (and the others I’ve read about this incident) don’t make any reference to an actual harm being uncovered.
      - ethbr1 2y ago
        I think there should be a "reasonable expectation" of a breach having happened. Secrets laying in an accessible place for 7 years... reasonable expectation is someone looked at them.
        AmericanChopper 2y ago
        It’s a reasonable possibility, it’s also a reasonable possibility that nobody did. But somebody incidentally seeing them, and maybe, maybe not recognising they were passwords is not a breach. Somebody intentionally misusing them would be, and I haven’t seen anything to suggest there’s a reasonable expectation that that occurred. A reasonable expectation is also not the standard of proof I’d generally like to see from a government attempting to enforce a penalty.
        ethbr1 2y ago
        I think knowledge of them would absolutely be a breach, because you wouldn't be able to guarantee that person didn't remember and subsequently misuse them.
        AmericanChopper 2y ago
        If the data was publicly leaked then this argument would have some merit. But it wasn’t, the only people who could have accessed these passwords were insiders, and those passwords were used to protect data that many of them would have access to anyway. There is no evidence any unauthorised party gained access to any private data as a result of this incident. There is no evidence that any authorised party misused data as a result of this incident. A “breach” that involves no unauthorised access, and no misuse is not a breach. A control failure occurred, and it was remedied in the most appropriate way possible.
        ethbr1 2y ago
        Given the frequency of customers reusing passwords across sites, the risk isn't specific to Meta data.
deleted 2y ago
[deleted]
markarichards 2y ago
It's relatively common for publications to lazily only reference an action that resulted in a legal outcome, rather than the justification provided for the outcome. For instance, Bob imprisoned for car bomb rather than Bob imprisoned after judgement rules deaths unlawfully resulted from Bob's malicious car bombing. Had Bob's car bomb been on a film set and no one hurt, Bob would hopefully be fine. If you read coverage with this in mind, then what matters is more a case of how likely an action is to be unlawful and thus how lazy the publication is being. If someone blows up a car, we'd assume it was unlawful. If a company stores passwords unlawfully we'd assume it was unlawful and hopefully for good reason... From GDPR: "personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed" A typical security policy for securing passwords is to never store them in plaintext. It would be a rare situation for the storage to not be accessible (what would be the point of storing it). Thus it would seem fair to assume that in most cases plain text storage of passwords would be a breach of security (internal controls breach) would implicitly also be a breach of personal data (legal definition) as it would at the very least be accidentally accessible to staff, contractors or third parties (whoever hosts the storage). So, it will likely fit the definition of a breach. But, it still needs to escalate to a point where it would be recognised as serious enough to warrant action (like reporting to data subjects or regulators). There are situations where storing passwords in plaintext may not warrant reporting or fines, such as if upon realising the breach it was evident that nobody had accessed the data and it was destructed before harm could be realised; but I doubt anyone would ever know about these situations happening in companies so it's fair to assume they wouldn't reach major news sites.
- AmericanChopper 2y ago
  Even by the broadest possible definition of a breach, this is still just a control failure rather than a breach. The control that failed might have made it possible for Meta employees to perpetrate a breach, but the article makes no mention of that happening, or provides any suggestion that there is evidence that it might have happened. At at least one point in my career, I have also accidentally mishandled password data (I accidentally leaked them into a log one time - well one time that I know of at least). When I did that I caused a control to fail, and I caused a security incident that required follow up remediation work (including password resets and disclosure), which is exactly what happened here. But I did not cause a data breach to occur. I struggle to image a world where I could have caused my employer to be fined $102M for that incident, and for that to be deemed a data breach, when there is no evidence (presented or referenced in this article at least) that a breach ever occurred. If I leave the office and forget to lock the door, I've caused a control failure. But if nobody comes in to rob us, then I haven't caused a robbery or a breach or anything else like that to occur, even if a typical security policy might require me to lock the door before leaving. The creativity required to come to this conclusion doesn't do anything to improve the credibility of the GDPR, which from an outside perspective really doesn't look like anything other than an import tariff on foreign tech in disguise.

ethbr1 2y ago

I think it's impossible to say there was no breach, given they were exposed for 7 years.

AmericanChopper 2y ago
I would agree. Which is why I’m suggesting that the Irish Data Protection Commission and Engadget should refrain from saying that. It’s also impossible to say that I am not responsible for a breach of your private data either. How much should the Irish Data Protection Commission fine me?
- ethbr1 2y ago
  "Potentially breached" would probably be an accurate phrasing. If you had my private data written in the back of a notebook, that you carried around with you to coffee shops, for a few days, I'd feel substantially better than if you did it for a few years. Likelihood that someone peeked scales with time.
  - AmericanChopper 2y ago
    Sure, and I don’t disagree that it’s a bad situation for Meta to have created. It’s being fined for “potentially violating” a statute that I find objectionable. Being breached implies that some harm befell consumers, this article (and the others I’ve read about this incident) don’t make any reference to an actual harm being uncovered.
    - ethbr1 2y ago
      I think there should be a "reasonable expectation" of a breach having happened. Secrets laying in an accessible place for 7 years... reasonable expectation is someone looked at them.
      - AmericanChopper 2y ago
        It’s a reasonable possibility, it’s also a reasonable possibility that nobody did. But somebody incidentally seeing them, and maybe, maybe not recognising they were passwords is not a breach. Somebody intentionally misusing them would be, and I haven’t seen anything to suggest there’s a reasonable expectation that that occurred. A reasonable expectation is also not the standard of proof I’d generally like to see from a government attempting to enforce a penalty.
        ethbr1 2y ago
        I think knowledge of them would absolutely be a breach, because you wouldn't be able to guarantee that person didn't remember and subsequently misuse them.
        AmericanChopper 2y ago
        If the data was publicly leaked then this argument would have some merit. But it wasn’t, the only people who could have accessed these passwords were insiders, and those passwords were used to protect data that many of them would have access to anyway. There is no evidence any unauthorised party gained access to any private data as a result of this incident. There is no evidence that any authorised party misused data as a result of this incident. A “breach” that involves no unauthorised access, and no misuse is not a breach. A control failure occurred, and it was remedied in the most appropriate way possible.
        ethbr1 2y ago
        Given the frequency of customers reusing passwords across sites, the risk isn't specific to Meta data.

deleted 2y ago

[deleted]

markarichards 2y ago

It's relatively common for publications to lazily only reference an action that resulted in a legal outcome, rather than the justification provided for the outcome. For instance, Bob imprisoned for car bomb rather than Bob imprisoned after judgement rules deaths unlawfully resulted from Bob's malicious car bombing. Had Bob's car bomb been on a film set and no one hurt, Bob would hopefully be fine. If you read coverage with this in mind, then what matters is more a case of how likely an action is to be unlawful and thus how lazy the publication is being. If someone blows up a car, we'd assume it was unlawful. If a company stores passwords unlawfully we'd assume it was unlawful and hopefully for good reason... From GDPR: "personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed" A typical security policy for securing passwords is to never store them in plaintext. It would be a rare situation for the storage to not be accessible (what would be the point of storing it). Thus it would seem fair to assume that in most cases plain text storage of passwords would be a breach of security (internal controls breach) would implicitly also be a breach of personal data (legal definition) as it would at the very least be accidentally accessible to staff, contractors or third parties (whoever hosts the storage). So, it will likely fit the definition of a breach. But, it still needs to escalate to a point where it would be recognised as serious enough to warrant action (like reporting to data subjects or regulators). There are situations where storing passwords in plaintext may not warrant reporting or fines, such as if upon realising the breach it was evident that nobody had accessed the data and it was destructed before harm could be realised; but I doubt anyone would ever know about these situations happening in companies so it's fair to assume they wouldn't reach major news sites.

AmericanChopper 2y ago
Even by the broadest possible definition of a breach, this is still just a control failure rather than a breach. The control that failed might have made it possible for Meta employees to perpetrate a breach, but the article makes no mention of that happening, or provides any suggestion that there is evidence that it might have happened. At at least one point in my career, I have also accidentally mishandled password data (I accidentally leaked them into a log one time - well one time that I know of at least). When I did that I caused a control to fail, and I caused a security incident that required follow up remediation work (including password resets and disclosure), which is exactly what happened here. But I did not cause a data breach to occur. I struggle to image a world where I could have caused my employer to be fined $102M for that incident, and for that to be deemed a data breach, when there is no evidence (presented or referenced in this article at least) that a breach ever occurred. If I leave the office and forget to lock the door, I've caused a control failure. But if nobody comes in to rob us, then I haven't caused a robbery or a breach or anything else like that to occur, even if a typical security policy might require me to lock the door before leaving. The creativity required to come to this conclusion doesn't do anything to improve the credibility of the GDPR, which from an outside perspective really doesn't look like anything other than an import tariff on foreign tech in disguise.