7 ms·
He should partner with a law firm, for class action lawsuits, for every breach due to negligence (which is probably all of them). Tie in to a banking service,
by neilv 1y ago
He should partner with a law firm, for class action lawsuits, for every breach due to negligence (which is probably all of them).
Tie in to a banking service, so you can do direct deposits to many millions of people, every time there's new settlements paid, and you'll be a folk hero.
Get lawyers who want negligent companies to actually regret the breaches, with judgements that hurt. (Rather than a small settlement that gets lawyers paid, but is only a small cost of doing business, which is preferable to doing business responsibly.)
Optional: Sell data of imminent lawsuits, to an investment firm.
Though, ideally, investors won't need this data, since everyone will know that a breach means a stock should take a hit. Isn't that how it should be.
- nyokodo 1y ago> do direct deposits to many millions of people, every time there's new settlements paid I wish I could easily donate my tiny settlements to a good cause. It might make it worth the time to register for the class.
- Covzire 1y agoI'd donate a bit to make this a reality if someone had a chance at pulling such a service off.
- Avicebron 1y agoProbably impossible, but create a slush fund where companies that behave badly are forced to pay into so we can do things like fix roads and build housing.
- idiotsecant 1y agoWow I think you just launched a political party I would vote for
- hx8 1y agoFine companies to fund bridges.
- deleted 1y ago[deleted]
- gruez 1y agoThat sounds like a great slogan, but you really don't want a justice system that's has an additional mandate to collect revenue. It's basically civil forfeiture all over again
- idiotsecant 1y agoIsn't that...taxation? Seems alright to me!
- tylerflick 1y agoWe shall call it the Turtle Party, inspired by the Turtle Religion. Turtles all the way down.
- glial 1y ago> companies that behave badly are forced to pay Isn't this just regulation?
- brewdad 1y agoIt’s a form of regulation. We could also put the sysadmin and the CIO to death every time there is a data breach but we, as a society, have decided that is too extreme. We could also choose to simply wag our fingers and hope the shame they feel will prevent a repeat. Fines seem to strike a balance.
- GuinansEyebrows 1y agoHN Invents Taxes And Fines
- recursivegirth 1y agoSo what we are really saying is that we should form a new government?
- asdffdasy 1y agoliberal tax and fines
- mulmen 1y agoThe idea of fines as a revenue stream has never sat well with me. Fines are meant to be a disincentive. The ideal collection amount is zero. Treating them as a revenue stream creates a perverse incentive to enforce the penalty without disincentivizing the behavior.
- deleted 1y ago[deleted]
- deleted 1y ago[deleted]
- tutorialmanager 1y agoJust like police departments use asset forfeiture to get money to buy their “toys” while innocent people lose their cash and cars because carrying cash is suspicious.
- anamexis 1y agoI think the problem is: 1. How else would you penalize businesses? 2. What else would you do with fines? If fines exist, it would seem foolish not to budget around that.
- watercolorblind 1y agoMaybe a uniform tax credit/refund for each citizen that is covered by that level of government. We the citizens can then decide if we fix the issue or continue to generate fines, but at least the budget isn't expecting revenue that could disappear (like the lack of traffic tickets during the beginning of COVID).
- j_w 1y agoGovernments should not operate fiscally like corporations. A financial institution will budget around fees because it's in their benefit for their customers to incur fees. A government should not budget around fines because they want the behavior which was fined to not occur at all.
- _heimdall 1y agoWe could also design some kind of electoral process for picking those in charge of defining the rules and creating yet more bodies to enforce it. Maybe this time we can come up with a better way to disincentivize corruption and bribery.
- gleenn 1y agoSo on the nose. We shouldn't have to wait for pennies from lawsuits to have good roads and adequate housing
- keybored 1y agoWe could instead randomly select representatives instead of using popularity contests where the candidates need money for advertisements in order to get popular, or to just even let people know that they exist.[1] https://en.wikipedia.org/wiki/Sortition https://en.wikipedia.org/wiki/Sortition [1] But the real solution is getting rid of money.
- jonhohle 1y agoI think there’s already an amendment for that.
- deleted 1y ago[deleted]
- throwaway8eor 1y agoI think this would have a negative effect. Getting a company to publicly announce a breach is hard today. Your suggestion would make it even harder, and more data breaches would be kept from the public because of the consequences. I would rather know that a company messed up and change my password, than not knowing
- mock-possum 1y agoOnly get a couple bucks from these class action lawsuits - give ‘em a 15% discount or something if they own up to it publicly, I don’t mind getting $18 instead of $20
- pfranz 1y ago> I think this would have a negative effect. How? Disclosure should already be legally required--class-actions and lawsuits should already be a thing. The Have I Been Pwned data sets aren't volunteered by these companies. It's a catalog of leaked data. The class-action response of "identity monitoring" is nonsense. More companies, if they can't afford to or don't want secure data, shouldn't collect it or should aggressively purge it. User data should be a liability.
- freeopinion 1y agoAmen. User data should be a liability. The incentive should be avoiding data collection.
- BrenBarn 1y agoI'm not sure, the effect would be to increase the riskiness of nondisclosure. If you disclose and get fined, that would be bad, but if you don't reveal and the penalty for nondisclosure is bankruptcy for the company and all its executives, that would be worse.
- bix6 1y agoTake my money. Still waiting for Blue Shield to pay me for selling my health info to Google.
- dylan604 1y ago>Tie in to a banking service, so you can do direct deposits to many millions of people, every time there's new settlements paid, and you'll be a folk hero. and how long until that data is breached?
- Tubelord 1y agoStock market is too illogical. Seems like a dip buy opportunity every time. I bet companies even buyback after these dips.
- gerdesj 1y ago"He should partner with a law firm" He is a Microsoft employee.
- paranoidrobot 1y agoNo, he's not. https://www.troyhunt.com/about/ https://www.troyhunt.com/about/ says "I don't work for Microsoft"
- gerdesj 1y ago"Microsoft Regional Director" We can debate semantics but if you describe yourself with a job title attached to a company then I suggest that you have an association which looks rather like ... employment.
- cupofnotjoe 1y agoIts not semantics at all, you just are excusing your own misunderstanding. He didn't describe himself with a job title, and he even explicitly states directly after listing those awards, that he is not an employee of Microsoft. Extending your logic, I have a CCIE, so if I ever state I'm a CCIE, I'm an employee of Cisco? I have a masters degree by coursework from a university, so I I ever state I have an Msc, I'm an employee of the university? I have an electrical licences issued by EnergySafe Victoria, so if I say I'm an A-Grade Electrician, I'm an employee of EnergySafe Victoria?
- patmorgan23 1y agoIf I say "I'm a Cisco Regional Director" or "I'm a Walmart Regional Director" is you immediate though that I don't work for Cisco/Walmart?
- shkkmo 1y agoNobody is really disputing that Microsoft chose a confusing award name. However that name being confusing doesn't mean he is an employee or anything really like an employee.
- linkregister 1y agoUsually a breach results in a brief dip in a company's stock price, followed by a rally. Look at what happened after the Coinbase incident.
- conception 1y agoI bought croudstrike on “the day”. Just waited a few months and back up to pre destroying the world levels.
- Vinnl 1y ago> Tie in to a banking service, so you can do direct deposits to many millions of people, every time there's new settlements paid, and you'll be a folk hero. That's not much of a motivation, given that Troy already is a folk hero.
- hresvelgr 1y agoThat's a massive infrastructure change to pay out what would likely be peanuts to users, put a massive maintenance burden on the platform (payments are a nightmare system), and disproportionately benefit a law firm profiting off of the lawsuits and the good will of the brand. Seems like a shit deal to me.
- Fokamul 1y agoHeh, such an American response. Sue everyone and everything, lawyers gets paid. But at the end of day, nothing changes. Meanwhile in EU, we have laws like NIS2, where if negligent in non-compliance. Fines are 10mil. EUR or 2% of global annual revenue. Eg.: If Apple gets $8bil. fine, yep that changes quite a lot I think. :)
- dfee 1y agoThe difference between the US and the EU being: the cost of negligence is known ahead of time?
- uncletammy 1y agoHow does the EU solution make user's whole? At least with class actions, users get to see a few pennies. I'm not trying to make an argument against strong regulatory bodies. We need those for sure. It would just be nice if the users were compensated for the exploitation and abuse they're subjected to.
- devmor 1y agoThe US solution does not make users whole and does not meaningfully change anything. The EU solution meaningfully changes the offending company's behavior. I would rather have significantly less breaches of my information than a check for $6 in the mail every couple months.
- Chiron1991 1y ago> The EU solution meaningfully changes the offending company's behavior. Citation needed. I'd imagine they just add a tiny markup to their prices to pay the eventual fine instead of investing huge amounts of money into fixing their broken processes. Comparing the list of EU-issued fines against the respective companies' profits shows that they can simply afford to make those mistakes instead of preventing them.
- lone-commenter 1y ago
- freedomben 1y agoAh yes, automated lawsuit initiation, that's what we need! Ooh, we could run every breach announcement through Deep Research and let the AI make a determination on which one is negligence! That would definitely incentivize more transparency and accountability on behalf of companies! Actually no, the end result of this will be a return to deny, deny, deny, because the worst case scenario then becomes the truth getting out. IMHO we should be crucifying the liars and the truly negligent, but forgiving the honest and good faith efforts. At least for now, automating that judgment is pretty difficult and will result in more of the "customer service" like experiences that we already get from most big tech, except now it has the power to make or break companies. Man we have sure moved on from the era of Blackstone's Ratio being a thing people united around. I'm not saying it should be applied literally, but punishing an innocent person should be considered a lot more wrong than not punishing a guilty person IMHO.
- meroes 1y agoLook at this recent “data incident” https://oag.ca.gov/system/files/Partnership%20HealthPlan%20of%20California%20-%20Sample%20notice.pdf https://oag.ca.gov/system/files/Partnership%20HealthPlan%20o... “Based on the investigation into this incident, it was determined that the information involved may include your name, Social Security number, date of birth, Driver’s License number (if provided), Tribal ID number (if provided), medical record number, treatment, diagnosis, prescription and other medical information, health insurance information, member portal username and password, email address, and address.” It’s not about innocence or guilt. If you leak so much information these people will have to monitor every single account, credit card, etc for life, on top of all their personal sensitive info being leaked and possibly accessed by unscrupulous employers. The damage is incredible. It’s not about innocence. It’s about responsibility.
- freedomben 1y agoI guess I should clarify: for incidents like that, I agree there should be severe consequences and blowback, including class action lawsuits and the like. If you are collecting stuff like SSN, DoB, DL number, etc then you definitely have a huge responsibility to protect that. I want to make data like that radioactive to collect so people think very carefully about whether they want to take on the liability. What I don't think should happen is some automated lawyer combing the internet looking for any disclosures and then automatically filing lawsuits based on it.
- deleted 1y ago[deleted]