5 ms·

At some point Insurance is going to require companies to obtain paper copies of any documentation/policies, precisely to avoid this kind of situation. It may ta

At some point Insurance is going to require companies to obtain paper copies of any documentation/policies, precisely to avoid this kind of situation. It may take a while to get there though. It'll probably take a couple of big insurance losses before that happens.

_slih 9mo ago
Insurance is already moving that direction for cyber policies. Some underwriters now require screenshots or PDF exports of third-party vendor security attestations as part of the application process, not just URLs. The carriers learned the hard way that 'we linked to their SOC 2 landing page' doesn't hold up when that page disappears after an acquisition or rebrand.
- pwg 9mo ago
  > when that page disappears after an acquisition or rebrand. Sadly, it does not even have to be an acquisition or rebrand. For most companies, a simple "website redo", even if the brand remains unchanged, will change up all the URL's such that any prior recorded ones return "not found". Granted, if the identical attestation is simply at a new url, someone could potentially find that new url and update the "policy" -- but that's also an extra effort that the insurance company can avoid by requiring screen shots or PDF exports.
  - hsbauauvhabzb 9mo ago
    It sounds like you work at Microsoft, they do that ALL the time.
    - pwg 8mo ago
      Good lord no, I would never work for that massively evil corporation. I do, however, work for one that is deathly allergic to HTTP redirects and that changes the user visible URL's each time they change/move/update servers (or for practically any other change). So there's a constant churn of "project X is deploying to Y on date Z, the new URL will be Q" announcements -- and meanwhile, you find that any deep links to URL Q[t-1] also got changed up when date Z arrives and the URL becomes Q[t]. And then in a few months, the same game, only with URL Q[t+1].
seanmcdirmid 9mo ago
Digital copies will also work I don’t understand why they just don’t save both the URL and the content at the URL when last checked.
- trollbridge 9mo ago
  What if the TOS expressly prohibits archiving it, and it's also copyrighted?
  - pixl97 9mo ago
    Then said writers of TOS should be dragged in front of a judge to be berated, then tarred and feathered, and ran out of the courtroom on a rail. Having your cake and eating it too should never be valid law.
    - croes 9mo ago
      Maybe we should start with those who made such copyright claims a possibility in the first place
      - wizzwizz4 9mo ago
        They're long, long dead.
        croes 8mo ago
        There are still people who help extending it
        wizzwizz4 8mo ago
        If copyright can be used to prevent the archiving of ToS documents, a copyright duration of 3 years would be sufficient. Not all objections to copyright boil down to "the Mickey Mouse Protection Act should never have passed!".
  - 9mo ago
layer8 9mo ago
More likely, there will be trustee services taking care of document preservation, themselves insured in case of data loss.
- ninjagoo 9mo ago
  Isn't the Internet Archive such a trustee service? Or are you thinking of companies like Iron Mountain that provide such a service for paper? But even within corporations, not everything goes to a service like Iron Mountain, only paper that is legally required to be preserved. A society that doesn't preserve its history is a society that loses its culture over time.
  - layer8 9mo ago
    The context was regulatory requirements for companies. I mean that as a business you pay someone to take care of your legal document preservation duties, and in case data gets lost, they will be liable for the financial damage this incurs to you. Outsourcing of risk against money.
    - ninjagoo 9mo ago
      Whether or not the Internet Archive counts as a legally acceptable trustee service is being litigated in the court systems [1]. The link is a bit dated so unsure what the current situation is. There's also this discussion [2]. [1] https://www.mololamken.com/assets/htmldocuments/NLJ_5th%20Circuit%20Raises%20Bar%20for%20Website%20Snapshots_April%202022.pdf https://www.mololamken.com/assets/htmldocuments/NLJ_5th%20Ci... [2] https://www.nortonrosefulbright.com/en-au/knowledge/publications/57e50249/using-screenshots-from-the-wayback-machine-in-court-proceedings https://www.nortonrosefulbright.com/en-au/knowledge/publicat...
mycall 9mo ago
Also, getting insurance to pay for cybercrimes is hard and sometimes doesn't justify their costs.
dahcryn 9mo ago
We already require all relevant and referenced documents to be uploaded in a contract lifecycle management system. Yes we have hundreds of identical Microsoft and Aws policies, but it's the only way. Checksum the full zip and sign it as part of the contract, that's literally how we do it

_slih 9mo ago

Insurance is already moving that direction for cyber policies. Some underwriters now require screenshots or PDF exports of third-party vendor security attestations as part of the application process, not just URLs. The carriers learned the hard way that 'we linked to their SOC 2 landing page' doesn't hold up when that page disappears after an acquisition or rebrand.

pwg 9mo ago
> when that page disappears after an acquisition or rebrand. Sadly, it does not even have to be an acquisition or rebrand. For most companies, a simple "website redo", even if the brand remains unchanged, will change up all the URL's such that any prior recorded ones return "not found". Granted, if the identical attestation is simply at a new url, someone could potentially find that new url and update the "policy" -- but that's also an extra effort that the insurance company can avoid by requiring screen shots or PDF exports.
- hsbauauvhabzb 9mo ago
  It sounds like you work at Microsoft, they do that ALL the time.
  - pwg 8mo ago
    Good lord no, I would never work for that massively evil corporation. I do, however, work for one that is deathly allergic to HTTP redirects and that changes the user visible URL's each time they change/move/update servers (or for practically any other change). So there's a constant churn of "project X is deploying to Y on date Z, the new URL will be Q" announcements -- and meanwhile, you find that any deep links to URL Q[t-1] also got changed up when date Z arrives and the URL becomes Q[t]. And then in a few months, the same game, only with URL Q[t+1].

seanmcdirmid 9mo ago

Digital copies will also work I don’t understand why they just don’t save both the URL and the content at the URL when last checked.

trollbridge 9mo ago
What if the TOS expressly prohibits archiving it, and it's also copyrighted?
- pixl97 9mo ago
  Then said writers of TOS should be dragged in front of a judge to be berated, then tarred and feathered, and ran out of the courtroom on a rail. Having your cake and eating it too should never be valid law.
  - croes 9mo ago
    Maybe we should start with those who made such copyright claims a possibility in the first place
    - wizzwizz4 9mo ago
      They're long, long dead.
      - croes 8mo ago
        There are still people who help extending it
        wizzwizz4 8mo ago
        If copyright can be used to prevent the archiving of ToS documents, a copyright duration of 3 years would be sufficient. Not all objections to copyright boil down to "the Mickey Mouse Protection Act should never have passed!".
- 9mo ago

layer8 9mo ago

More likely, there will be trustee services taking care of document preservation, themselves insured in case of data loss.

ninjagoo 9mo ago
Isn't the Internet Archive such a trustee service? Or are you thinking of companies like Iron Mountain that provide such a service for paper? But even within corporations, not everything goes to a service like Iron Mountain, only paper that is legally required to be preserved. A society that doesn't preserve its history is a society that loses its culture over time.
- layer8 9mo ago
  The context was regulatory requirements for companies. I mean that as a business you pay someone to take care of your legal document preservation duties, and in case data gets lost, they will be liable for the financial damage this incurs to you. Outsourcing of risk against money.
  - ninjagoo 9mo ago
    Whether or not the Internet Archive counts as a legally acceptable trustee service is being litigated in the court systems [1]. The link is a bit dated so unsure what the current situation is. There's also this discussion [2]. [1] https://www.mololamken.com/assets/htmldocuments/NLJ_5th%20Circuit%20Raises%20Bar%20for%20Website%20Snapshots_April%202022.pdf https://www.mololamken.com/assets/htmldocuments/NLJ_5th%20Ci... [2] https://www.nortonrosefulbright.com/en-au/knowledge/publications/57e50249/using-screenshots-from-the-wayback-machine-in-court-proceedings https://www.nortonrosefulbright.com/en-au/knowledge/publicat...

mycall 9mo ago

Also, getting insurance to pay for cybercrimes is hard and sometimes doesn't justify their costs.

dahcryn 9mo ago

We already require all relevant and referenced documents to be uploaded in a contract lifecycle management system. Yes we have hundreds of identical Microsoft and Aws policies, but it's the only way. Checksum the full zip and sign it as part of the contract, that's literally how we do it