4 ms·

So by the way, when and how will Sony be held liable for criminal negligence? Their security track record is equivalent to a bank storing its customers, partne

by moe 12y ago

So by the way, when and how will Sony be held liable for criminal negligence? Their security track record is equivalent to a bank storing its customers, partners and employees crown jewels in a wooden bikeshed with no doorlock. Repeatedly. Stomping your feet, blaming evil North Korea and launching lawsuits against unrelated bystanders may be a convenient way to distract the mainstream media. But it's also completely missing the point and a little bit embarrassing...

dmix 12y ago
Which part was criminal? Various employees have started civil suits claiming damages. Their entire IT infrastructure was obliterated and they had to spend tons of money on IR and new security tools. So quite a bit of damage has been done already.
- salibhai 12y ago
  For one, why was all this employee information available on a computer connected to the public internet?
- moe 12y ago
  Which part was criminal? The part where they don't establish most basic protection at least for their critical customer data, after suffering from security breaches pretty much constantly[1] for over 3 years. If you have an account with any Sony product (Playstation network etc.) then your personal and payment data (credit card numbers) have most likely been leaked not once but multiple times by now. Why is Sony still allowed to store payment data? Why is their PCI certification not revoked? [1] https://news.ycombinator.com/item?id=8790458 https://news.ycombinator.com/item?id=8790458
  - BHSPitMonkey 12y ago
    Can you point out which law(s) you mean? It's a little hard to establish a criminal charge otherwise. Everything in your comment so far indicates cause for civil damages, which are already being pursued as pointed out.
    - moe 12y ago
      I am not a lawyer, my question was rhetoric. As a layman I would argue that we know anyway that these kinds of laws are rarely ever enforced upon companies the size of Sony. Especially not when there's a political PR spin as convenient as "omg North Korea" (was: "omg terrorists"). However, the least that they have obviously violated (on multiple occasions) are the PCI-DSS diligence requirements and probably every data protection act under the sun.

by moe 12y ago

dmix 12y ago

Which part was criminal? Various employees have started civil suits claiming damages. Their entire IT infrastructure was obliterated and they had to spend tons of money on IR and new security tools. So quite a bit of damage has been done already.

salibhai 12y ago
For one, why was all this employee information available on a computer connected to the public internet?
moe 12y ago
Which part was criminal? The part where they don't establish most basic protection at least for their critical customer data, after suffering from security breaches pretty much constantly[1] for over 3 years. If you have an account with any Sony product (Playstation network etc.) then your personal and payment data (credit card numbers) have most likely been leaked not once but multiple times by now. Why is Sony still allowed to store payment data? Why is their PCI certification not revoked? [1] https://news.ycombinator.com/item?id=8790458 https://news.ycombinator.com/item?id=8790458
- BHSPitMonkey 12y ago
  Can you point out which law(s) you mean? It's a little hard to establish a criminal charge otherwise. Everything in your comment so far indicates cause for civil damages, which are already being pursued as pointed out.
  - moe 12y ago
    I am not a lawyer, my question was rhetoric. As a layman I would argue that we know anyway that these kinds of laws are rarely ever enforced upon companies the size of Sony. Especially not when there's a political PR spin as convenient as "omg North Korea" (was: "omg terrorists"). However, the least that they have obviously violated (on multiple occasions) are the PCI-DSS diligence requirements and probably every data protection act under the sun.