3 ms·

This attitude is pervasive on HN, and I find it a little baffling. If someone took advantage of a lax property-management company to successfully burgle an apar

This attitude is pervasive on HN, and I find it a little baffling. If someone took advantage of a lax property-management company to successfully burgle an apartment complex, I can't imagine anyone being so cavalier about pursuing the actual criminals behind the theft.

benmanns 12y ago
Even if the apartment complex didn't lock the doors and didn't allow tenants to put locks on the doors? If the apartment complex was supposed to have employees that install and check locks and cut the budget? If those cuts helped the apartment complex turn $2.56B in net income last year?
- mbreese 12y ago
  It's still illegal to enter an unlocked door unless you're authorized. Two things can be true: you should have locks on your door AND you shouldn't enter someone else's unlocked door. (Ironically, not locking your doors could also increase your insurance rate...)
  - chrsstrm 12y ago
    So we should expect that criminals, who by definition violate laws and regulations, won't do something simply because it is illegal? In that case, we should just put trespassing and breaking and entering laws on the books and call it a day, that should stamp out the problem immediately.
- PhasmaFelis 12y ago
  There can be more than one bad guy. If your maintenance guy left the door unlocked, and a burglar walked in and stole all your shit, then both of them are responsible.
lazaroclapp 12y ago
I take it as a matter of practicality. Network intrusions are, as a rule: a) much harder to attribute, b) impossible to prosecute (Assume it is Russia or China, what is your recourse? the U.S. is already hacking them too, under slightly different rules, and any other response is just a needless international incident. If it is people in another country, not associated with their government, there is even less you can do), and c) possible, at least in theory, to defend against robustly (compared to doors and locks which are always vulnerable to literal brute force, without the need to be particularly clever about it). So, given that punishment is impossible and prevention is possible, focusing on the second is a good idea. Or, at least, in some combination of prevention and mitigation (including insurance, or say, ways of detecting and changing stolen SSNs or credit card numbers with minimal disruption). Now, I am not saying it's the fault of a single insurance company. Security is pretty hard to get right and we systematically under-prioritize it when developing the technologies and systems we use. But as a society, making our computer systems more secure is more cost effective than keeping pilling up cyber crime laws that are unenforceable unless you happen to get lucky enough that the hacker is among the 1/20th of the world population you have jurisdiction over, or getting into a harmful retaliatory mode under ideas like "cyber-warfare". p.s. By "possible to defend against robustly", I mean when you trust the suppliers of your computing base to be non-malicious and you have ensured physical security (which you can enforce by law and national defense and whatever other age tested methods people/groups/nations have used to secure their property for millenia).
bsder 12y ago
I have no problem with them pursing the criminals. However, the criminals lately always seem to be "China" or "Russia" rather than "Chinese individuals" or "Russian individuals". The reason for this is that practically every contract includes an escape clause for "Act of War" by a foreign state but not for foreign individuals. To further your analogy, if someone burgled an apartment complex because the manager left the skeleton key under his doormat, you can be sure that the apartment manager would be getting prosecuted for gross negligence as well as the individual who burgled the apartments. It's time that an IT breach carry a charge of gross negligence against the CEO. Suddenly, IT will have lots of funding and importance.

benmanns 12y ago

Even if the apartment complex didn't lock the doors and didn't allow tenants to put locks on the doors? If the apartment complex was supposed to have employees that install and check locks and cut the budget? If those cuts helped the apartment complex turn $2.56B in net income last year?

mbreese 12y ago
It's still illegal to enter an unlocked door unless you're authorized. Two things can be true: you should have locks on your door AND you shouldn't enter someone else's unlocked door. (Ironically, not locking your doors could also increase your insurance rate...)
- chrsstrm 12y ago
  So we should expect that criminals, who by definition violate laws and regulations, won't do something simply because it is illegal? In that case, we should just put trespassing and breaking and entering laws on the books and call it a day, that should stamp out the problem immediately.
PhasmaFelis 12y ago
There can be more than one bad guy. If your maintenance guy left the door unlocked, and a burglar walked in and stole all your shit, then both of them are responsible.

lazaroclapp 12y ago

I take it as a matter of practicality. Network intrusions are, as a rule: a) much harder to attribute, b) impossible to prosecute (Assume it is Russia or China, what is your recourse? the U.S. is already hacking them too, under slightly different rules, and any other response is just a needless international incident. If it is people in another country, not associated with their government, there is even less you can do), and c) possible, at least in theory, to defend against robustly (compared to doors and locks which are always vulnerable to literal brute force, without the need to be particularly clever about it). So, given that punishment is impossible and prevention is possible, focusing on the second is a good idea. Or, at least, in some combination of prevention and mitigation (including insurance, or say, ways of detecting and changing stolen SSNs or credit card numbers with minimal disruption). Now, I am not saying it's the fault of a single insurance company. Security is pretty hard to get right and we systematically under-prioritize it when developing the technologies and systems we use. But as a society, making our computer systems more secure is more cost effective than keeping pilling up cyber crime laws that are unenforceable unless you happen to get lucky enough that the hacker is among the 1/20th of the world population you have jurisdiction over, or getting into a harmful retaliatory mode under ideas like "cyber-warfare". p.s. By "possible to defend against robustly", I mean when you trust the suppliers of your computing base to be non-malicious and you have ensured physical security (which you can enforce by law and national defense and whatever other age tested methods people/groups/nations have used to secure their property for millenia).

bsder 12y ago

I have no problem with them pursing the criminals. However, the criminals lately always seem to be "China" or "Russia" rather than "Chinese individuals" or "Russian individuals". The reason for this is that practically every contract includes an escape clause for "Act of War" by a foreign state but not for foreign individuals. To further your analogy, if someone burgled an apartment complex because the manager left the skeleton key under his doormat, you can be sure that the apartment manager would be getting prosecuted for gross negligence as well as the individual who burgled the apartments. It's time that an IT breach carry a charge of gross negligence against the CEO. Suddenly, IT will have lots of funding and importance.