Hacker News Reader

Comment by seccess | Hacker News Reader

Man, I have some real cognitive dissonance when it comes to physical versus cyber crimes. If someone were to leave their car unlocked then have items stolen out of it, I would find the criminal despicable; people make mistakes and don't deserve to be robbed for it. When a company leaves its data vulnerable and someone steals from it, I find the company despicable, as if they were "asking for it". Apparently the hacker was trying to extort TalkTalk, so its hard to sympathize with him, but I still find myself blaming TalkTalk first. Its really hard to know what the right attitude towards these breaches is supposed to be.

View on HN

For me, it's not a question of physical vs cyber, it's securing your own vs securing other's stuff.

If I paid for a car parking service that had the practice (not a one time incident) of leaving all their clients' cars unlocked, I'd definitively find them despicable.

While at the same time, if someone was hosting their own little personal server and forgot to apply a security patch and someone hacked it and used it for spam or as a botnet, I'd find the attacker despicable.

It's more akin to a bank not protecting their clients assets. It doesn't make the robber less of a criminal but doesn't make it ok for the bank.

Perhaps class actions against negligent companies with big payout would push their insurers to breath down their neck and would result in better security.

But make no mistake, the #1 problem is incompetence among developpers. I am sure it's not a direct order from the CEO to code in a way that leaves them exposed to sql injections. It doesn't cost more money to use a parameterized query. It's just that so many people call themselves developpers and simply just don't have a clue.

Your comparison is not analogous. It should be; a car owner that left the car unlocked with a bunch of private information inside.

I hadn't considered that angle before. That helps me reconcile it – imagine it's health records left more or less unattended.

There are two crimes. One is theft, the other negligence.

Negligence in this incident is a civil issue, not criminal.

Please take a moment to actually read the Data Protection Act 1998.

http://www.legislation.gov.uk/ukpga/1998/29

75 matches for 'offence' on that page.

Sections 61 and 47 are particularly relevant. European data protection legislation really does have teeth, though the Commissioner has to have the will to use it.

Reply on news.ycombinator.com