I am sick of seeing headlines about teenager hacker being put in jail.
It's not because they are geniuses it's because of poor IT defense.
The companies should be severely fined for criminal negligence.
if I don't put 3m electric fence with automatic sentry guns around my whole hypothetical house and land, does it mean everybody is automatically invited to freely try to break in, do damage, steal my stuff or post my private and legal data online for others?
state should have better use for these guys, but there should definitely be punishment, not reward in any way. that's how all countries run these days
If you did, there is a name for what you have built: a bank. And you can be pretty sure people then will not have any issues with whatever security measures you take. Most of all, your cost of security installation is now covered by other people's money, which effectively gives you very precise calculations on what exactly you can and cannot spend. You are more than free to return the money and shut down shop if you feel you are in a completely unsafe neighborhood which makes your bank impossible to run at a profit.
To stretch this point a little further, imagine you did have a bank, and your customer comes and demands to take their money out, and you say "Oops. I had just left it out here on this desk, and when I went to pee, a kid just came in and ran out with all your money. I feel bad for you, but the cost of moving the stuff back and forth between front desk and the vault would make the service unprofitable. Its not my fault, its all these children in the neighborhood who keep pranking me".
The lowered barriers to hacking, combined with an ever moving target for what constitutes good security, are genuine concerns. But as a company, you are expected to shoulder the burden of security as a precondition of making the claim that you provide a good service. One way or another, people actually pay you to take care of their data as part of the service.
A house offers protection, no doubt about it and anyone but a social recluse will potentially offer it to others, although not foreigners. You are certainly not trying to say negligence would be OK as long as it concerns foreigners.
Your bank doesn't have weapons turrets in its physical branches, either.
And if that same customer smashed a bunch of stuff, vandalized the walls, and stole product that was being stored in the warehouse - you'd prosecute the hell out of him... and then fix the lock.
"Attractive Nuisance"
Yes, if the IT defenses are poor and they get in fair enough, another one is if they get the password list and shop around
You're saying like it's ok to rob the house with only one lock as opposed to the one with several locks and security cameras
Companies like Yahoo did try to secure themselves. They were just really bad at it.
They should be fined for negligence, but that doesn't mean the attacker is somehow morally right in any way.
But (this is unrelated matter) why is it possible to steal someone's money just by copying several short numbers? We have all kinds of advanced cryptography today but some payment systems still rely on transistor era technologies.
And even worse, companies can track customers using CC numbers. That is wrong too. The shop should not get your name or other unique identifier when you just buy something with a card.
Blaming the victim is easy.
These days it's hack for stealing creds or money or secrets or perhaps just putting ransomeware on all the comapanies systems to get a bitcoin payment out of them...
Sure, the hacker broke the law by hacking in, but I wouldn't have had my PII stolen if the thing had been secured.
Locks, physical and mathematical, are for the deterrence and convenience of the generally honest. Law enforcement, as an active defense, is for the deterrence of the actively attacking. At some point you're always going to have to stop turtling and build an army.
What if it's "cheaper" for the car companies to let the cars crash than adopt stronger security? You may think that there's no way a recall would be worth it, but we're already seeing companies such as Tesla "fix" the issue over the air, and chances are most of the new self-driving cars will be fixed the same way, if not all.
The only thing that would be left is the "bad PR", which may be much smaller in the future, because there won't be any recalls. If only 2 people die, and then all cars are fixed, the outrage just won't be as big as when 100 people die due to a brake malfunction, and then 5 million cars have to be recalled, impacting 5 million people (as opposed to only the families of those two in the former example) that would then personally spread the bad news.
Also the "bad PR" doesn't seem to affect tech companies, or even retailers, or banks, all that much, so I doubt it would affect car companies that much more in the future (for the reasons I mentioned above).
Just because there isn't a fense around an area that says no trespassing doesn't make it legal to walk through.
"But they didn't have a fense and it was easy to walk into the area."