Hacker News Reader

Comment by strictnein | Hacker News Reader

What law did they break, exactly? These aren't medical or financial records.

A careless programmer makes a bad choice and the CEO has to go to jail? Come on.

>?A careless programmer makes a bad choice and the CEO has to go to jail? Come on

An institutional failure of review, testing and security that will lead to tens of billions of dollars of identity theft goes unpunished completely?

Come on.

A CEO is responsible for his organization. If you ruin lives, you have to pay the price.

Can't handle the heat?

Don't take the job.

I hate how CEO's get hundred million dollar parachutes because, the risk and danger and difficulty of such a position warrants such extravagant pay.

But, then, we ask them to be responsible, bear responsibility for the organization which paid them a hundred million dollars to be responsible,and we say "come on?"

Utterly ridiculous.

CEO's bear responsibility for their organizations, or the organization should not exist. There must be responsibility for private organizations, lest the concept of private organization be nothing more than a cheap trick to remove criminal and civil liability from wrong doing.

This isn't social security numbers.

This is all publicly available data scrapping stuff. Like your public Facebook profile.

If you don't want that stuff to be leaked, then don't put your info publicly on Facebook.

I'm starting to kind of hope there is just a giant "leak" of every single US citizen's basic public information including SSN, etc. Get it all out there so we can stop having the debate over what is private information vs. public.

Then we can stop having this conversation constantly. None of this information is secret, I would put SSN into "quasi-secret" land since it takes such minimal effort to get at it.

We've been relying on security through obscurity for far too long. If the only thing stopping mass identity theft is someone compiling a list of otherwise public information, it's far beyond time we re-evaluate where the true problem lies.

So yeah, I agree. At some point society is going to actually have to confront this in a useful manner vs. hysterics and patching over an obviously failed system.

I didn't put mine on Facebook. What's step 2?

Are you registered to vote?

Then your info is publicly available for anyone to get. The government will just give it to you.

Don't want your freedoms threatened? Avoid attention by never exercising them!

I reject the argument that those who aggregate vast troves of data about people, publicly available or voluntarily shared though they may be, are exempt from any sort of responsibility for the curation and deployment of said data. Informational asymmetries lead to power imbalances, and sufficiently severe power imbalances lead to oppression.

It's still not clear that this is all publicly available information.

Jail is a bit much, but I do think corporations should be financially accountable for the clean-up of privacy spills. (E.g., similar to environmental disasters.)

If corporations face the prospect of a big bill, and the cost of that bill far exceeds the cost of keeping user data safe, a lot of the right things will start happen.

But what law specifically was broken? Should we have a law that punishes the CEO for data breeches? Is a CEO responsible if his experts recommended the practice? Is the CEO responsible if their staff went around and did this without conscent? That seems rife for abuse. Don't like your CEO, leak some data and have him go to jail.

I think data that has to do with voting records, or suspected voting records, would be very reasonable to be under the purview of being treated as sensitive data that, if breached, should have consequences to a company.

If these are voting records, which are public, it may well be that haven't done anything prohibited even if they intentionally distributed all this data to everyone.

As in, the company didn't want to distribute this data, so it's a breach, and the person who did that would be guilty of stealing the company's confidentional information (i.e. the modelling info) but it seems quite likely that purely (re-)distributing the core data of people's names and addresses doesn't actually violate any US laws at all; US privacy laws (outside of medical data) are very lax compared to e.g. EU.

I could imagine that victims of a future identity theft might have a civil claim against company if/when real losses have occurred, but it's quite possible that if the CEO personally published all this data, filmed all of this, and sent to the prosecutor's office, that no crime (according to current USA privacy laws) could be found there.

I'm not saying this shouldn't have consequences. What I'm saying is this is far too nuanced to just say "lock up the CEO"

How about making positive proposals of your own instead of negating everyone else's? Clearly many people find the existing rules and practices inadequate and propose heavy burdens of responsibility commensurate with the substantial incentives and rewards that accrue to success in business.

CEOs are not an oppressed class groaning under the burden of social structures that keep them locked up in the C-suite. Even if they are confronted with draconian penalties for naive misadventure, most CEOs of medium and large firms can afford A+ legal representation. If you're more worried about them than you are about the potential first and second-order effects upon tens or (in this case) hundreds of millions of people, then you are essentially choosing to be a pawn of the powerful.

I think you're blowing grovegames' original post out of proportion — he asked some pretty reasonable questions.

Of course they're reasonable. But problematic large scale data breaches are not a new problem. The last financial crisis was almost a decade ago, and yet we haven't developed a new culture of organizational responsibility since, despite the massive societal costs.

Not to make overly sweeping generalizations, but 'hold on, let's think through all the ramifications here instead of being too hasty' is a great way to maintain the status quo while avoiding any responsibility for it. Who benefits? It sure ain't the general public.

Indeed, lock up a couple CEOs and the others will feel a much stronger need to create better protections. Right?

I don't think it's so simple, but it's clear that most businesses take a reactive rather than a proactive approach to security and many other important considerations. Guillotining a few corporations is likely to have a salutary effect upon the others.

To some extent this is a cultural divide; anglo-Saxon capitalism has an unspoken ethic of 'forge ahead, cross bridges when you come to them' while continental European capitalism is far more accommodating of social considerations and has a 'first do no harm' approach. There are upsides and downsides to both approaches - and of course these are very shallow and incomplete characterizations of complex economic and cultural factors, which I have no intention of trying to defend if someone complains about them.

"A CEO is responsible for his organization. If you ruin lives, you have to pay the price."

If you break the law, you pay the price of jailtime. If you haven't broken the law, you might pay the price in the marketplace, but that's all.

If a law was broken, then of course whoever broke it should be prosecuted. But I don't think anyone disagrees with that, nor does it need to be explained in a lengthy HN comment. The only reason we need such an explanation is exactly because this isn't the way our society works. We set up the rules of the game and expect people to play within those rules, but we don't go around jailing people because we dislike them or disagree with their choices.

"CEO's bear responsibility for their organizations, or the organization should not exist."

Don't forget that a CEO is an employee, and just one employee. A particularly important and influential (and well-paid) one, but "just" an employee. An organization is not solely defined by its CEO, nor does it make sense to think of them as all-powerful in terms of what the organization does. A CEO who doesn't perform can (and probably will!) be fired at some point.

An institutional failure of review, testing and security that will lead to tens of billions of dollars of identity theft goes unpunished completely?

I'm going to agree with you in wanting to see someone punished for this, I'm not sure if I'm on the side of jail time in the absence of malicious intent.

You can't blame a "careless programmer" when the real problem is organizations simply not committing any resources to security. It's like a hospital only employing 1 nurse and blaming her when patients inevitably die. The organization has a clear responsibility to employee a sufficient number of experts to protect their data. DRA is not unique here but does demonstrate a pattern of companies playing fast and loose with sensitive data with minimal repercussions. We'll keep seeing things like this until our laws are such that stewards of data like these have some sort of incentive to protect them.

>You can't blame a "careless programmer" when the real problem is organizations simply not committing any resources to security.

How have you established that they didn't have a sufficient number of experts? What if they purchased a product or service and it simply didn't work? Its rather harsh to point fingers without having all of the information.

>We'll keep seeing things like this until our laws are such that stewards of data like these have some sort of incentive to protect them.

I think we need to give companies appliance-like products with a simple set of instructions that anyone can follow. Even a simple change where the data is stored in a 'vault' that requires the use of special tools with built in access controls and auditing would prevent a lot of data breaches. This means you cant email files around or share them on google docs or whatever. I'm convinced that people will do the right thing if you make it easy enough for them.

I'm really impressed at the lengths people will go to defend those whose malfeasance or ineptitude unarguably worsen the lives of up to two hundred million people. You seem like a smart person, please tell me how you think it's OK that these folks' contact details and potentially very detailed psychological and political profile information are now likely available on the dark web?

Given that this data was collected for explicitly political purposes with the specific goal of shaping voting behavior - one of the few things in American life where privacy is considered sacrosanct - surely you don't need me to point out the potential for manipulation, exploitation, and intimidation that become available to bad actors in possession of this data.

Are you familiar with the concept of 'strict liability'? Do you have any policy reason why such a standard shouldn't apply in cases like this?

Well, for one, you can legally obtain much more detailed information on a person from any background check application currently available. So, it's arguable this has really increased the likelihood of a future crime.

"In criminal law, strict liability is liability for which mens rea (Latin for "guilty mind") does not have to be proven in relation to one or more elements comprising the actus reus (Latin for "guilty act") although intention, recklessness or knowledge may be required in relation to other elements of the offense."

Proving recklessness is harder than you think.

If data is leak because someone within a company with the appropriate level of access decides to sell out to the dark web, all the security in the world won't protect you. Should the CEO go to jail because an employee turned on the company?

Heartbleed - you could have had 100 security professional on your team, and you still would have been vulnerable. Should every CEO on the planet go to jail?

Security persons do make mistakes and leave keys in places they shouldn't, genuinely by accident. Whom is going to jail for this error? If you think you are sending the security personel to jail, well, we're going to have an exodus of people willing to call themselves security personel, because no one is paid enough to risk jail for a job.

So, it's not a matter of defending ineptitude, it's a matter of recognizing the problem is complex and unless you can have clear boundries of what is punishible and what is not, your going to have a bad time enforcing anything that makes a difference. As a security person, I'm sure you know a policy without adequate enforcement is absolutely useless.

The hardest part of data processing is collecting it. If you can just grab already collated data for cheap, then it absolutely is more likely to be exploited.

That's all true, but continually talking about what a hard problem it is as a way to avoid settling on some harsh penalties (financial or custodial) for negligence of various types only perpetuates the problem. Courts can decide whether a harsh punishment should actually apply in any given case. But right now, no such punishments are even defined so there are no strong incentives to minimize negligence and restrict collection and distribution of that information.

tl;dr penal incentives function like a sword of Damocles. As long as we're debating whether and what size of sword of sword to hang from a thread, Damocles has no reason to worry.

> I'm really impressed at the lengths people will go to defend those whose malfeasance or ineptitude unarguably worsen the lives of up to two hundred million people. You seem like a smart person, please tell me how you think it's OK that these folks' contact details and potentially very detailed psychological and political profile information are now likely available on the dark web?

So far I've seen people disagree with simply throwing them in jail and people who want more data (was is a screw up? even security people make mistakes. Did they not have appropriate resources? etc).

I haven't seen anyone say this is OK in any way, shape or form. I see many reasonable discussions.

We've been having reasonable discussions on these topics for many years. Discussions that never lead to decisions and actions are a sideshow.

I'm calling for action - strong user-centric privacy protections with strict liability and significant personal and organization penalties for negligence, similar to the French model.

Criminalizing something doesn't mean you've "done something about it". It just means you've applied a traditionally flawed approach to fix a systemic problem that could be better handled through education, training and awareness. However, those things are much harder to do than to simply write something into the legal code without the public being any more prepared to deal with the situation.

a systemic problem that could be better handled through education, training and awareness

How's that been working out for you? This isn't a new problem. Where are those educational, training, and social awareness resources? What budgets have been allocated to them? What mechanisms put in place to monitor the effectiveness of the deployment? How many more years of theoretical discussions about ideal solutions should we have before acting, notwithstanding the possibility of error? If your cautious incrementalist approach is so great (and heaven knows I've spent many years thinking and advocating within that framework) why does the problem keep getting worse? How long and to what extent are you willing to wait for this informed public to manifest and (somehow) overcome all the countervailing forces that have economic and political interests in quite different outcomes?

And why, I ask myself, did you respond to my positive proposal about "strong user-centric privacy protections with strict liability and significant personal and organization penalties for negligence" by ignoring it and instead knocking down a straw man of 'criminalization' that I took care to avoid?

You don't want to be the person responsible for taking or advocating for a decision that might work out poorly, fine. But reiterating the reasons for your hesitancy achieves nothing.

>Where are those educational, training, and social awareness resources? What budgets have been allocated to them? What mechanisms put in place to monitor the effectiveness of the deployment?

Just because there is no information about that in the article, doesn't mean they weren't in place.

> If your cautious incrementalist approach is so great (and heaven knows I've spent many years thinking and advocating within that framework) why does the problem keep getting worse?

How do we know its getting worse? I work with a LOT of non-technical people, and they are very good at detecting spam emails, and not clicking on the fake bluescreen popups, etc using just their intuition and general awareness. They DO pay attention whenever articles about viruses and hacking and whatnot hit the front page.

>You don't want to be the person responsible for taking or advocating for a decision that might work out poorly, fine. But reiterating the reasons for your hesitancy achieves nothing.

Would you consider flipping it then? Let's also put software developers who introduce security bugs in jail. Oh, but software is so so complex!! A million different pieces working together, and I didn't write all that other code, so how could __I__ possibly be held responsible?! Well, people to people interactions are complex too, and putting a process in place where every person is supposed to follow a protocol is hard too.

There are times when I disagree with you, but then there are times like this when I can't agree more.

Now, with that said, I find this position slightly juxtaposed to the position you appeared to hold on the privacy of citizens when the Snowden leaks happened.

Why would political preferences be more sacrosanct than other preferences or private predilections people hold...

It would be great to define all the data-types a citizen can hold a position on and determine those which the government / entities can gain access to, and those which a citizen can expect privacy with...

And have that as a simple checklist as opposed to hidden in lengthy language of laws?

A good question indeed. I was not at all thrilled about eh Snowden leaks, but I had, and still have, some faith in the mechanisms of institutional governance, plus I viewed it in the context of strategic calculus.

Being a Euro I personally favor very rigorous privacy protections, and think you should be able to know who has data on you, get detailed copies of it in some accessible format, and request its deletion. Public institutions that do have a custodial data function should be subject to increasing levels of accountability and their powers should not be unlimited.

Now, since the US doesn't currently promulgate such strict data-gathering and retention standards in the public or private sector as I would like, it's a strategic reality that well-resourced actors like foreign governments can vacuum that up for their own ends, whether nefarious or merely curious. So I'm OK with the NSA collecting such data insofar as it seems irrational for the government to put itself at a disadvantage relative to everyone else in the private sector, in the same way that it would irrational for police officers to have fewer powers than regular people, as opposed to greater responsibility in the exercise of those powers.

In short, if all that data on people can be legally bought or acquired, it'd be pretty stupid for the USA/NSA to be the only entity that didn't have a copy.

I do heartily agree that data aggregation in both public and private sectors is way, way out of control, and I also agree that a checklist approach would be far preferable to yet more books of rules. I have some radical (but inchoate) technical approaches to this problem in mind, if you want to get in touch via gmail.

> You can't blame a "careless programmer" when the real problem is organizations simply not committing any resources to security. It's like a hospital only employing 1 nurse and blaming her when patients inevitably die.

This isn't a very good example. A shortage of nurses will directly correlate to poor patient care and possible death. But a shortage of security experts? Who knows. I worked at an insurance company that left an access database open to the internet FOR YEARS. We ran analytics when I found it and it was never served from our web server.

So since it didn't get into the public does that mean they were responsible for their security? If the answer is "no" then how would you ever measure these unknowns?

Security is a major problem in tech. It's very difficult, it's nuanced and its vast. Security covers so so much that it would be difficult to one or maybe even a handful of security experts to fully over all aspects of an app depending on your scope.

Beyond that though is mistakes happen. People will screw up. Even security people can screw something up. Throwing someone in jail for a screw up reminds me of the war on drugs; it's not going to stop someone from making a mistake or simply not realizing an unknown unknown.

> Security is a major problem in tech. It's very difficult, it's nuanced and its vast. Security covers so so much that it would be difficult to one or maybe even a handful of security experts to fully over all aspects of an app depending on your scope.

Which is why it's so important to hold companies that screw it up accountable. That's the only way to get it to change. Forget about everything else, accountability will force new rules for data storage and protection. Without accountability, nothing will change.

> Which is why it's so important to hold companies that screw it up accountable. That's the only way to get it to change. Forget about everything else, accountability will force new rules for data storage and protection. Without accountability, nothing will change.

Sure but everyone on HN suggests accountability but never defines what they mean by it except for the few who think someone should just be thrown in jail.

So, what do you suggest for accountability?

I'm not sure it means jail time. It does need to be substantive. Holding the CEO, CTO and CSO directly accountable is a start. But I think it needs to be company wide. It needs to be punitive damage to the company and its shareholders. The risk of mishandling PII and similar data needs to outway the benefit (that may differ per type of PII).

At that point it would be my theory that consolidation around best practices, software, security audits... would become the norm. It would raise the cost of a company taking on the responsibility itself, that they'd rely on others to reduce the cost through volume. It would probably start looking a lot like PCI and credit card co. Requirements. The big difference here being that there isn't an industry body responsible, but the government, which would always be political and probably not have enough teeth.

Careless programmers can also mishandle health/credit card/minor information. We have laws protecting all of that data in particular. I'm not sure the expansion of data privacy laws to include all PII is so farfetched.

It's a slippery slope. Analysis of writing style, patterns of use, etc can deanonymize data to the point where basically everything becomes PII.

Treat everything as PII and we are good. The constitution has an amendment to protect our rights. That seems important. I know of no guaranteed right of corporations to infringe on our privacy and to provide access our data.

Forty years ago we didn't have this issue because there wasn't so much data for them to try to get their grubby greedy hands on. They don't need our data (ANY OF IT)!

The US constitution forbids the US government from acting in certain ways, it in no way impedes upon private organizations. Tort law and the like is what holds private organizations accountable. i.e. The fourth amendment does not protect you from a private entity or individual; laws covering trespassing, theft, breaking and entering do. Please don't drag the constitution into an argument it does not have a place in.

I didn't say the constitution protects me from private assholes. My point was privacy was important to our founders and remains important today. Had our founders known corporations would be a thing and grow as powerful as the government, I would argue they would be included.

We need laws to protect us from them. Much more and better laws. The fact that the constitution does protect us from gov. is a good argument that our gov. should be active in protecting us from corps. Anyway that is my conjecture.

I'd like to argue (not for the first time either) that the Constitution is seriously deficient in its failure to enshrine privacy as a personal right. Great as it has been for the last couple of centuries, I think it's obsolete and should be replaced rather than merely amended.

There's no reason that can't be done as an amendment.

It's not the only thing I'd like to change. Besides which, there is already a movement in progress to bring about another article V convention and I'm guessing the goal of the proponents is drastic rather than minimal alteration. Here's a recent summary article on developments:

https://www.washingtonpost.com/opinions/were-surprisingly-cl...

The problem is everyone wants different drastic changes.

Obviously. This is going to lead to a bitter conflict in the not-too-distant future, unfortunately.

Let's slide a little more down that slope, then.

Where personal data and privacy is concerned, I'd rather err on the side of caution, than the world we live in now.

Dunno about anybody else, but I'd like to find a convenient canyon.

Literally everyone wants that, the problem is there isn't one, at least that anyone's been able to identify as of yet.

There certainly is one, if you only take into account public opinion. We're dealing with conflicting interests of people who generate data and corporations that collect and traffic data.

OP is clearly suggesting creating a law to avoid this sort of outcome. And while these aren't medical or financial records, they did include: "names, dates of birth, home addresses, phone numbers, and voter registration details, as well as data described as 'modeled' voter ethnicities and religions." Say on average people would pay $5 for this stuff not to be leaked. You're talking about a $1 billion fuckup resulting from a choice that is, as far as I can tell, gross negligence on the part of the programmer.

I dunno about the jail part, but the being ultimately responsible for the actions of the people working for you sort of goes with the title.

Like, why is the organization set up so that 1 programmer can make a catastrophic mistake? The CEO is responsible for that.

So if the system is set up so that one programmer can make a catastrophic mistake, then the system is broken.

If the system is set up so that one general can launch a nuclear warhead, then the system is broken.

If the system is set up so that one politician can kill people without a trial, then the system is broken.

If the system is set up so that one nurse can release data on 1 million patients, then the system is broken.

It's not "what happens when a careless programmer does X." but rather "why do we have a system where a careless programmer can do X."

While I generally agree with your point, it's hard to make this into law. Do you think it should be illegal to have a company with only 1 programmer? If not, how do you prevent them from making catastrophic mistakes?

Law generally doesn't prevent catastrophic mistakes, it creates consequences for them which incentivizes those in a position to make them to find ways of preventing them.

As of right now there is not a Federal law describing exactly what is PII data (which would be a prerequisite for this).

There are many (48) different state laws that do define what PII is and how organizations (commercial and governmental) are to handle data breach notifications. If you want to see what a crazy patchwork map of laws this is checkout:

https://blog.varonis.com/us-state-data-breach-definitions/

These only come into play if a certain minimum number of state residents have had their data compromised and if that data is of a certain class.

Typical classes are:

- Account info - Financial info - Health Info - Health Insurance info - DNA - SSN - Biometrics, etc.

And I'm not a lawyer, and we likely don't have all the facts, but at first glance the data released in this breach doesn't meet any of those classifications. It looks pretty much like the data you'd get out of a phone book (name, address, phone number) with a few data points like geocoding and their guess as to your religion and politics.

Which isn't to say that it's great, or that it's not a problem that this was all released, but it is pretty much public data.

> What law did they break, exactly? These aren't medical or financial records.

I know this is USA, but FYI in the EU, all personal data is protected.

A careless programmer making a bad choice should simply not be able to leak 200M personal details.

I am not sure that jail time is really the thing here, but there are institutional problems if this is something that happens.

It's not about the careless programmer IMO. It's that there was nothing in place to make sure the data was secure. Or if there was, it wasn't effective.

The point is that we need laws to govern the management of personally sensitive data like this. Privacy laws in the USA are appallingly weak.

Where does the buck stop then?

Careless programmers don't compile dossiers on over 200M American citizens just for funsies.