Hacker News Reader

Corporate charters can be dissolved by the government at any time. Given Equifax ONLY deals in building detailed profiles of every US adult and managed to lose that information to criminals is grounds for terminating their corporation.

At this point, their lack of basic security practices has endangered national security by weakening the banking and credit systems.

On top of that, this company is massively unpopular. Their only purpose is to potentially slander Americans en masse. Make a fucking example out of them so the rest of the finance industry takes notice.

The government can't just dissolve a corporation on a whim. We have due process and the rule of law.

> The government can't just dissolve a corporation on a whim.

Not on a whim, but for (e.g., in Delaware) “abuse, misuse or nonuse of its corporate powers, privileges or franchises.” (Delaware Code Title 8, § 284.)

> We have due process and the rule of law.

While rarely used in practice currently (it was more used in the past, and there is a movement to revive the practice), the law provides for charter revocation for corporate misconduct.

The point is that charter revocation requires both the executive and judicial branch to agree. Moreover, I think I can guarantee that any vague sounding statement like "abuse, misuse or nonuse of its corporate powers, privileges or franchises." has been translated into a series of relatively specific conditions by the courts. You can't just sue someone for being vaguely terrible.

Basically, however appalling the unaccountable power of credit bureaus is, it was legal yesterday and it's not the job of either the executive branch or the judicial to decide today that such power isn't legal today. The judicial system especially is oriented towards prevent that kind of thing. Rather, deciding that is the job of (even more dysfunctional) legislative branch.

This, of course, doesn't guarantee that executive or judicial branch couldn't "get religion" and try to get end this situation but it would have it own messiness.

And there you have it - an American legal/government system very much resembling a well built car driven far too long without an overhaul.

It doesn't seem like the executive and judicial branches will need to get involved whatsoever if there is a multibillion dollar lawsuit; if successful this will basically 'dissolve' Equifax.

Well, I wouldn't shed any tears over the dissolution of Equifax and other credit agencies - though a lawsuit would of course involve the judicial branch (the courts).

But the problem is:

A. If Equifax gets a judgment for close to or for more than the company is worth, the simplest way one could assure the suit is paid to sell the company, keeping the operation going rather than ending it.

B. Many businesses integrate credit checks into their operations - it's ridiculous and despicable as mentioned by other but most of these companies and individuals (landlord for example) at least imagine they couldn't survive without the credit agencies so this large group would push for another solution then just getting rid of the credit agencies.

C. Getting rid of one credit agencies leaves the other two even stronger.

"Well, I wouldn't shed any tears over the dissolution of Equifax and other credit agencies"

In Project Mayhem we have no names.

If there were a $17 billion judgement against a $17 billion company, it would not sell for $17 billion.

It is also unlikely a $17 billion market cap = $17 billion in assets during an emergency sale. Especially with the shadow of a $17 billion judgement that could encumber the acquired assets.

It's bad business to acquire assets from someone with a judgement against them, unless you're getting a great deal.

If there were a $17 billion judgement against a $17 billion company, it would not sell for $17 billion.

If there is a judgment against a company which that company cannot pay, that company enters bankruptcy.

What happens when a corporation enter bankruptcy is the assets of the corporation are assigned to a receiver. The receiver then disposes of those assets with the aim of raising as much money as possible to pay the creditors involved. In the case of a credit bureau, keeping the bureau functioning would arguably be the best way to earn money to pay the individuals who the corporation owes money to - both the people who the got the judgment (first priority), other creditors(second priority) and then the share-holder (third priority).

This situation means that corporation that produces toxic waste, dumps it in a river and goes bankrupt from a private suit against it could continue to produce toxic in order keep producing and making money, in order to pay that judgment (it would probably be argued that the toxic-waste leak was a one-time thing).

Part of the problem is a private lawsuit isn't a substitute for state regulation even if it's often presented as such. Part of the problem is the very worst that happen to the owners, the shareholder, is their shares become worthless so their incentive for stopping truly bad behavior by organizations is limited.

You might say this is fucked-up and I would agree with you. Don't confuse my comments with statements of support for how things. I simply want to thorough, accurate and complete summary of just what a messy we're in.

Bankruptcy is the strange other side of the US debt system. In this case, it would be an unfair get out of jail free card, a shirking of responsibility.

> they couldn't survive without the credit agencies

Europe operates just fine without the notion of credit or credit agencies.

If there is a lawsuit, the judicial branch is involved.

This assumes the highest good is to maintain the previously defined delineation of governmental branches.

Some of the legislative branch dysfunction is due to interference from the same corporate interests they should govern.

Corporations are able to DoS their oversight.

You are correct there will be unexpected messiness. The question becomes whether our current trend is sustainable over the long term; many believe the second order effects cannot be worse than the path we are currently on.

Since Congress defines what the law is, couldn't they do it? The only law binding Congress's lawmaking powers is the Constitution, and I don't think it restricts their ability to dissolve corporations.

The powers not delegated to the United States by the Constitution, nor prohibited by it to the States, are reserved to the States respectively, or to the people.

So this would only work if you can find a clause permitting them to do this. I assume this would be the commerce clause?

It does actually have such a restriction (Article 1 Section 9): "No bill of attainder or ex post facto Law shall be passed." Further, it prohibits the states from passing such laws as well (Article 1 Section 10).

If Equifax gets sued into bankruptcy and the government passes a law for next time this happens I'd be okay with that outcome.

In addition to what others have said, you cannot be deprived of life, liberty, or property without due process in the US.

In principle that's true...

In reality 1. You can be shot by a cop even if you do not pose a real threat (they just need to claim they though you might have a gun, simple) 2. People are routinely kept in jail for unreasonably long time because their families cannot afford bail often on things charges are dropped for later 3. Ever hear of civil forfeiture?

The whole thing is a nice story that we love to repeat to each other. Maybe it was easier to accept that during the cold war when the other guys were worse and news traveled slowly (or didn't). It's pretty apparently that isn't true given the quick news cycle... and opening any US history book.

Sometimes I wish I could myself become a corporation. Seams it's much easier to exercise your rights as a corporation.

>Ever hear of civil forfeiture?

Yes, a process in which the government has to prove to the same standard of evidence as someone suing you. That is due process.

Due process has been somewhat lacking in practice. https://www.nytimes.com/2017/07/19/us/politics/justice-depar...

The difference being that the government confiscates the property while the case makes its way through court.

In practice this is a huge difference.

> Yes, a process in which the government has to prove to the same standard of evidence as someone suing you.

That's not quite true. They don't make a claim against _you_. They make a claim against the property.

So, it's the same level of evidence and adversarial hearings as someone suing $1,000. This is not due process. It's a farce.

They have to convince a jury that the property in question is the proceeds of a crime.

That's not true in all cases, which is one of the problems people have with civil asset forfeiture.

That is civil asset forfeiture.

Not all states guarantee a jury trial for civil asset forfeiture.

And federal civil asset forfeiture almost always starts out as administrative forfeiture which doesn't involve the judiciary at all.

When the feds seize an asset the owner has 60 days to file a claim. If no claim is filed the government keeps the asset.

If a claim is filed, the government can either pursue civil or criminal forfeiture. In the case of civil forfeiture there is a right to a trial by jury.

However, as I said previously this isn't automatic. The person has to either have the legal knowledge to know how to file a claim, or they need a lawyer. In the majority of cases no claim is filed in many cases because the legal fees necessary to recover the asset will be greater than the value of the asset.

Basically if the government sizes a few grand in cash, it will cost you too much to recover it to make it worth it.

In states like Tennessee, police can seize your cash and you have to sue to get it back. They automatically get to keep the assets unless you sue them. They don't need to convince a jury of anything unless you sue them.

This is not the same thing as a person suing you and then using a replevin action to force you to give up your property. This is like if a person broke into your house, took your TV, and then you were forced to initiate a lawsuit to get it back. Plus you couldn't recover legal fees, it was significantly more complicated and costly than small claims court, and the thief suffered no consequences beyond returning the TV even if they lost the case.

Even Clarence Thomas, the most conservative member of the the Supreme Court, indicated in recent statement that he believes the current way civil asset forfeiture is practiced is unconstitutional.

I'm sure that comes as great comfort to all the people in the US to whom that's happened.

What I can't believe is why there's not a criminal case against these idiots? When you are controlling something dangerous and you allow that thing to harm someone else, it's a criminal offense. It's not a matter of whether it's hard. It's simply your responsibility to ensure no one gets hurt. This company has already caused harm to literally everyone in the US. Minimally, we all now have to take action to attempt to avoid identity theft. And it only gets worse from here. And these bastards have the chutzpah to wait until hurricane Irma is upon us to make the announcement.

> This company has already caused harm to literally everyone in the US.

Not yet. People might be annoyed but not many of them have been harmed yet. They're harmed when their identity is actually stolen (i.e. used by someone else), not merely when someone gets access to their data.

(Not saying I like this system. Just saying this it how the system works.)

If people did not go to jail for the wells fargo fiasco where willful fraud was committed, I very much doubt anyone will go to jail for this. Although you are absolutely right, someone should be severely punished for this.

Bourgeois law in its wisdom protects individual property owners from their mistakes, unless they affect owners of larger property... that said, Equifax may have just fucked over the entire retail/consumer credit industry in the US, so the hammer may very well fall on them. We might get some of those banker perp-walks everyone loves.

But with the current administration as well as Congress (we're likely to see a Federal gov't shutdown over the budget even though the Republicans control the legislature and White House), I wouldn't anticipate seeing any regulation down the pike because of this.

They mention the Struts vuln, but not which one... did an attacker access the info directly via a naive attack, or was this a campaign? Having worked on Enterprise-Ready(tm) systems I wouldn't be surprised if Equifax had an unsegmented network...

Confused. Some sources are reporting this was a zero-day vulnerability only recently discovered.

I'm as emotionally upset as anyone else, but if in fact this was a zero-day, I also lose the basic lack of security practices argument.

https://qz.com/1073221/the-hackers-who-broke-into-equifax-ex...

Even with an 0-day, why was consumer data not encrypted at rest with segmentation for access?

If you have the most sensitive information for millions of people, maybe don't only worry about perimeter defense?

True. A flaw in the perimeter doesn't forgive poor data management practices.

Given the number of FS sites running on IBM Websphere and Struts, this may only be the tip of iceberg.

FS == Financial Service???

>Ok, so credit reporting agency collects sensitive personal and financial data on basically every adult American, loses it to a bunch of criminals and now I have to deal with the consequences?

This is what pisses me off - I never gave them authorization to collect information on me. I have no business relationship with these companies. To me they look a lot like parasites even when they're not giving away my data.

EU privacy and right-to-access laws aren't looking so bad now are they

You often agree to this when applying for a loan or credit card.

agreeing under coercion shouldn't be considered agreement.

yes, I realize that the definition of "coercion" here is complicated and nuanced, but I feel the point stands.

You don't have to unfreeze the reports to open a new credit application - the credit app gets rejected (on hold), and the credit issuer will ask you for an auth code. You go to the appropriate agency, log in with the credentials you used when you set up the freeze, provide the request code, they respond with an auth code, you relay the auth code to the credit issuer, credit app progresess.

It basically just forces an auth flow for a credit application, which is quite sane. You can also do the whole process - enrollment and manual authorization - online. It was quite painless for me to do it a couple of years back.

That hasn't been my experience applying for credit with frozen reports. I have to unfreeze them (paying the fee), call the creditor to reattempt to pull the report, then refreeze.

>So why can't I have a mobile app (or three) for free

Yes, and I think it's a bigger question of why we have so little control over or access to our own data in the first place? It's a racket that they monetize our data by selling it to others, then charge us again to access and protect it. And, if you've ever had to go through the pain of having something corrected in a timely fashion, then you know it's doubly-maddening. They are purposely opaque and byzantine.

Yet, without our data, they'd have no business.

>Yet, without our data, they'd have no business

Yet, without credit rating agencies, you'd get no loans.

This kind of thinking is what allows these companies to get away with this kind of incompetence. Loans were given before credit rating agencies existed. This incident shows how flawed our current system is.

There is no such agencies in lots of countries (e.g. France) and still people get loans. When I came to US, I had to purposely take extra credits/loans to boost my inexistent credit history. Now I am credit worthy thanks to my artificial debt.

I'm not arguing against you, just curious... in France, what prevents people from just applying for loans over and over and never paying them back?

There are other means to determine whether someone is eligible for a loan (wages, collateral, family support...).

> Yet, without credit rating agencies, you'd get no loans.

Loans existed for millenia before credit rating agencies, so that seems unlikely. It's more likely that the people getting the best loans terms today would pay a higher cost for borrowing without credit rating agencies, and that credit references would be more important, though.

Not true. But, even if it were, there's no requirement that they operate as they do.

hmm i called the 3 mentioned here today and all were free.

https://www.consumer.ftc.gov/articles/0497-credit-freeze-faq...

    Equifax — 1-800-349-9960
    Experian — 1‑888‑397‑3742
    TransUnion — 1-888-909-8872

What state do you live in? Credit freeze rules vary from state to state.

Is there a wiki page or government list that describes the rules for each state?

Here's one list: http://www.creditcards.com/credit-card-news/credit-card-free...

I'm wholly ignorant to this but I am very curious. Why would it be like that?

Different state laws mandating different things.

Federal Law allows a fee, some states have passed laws mandating no fee, or no fee to freeze but a fee to unfreeze, etc

I believe it depends on your state. I'm in California and I had to pay $10 for freezing on Experian and TransUnion, although it was free for Equifax.

Same experience here (also CA), and I was able to freeze all of them online.

It's mildly interesting how different the experience was across the three. Experian gave me the choice between choosing a PIN and getting a generated one, Equifax just gave me a PIN, and for TransUnion I had to choose the PIN (shorter than for the other reports) myself.

How do you freeze them online?

Come on, that's really not hard to find out for yourself. But here are the links anyway:

https://www.freeze.equifax.com/ https://freeze.transunion.com/ https://www.experian.com/freeze/center.html

ugh. even their 10 digit code they provide to unfreeze someone isn't very secure. It's simply todays date plus a 4 digit pin that moves up in the order that someone signs up. For example: 090817xxx1, 090817xxx2. So my wife and I are simply two numbers apart.

Jesus. I think you can provide your own. But yeah, when the user-facing bits are this bad, you know it's nothing but garbage below. I can't believe these companies have so much power.

It worse. It's not even a 4 digit PIN. It's the time in 24-hour format HHMM: https://news.ycombinator.com/item?id=15205579

You and your wife just did it 1 minute apart...

I can't even imagine how something like that can be implemented. Even if you put the most junior developer on this, something so serious should have been reviewed by someone. At least do a quick search on stack overflow or something.

i filled out the experian form online for free:

https://www.experian.com/fraud/center.html#content-01

That's not a credit "freeze". It's just an alert system.

All the confusion in this thread is disturbing. If HN readers can't figure this out, the general public is totally screwed.

Experian freeze is here: https://www.experian.com/freeze/center.html

https://www.consumer.ftc.gov/articles/0497-credit-freeze-faq... said:

"You'll need to supply your name, address, date of birth, Social Security number and other personal information. Fees vary based on where you live, but commonly range from $5 to $10."

So depending on where you live, you probably have to pay.

I thought all 3 were free to freeze but $10 to unfreeze

$10.83 in Texas for Experian

f no I'm not paying them anything

Fuck that, Equifax should offer free freezing for anyone affected by their breach. Charging for it is profiting from their own negligence.

Would love to hear a lawyer's take on this.

We all got two comments into this thread and decided literally anything is better than trying to deal with all the crazy legal theories and bullst going on in here.

I've just been skimming search result for lawyer... You're pretty much the only one actually asking for one...

So wait, you only need to provide the very same data that was just breached? So anyone can just freeze anyone else's credit now?

Edit: well, you have to pay with a credit card so it's traceable, so not that bad.

I'm sure paying with a stolen credit card is no problem for somebody willing to steal your identity in the first place...

Well depending if you have the answer to the 4-5 security questions , like previous address ,car loan payment amount, or mortgage , stuff that you would only know. I don't know the full scope of the compromise, but someone wanting to use your info would not benefit from freezing it. If you forget your pin I'm expecting them to send it to the mailing address

Even if an attacker doesn't benefit, it's still possible for them to mount a denial-of-service attack. That could be very damaging. Or, they could use the threat of a DoS attack for extortion purposes.

Experian has not accepted phone applications for a security freeze for a while now.

> So why can't I have a mobile app (or three) for free that allows me to easily lock and unlock my file or, better yet, to vet every inquiry and approve it or not?

Indeed. This is now no longer something that would be nice to have; it's the only way the system can possibly work. If a credit agency can no longer verify your identity by asking you questions about your history -- the criminals now have all that information -- there's going to have to be another way.

Sounds like a great YC application! Someone should do it!

PBS also reported that if you sign up for this, you give up your right to go after them if something happens - there's some kind of agreement that you have to go thru some process I forget the name of, in which the company usually wins.

Also, although they offer 1 free year, the problem here (social insurance number, etc) is a lot longer than that, so you'd be paying a recurring amount, wouldn't you?

Specifically indicated on their site:

>2). NO WAIVER OF RIGHTS FOR THIS CYBER SECURITY INCIDENT In response to consumer inquiries, we have made it clear that the arbitration clause and class action waiver included in the Equifax and TrustedID Premier terms of use does not apply to this cybersecurity incident.

Except that isn't binding like the agreement it is contained within.

If there is a cost it will depend on your state, all 3 were free for me

Equifax: https://www.freeze.equifax.com/Freeze/jsp/SFF_PersonalIDInfo... Experian: https://www.experian.com/consumer/cac/InvalidateSession.do?c... TransUnion: https://annualcreditreport.transunion.com/fa/securityFreeze/...

which state you are in?

Just chiming in to say that I was able to freeze all three online yesterday. No calls needed!

How'd you do this without calls? Did it cost?

I used the handy links here:

http://clark.com/personal-finance-credit/credit-freeze-and-t...

Of course, Equifax just gave me a 500 AND charged my card anyway, so that was nice. The other two worked fine though. Equifax is a steaming pile of garbage.

Edit to mention that I only used burner cards for the payments.

I posted this on another less popular thread about the topic; Equifax stock was down about 14% overnight from yesterday to this morning but held pretty steady today...

"This is not financial advise:

I remember a few commentors on HN recently saying they have made large gains by buying stock of companies after the news of cyber security breaches significantly reduced the share value, then waiting for the dust to settle(reaction-news-cycle to complete) and price to return to similar value after a few months."

Hopefully this time will be different, but I doubt it.

It depends on how well the proposed multi-billion dollar lawsuit goes. It's reasonable that the stock price would include a risk premium.

For NC residents, it's free to freeze your credit files:

http://www.ncdoj.gov/freefreeze

I was able to freeze my credit through on-line forms using instructions here:

https://www.reddit.com/r/personalfinance/wiki/identity_theft

Fees vary by state. I think I paid ~$20 total and not all of them charged me.

Oof. I really don't want to give these incompetent losers my credit card number.

Seconded. _Really_ do not want to give them my money, as it they've earned it. This is their screw up.

I use privacy.com for things like this.

Credit card number is the last thing you should be worried about.

They already have your credit card numbers. Banks report the numbers to them.

I'm amazed these events don't seem to shake the american love for credit cards. Like now you've seen what happens in the extra layers between you and the money, I wish people would go back on the poison pill and maybe switch to debit cards.

Credit cards are great because if someone steals mine and makes fraudulent charges, they're stealing Chase's money, not mine.

(In theory if someone steals money through your debit card you can get it back... in theory. I'd like to avoid ever having to find out how well this works in practice).

For which priviledge Chase charges you something obscene. The process post-theft on a debit card is not as scary as you seem to think it is, but that may be a EU vs US rather than credit vs debit thing.

Chase isn't charging me anything for the privilege. I have two credit cards with them -- one with a $0 fee and the other with a $450 yearly fee (but on which I earn way more than $450 in rewards points a year so it washes out).

They charge interest, but you don't pay any interest if you settle the full balance every month, which I always do.

I'm sure the maths work out at an individual level, but have you considered the effect on pricing being a debit-first society would have?

Most merchants/payment processors include a premium for handling the edge cases that arise from credit-linked misbehaviour. In the same way you sometimes get a cash discount, removing the merchant/provider protections should show up in your wallet as a good (and surprisingly high) surprise.

As I understand it (please correct me), the party who gains for the furtherance of this agenda is the financial service sector who has another opportunity to insert marginal fees and more importantly, a direct access to your transactions without necessarily having the same fiduciary duty or alignement of goals than a bank teller/account manager would have.

Does it affect your credit rating to freeze and unfreeze your credit? I wouldn't be surprised if it does. It's insane to me that looking up your credit rating negatively affects it. WTF is that about?

It does not affect your credit rating for freezes and unfreezes. And it's a good thing that hard pulls on your credit affect your score, because it's a stop gap for excessively requesting credit. It can also prevent heavy fraud because creditors will often reject potential customers with too many hard pulls.

Freezing/unfreezing does nothing to your credit score. Also, looking up your credit score and pulling a report for personal reasons (read: not a credit line application) will NEVER affect your score. It's what they call a soft credit inquiry, which is not shown on your report when creditors pull it, and won't factor in to credit score calculations. https://www.creditkarma.com/article/hard_inquiries_and_soft_...

This is how I feel. https://equifaxbreach2017.com

FYI. That is a satire / parody site and not the real one.