Equifax Lobbied to Kill Rule Protecting Victims of Data Breaches | Hacker News Reader

Equifax Lobbied to Kill Rule Protecting Victims of Data Breaches

ibtimes.com

893 pointsDowwie167 comments

Wow if anything this is quite worse than the article says.

You can read Equifax's original letter in all of its Orwellian double-speak: https://www.regulations.gov/contentStreamer?documentId=CFPB-...

It's absolutely shocking to me how many times they use the words "serve the public interest".

The sell-out that wrote that letter btw is this guy: https://www.cov.com/en/professionals/s/david-stein

oh man even worse this guy used to work in regulation for the government as part of the Consumer Financial Protection Bureau. Such a clear case of "regulatory capture", or the process where former employees of regulatory agencies leave to go reveal all their thinking and decision making tactics to the highest bidder.

That's not really what regulatory capture means...

Would you say it's part of the process though?

No,the problem is not that they reveal anything about what they were thinking. That's pretty much public knowledge, and doesn't need protection.

It's that they modify their thinking and their actions while in the regulatory agency in ways that benefit the business interests, in exchange for a cushy job after their time in office.

Or the reverse, that they originate from the businesses and go to the agency to implement the business policies.

Regulatory capture is when regulators later join the people they were regulating This compromises their ability to regulate because they anticipate working that industry later. David Stein used to regulate the financial industry. Now he works in it. That's exactly what regulatory capture is.

I'd say that that's a mechanism of regulatory capture, but not the phenomenon, itself. As Wikipedia puts it:

"Regulatory capture is a form of government failure that occurs when a regulatory agency, created to act in the public interest, instead advances the commercial or political concerns of special interest groups that dominate the industry or sector it is charged with regulating."

There are many ways this happens without a revolving door.

IE, the EPA at the moment.

Yep look at hairdressing, taxi, funeral homes industries for examples.

And banking, for another example.

What you've described is the revolving door, which is logically disjoint from regulatory capture.

To be clear, regulatory capture is when the regulator advances the interests of the industry rather than of the public. Revolving door is a separate issue.

There's an interesting argument that the revolving door actually prevents regulatory capture through encouraging regulators to be more strict. The idea is that the more onerous the regulations, the more desireable it is for corporations to hire former regulators who know the system. "Keep your friends close, and your enemies closer."

Matt Levine's take on it: https://www.bloomberg.com/view/articles/2014-06-26/strict-re...

The problem with civil servants taking high paid jobs when they leave is that it can be a payoff for being biased for the company. If companies can dangle the carrot of an eventual job the civil servant will avoid actions that sink their chances.

There's a lot of stuff on real revolving doors in the UK in the magazine Private Eye. Stomach turning really.

Nobody is arguing in favor of the revolving door, they're just pointing out how it differs from regulatory capture. Don't argue for the sake of argument.

The revolving door doesn't require regulators to be more strict.

All it needs is for companies to give big rewards (six figure salary for a day a month of work) to regulators who have previously done things the companies like.

Then their replacements will know strengthening regulations is against their personal interests.

You don't hire an ex-regulator for their expertise, you hire them as payment for services already rendered.

There's an interesting argument that the revolving door actually prevents regulatory capture through encouraging regulators to be more strict.

So "interesting" now means is "deceptive and ingenuous".

In a hypothetical world where corporations were akin to mom-and-pop bakeries that would need to hire power, sophisticated regulators to guide them through a very tough state, that argument might be plausible.

In the real world where corporations are powerful, forward-looking institutions who know full well that paying people involves a process of rewarding behavior, this argument says more about the person advancing it than anything else.

And sure, a lot of smart people might claim this, just as similar stable of smart people operate in the stable of the corporations writing arguments for newspapers and magazine. But maybe all those people aren't at all tainted in their views. I'm sure they could come up with hypothetical situations where they aren't.

>stable of smart people operate in the stable of the corporations writing arguments for newspapers and magazine

I'm not sure if you're suggesting Matt Levine is "in the stable of corporations", but if you read his article history, he's clearly not. One reason (among many) it's fun to read him, is his incisive criticism of his previous jobs in finance and law.

> former employees of regulatory agencies leave to go reveal all their thinking and decision making tactics to the highest bidder.

This implying thinking and decision making tactics of regulators should be some kind of closely guarded secret? These people are essentially writing the laws that rule our economy, I'd think if anything should be public that's their thinking and decision making tactics.

Unfortunately, regulations are complicated, vague, and enforced unequally.

And yes, sometimes they're even secret, because of fear that if their exact model is publicized, the banks will just optimize around it. "Security through obscurity", essentially. http://www.marketwatch.com/story/fed-says-stress-test-models...

> Unfortunately, regulations are complicated, vague, and enforced unequally.

All true, they are. But how implying helping somebody to navigate this mess is somehow bad thing? The bad thing is complicated, vague and capriciously enforces law, not people trying to deal with it.

> And yes, sometimes they're even secret, because of fear that if their exact model is publicized, the banks will just optimize around it

This is the opposite of how the law should work. It's like the argument of making the laws and the courts secret because otherwise criminals would know the law and would learn how to avoid being prosecuted, and would also be able to hire lawyers for the same purpose. Yes, they are, and that's how a normal country works. The opposite is how a totalitarian police state works. Sure, it's probably harder to get away with a financial crime in North Korea - but it's also impossible to live a normal life and enjoy freedoms we all have. I'd rather let some crooks slip through now and then than turn the country into North Korea.

Fun fact: Obama's attorney general, Eric Holder, works at the same firm. These guys are the embodiment of the revolving door.

Well here's your chance to agree with Donald trump: he made everyone sign an ethics pledge that they would not lobby within 5 years of their tenure in government. https://www.whitehouse.gov/the-press-office/2017/01/28/execu... getting Congress to pass a law that puts some teeth behind the promise is another question.

Even without lobbying, large corps can still use sweetheart positions in the private sector as a "reward" for friendly legislators who retire.

Obviously targeting lobbying is an improvement, but it's not enough.

And also, I'm wondering how that impacts a not-for-profit that a politician decides to champion after retirement... Is that "lobbying"?

From what I have read he is stacking agencies with lobbyists from industries they are supposed to regulate. So no, there is no reason to agree with him.

saying "everyone" isn't correct, because trump will give you a waiver if he wants you in his cabinet:

https://www.washingtonpost.com/news/post-politics/wp/2017/05...

> here's your chance to agree with Donald trump: he made everyone sign an ethics pledge that they would not lobby

This seems like a case of "Do as I say, not as I do." Ignoring the question of what percentage of senior people have left due to being fired, the potential for legal cases against them, inability to personally pay for anticipated legal expenses, or some combination thereof, there's also the fact that it's still early in the Trump administration.

The bigger factor is likely the massive number of (former?) lobbyists being hired into positions of influence. In fact, it seems that the lobbying ban you pointed to also removed a lot of restrictions that had been in place [1], and that there's been both noticeable granting of waivers and significant resistance to releasing information on those waivers [2].

[1] http://www.politico.com/story/2017/01/trump-lobbying-ban-wea...

[2] https://www.nytimes.com/2017/06/07/us/politics/lobbyists-eth...

He did! He also weakened the language for what defines the areas in which one is allowed to lobby. Specifically, Trump's lobbying ban only prevents officials from lobbying their former agency - it doesn't prevent them from becoming registered lobbyists. For example, an SEC official couldn't lobby for changes to the SEC, but they could lobby the other 4 financial regulatory agencies. There's also an ongoing legal debate about whether the language used in Trump's lobbying ban includes a loophole that would allow officials to continue to try to engage in certain kinds of lobbying - involving "agency proceedings" rather than legislation.

The previous administration had stronger language (no lobbying whatsoever) and a 1 year ban. So Trump extended the timespan, and poked the ban full of loopholes.

http://www.politifact.com/truth-o-meter/promises/trumpometer...

http://www.politico.com/story/2017/01/trump-lobbying-ban-wea...

Worse, Trump has issued at least 16 ethics "waivers" to at for staffers who would be banned from serving on his staff over his ethics rules. Once you make more than a dozen or so exceptions for who you're putting on your team, it's not really a rule at all.

https://www.whitehouse.gov/ethics-pledge-waivers

Bullshit. Trump is bringing cronyism and opaqueness to heights unprecedented in recent administrations. His lobbying EO actually weakened some of Obama's lobbying restrictions. And while Trump strengthened some rules, he then promptly started handing out secret waivers to so his favorite lobbyists and and industry executives can come work for him. Go read about what the federal government's top ethics officer Walter M. Shaub Jr. had to say about this before he resigned.

Honestly, this isn't hard to see. Just look at EPA, DOE, FERC... Trump is stacking our agencies with industry executives and lobbyists hostile to these agencies' charters, and in some cases their very existence.

If they are secret waivers, how do you know about them?

Because Shaub didn't like what Trump was doing in secret so he outed them before he resigned?

https://www.nytimes.com/2017/05/01/us/politics/top-ethics-of...

I may have a different definition than they appear to be using. If I'm understanding your link correctly, I'd say they were undisclosed. There would have been a paper trail and the data wasn't classified, correct?

If he were to resign and leak secret information, he'd be in legal trouble, yes?

Note: This is not meant to be read as approval, just a bit of contention at the language used.

I'd say the salient point about secrecy being this:

> But Mr. Trump has chosen to keep the waivers secret. He dropped a practice, in place during the Obama administration, that any waiver would be shared with the Office of Government Ethics and posted on the White House website or the ethics office’s website, or on both.

It certainly wasn't "top secret" in the classified sense but it was done with secrecy as if he had something to hide regarding the practice or, perhaps a more charitable reading was that he was ignorant of the precedent. From hiding the wh visitor logs to the ethics waivers to stopping the recording inside the wh press briefing room in my view they are actively trying to be less transparent in their dealings.

Maybe it is just my perspective but that reads very slanted to me. I was a freelance journalist that covered the political best and hard copy. This was back in my university days, but I'm not sure my editor would have put that through without changing it to something like the mentioned 'undisclosed.'

Secret, as a word, implies intent - at least to me. It may also imply legality. While certainly worthy of raising an eyebrow, I'm not sure we can make accurate claims of intent?

Ah well, it's largely immaterial. I do thank you for taking the time to explain.

Good question. The administration admitted to the existence of these waivers in May, but refused to disclose their contents to the OGE, which is unprecedented among recent administrations. This secrecy was roundly condemned throughout the federal government, and notably and publicly by George W Bush's former chief ethics lawyer [0].

Trump was eventually forced to back down and the waivers were released, revealing such swampy critters as Michael Catanzaro and Shahira Knight [1].

EDIT: So, "secret" in a more colloquial sense than the technical "classified" definition.

0 - http://www.businessinsider.com/trump-lobbyist-ban-cabinet-wa...

1 - https://www.nytimes.com/2017/05/31/us/politics/lobbyist-ethi...

Why do you keep saying "recent administrations"?

The norms of what administrations do changes over time in part because what administrations need to do change over time. It's obviously not helpful to contrast George Washington's executive behavior with George Bush's.

In particular, it's useful to draw a line pre- and post-USSR, as that was a sea change in executive policy. That means Bush 1 / Clinton onward. Other common markers are pre/post Great Society, pre/post WW2, pre/post New Deal, etc.

Yeah, I read an article that another user posted. I think I prefer the term 'undisclosed.' At least in my head, secret means someone is in trouble for leaking it. There was a paper trail, for example.

I guess the use is valid, but I'm not sure it's objective. I don't prefer Trump, but I do try to remain objective. Try being the operative word.

Secret just means the vast majority of people can't know the details. You can have a huge paper trail with secret classified documentation.

EX: Huge gang's may have secret handshakes.

> Well here's your chance to agree with Donald trump: he made everyone sign an ethics pledge that they would not lobby within 5 years of their tenure in government. https://www.whitehouse.gov/the-press-office/2017/01/28/execu.... getting Congress to pass a law that puts some teeth behind the promise is another question.

You are mistaken if you believe that is a campaign promise he actually kept.

https://www.vox.com/2017/6/1/15723994/trump-ethics-waivers

> But he immediately began to staff the administration with people whose work seemed, on its face, to clearly violate the terms of the order. Rather than publicly grant waivers of ethics rules with a clearly stated rationale, the White House was simply routinely waiving ethics rules in secret so nobody knew how many waivers were issued or for what purpose.

> Trump has finally provided documentation, and it shows that the ethics rules are plainly meaningless. He’s granted five times as many waivers in his first four months in office as Obama did, which cover key figures in the administration like Chief of Staff Reince Priebus, chief strategist Steve Bannon, and counselor Kellyanne Conway. All told, 17 waivers were granted to members of the White House staff, and we still have no idea how many waivers have been granted for other executive branch agencies or whether anyone is even keeping track.

http://www.politico.com/story/2017/01/trump-lobbying-ban-wea...

> Trump's ethics pledge, issued as an executive order on Saturday, includes a five-year "lobbying ban" that falls short of its name, preventing officials from lobbying the agency they worked in for five years after they leave, but allowing them to lobby other parts of the government.

It is the weakest "lobbying ban" since Bush Jr.

fun fact: it was republicans equifax lobbied.

Another fun fact: the revolving door is non partisan. Money is what counts

and yet you decided to link obama to this lobbyist with a game of 6 degrees of separation.

They work for the same company. That's a little less than six degrees.

I don't know how I would feel if I was linked politically to everyone I have ever worked in the same company with.

This is not politics theater as in Democrats or Republicans. Money is bipartisan.

Holder is not on this letter. And the letter was sent to the CFPB. Holder never worked at CFPB, which has very different jurisdiction than the DOJ. So what exactly are you alleging?

I'll take a wild guess that he is alleging that Eric Holder's failure to prosecute any of the CEOs of the financial institutions that played a critical role in the financial crisis (by, e.g., making loans to people without incomes, packaging the loans into mortgage backed securities, and passing the resulting time bombs off to other parties) was appreciated by his former and future colleagues at Covington and Burling and their clients in the finance industry. That Eric Holder was very aware of that appreciation and anticipated that he would be rewarded for it.

When party A sells party B a crappy product with overinflated promises, the result is a civil suit, not a DOJ criminal prosecution. In any event, what does Equifax have to do with that? Was Equifax rating mortgages or something? Is it a bank?

When the creation and representation of crappy products entails fraud or other crimes the result would actually include criminal prosecutions by the DOJ (in a world where the DOJ weren't captured by party A's industry). Tying the two scandals together is the influence of the finance industry on regulation and enforcement through the revolving door, in both cases to the same law firm representing financial institutions.

Fraud can be either civil or criminal, depending on the circumstances. Where sophisticated parties are on both sides of the transaction, and the allegations of fraud boil down to complex questions regarding representations about the product, it's a civil matter, not a criminal matter. The fact that the DOJ correctly interpreted the law instead of trying to satisfy peoples' bloodlust isn't a "scandal."

I am alleging that this company is expert in hiring people from government agencies who had in some way to do with financial regulation. That's all. You can draw your own conclusions.

The sell-out that wrote that letter btw is this guy:

I don't think it's a good idea to post someone's personal information in such a flippant way. He's not a public official and the whole point here is to witch hunt him. It comes up with his name, phone number and email address.

He's a lobbyist. Every interaction he has with the government is a matter of public record. If he felt he didn't want that information public then he shouldn't be a lobbyist.

Posting the document is fine. Posting a link to his contact page while calling him a sellout is probably overstepping. The sole reason for posting the second link is to say "Look at this person. Isn't he horrible? Here's his name, phone number and email address."

HN is almost a top-500 website by traffic. A lot of people come here. How likely is it that people here will start harassing him just because it's easy? His info is right there.

If posting the document is fine - which you didn't read - then posting a link to his corporate bio is fine. It is in the effing document. It is already public record.

I'm well aware. There's a major distinction between someone's info being in a document vs linking to his info with "This guy is a sellout:"

This post is currently #1 on HN. The comment is the top comment. That means all of HN's traffic that reads comments is going to that person's contact info.

If you don't agree, just downvote and move on. Personal swipes are unnecessary.

I have to admit, this is some top-level concern trolling.

Judging by his public record, the guy is a sellout, and it is 100% OK to call him out as such. If he didn't want his contact info to be public, he should not have put it online. Since he did, it is, again, 100% OK for people to link to it. That's the entire friggin purpose of a contact page!

I like how I was immediately called a concern troll after saying personal swipes are unnecessary.

It's unclear to me how or why posting a lobbyists publicly available information along with a personal opinion should be self-censored.

If you don't like what he is up to, it makes perfect sense to contact him and let him know.

He should be all for people communicating their opinions about his actions to him, he is after all a lobbyist.

The parent didn't call you a concern troll, though. They said "this is some top-level concern trolling". Criticizing behaviour is not the same thing as name calling or personal swipes.

"Concern troll: a person who disingenuously expresses concern about an issue with the intention of undermining or derailing genuine discussion."

Yep, that's name calling. It's also poisonous to the discussion. It's not "criticizing behavior" when I wasn't doing it.

More importantly, it makes for boring reading. You can see how unproductive the conversation became.

But whatever. Just have thick skin, right? We can't simply expect people to be civil.

No one is calling his house, contacting his spouse or kids. His work email, phone number, and address are publicly accessible. This goes with the territory of being a lobbyist.

Doxxing is a toxic problem on the internet. However this is not really his "personal" information. It's his professional contact information, which he publishes freely, and uses to attempt to persuade government officials. Contacting him professionally and non-aggressively is a perfectly fine thing to do.

We own this document.

I think it's good idea to link to public documents that companies put up on their public web page.

I think this 'dox' does not mean what you think it means.

Whatever information is at that public link is info posted by the guy or his employer. It's not doxxing him. It's merely linking to a public webpage that the person themselves approved.

We live in a civil society in which people who advance opinions (or agendas) which affect the public are held to task amidst public debate.

That's not the same thing as a witch hunt.

>>>David Stein advises clients on retail financial services, credit reporting, financial privacy, payments, fair lending, and technology and e-commerce issues. He assists banks, non-bank lenders, consumer reporting agencies, payments and technology companies, and their vendors with regulatory, compliance, supervision, enforcement, and transactional matters.

Notice hw he in no manner of speak "assists" any of the consumers/users of said services?

This guy is a shill POS.

Why you call him a "sell-out"? He seems to be professional consultant. His main argument seems to be that CFPB does not have legal right to enforce the regulations he is talking about. That may be true or false - I have no idea, for that one needs to be a lawyer specializing in regulation law and parse the documents establishing CFPB and all accompanying regulations and caselaw. Which is way beyond my abilities, and I suspect, most of people here. But how it is "Orwellian"? He also raises a very correct argument that considering only benefits of successful class action and not the costs of the litigation and the fallout for both consumers and credit industry is just wrong. I mean, if you win $10 from successful lawsuit but would be forced to pay $20 more next time you need a credit check (numbers are just an invented example, of course), then this setup won't be worth it for you.

Again, his point may be wrong - maybe benefits of class actions are much larger than the costs - but this point is certainly in no way is "Orwellian". And if he is right, avoiding such regulation would definitely be in the public interest, in a very direct sense of the term. We have tons of regulations which serve as nothing more than a feeding ground for unsavory opportunistic plaintiff lawyers, with no benefit for purported victims (which get peanuts while lawyers are getting millions, and often the lawyers just buy plaintiffs for minuscule sums in order to mass-file lawsuits) and huge costs for everybody else. Last thing we need is more of these.

He also raises a very correct argument that considering only benefits of successful class action and not the costs of the litigation and the fallout for both consumers and credit industry is just wrong. I mean, if you win $10 from successful lawsuit but would be forced to pay $20 more next time you need a credit check (numbers are just an invented example, of course), then this setup won't be worth it for you.

This argument confuses a payoff to plaintiffs with costs to the credit bureau's customers - but the plaintiffs would not be the customers of the credit bureau but everyone monitored (involutarily!) by the credit bureau.

Just as much, the purpose of the state allowing a lawsuit would not be to give money to the plaintiffs but rather to give the credit bureau a disincentive for doing what they did - manage their subjects' (now victims) data poorly.

Which is to repeat what other have noted - the average American isn't the credit bureau's customer, they are the credit bureau's product (the customers are employers and landlords). If having a secure credit-check system costs more, let the credit bureau's actual customers pay more.

And sure, landlords sometimes pass credit-check costs on to tenants but that's just one more part of the whole abusive system that it would be nice to see reigned-in (though naturally I'm not optimistic).

> This argument confuses a payoff to plaintiffs with costs to the credit bureau's customers

Most people would be both for a class-action lawsuit, or subclass of one another. The point is these things have costs, and when thinking "great, we just took a billion dollars from a richy rich bank!" you should also think of "wow, the richy rich bank just raised fees and made some produces worse and more costly and decided make less investment, which hurt local economy, how that happened I wonder?"

> Just as much, the purpose of the state allowing a lawsuit

This however allows all lawsuits - not only about poor data management but about somebody getting bad credit score and suing the credit report company, and about a font in the report making somebody nervous, and about some document on the company site being not compliant with some God-forsaken regulation from 1907 which some enterprising lawyer dug up and decided to turn into a nice yacht for himself. These things cost big money, and there are people specializing on making big money from such things, with zero use for the public but raising the costs of doing business (which is inevitably shifted on the end consumer). Regulations should take this into account.

> the average American isn't the credit bureau's customer,

How that is true? I've been asked for credit report when getting a credit card, renting apartment, signing up for phone service, signing up for internet service, signing up for the TV service, buying a car, buying any of the kitchen appliances, getting a mortgage, buying life insurance, buying car insurance... You get the idea. What kind of "average American" does none of these things? It's certainly not an average American I have ever met or heard of.

> And sure, landlords sometimes pass credit-check costs on to tenants but that's just one more part of the whole abusive system

I'm not sure - how this is "abusive system"? Do you expect credit bureaus work for free or landlords not charge the costs of doing business because of pure althruism and hate for money? Landlords don't rent out their property because they want to serve the humanity - they do it for money. And if something like credit check costs them money, they'd include it in the price - and unless there's a cheaper offer on the market, that'd be the price of the offer. What's "abusive" in it?

>How that is true? I've been asked for credit report when getting a credit card, renting apartment, signing up for phone service, signing up for internet service, signing up for the TV service, buying a car, buying any of the kitchen appliances, getting a mortgage, buying life insurance, buying car insurance... You get the idea. What kind of "average American" does none of these things? It's certainly not an average American I have ever met or heard of.

How does that make you a customer? This has uses for the companies you buy things from, but not for you directly. I live in a country with no credit reports (credit is given using other metrics) and in do way do I see this as you being the customer or consumer in this case.

> How does that make you a customer?

That's something that allows me to access easy credit. If I don't have one (e.g. as a new immigrant I didn't have any credit record) I do not get access to credit, instead I have to prepay stuff, use very expensive credit (12% APR instead of 3% APR, that sort of thing), large security deposits etc. Clearly having credit reports make my life easier (and cheaper). How that's not being a customer?

Because I, and many people worldwide, can do all that without credit reports. If it weren't for the credit agencies banks would find another way to determine what credit to give you without additional costs to you.

>I mean, if you win $10 from successful lawsuit but would be forced to pay $20 more next time you need a credit check

Yes but he competing agencies who don't get sued can charge less and put these guys out of business.

There is no behavior that can guarantee business is not going to be sued. People sue for all kinds of completely frivolous reasons, and it still can cost lots of money to deal with it.

So your argument is that because the credit reporting companies may raise prices as a result of being sued for their bad actions we should prohibit anyone from suing them and allow them to operate with out any legal liability.

They should be allowed to create databases of ruin, not secure those databases, sell this data to who ever and no one should have any legal recourse because prices might go up if they were found to be liable...

Really? That is your position

I have a problem with these credit reporting agencies even being legal in the first place. I have a problem with the fact I have almost no control over the data they collect, and sell about me, I have a problem the fact they can sell this data about me to whom ever they wish with out my permission, and I have problem with the fact they charge me to access this data in any meaningful or real time manner, sure they are legally required to give me a report 1 time per year, a regulation they also tried to kill, but if I want meaningful access I have to pay them a monthly fee to access my own data.

So it is safe to say I 100% disagree with your position, these credit reporting agencies should face bankruptcy for breaking the public trust. This data breach should mean Equifax as a company is dissolved, unfortunately due to flawed and unethical arguments like the one you are making this company will likely make a profit off this data breach

> So your argument is that because the credit reporting companies may raise prices as a result of being sued for their bad actions we should prohibit anyone from suing them and allow them to operate with out any legal liability.

Nope. My argument is we need to account for the costs of this when we decide if having arbitration ban is a good thing or not. It's not "evil fatcats want no responsibility for their greed, let's stop them!", it's "we have two setups here, with complex cost structure, before we decide which one we are going with, we need to carefully weigh the costs of each, not dismissing any of them because it makes us feel bad and not using unicorn-land economics that says everything that makes one feel bad doesn't really exist". My point is not one is better than the other - I didn't do the work to know that - my point is you have to do the work to know it. Wishing well is not enough, unlike fairy tales, in the economics it's not enough to be pure of heart, you also have to have math and data on your side.

> Really? That is your position

No, not really, you can stop strawmanning now, before you caused local straw shortage and the costs of straw skyrocket.

> but if I want meaningful access I have to pay them a monthly fee to access my own data.

I know right now about half-dozen of absolutely free ways of getting credit reports and scores. I didn't look for them that hard, I was told about them by companies' marketing, banners, mails (both paper and electronic), etc. Discover, American Express, Barclay, CreditKarma, Mint, Citi. Everybody is doing it now. I am sure if I look harder, I can find even more free offers. Surely, the paid ones could have slightly better UI and maybe a couple of added-value services like insurance and notifications and stuff, but bare access to data has been free for a while, if you spend 10 minutes on research.

> This data breach should mean Equifax as a company is dissolved,

So instead of 3-way oligopoly you have 2-way oligopoly. That surely will fix things.

Is using words like "sell-out" for a professional doing his job consistent with HN policies?

This is a genuine question and not a rhetorical one.

Perhaps the world would be a better place if Equifax went out of business. The other two members of the oligarchy could easily shoulder the load.

there is no reason to believe the others are better.

They might get better if they know the consequences of bad behaviour is bankruptcy.

Yep. Kill the chicken to scare the monkey.

I agree with your intention, but I worry about the consequences: One thing worse than a group of companies controlling credit ratings is one company having a monopoly on controlling credit ratings and being "too big to fail".

What exactly is the best case scenario here I wonder? More credit rating companies equals more competition but greater attack surface and chance of breach, but fewer companies approaches a monopoly situation which isn't good for consumers either. This feels like a lose-lose...

> What exactly is the best case scenario here I wonder?

It seems clear: a transition away from the economic and financial models of the industrial age, which Experian, TransUnion and Equifax - along with the banking cartels and various national reserve banks - represent.

Fortunately, that's happening; the best-case scenario seems inevitable.

This is a time for optimism.

>Fortunately, that's happening

Can you link to some sources? How is our current system post-industrial?

I submit that, for example, the explosion in creativity surrounding blockchain tech is evidence that the model embodied by these entities is no longer relevant.

And that these sorts of developments are tantamount to entry into a different age (the "information age" is the typical vernacular) which has a different set of norms than the industrial age did.

and I think people in the Tech Bubble massively over state the importance of "the block chain" as some kind of savior when in reality one of 2 things will happen

1. The Banks and National Reserves will fold the technology into their operations making it apart of the current system. This process is already in the works. This will result in the same system we have today just backed by different technology, but will not lead to the end of Centralized Authority like the vision of block-chain supporters seem to have

2. The Technology will fizzle and die. Which seems unlikely at this point but it is still possible. Security concerns and other aspects still remain high....

However I very pessimistic that block chain will be what brings us to a different age, where these entities are no longer relevant

Outside of the Tech Bubble, there are very few people that even know what a block chain is.

> What exactly is the best case scenario here I wonder?

Pass a law that (a) lets Equifax fail, thereby (i) sending a clear message while (ii) solidifying, in law, the industry's liability to consumers; and (b) prohibits existing credit rating agencies from purchasing Equifax's data, thereby priming the pump for a new entrant. Alternatively to (b), mandate a separation (Glass-Steagall style) between those who warehouse credit data and those who use it to calculate a credit score.

How about we not let them declare bankruptcy and send them to corporate debter's prison instead: hold them accountable by garnishing future earnings until their debts are accounted for. Essentially let them continue operating but let them hang out in the pink sheets for a decade or so as punishment.

I know it's probably a rash idea full of a million flaws and unintended consequences, but sometimes bankruptcy is too lenient of a punishment. And this feels like one of those cases.

> How about we not let them declare bankruptcy and send them to corporate debter's prison instead: hold them accountable by garnishing future earnings until their debts are accounted for. Essentially let them continue operating but let them hang out in the pink sheets for a decade or so as punishment.

The purpose of bankruptcy is to determine how to proceed when a company's liabilities exceed its assets. The company had $10B in assets and $7B in liabilities, a fine added another $5B to their liabilities, now they're bankrupt. Not all creditors can be paid the amount they're owed. Bankruptcy laws exist to make sure what happens next is fair, e.g. each creditor gets 75c on the dollar instead of having the CEO pay all the debts owed to his brother's company first and leaving the other creditors with nothing.

In practice what usually happens in a case like that is that the company files for bankruptcy, sells all its assets --including its name -- to a new corporation that continues operating its business, and the proceeds from the sale are used to satisfy the old corporation's liabilities as much as possible.

Assuming the sale price is fair market value, there is no way to extract any more money from the company than that -- that's what fair market value means. You can't get any more money by forcing them to continue operating. Their future profits are built into the price of what you can sell their operations for. If that amount is less than what they owe, there is nowhere for the rest of the money to come from.

Well, you could eliminate limited liability and go after the shareholders, but if that's the intention then it shouldn't be done ex post facto.

Two things: impose duty of care and accuracy requirements, violation of which can kill the entire business; and restructure the industry to reduce switching costs, so that new rating administrators can come online faster and eliminate TBTF.

Not a big deal, just break it up into 4 smaller companies and let them fight it out. I'm sick of this craven unwillingness to interfere with business' systematic exploitation of consumers.

Exactly. The concept of credit score should be replaced with something better, or just kill the idea.

Something better like what? Did you have something better lines up already?

Were a blockchain used to replace this industry, how would we compensate the miners? Would this be a good use-case for Etherium and Gas?

> Were a blockchain used to replace this industry

How would this work? Make everyone's personal credit details public?

Combine with zero-knowledge proofs. A bank can inquire whether the party that has given it a scoped token meets Criteria X, Y, and Z. The bank gets back a yes or no.

While Bitcoin and Bitcoin-like blockchains use no encryption, others like zcash do. It's possible to hide secrets in a blockchain using encryption and selectively confirm narrow assertions without compromising privacy.

So each credit interaction would be stored, encrypted, on the blockchain? And then to check my credit an agent would request all those blobs? What prevents me from just handing over the blobs I haven't defaulted on?

You'd need a blob that links a "me" blob to all those interaction blobs, and an authentication mechanism that links meatspace me to the "me" blob. People will lose their private keys, so you need a trusted party comparing the meat and blob "me". This ends us up at the same place we started, with extra steps and a structurally-ensconced middleman.

For the sake of brevity I'm ignoring that a blockchain kicks dispute resolution to an oligopoly of miners.

Much as Bitcoin addresses the double-spending problem to ensure that a single output isn't spent twice, a "credit interaction" would be added to the ledger as a continuation of an existing history (or a new one). The zero-knowledge proof would assert various attributes of that history.

At one point or another, the history could be associated with a specific human. Or not; depending on the goal of the design, a single credit history might pertain to one person, multiple people, or a business association. A single person might have multiple histories -- though longer-lived and more active ones would be more valuable, which reduces the viability of a Sybil attack.

Loss of private keys is a problem if users are their sole maintainers. A credit union would surely be willing to safely store a key for a 2-of-3 transaction that empowers it to manage a customer's history.

Distributed ledgers absolutely do not need miners, especially if level of trust is a variable aspect of the design.

By the way, your initial question could have been interpreted as a request to engage in a brainstorming discussion to produce a blockchain-based public record that preserves privacy. If so, you should know that your subsequent response is inconsistent with that sentiment, though I'm giving you the benefit of the doubt by continuing in the spirit of additive discussion. If you're not interested in brainstorming, then please state your intentions so we don't waste time talking past each other.

Tied to some form of secret ID.

Maybe we could encrypt each credit update with the person's Social Security Number? That way, it would at least approximate the current level of security.

This would be much easier if we could replace the current Social Security Number system with a public/private Social Security Number key system. But alas, that would require much regulatory change.

You're going to encrypt publicly accessible sensitive data with a 9 digit number ? This is not even close to the current level of security. You don't get to make millions of guesses when some dumb website or clerk requires your SSN to do something.

To decrypt data you get to guess over and over again. An SSN would be a terrible key for that.

yes, though it could be pseudo-anonymous like bitcoin. you could have each side of a transaction rate the transaction, and use a page-rank algorithm to create ratings.

Check out Cred - https://crednetwork.org

There's more than just 3 credit agencies, it's just that those three are the most reliable of them for credit reports. Given all the complications people have with even those three, it really doesn't say much for the rest of the industry.

The odd thing is, I never had to worry about this stuff in the UK. There's no notion of a credit score or centralised credit agencies that I needed to worry about. Most loan etc interactions take place with your existing financial institutions who already have your information on record.

Uhh there totally is a credit score and reports in the UK. In fact Equifax and experian are two of the major agencies in the UK. So you aren't in the clear.

There definitely are credit ratings in the UK! Try taking out a new credit card or loan or even getting a phone on contract -- they will almost always run a credit report check.

Just Google "UK free credit report" -- there are websites like Noddle that will show you your report for free.

So what if you want to interact with an institution you never worked before - what happens? I.e., you move in to a new city and want to get a credit card?

The odd thing is, I never had to worry about this stuff in the UK. There's no notion of a credit score or centralised credit agencies that I needed to worry about.

This the opposite of how things are here in the UK.

I'm wondering how you've not encountered Equifax, Experian, Noddle and the other credit reference agencies in the UK before.

Even an application for a mobile phone contract in the UK will definitely end up going through these agencies at some point, and your bank most certainly will consult them when applying for a loan.

Unfortunately, we already got Equifax and Experian in India. https://www.bankbazaar.com/equifax/equifax-cibil-experian-hi...

CIBIL is Transunion. So, all there are in India, along with 4th one Highmark

Or just delete all 3 from the earth, physically destroy all of their data storage media and let people make loans the way they always have for millennia, without three unaccountable private behemoths stealing and hording private data on every citizen then charging them to see/access/protect it, then cutting costs around security and getting all of it stolen. They do not need to exist and their services are a net negative on society.

And a big fuck you to everybody that has made efforts and sacrifices to improve their credit rating, they can take the same (higher) interest rate as everyone else?

> And a big fuck you to everybody that has made efforts and sacrifices to improve their credit rating, they can take the same (higher) interest rate as everyone else?

If it becomes harder to get credit then there will be less inflation (or allow the same amount of it to be caused by government printing money instead, which allows lower taxes), either of which means less need for credit to begin with. Moreover, less need for credit means less credit fraud, the cost of which is paid by everyone.

The concept that credit is a good thing is perpetuated by creditors. Credit is a competitive advantage when you're the only one who has it, but when everyone has it it's just an arms race. It's better for everyone (except creditors) for everyone to have less of it.

I don't know if there should be more or less credit, although it sure seems like an improvement to reduce fraud and have less people up to their ears in debt.

Even if the companies running the system have serious problems, it still provides a mechanism of trust. Most people are likely to experience at least one event in their life, for example an unexpected expense or some long term investment, which would easier to navigate if credit were available.

Replacing the credit score system with the subjective judgement of a creditor introduces arbitrary, discriminatory bias into the system.

If credit is a competitive advantage then isn't hurting its fair availability is somewhat an own goal as long as the USA remains part of a global economy?

> Most people are likely to experience at least one event in their life, for example an unexpected expense or some long term investment, which would easier to navigate if credit were available.

For unexpected expenses that is the purpose of insurance. For investment opportunities that is the purpose of savings.

Finding a sensible investment opportunity that provides a risk-adjusted return higher than the interest rate on borrowed money is very rare, because why would the investment company use you as a useless middle man instead of borrowing the money directly from the lender?

> Replacing the credit score system with the subjective judgement of a creditor introduces arbitrary, discriminatory bias into the system.

The existence of bias is independent of the existence of credit reporting.

> If credit is a competitive advantage then isn't hurting its fair availability is somewhat an own goal as long as the USA remains part of a global economy?

Geography mitigates most of that. An engineer in China is not borrowing money from a Chinese bank to bid on a condo in San Francisco because he isn't in San Francisco to live in it. And to the extent that foreign speculators do that, we could prohibit it -- require US real estate to be owned by US citizens or corporations owned by US citizens. They do it to us.

But the more important point is that availability of credit is not the same as availability of money. As an economy expands the money supply has to increase to prevent deflation. The primary way this currently happens is borrowing -- Alice deposits $1 in the bank, the bank loans it to Bob, now Alice and Bob each have $1 in their accounts but in the bank's vault there is not $2, there is only $1 and a promise from Bob to pay $1 plus interest.

An alternative way to create money is for the government to do it by fiat. If they create a dollar then they can charge Bob a dollar less in taxes, or provide an extra dollar in UBI. So as long as the government increases the amount of money they create by fiat by the reduction in the amount that banks would be lending, Bob has the same amount of money in his pocket to buy things with -- but now he is not paying interest on it to the bank.

> Finding a sensible investment opportunity that provides a risk-adjusted return higher than the interest rate on borrowed money is very rare, because why would the investment company use you as a useless middle man instead of borrowing the money directly from the lender?

I guess this must be news to all the businesses that reguarly operate on credit.

> I guess this must be news to all the businesses that reguarly operate on credit.

We are talking about individuals.

The only thing like an "investment" most people are going to buy on credit as individuals is a house, and besides being an investment it's also a place to live in. Arguably that's more salient than the speculation opportunities.

Deflation will certainly make fewer people take out loans, but not necessarily because they are living high on the hog without them.

> Deflation will certainly make fewer people take out loans, but not necessarily because they are living high on the hog without them.

Deflation is caused by the economy growing faster than the money supply. Increasing the supply of money counteracts this. Both banks and the government are allowed to do this. Banks create money when they make loans; suddenly you have more money in your account but there is the same amount of cash in the bank's vault.

Creating too much causes hyperinflation, so more of one requires less of the other. If the banks lent less money the government could create more.

> let people make loans the way they always have for millennia

I.e, hardly make any loans at all! Most people agree that access to credit has greatly increased the wealth of our society. Not everyone agrees - but I believe this is the consensus.

> They do not need to exist and their services are a net negative on society

Perhaps, perhaps not. The more information that a lender has about a potential borrower the more specific they can make their loan assessment.

Without a credit history, lenders will have to rely on averages. Some people will win from this (e.g. people who "look" like good borrowers on the surface) and some will lose (people who "look" bad on the surface, but have a good history).

The likely outcome if we remove this background information from a lending check will be more misallocated credit.

To be clear, I'm not really arguing that "credit agencies" in their current form should exist, but some sort of information about borrowers is useful to improve allocation of resources. Perhaps each person could manage their own signed Merckle tree of information...

Perhaps, perhaps not. The more information that a lender has about a potential borrower the more specific they can make their loan assessment.

So what? The lender's interests are not he only ones at stake. I'm not convinced of the objectivity or desirability of perfect economic efficiency in credit allocation. There's plenty of evidence to suggest the information asymmetry will be abused by unscrupulous corporate actors.

My point is that certain borrowers will lose out if the lender can't be specific in their assessment - see the paragraph following that quote about how some borrowers will win and some will lose.

> I'm not convinced of the objectivity or desirability of perfect economic efficiency in credit allocation. There's plenty of evidence to suggest the information asymmetry will be abused by unscrupulous corporate actors.

Interesting. There are certainly plenty of flaws with credit. A big one for me is that consumers often don't act in their own long term interests and get into too much debt. Another one is that credit is inflexible (compared to equity) when things go bad, and has a tendency to cause crashes. Both of these are a challenges to economic efficiency.

On the other hand, I'm not sure about the benefit of reducing the information that lenders have. I'd be interested to hear your point of view.

>see the paragraph following that quote about how some borrowers will win and some will lose.

So, no change? https://www.nytimes.com/2016/07/19/business/dealbook/race-st...

Centralized credit scores can be gamed, easily, helping those who are inclined to game them -- these are currently the "winners". Taking out a debt for no reason and then paying it back on time is a stupid economic decision, but it's great for your credit score.

The minimal increase in efficiency that comes from lenders having all this often incorrect, unaccountable private information about borrowers must be balanced against the damage the big 3 do as well as the damage lenders can do by exploiting the aforementioned information asymmetry it gives them. It comes up pretty short in my view.

But in their absence, what will creditors do? Outright discrimination?

Less players in already highly monopolized business is better? How exactly?

Maybe entrust this function to a government agency? A least they wouldn’t be in the business of selling your information—i assume that happens in some fashion under the current system but maybe someone can clarify?

The government is not in the business of selling your info?

Why is it then the government has setup massive databases of public information records that anyone to get a copy of for a nominal fee...

The government collects and sells more information about you than the credit reporting agencies do...

Hell the government is a large source of data FOR the credit reporting agencies, they correlate government data with data they get from Lenders.

Trusting the government is just as bad as trusting these companies

Question. Can't we just let this company die? Do we really need a new law created by congress (EG HIPAA 2.0). Wont this just destroy the ability to create startups quickly? I understand it will help lawyers get fat and happy, but enforcing 'privacy' laws would be a trolling circus.

Do I really want a startup doing this stuff? Iterate fast and break things? I would rather just have a heavily regulated industry with a lot of checks and balances handle very important data like this. Why could you even access the core databases from the front end? Why isn't the data on completely separate server where all queries are completely scrubbed and verified?

Heavily regulated like: airlines, healthcare, public schools, prisons and drugs?

Air travel is pretty safe.

That and if an airline has a major crash, there is a high probability they'll be out of business relatively soon, or forced to acquire a new brand.

* Pan Am had two 747 crashes in 11 years. Flight 103 & Flight 1736 (Tenerife) although the airline was not directly to blame for either crash.

* TWA 800 (along with 9/11) led to the collapse of airline.

* Valuejet 592 crashed in Florida in 1996, grounded for several months, and then merged with Airtran Airlines in 1997.

Those are interesting questions, but distract fromt he central one of just why we should continue to let Equifax exist.

What do you mean, "let it die"? Do you honestly think there's even a shred of possibility that Equifax would go out of business?

I don't think it will be long until the data is sold, then some group figures out you can program with the data + curl + facebook and automate applying for loans and tax refunds in mass. There could be millions of erroneous loan applications, tax refunds, business filings, car applications. Then! Law suites, government inquiries, etc. They don't sell oil - money will run out.

Take a look at the analyst outlook and decide if you still think that's going to happen: https://baird.bluematrix.com/docs/pdf/dbf801ef-f20e-4d6f-91c...

Our understanding is data retained by EFX primarily generated through consumer interactions was breached via the Apache Struts flaw (i.e., core databases not believed to have been breached).

This is complete and utter garbage. There is no solid evidence to back this theory of the breach. It is still too early to tell exactly what data was leaked and how. We simply won't know until the security consultants auditing Equifax's systems publish a report (or otherwise publicize their results).

I also find it pretty hard to believe that a company like Equifax didn't just have everything hooked up to one big database, but I still don't think it's likely the breach is going to take the whole company down.

Most people aren't going to be tuned into the leak the same way that we are on HN, they've still got their special place in a government-sponsored near-monopoly, and big companies have the resources to deflect blame and hunker down to weather the storm.

Remember the Deepwater Horizon spill and how angry people were at the time? These days, a large majority probably don't remember the details or even the name of the bigco responsible.

Where do you think the analyst got their information? Companies routinely share such things so that the analysts can get updated guidance out and prevent excessive panic from investors.

The management of the firm has already been selling shares while keeping the data breach covered up, so let's assume for now that any information coming out of their without a subpoena is a pack of lies. They've blown any claim they had to the benefit of the doubt.

A silly and baseless claim. The executives didn't know about the breach at the time of sale, and it wasn't "covered up". It's standard industry procedure to first stop an intrusion, investigate the scope, contact law enforcement and regulatory agencies, and prepare a consumer response, before publishing a breach. This wasn't something that was dug up by an investigation, so calling it a cover-up is simply wrong.

Sure, I always dump stock in companies I manage while sticking to standard industry procedure after not sticking to any industry procedures until I had a massive failure. Sorry, I am not into business people the benefit of the doubt when all the facts point the other way.

Could it be that the executives will get in more trouble for selling the shares - i.e. insider trading - than for managing the company with such a massive data breach?

They weren't "dumping stock". They sold a small percentage of their holdings. They have much larger stakes in Equifax than what was sold.

It's easy to put a company out of business. All that's required is the political will to do so.

> Wont this just destroy the ability to create startups quickly?

Why does this matter to anyone but startup founders?

Because monopolies are bad.

Equifax is not a monopoly. Furthermore, the root cause of this problem does not lie in any quasi-monopolistic feature of the industry. Appropriate regulation should not be ruled out, as a possible remedial action, on the basis of non-sequiturs.

Could argue that industries with low startup costs are much less likely to suffer a proliferation of Apache Struts. Increased competitive pressure to improve an information product might bring the side effect of more modern technology, but who knows the overall impact it would have on security.

Maybe, but the underlying problem is not a particular technology, or even technological in general; it lies in having a system built on false assumptions about the confidentiality of SSNs and other data.

Suppose we have a solution to the underlying problems. It would undoubtedly be difficult and costly for the financial industry to adopt it, and a startup that implements it will not be in a position to force its adoption. About the only thing that could would be regulation - but I'm not holding my breath.

From a single company's point of view, as an evolutionary entity , there is absolutely nothing better than becoming a monopoly.

Well, I think if you compromise the identities and credit files of 150m+ Americans, "full disgorgement of revenue" is a fair punishment.

I wonder if this act can be used in court to demonstrate intent to remain negligent? The idea being that they lobbied for this because they had decided to not invest in better security.

This type of behaviour shouldn't be surprising at all. Corporations are, on the average, amoral -- a result of human group behaviour. As with wild animals, one doesn't get mad at them for following their instincts -- yet, one shouldn't hesitate to carry a gun lest they themselves become lunch.

Thanks for the grounding simile.

Everyone gives something to take part in and benefit by society. Corporations form, and seem to refund to their members all that they gave and occasionally more. We do not measure the externalities well, only the benefits. An externality estimator would be a great economic tool, does anyone know of one?

Some might say that this is a function of government -- that is, the collective will of society forcing corporations and/or individuals to take into account otherwise hidden externalities. Though this is a somewhat contentious view, it makes sense to me.

I will like to know what's the ethical standards of the people that are trying to push for this legislations. Do they realize that they can be victims themselves of this kind of abuse? I guess that it's the tragedy of the commons. They can suffer the consequences, but they are ripping all the benefits.

When I say the Ferengi* in Star Trek, I found it hilariously unrealistic. Nowadays the possibility of corporations with rights but without responsibility is a scary possible future. Reality can surpass fiction.

* https://en.wikipedia.org/wiki/Ferengi

so i have been sort of monitoring this equifax thing. yesterday or the day before i was thinking "let's see what the aftermath brings to light"...

let's reflect for a moment: biggest leak of personal data of us citizens - right after the opm debacle. the same company funds strategies detriment to its customers.

i bet everybody feels like it can't get any worse.

i'm not very old, limited experience but i will predict, brace yourselves, this will go on and on. _nothing_ will change because people don't fucking care and the minority who does care does not have the electorial power it needs to change this system.

i'm waiting for the same thing to happen in germany. it's even worse here because virtually only one company has the monopoly over private credit ratings. everybody is annoyed and _nobody_ cares. we have major elections this month and all those sheep will vote safe.

this is going to be fun. good luck over there, friends.

that place is evil.

Mister Burns style evil.

evil should be punished not rewarded.

(i am already familiar with the phrases: all corporations are like that. everyone is doing it.)

I had my identity stolen 10 years ago. 6 months ago I finally had the last of it wrapped up. I hope. It was a miserable experience that costs a ridiculous amount of time, money, and effort to clean up. And it seemed completely random.

This breach is likely worse than anyone can predict. It could lead to a near unlimited amount of identities for organized crime groups.

To illustrate, my wait times on the phone to the IRS was usually between 1-3 hours(during off-peak seasons too).

At this point it might be worth scrapping the social security system and switching to private keys.

Boy, the IBTimes has always been a terrible place to read articles, especially with its autoplaying videos, but now when you scroll down (after having stopped the video of course) it inexplicably jumps to the lower right corner of the screen and then PULLS the article to the top of the screen where the video used to be. So while you're reading and scrolling, the article just jumps away from you and you lose your place.

Incredible. How anyone thought this is good web design is beyond me. Then again, IBTimes has always been a really shitty place for journalism overall.

I selfishly prefer that we limit the damages that can be sought from businessss by victims of cyber crime. I don't have the resources and capability to fight against state sponsored hackers, neither does the NSA, any major corporation or anyone on HN. It would be nice to know that I won't be risking jail or bankrupting my company by bringing my services to market. The call to arms to punish these companies can have far reaching ramifications on the cost of services and ones willingness on the margin to build them.

Well you can't say lobbying doesn't have great ROI.

Reply on news.ycombinator.com