Hacker News Reader

Comment by yebyen | Hacker News Reader

I never consented to have my information in their database, and I have no power to get it out of their database. They have roundly and repeatedly demonstrated that they are not fit to hold and be trusted with maintaining the SSNs and other personal information of the entire country's worth of credit holders.

Is there even a license that the Equifax company needs to have, in order to do this type of work, that can be revoked? It needs to be revoked! But I'm afraid they don't need any license, they just woke up like this.

The right to covertly surveil and maintain dossiers on 50%+ of the citizens of this country should not be default-allow. Strongly disagree. People in power holding that kind of opinion, is exactly how we got here.

View on HN

> I never consented to have my information in their database,

Don't you think that somewhere in the T&Cs of a loan you took or a credit card that you got or a phone contract you signed up for (or many other things) are lines explaining that your information would be shared with credit reporting agencies? So legally, you would've consented to the sharing of information at those times. If that isn't true, then I'd assume that you should be able to sue the institution that shared your information with all these agencies.

You know the point I'm trying to make, and it's disingenuous to point at some line in some far-away terms and conditions, and say "that authorizes Equifax and two other companies to collect and maintain all information on you, in perpetuity, without any option to revoke this grant."

Are they licensed to do this type of work? Shouldn't they need to be? Should that be revokable? What is the process for revoking that permission, and can we get it started already? It just came out that in their response to the breach, they've been linking their "customers" to a phishing site since September 9. It's time to revoke those grants.

I know the point you're trying to make, and I'd say more to that point: we already recognize that you can't sign a contract that strips you of some basic human rights. You can't sign a contract that enslaves you, etc.

With the amount of power these organizations and this information has over each of us, individually, I'd go so far as to say there is a human rights issue at stake. People's lives get fucked up through credit bureau mistakes, and what consequence is there for those bureaux?

Pointing to a subclause in a contract to say "well, here's where you let them potentially fuck up your life with no recourse, and everything is legal" suggests to me that our thinking around the power these agencies, and around ownership of information about our lives, have needs revisiting.

What's really at stake here? Your ability to take on debt, which primarily benefits the banks. The bigger problem I think we have here is the cavalier nature in which people view debt. Debt is bad for you. Rather than bringing going into debt under the umbrella of "basic human rights" how about a cultural shift away from debt altogether?

Now if we could just do something about those housing prices, that might even be possible. (What percent of homeowners do you suppose bought their homes without taking on some debt?)

Paying rent is also bad for you.

Getting a home loan is relatively easier, because plenty of banks still do manual underwriting for things the size of mortgages. And if we had a culture that avoided unsecured debt, car debt, etc. then more banks would have to perform manual underwriting because no one would have a credit score. Instead they would have something better: money.

I hope that we can start having that conversation! Right now it seems unlikely.

It would not be so controversial if I claimed that Amazon grants customers a revokable license to audio and video content hosted on Prime, but my social security number and credit history evidently is not afforded as much protection under the law.

Not to mention that the terms in the contract do not cover all retention and usage policies of the data. The terms are vague.

I completely agree that there doesn't seem to be any kind of good oversight on the entities, what they do and how they do it. The entire process and chain of information sharing doesn't seem to be in the best interests of consumers.

> it's disingenuous to point at some line in some far-away terms and conditions, and say "that authorizes Equifax and two other companies to collect and maintain all information on you, in perpetuity, without any option to revoke this grant."

To be fair, I'm pretty sure they can legally do that if this was actually the case.

It's a finer point, but if I have authorized Chase Bank to share data with a credit reporting agency, does that mean I have also authorized the credit reporting agency to retain that data? I don't think it does.

Absent any law that says exactly how they may and may not collect and retain such data, you're probably right that it is exactly what it means. The owners of the data (the banks) authorized them, so they are authorized to have the data.

It does not change the fact that, if true, the law is an ass. I do not grant power-of-attorney to the credit-holders that I do business with. They are not authorized to sign documents in my name. They should not be able to authorize arbitrary agencies to hold my personal data in an irrevocable fashion.

(And if I understand the difference in law between US and Europe, in Europe they would not be able to permanently retain my personal data without any recourse for me to shut it down. But in the US, they may be allowed to do this.)

> It's a finer point, but if I have authorized Chase Bank to share data with a credit reporting agency, does that mean I have also authorized the credit reporting agency to retain that data? I don't think it does.

I think you're placing too many constraints on a hypothetical contract just to support your initial argument. Most likely the contract is carefully written in such a way that it's legal for them to do whatever they wanted to do with your data to begin with. It's pointless arguing over what ifs.

Only in America. They could not store personal information about us without obtaining permission in Europe, and we would have the right to revoke it for any reason as well.

This is not normal, it is dysfunctional. I'm not arguing that it's not legal, I'm arguing that they need to lose their license. (Never mind that no such licensing requirement exists. Like I said, it's a dysfunctional system, and I don't know why we don't have more than 3 credit reporting agencies. It sounds like a great gig!)

>some far-away terms and conditions

Are you claiming that people don't know what credit reporting is when they sign loans? If so, that's a failure of basic financial education on the part of parents and K12. If someone imagines they have the right to delete the records of debts they don't want to pay, that person has been tragically misled about the fundamental nature of adulthood.

Knowing that lenders communicate with each other about your reputation, especially when you'd rather they wouldn't, is right up there with knowing what interest is.

I'm claiming that we should have the right to tell one of the three credit reporting agencies to get bent and delete our file if they're Equifax in October of 2017. That's not the same thing as "delete the record of debts I don't want to pay." That's completely disingenuous of you to suggest that's what I meant.

There are three credit reporting agencies. Can you tell me why there aren't more? Because from everything I can tell, there is nothing short of purely criminal activity that could actually result in Equifax being required to go out of business. It seems that no amount of negligent behavior on their part can give me the right to say "cease and desist your retention of my record," while I've never so much as signed a document that came from Equifax. I have no direct relationship with them, and I have the right to get a restraining order if a malicious stalker is all up in my shit, so how is this situation any different? What makes them the authority? Because credit banks do business with them? That's nice... I want them out of business! In Europe, I would have this right. Nobody could maintain a file on me that I can't get a legal order for them to delete.

I'm not talking about debt holders. I'm talking about this parasitic company that evidently has no security team, or has chronically underfunded it to the point that we get where we are now, or had simply disregarded their advice umpteen times _after_ it became clear that the situation was very dire.

The struts vulnerability was disclosed months before they patched it. Any security researcher worth a dime could have told them it was a mistake to put up that equifaxsecurity2017 site that was literally (so much that their own Twitter account linked to it 9 times) indistinguishable from a phishing website and make the only way to know it was legit, a link from the front page of Equifax.com.

How did they get such a great gift from the law, if such is true then sign me up to be a credit reporting agency! I know how to build crappy websites and persist database records, it seems I meet all of the non-existent licencing requirements to be a CRA.

Oh yeah, so you do have a choice if you want to live in a cave.

What is a reasonable alternative to credit agencies? Most countries I know use similar (or sometimes the same, like the UK) agencies, though sometimes with a caveat that they only log defaults or other stuff you mess up.

The alternative is the two other credit agencies that haven't (as far as we know) given up all of our personal information to hackers, and who haven't responded to the news of the breach by linking some of their customers to a parody/phishing site that was nearly indistinguishable from their own (very bad) breach response website.

There is no way out of this (the cat is out of the bag) but we can go on about our lives without Equifax. They need to be unplugged.

Ok sure but all of your objections above (https://news.ycombinator.com/item?id=15303289) can be applied to the other two agencies as well. They collect all your info also. I'm personally not super optimistic about their security.

Me either! That's absolutely a valid point. And I am terrified that this breach will ultimately result in the end of the credit system as we know it, but right now taking such a position is still scare-mongering. (Very reasonable scare mongering, mind you, but maybe cart before the horse.)

We can't just unplug all three agencies and shut down the credit industry, but why can't we shut down Equifax? Take the drivers' license and the car keys away from the drunk driver.

They are the ones that let the cat out of the bag, they should no longer be allowed to collect our personal information. There is no reasonable argument that can be made that Equifax in particular, should be allowed to go on making money off of our personal data with the negligent failure that they have created for us and admitted to, after what all has happened.

Edit: When Sonny Vleisides plead guilty to Felony Mail Fraud in 2007, he was forbidden to engage in loan programs, gambling or gaming activities, telemarketing activities, investment programs or any other business involving the solicitation of funds. He went on to found the company called Butterfly Labs in 2010, a company that took pre-orders for Bitcoin mining equipment (in many cases soliciting funds for hardware that didn't exist, until it did).

Many people argued that this model was a direct violation of the terms of his supervised release. He stood in front of a judge in 2014 that said there was a "strong smell" of fraud with respect to his company.

Equifax it seems gets to skip the whole "plead guilty" thing and just announced their negligent failure directly to the world. When does Equifax get their 14 months in jail followed by a supervised release? Never, apparently, they just go on about their business and no charges are filed. It's absolutely ridiculous in my humble opinion. Maybe I'm the one who is being unreasonable, expecting that the wheels of justice can turn more rapidly than one can reasonably expect.

It's not exactly parallel, I'm stretching to draw parallels obviously, but there should be some parallels in the arena of legal action here. Has anyone argued that Equifax wasn't negligent in the circumstances leading up to the breach? What about in their actions since then? How much further does it have to go before we can get the FTC or US Marshals involved and shut the place down?

"In at least 40 other countries — including Belgium, France, Germany, Italy and Spain — credit reporting can be done by a public credit registry. It is usually operated by a central bank that already oversees the financial institutions that feed information into the reports. These reports tend to be more accurate because the operators have a legal right to demand data from banks as well as a mandate to ensure it’s correct and that errors are fixed. Data on late payments and defaults are erased once a consumer has settled up."

From the article.

Right but surely a public credit registry would have the same risk of being hacked, no? At least in the US, we have government run data get hacked on a routine basis. That seemed to be G(G?)P's concern.

At the end of the day, whether it's a private or public credit agency, they're still collecting all your data whether you want them to or not (modulo going full Thoreau and removing yourself from the economy), and still could get hacked and have all that stolen.

> Right but surely a public credit registry would have the same risk of being hacked, no?

No, I disagree. A public agency would have the same value as a target. But its incentives would be better aligned (no profit motive), which could result in better practices and less actual risk.

You don't have to provide consent to having a CRA host "your" data, because you're not the customer unless you buy a product from one of them.

CRAs are regulated by the government, with things like GLBA, CFPB, FCRA, and other acronyms covering what they can and cannot do, what their responsibilities are, etc. The CRAs have all been fined for improper handling of data, failing to adequately vet data provided to customers, etc.

CRAs get data from two places primarily: public records and CRA members (banks, credit card companies, retailers, etc.) The public records stuff is just that: public. Anyone can get it if they ask and are willing to pay the costs to gather it.

Member data is provided by members to CRAs, and you absolutely grant the right to them to do so when you signed up to use them. When you get a bank account, or credit card, or sign up for a store card, or really agree to do business with any entity on a financial basis, you approved it with your signature.

Your statement about "covert surveillance" is factually incorrect. You have a right under the law to view your entire credit file as held by all CRAs once per year. I also think (not sure) that you can get a copy if you're turned down for credit due to information on a credit report. So how is it "covert", if you not only know about it but can see it?

It's interesting that "your" data is in quotes. I understand what you mean by "your" data and it's a valid point. It's not my data, not in this country anyway, even when it identifies me personally. That's another subject.

You have made a substantive comment and I don't have time to respond substantively to any more comments right now unfortunately. I'm not arguing that they didn't have the right to collect the data.

I'm arguing that we have two other credit reporting agencies that appear to be functioning properly, and one that looks like it is in a continuing state of dysfunction. There appears to be no end to their ongoing dysfunctional behavior, and no possible remediation for affected parties on the horizon at all.

I just want to know what other kind of business in America would still have any customers after the two weeks that Equifax has just had? Do you think that Equifax should now have the right to continue operating, all things considered?

> I'm arguing that we have two other credit reporting agencies that appear to be functioning properly, and one that looks like it is in a continuing state of dysfunction.

I strongly suggest you do some research about that. You'll find that the other two CRAs have been equally "negligent" at different times.

> I just want to know what other kind of business in America would still have any customers after the two weeks that Equifax has just had?

Remember the Target data breach? Or the Home Depot breach? How about when Sony was distributing a rootkit on their music CDs? Or when Lenovo was distributing a malware package preinstalled on their laptops? Or when Best Buy was selling digital picture frames that had a virus? The list, sadly, goes on and on and on...

> Do you think that Equifax should now have the right to continue operating, all things considered?

Of course. Since you're here on Hacker News, I presume you must have some knowledge of computer security...do you really think it was negligence that caused all of this? Do you think that the other CRAs are in any way more secure or less negligent? Or banks? Or any business that uses, say Cisco switches (which have tons of vulnerabilities)? Or businesses that uses Microsoft Windows (too many viruses and worms to count)?

I'm personally more upset about their continued incompetence in their response to the breach, than about the breach itself. I'm sorry I can't write more right now...

First they suppressed valuable information in the form of interviews with their CISO that were public until September 10, when they came down for some reason.

Then they started tweeting out links to a phishing site that looked just like their own "equifaxsecurity2017" site. About this time, the CIO and CISO were removed from the picture entirely.

A few days later, each of these gaffes became known. Meanwhile they had delayed long past the timeline outlined in legal requirements for their reporting of the breach. Where are the Congressional interviews with their executive directorship?

Not on the calendar yet, why don't we schedule it for next February 30th. First of never. I'm just as incensed about the (seeming lack of) response of law enforcement, which admittedly I don't personally have much visibility into, but seems inadequate.

At a minimum I would argue that Equifax needs a "time-out." Ideally they would not be handling the response to this situation at all. They should go on the hook to pay someone competent to handle the response.

> Then they started tweeting out links to a phishing site that looked just like their own "equifaxsecurity2017" site.

Not much to say about that one, for sure. I still don't understand why they wanted to make a completely separate site with that stupid name.

> Meanwhile they had delayed long past the timeline outlined in legal requirements for their reporting of the breach.

I think you'll find that they adhered to the letter of the law on that. Maybe you know when Equifax made the breach public, but you don't know when they first contacted the relevant authorities (law enforcement or regulatory).

> Where are the Congressional interviews with their executive directorship?

Oh, that's coming, for sure. Other companies have been called before congress for far less. But what good has ever come out of such a hearing? That's what you do when you want to save face with the American public and seem like you're going to do something. There might be hope...Al Franken is the ranking member on what I think is the relevant committee, and he usually does a good job in calling out BS when he sees it.

> I'm just as incensed about the response of law enforcement

How so? What would you expect from law enforcement here?

> How so? What would you expect from law enforcement here?

Copied from another sub-thread I posted in...

When Sonny Vleisides plead guilty to Felony Mail Fraud in 2007, he was forbidden to engage in loan programs, gambling or gaming activities, telemarketing activities, investment programs or any other business involving the solicitation of funds.

He went on to co-found the company called Butterfly Labs in 2010, a company that took pre-orders for Bitcoin mining equipment (in many cases soliciting funds for hardware that didn't exist, until it did).

Many people argued that this business model was a direct violation of the terms of his supervised release. He stood in front of a judge in 2014 that said there was a "strong smell" of fraud with respect to his company.

Equifax it seems gets to skip the whole "plead guilty" thing and just announced their negligent failure directly to the world.

When does Equifax get their 14 months in jail followed by a supervised release? Never, apparently, they just go on about their business and no charges are filed. I would expect for them to get a "time-out" after their bungling of the response to this breach, at the bare minimum.

But no, let's give them a participation trophy instead, let them continue handling the response to the breach, they've earned it...

> Equifax it seems gets to skip the whole "plead guilty" thing and just announced their negligent failure directly to the world.

You're presuming that Equifax is guilty of something. Of what? Of being victims of a hack? What about the SEC, who just notified the public now that they were hacked back in 2016?

You seem to think that Equifax is guilty of negligence. Good luck proving that. They're subject to security audits not only from the government, but in relation to the contracts they have with their various customers (standard stuff when companies deal with each other, not least of which when consumer data is involved). Their security wasn't good enough, but they didn't know that until too late. Same as Target. Same as Home Depot. Same as the SEC.

Equifax is going to get fined. They're going to lose business. They're going to eat the cost of providing identity theft protection/monitoring to the entire country. They're going to have to fight their way back to whatever previous stature they had. But any thought that they're going to be found criminally liable for this is simply not credible.

Their behavior during the response has been chock full of negligence, and I don't need to prove it in a court of law. I just need you to concede that point, and I can go on with my day. :-D

They should not have been in charge of the response, but there was no way for us to know that for sure until they had already flubbed it so badly.

They are guilty of handling the response very poorly in a way that has been hashed out and rehashed at least six dozen times on HN until the culmination (so far) yesterday, when we found out that their site was so easy to spoof it fooled even Tim, the Twitter guy from Equifax, who tweeted links to the spoof site out to eight or nine customers over the course of the response.

That was possible because of their initial poor (evidently hasty, and negligently so) response. I'm not asking to make anyone criminally liable, I'm suggesting that next time a company leaks sensitive records on 140MM Americans, we should remember this chain of events and somehow all do better. (And not have another repeat of this shit show, if possible... but who am I kidding, it will repeat.)

The poor response was probably made worse because of their internal culture that resulted in the CIO and CISO being canned (that sounds like all of their top technical leadership put out the door) right as the response was just getting underway. That too, in my opinion, was probably negligence!

I know we don't put companies in "time out" but it seems like we had better think about doing exactly that in this case, lest we soon find out what it will look like when the (next) other shoe drops.

The Equifax story will only continue to get worse! Just wait until their new free credit monitoring systems are breached, and we get to find out exactly what that mandatory class-action arbitration clause we've all heard about is actually intended to do!

> They should not have been in charge of the response

Then who should have?

> we should remember this chain of events and somehow all do better. (And not have another repeat of this shit show, if possible... but who am I kidding, it will repeat.)

100% agreement here.

> > They should not have been in charge of the response

> Then who should have?

Better question: what would be an appropriate response? Because this one isn't, that much is sure, but I don't have an answer for this question other than "one that is not so hastily and shoddily implemented."

You were lamenting about the "delayed" response before, and now you're unhappy with the "hasty" response.

Further, do you really think this was a hasty response? This is the response dictated by the law, coupled with recommendations from their legal team, and probably with input from regulators as well.

It was delayed, in terms of how long it took them to let us know that we could be affected.

It was hasty, in terms of... just look at equifaxsecurity2017.com

Did they run this plan by even one security researcher before it was put into action? If so, that person's advice was either terrible, or ignored. No time at all had elapsed between the time we were alerted to the breach, and when Equifax revealed the 2-day old site that was protected by Amazon certificate.

I am building an HR web portal for employees to submit their identity when they do not go through our background checking service (some classes of employee who are exempt from the requirement to get a background check, for archaic reasons), and I am holding up Equifax's response to the breach as an example of "What Not To Do."

There is no legal requirement for them to put up a website that looks like a phishing scam, and respond to people who put in their information with a random value of "Yes you were affected/Check back later to find out if you were affected". There would certainly have been questions about "who was affected" but it would be better to answer with a blanket response of "everyone with a credit file" than to do as they did, and say "143 million Americans, now fill out this pointless form attached to a random number generator to find out if you are one of them."

> There is no legal requirement for them to put up a website that looks like a phishing scam

Seriously, what were they thinking? Even the most charitable light isn't enough for this to make sense.

> What about the SEC

Butterymales! What about Hillary!

My credit history is still in the hands of Equifax and I have no control over that fact. That is problem number one for me. I want to get off of Mr Bones Wild Ride.

> My credit history is still in the hands of Equifax

Your credit history is in the hands of all the CRAs, just like it has been since the first time you entered into any sort of credit agreement, or opened a bank account, or applied for a car loan, or rented an apartment, got student loans, or did anything where your "credit worthiness" comes into play.

In Europe, if I understand EU data privacy laws, all three of those CRAs would need my permission to retain my personal information. Maybe not explicitly granted by me directly and personally, but absolutely revokable by me, both directly and personally. In the USA, ... it is what it is. I can't revoke those grants, individually or summarily.

> I still don't understand why they wanted to make a completely separate site with that stupid name.

Probably because they still weren't sure that their existing systems were secure. So instead of securing them, or unplugging them, they ... built a new system, both hastily and shoddily!

Then they sent out an e-mail to everyone, telling them to put a little bit more of their SSNs than we're all used to providing at the drop of a hat, ... put them into the bucket. Isn't that about the size of it?

> Remember the Target data breach? Or the Home Depot breach? How about when Sony was distributing a rootkit on their music CDs? Or when Lenovo was distributing a malware package preinstalled on their laptops? Or when Best Buy was selling digital picture frames that had a virus?

I remember all of those things, and NONE of them were on the scale or level of impact of the Equifax breach. People who were affected by the Target breach, got replacement cards and moved on with their lives. Lenovo's malware package could be uninstalled and their hard drives could be reformatted.

People who are affected by Equifax breach... can do what? We are ALL affected by this breach. Every last American Citizen. The credit system itself, as we currently know it, now hangs in the balance.

I know that ALL of the credit reporting agencies have similar poorly designed systems, and THAT is EXACTLY what I am so goddamned mad about. Because THAT is a fact that is NOT going to change as a result of this. You know it and I know it!

We will still have the same 3 credit reporting agencies a year from now, and Equifax will STILL be profitable after whatever fines are imposed. We Need To Seriously Change This Shit Right.Fucking.Now! (NB. I have no specific suggestion, but I am so furious because of your apparent suggestion that there is no line that Equifax or any other CRA can cross that will earn them an honest decapitation. If not now, then when?)

This should NOT have been possible in any reasonable system designed to store sensitive data on every last American with a credit history, and the fact that it happened is all the evidence of negligence that you need. Someone exfiltrated ALL of the information they need to impersonate ANY American citizen with a credit file.

Nobody in particular needs to be held criminally negligent. No redress will make me happy about what has happened. The game is just over. The system is fucked, there's nothing left for them to protect. "Not for Identification Purposes" it's time to read the words on the card, and take them seriously.

> NONE of them were on the scale or level of impact of the Equifax breach.

I concede the possibility.

> We are ALL affected by this breach.

POTENTIALLY affected. There's been no disclosure of exactly how many records were accessed...I don't think they know, but it seems highly unlikely that their entire credit database could have been exfiltrated in that amount of time.

> I know that ALL of the credit reporting agencies have similar poorly designed systems

They don't actually. They tend to have above average security. It's just that it CANNOT be perfect. Just like we can't stop viruses, but Windows is still around.

> I am so furious because of your apparent suggestion that there is no line that Equifax or any other CRA can cross that will earn them an honest decapitation.

How about real criminal activity? You keep glossing over the point that Equifax was victimized here as well. What criminal intent, or even legitimate incompetence, can you claim that even remotely justifies that sort of reaction? Do you think this is Enron-level criminality? That was flat-out fraud, proven in court.

> the fact that it happened is all the evidence of negligence that you need

You're sadly mistaken as to the efficacy of computer security. The fact that it hasn't happened before, for a company that must be a target under constant and unrelenting assault, is actually a testimony to the how well they were maintaining security.

> "Not for Identification Purposes" it's time to read the words on the card, and take them seriously.

100% agreement on this.

> > We are ALL affected by this breach.

> POTENTIALLY affected.

This is true. We don't know if they got all of the records. Reports of "143 million Americans impacted" would seem to indicate that it was roughly everyone with a credit file.

But that is just a headline/byline, and we don't know until the hackers dump it and divest of whatever they got, and the data (honestly, I say hopefully) winds up as public information so we can all know exactly how bad it is.

> Reports of "143 million Americans impacted" would seem to indicate that it was roughly everyone with a credit file.

No reputable news source has said anything other than "potentially affected" as far as I know.

> the data (honestly, I say hopefully) winds up as public information so we can all know exactly how bad it is.

I agree.

Equifax's primary customers are the banks and other people who want to check out a persons credit worthiness. They did not leak credit reports. Just think if that information was copied and in the wild, available as a torrent. They would have a lot fewer customers. If you were renting out a place, instead of paying Equifax hundreds of dollars to check the credit of a dozen people, you could just check them out for free. That would be pretty cool. Sort of like the Sci-Hub situation.

That data would get stale very quickly...the window of utility would be a few months at best.

> I never consented to have my information in their database

Why yes, you did through your agreement with any vendor (e.g. bank, credit union, credit card company, rental) that you have dealt with. This is a standard clause, although some places don't actually do it (my landlord for instance as I found out when I went for a car loan).

I hate this, but claiming you didn't consent is just not a credible answer without some additional legislation to force contracts to be explicit in whom a vendor may share information.

I disagree, you're citing an agreement between me and my bank. The bank may have authorized Equifax to store the data, but I did not. The bank was authorized to share the data (by me), and Equifax was authorized to store the data (by the bank), it is a fine point but it is a fact. So in all of this, the bank is the one who is not in the wrong.

I can't say whether Equifax's agreement with the bank provides any clauses to allow for revocation of Equifax rights to store the information about me, but if it does not then I need to go out and find me a new bank with some better lawyers.

(I'm saying that a scenario such as this whole series of negligent behavior and events, should trigger one of those clauses.)

And when you sign up for [website X], there's never an explicit "and I authorize you to store my data in AWS" and yet that's exactly what happens.

You are trying to draw boundaries that don't exist.

They don't need permission to store the identifying personal data about me for some reason (they, Equifax, the entity that I have no direct relationship with...) what was that reason exactly? Medical providers would not store your personally identifying information without permission, even if it was shared with them. You can ask a health care provider to furnish you with your records and delete their copy at any time, if I'm not mistaken.

Shouldn't they have some kind of licensing requirement in order to be held accountable for their security practices? Where is the line, that when they cross it, they should lose their accreditation? There isn't one, because there is no such accreditation (not to my knowledge anyway.)

It is not reasonable if there are only 3 credit reporting agencies and they do not have any licensing requirements. If I am mistaken about this, please correct me.

I agree that some boundaries, licensing, and potentially security requirements make a ton of sense. I'm cautiously for them. (Only cautiously because the govt can't get their own act together most of the time.)

But as of now, those requirements don't apply to them. So acting like they do is distracting at best.

Let's figure out ways: a) to know what they have, b) to force them to accept corrections, and c) add major negative consequences if/when they f* up.

If we can't have reasonable licensing requirements, then we need a "right to be erased" like they have across all of the European states.

If 140MM Americans (or even 50MM, let's be reasonable) told Equifax that they wanted to be removed from their database in response to the breach, and Equifax was required to honor those requests, it would be a step in the right direction.

That would be enough to put some "fear of God" into the shareholders at the remaining credit reporting agencies, and it does not sound like an unreasonable request at all. Companies going forward would have a disincentive to do business with Equifax, because 1/3 of people are missing from their database. (Instead, we're all permitted to buy more "Credit Freeze and Monitoring" solutions from Equifax, for the low price of $0, plus a low low payment of $10 every time we need to freeze or unfreeze our credit again to access it in the future. So let's dig the hole even deeper!)

Citizens that want to have credit would not be incentivized to remove their credit history from all three reporting agencies; as you probably already know, having no credit history is worse than having a bad credit history.

Then again, if we allowed that, then what's to stop those hackers from benevolently making the request on behalf of all 140MM people whose information they have appropriated.

There is no negative consequence that will incentivize Equifax to do better next time, if the result of this breach and their subsequent bungling of the response, is that they are allowed to continue operating their business without interruption.

Take the keys to the car away from the drunk driver. That's step one.

You are going with the assumption that your sharing agreement with the bank has limits that don't really exist. I doubt you will be able to file a case based on the idea that the entity you have allowed your bank to share data with cannot actually store that data. I doubt a court would go along with that.

I'm not arguing that they weren't allowed to store the data. It would be less controversial apparently if I argued that Amazon grants a revokable license to consume the content on Prime Video and it is governed by the click-wrapped Terms of Service.

Im not saying they never had a right to store the data, I'm simply saying that it should be revoked. Let's not give them more responsibility and more data, they've already proven repeatedly that they can't handle it.

You didn’t consent to let them collect publicly available information, and information that you voluntarily shared with their business partners?

No, I have no contract with Equifax. Does that mean I don't have any standing in this discussion? You're being obtuse.

I’m guessing that, in the contracts you agreed to with credit card companies and others, you did consent to information being shared with the credit bureaus.

Yes. Conceded. That is different than consenting to the credit bureaus storing those data points in perpetuity.

It is an agreement with my bank. That lets my bank off the hook, not the negligent credit reporting agency Equifax. I must still have some kind of rights when any kind of agency is legally allowed to store my SSN and personal information. If this was Europe, with their data privacy protections, I would be sure about that. The reality in this country is, I have no idea if "I must have" is a statement of fact or not.

It should be my right to revoke this privilege that they have gained, however they came about it.

Heh, that's a really interesting point.

If I can go into Google and click a box to completely expunge my google history, why can't I do the same with a credit-reporting agency?

I get that the thinking is, well, you could just expunge away bad credit choices... but, so what? Your blank credit history is now your red flag, as well as a bad one.

But if you wanted to opt out, you could.

What could possibly go wrong? (Hah, I didn't mean that as a jokey rhetorical question!)

>It should be my right to revoke this privilege that they have gained, however they came about it.

And it's the bank's right not to write loans to people who think this, and they're exercising it.

The whole point of credit reporting is that you can't make your record go away.

But I don't have this right.

I can't tell Equifax to get bent and delete my record. I'm not asking for my credit history to go away (and shame on you for being the tenth person to suggest that I am), I am asking for the harmful company that appears to have chronically underfunded their security department, or ignored their advice, or whatever else has gone wrong to land us here, where we are now, to go out of business.

If I can't have that, then I'd settle for them being required to delete MY personal record upon my request. Next time I need to pull my credit file, I'll warn the lender not to try to pay Equifax to look me up, because they're going to get back a null reference with a timestamp of some September 2017 date on it. What's so hard about that? If the lender doesn't like it, I'll take my money elsewhere.

Lenders can keep their own records and report them anywhere they want, within the terms of our agreement and the law. I should not be obligated to remain in Equifax's database until fraud, criminal mischief, or negligence on their part is proven in a court of law. I am just asking for some modicum of control over where my records are stored, kept and shared.

But... that's not an option for me, we don't have EU style personal data privacy and protection laws!

Reply on news.ycombinator.com