Senator to Ex-CEO: Equifax Can't Be Trusted with Americans' Personal Data
npr.org
npr.org
> "This simply is not a company that deserves to be trusted with Americans' personal data," said Sen. Sherrod Brown, D-Ohio,
Obviously this quote leaves out a lot of nuance, but I like it and I like what Senator Brown has said in general. What Equifax has let happen is very bad, and I think moral judgments and perhaps even shame (which is how a society can enforce morality) should be brought onto its leaders individually.
I hate how businesses and business persons have been making horrible, destructive decisions for decades (not that humans in all fields weren’t beforehand) and have been escaping any kind of shame. Indeed they’ve been praised in many cases.
If you look at the top-level pages on Wikipedia (there are about 11 of them), one of them is for “Society”. About a third way down you’ll see “Business” listed under Society. I think this is a good reminder that business is a part of and functions for society, not the other way around.
https://en.wikipedia.org/wiki/Portal:Contents/Society_and_so...
Also, the wife and I were one of the millions whose personal details were stolen from the OMB hack.
We should hold a high standard.
We should not hold a double standard.
The Senators are beating up on this CEO for a security breach that happened under his watch -- suggesting he ought to be fired. For the OMB hack they were the ones with the power to fire the CEO of the organization responsible, i.e. the President. Did even a single one of them call for impeachment? Did any senators resign for thier lack of appropriate oversight?
They attack equifax for having bad security policies and procedures and dismiss the claim that one misfeasant employee is responsible. Well they are the organization largely in charge of writing and overseeing policies and procedures for the federal government. Did they attack themselves for doing a bad job after the OMB hack? Did they change any of those policies and procedures in response?
They are calling on equifax to fully compensate people whose information was released. What laws did they introduce and pass to fully compensate people whose information was lost by the organization they are in charge of?
Technically the identity of the speaker is of no moment, but it's a little hard to avoid rolling ones eyes in the face of such blatant hypocrisy.
Katherine Archuleta was in charge of the OMB during the time of the hack, lawmakers _did_ call for her to be fired, and she ultimately resigned due to the breach.
I think a more appropriate analogy would be that Obama was the "board of directors" of the OPM.
Equifax on the other hand is a complete organization. It has a bunch of different departments that all work together to accomplish the overall goal. Just like OPM, the State Department, and the Treasury all work together to accomplish the overall goal of governing the nation.
Therefore, the proper analogy for Equifax is the USG, not OPM, and the proper analogy for Equifax's CEO is Obama, not Archuleta. The group that is analogous to the Equifax Board of Directors is Congress.
Equifax fits into the relatively tidy box of credit reporting, identity theft protection, and maybe a few other services that I missed. The OPM fits into the relatively tidy box of investigating and managing security clearances, hiring Administrative Law Judges, and maybe a few other services that I missed. I can't even reasonably estimate the number of these services (to the same level of granularity) that the entire USG is responsible for.
Getting rid of the business structure analogy, really I just disagree with the sentiment that Obama should have been fired or pressured to resign over the OPM hack. I don't think there is much to be discussed there, so perhaps we should agree to disagree.
Trump is pushing the GOP tax proposal which has massive tax cuts. Bannon appeases the GOP non-rich voting base with these platitudes.
Trump trusts Bannon (or Bannon would be out of a job), despite any Kardashians-like fake acrimony.
This is just like the pre-election micro-targeting - they are saying whatever message appeals to whoever they talk to.
Bannon _is_ out of his job at the White House.
http://www.newsweek.com/trump-legal-fund-paid-billionaire-ro...
If this Struts vulnerability can lead to the personal information of literally half of America? I'm not a lawyer, but that sounds pretty damn negligent to me.
I agree with your larger point that the system probably shouldn't be built in the first place, at least not the way it is now, but there are still plenty of things they could have done, like not store it in plaintext at rest.
You can take proactive efforts to minimize the risk of breaches; they appeared to store large amounts of unencrypted (or encrypted in aggregate) personally identifiably information together and allowed a single struts vulnerability unfettered access.
For instance, one could not duplicate social security numbers, or could allow you to encrypt your data so you need to provide a key for others to access it. The possibilities are endless.
Yes.
As a professional engineer you are responsible for the systems you build and maintain. The security of the modern internet depends on engineers on the ground understanding and proactively fixing security issues.
There is no one else who can take responsiblity for code you deploy to production. The buck stops with you.
I'm not saying that such a model is the right one for devs, but it would certainly be an interesting move away from "not my fault - nobody would let me do it right".
CEOs would, of course, then have the choice to hire non-accredited engineers to work on their software, and then the buck does stop there because they made an active decision.
I would say I'm in a similar position, but that's because I'm more or less essential (no ego here, and can't explain obviously, but I am) and if I walk out, the company has a lot of BFPs to deal with.
Perhaps there should be some sort of guild? Some way that we could make it harder for ourselves to be replaced in such a way where we can actually stop bucks without just getting fired while they find some script kiddie to do what we wouldn't.
I mean how many firms do we read about a DAY on here who are collecting by the truckload consumer data, either to be used or sold later? And how many of said firms are taking proper steps to anonymize or secure (or both) said data properly?
If now somehow the database gets exposed, good luck! You'll also need to get the individual keys to decipher everything.
Then, although still you can be blamed for not using a vulnerability scanner, there is much less at stake.
[1] https://www.compose.com/articles/encrypting-sensitive-data-i...
* The executives selling stock before telling the public about the breach[1] — but "Equifax responded to TechCrunch’s questions about the timing of the transactions, particularly those of CFO John Gamble, with the following statement claiming that the executives in question were not aware of the hack which the company was made aware of on July 29"
* entering in phony name into the "Have I been breached?" site resulted in random answers; "Others have tweeted they received different answers after entering the same information."[2]
* Equifax hosted said "Have I been breached?" site, and services related to protecting oneself from the breach, on a domain that looked for all the world like a phishing site, and further, "What’s more, there is nothing tying the domain registration records for trustedidpremier.com to Equifax: The domain is registered to a WHOIS privacy service, which masks information about who really owns the domain (again, not exactly something you might expect from an identity monitoring site)." [4]
* Equifax wanted people to agree to a forced arbitration clause. [3]
* Equifax directed people to a fake phishing site [5]
…that it became a moral failing.
[1]: https://techcrunch.com/2017/09/07/equifax-managers-dumped-st...
[2]: https://techcrunch.com/2017/09/08/psa-no-matter-what-you-wri...
[3]: https://theintercept.com/2017/09/08/equifax-is-proving-why-f...
[4]: https://krebsonsecurity.com/2017/09/equifax-or-equiphish/
[5]: https://www.theverge.com/2017/9/20/16339612/equifax-tweet-wr...
It's an ethical failure that this industry has so many examples of above.
Whether or not this information should be collected at all may be a moral question, but how it's secured is about technical competence.
I also think we should keep in mind that, even if it was well-secured, there could have still been a breach. Would that have been less bad? The result would be the same.
Would that have been less bad?
No security professional is going to argue that you can or will prevent every vulnerability from being exploited. However, when you leave a critical vulnerability open for months on end, you knowingly and unnecessarily expose yourself, and any parties associated with you (by choice or otherwise), to a level of risk that is unacceptable.
If this were a 0-day exploit, then the conversation would be different. If their exec's hadn't sold off so much stock a such a suspect moment, then the conversation would be different. If the IT department had appropriately began remediating the vulnerability within a respectable timeframe but had already been exploited, then the conversation would be different.
There is, however, a degree of respect for that hazard, demonstrated in concrete safety practices, that can override that presumption.
I don't think Equifax has demonstrated that respect. To a layman's view, not many companies do. It's possible that the amount of respect necessary for a hazard as large as the one Equifax created is too onerous for a for-profit entity to realistically implement, but I don't know that there's a fundamental reason that sufficiently paranoid engineering practices couldn't make this moral.
What part of that doesn't seem like a moral failure?
The amazing thing about our society is that in most cases, the incentives of individuals are such that even bad people engage in good behavior. You say that businesses and business persons have been making destructive decisions "for decades" but there's definitely a reporting bias there; an overwhelming majority of businesses quietly ship bacon, pack boxes, deliver fertilizer, fold laundry, etc without any moral/shame oversight from senators or society at large. In fact, many of these businesses are likely ran by sonofabitches, but they still engage in good behavior because their incentives are aligned with their consumers.
The problem with Equifax and other headline news behaviors (pollution, bank crashes, etc) is not 'bad people made terrible decisions' but 'bad people had no incentive to make right decisions' because, for example, the credit bureaus are simply not motivated to protect consumer data. Legal and financial incentives are both aligned against consumers, not for them.
It's a little unfair to pile on the CEO of Equifax or the company because that's just fighting yesterday's battle too late. What we should be doing is fixing the incentive structures such that future Equifaxes don't happen.
Also, as other commenters have pointed out, we don't want to discourage good people from running credit bureaus out of fear that innocent mistakes may get them hung.
I couldn't agree more with the rest of your comment, but I draw an almost opposite conclusion.
We should discourage people, good and otherwise, from running credit bureaus. Collecting and holding sensitive personal data on millions of people is inherently a mistake, and after the last few years of data breaches it's getting hard to argue that it's an innocent one.
Companies have proved time and again that they can't be trusted with huge datasets on the general public. They don't have much incentive to apply the level of paranoia necessary to actually protect data that valuable, and even when they do they rarely have the level of InfoSec skills and, more importantly, culture to actually pull it off. In practice we see 2 or 3 nines of reliability when we actually need about 5 nines.
We should stop waiting until leaks happen. Holding sensitive personal data on hundreds of millions of people ought to be congressional hearing level scandalous whether that data has leaked yet or not.
No it's not. He and the CSO are ultimately responsible. That is part of why they get high pay and golden parachutes. That is their job.
Their incentive to make the right decisions is being shown right now via investigations and congressional testimonies which may lead to other charges.
The elite have this country over a barrel, it sucks. All anyone that isn't rich can do is to choose to die before they will work for these companies.
We've got tons of young men and women that sign up to be in the armed forces who happily go die to enrich the already wealthy...and we celebrate them!
So as a society can we start shaming workers that work for Palanatir, Comcast, Pfizer, Equifax? You being on your death-bed and unable to afford food is not an excuse to make the world worse. Die with some fucking integrity.
The bulk of the risk is created by the outdated credit system itself and it’s reliance on easily obtained personal information as keys to the kingdom.
Solve for x where x is “why can’t I just post my social security number on Facebook?”
The underlying problem is the existence of centralized identity, as opposed to decentralized identity. It's the practice of identifying people by a single global identifier (e.g. SSN) instead of having your bank identify you with your bank card and your employer identify you with your employee ID.
People are focused on identity theft here, but there are two points about that. The first is that identity theft doesn't exist without centralized identity, and the second is that identity theft isn't even the main issue.
Centralized databases know very private things about you. They know if you've paid for services at an abortion clinic or a cancer treatment center or a mental health facility. They know if you've ever been on the payroll of a police department, or paid tuition at a police academy, even if you're currently working undercover. They know whether you patronize gay establishments, even if you're in the closet. They know your current address, even if you have a crazy ex who doesn't.
That kind of information is inherently dangerous. In the wrong hands it can get innocent people fired or blackmailed or killed. Which means any central database containing all of it for everyone is inherently a huge vulnerability waiting to be exploited. And none of that goes away even if you replace the SSN with some kind of public key that doesn't itself need to be kept secret.
But centralized identity is the linchpin of those databases and it isn't really needed for anything else. So we should get rid of it.
There is no reason to have Bank A release your credit history with them to Equifax just so Equifax can release it to Bank B. Cut out the middle man and just ask Bank A release the information to Bank B.
Because you tell them to. When you're applying for credit with a new bank, you ask the existing bank to vouch for your history of making timely payments.
In theory the person applying for credit could keep one set of accounts that they always pay and another set which is delinquent but not disclosed, but not disclosing delinquent accounts would be fraud and anyone willing to commit fraud has been able to commit identity theft this whole time without the system collapsing.
And it's possible to have de facto progressive taxation without having any income tax by combining VAT or similar with a universal basic income.
Alternatively, it's possible to have a tax ID which is used only for taxes and prohibited by law from being used for anything else.
They could avoid local taxes by investing offshore, but they do that already.
Any progressive system would make it so that the less well off paid _at most_ as much as the 1%.* Income tax may not work very well, but it's one of the most progressive forms of taxation there is.
*And yeah, as you point out, tax avoidance makes a mockery of this anyway.
That's only true when you crib the definition of spending to mean only personal consumption.
Donald Trump owns Trump Tower. It generates rental income. He is obviously not spending all of it on hamburgers and hair products for his own personal self.
But it still gets spent, just not on himself. He doesn't put the cash in a mattress, he uses it to go out and build another tower somewhere. For that he has to buy steel and concrete and elevators and HVAC systems, which are all taxed in the usual way. Essentially all of the "unspent" income is spent doing things like this, because it's more profitable than holding cash that generates no returns.
Most of the time there will be a corporation in the middle. Trump doesn't buy concrete, he buys shares in a newly formed corporation which uses the money to buy concrete. But that doesn't change the fact that the money is used to buy concrete and concrete is subject to VAT.
In short, Donald Trump's net VAT bill is pretty much exactly his VAT on personal consumption. (It could be lower, depending on how exactly his personal finances are laid out wrt his business's expenses, but it won't be higher.)
That just prevents it from being charged twice. It's the same thing as saying that the tenant doesn't have to pay the VAT that the landlord has already paid.
> The effective rate of VAT for successful businesses is zero.
There is clearly some kind of fallacy happening if a transaction occurs, the government receives non-zero tax revenue, yet the effective rate is calculated as zero.
Income taxes and consumption taxes are effectively the same thing. The seller's income is the buyer's consumption. The taxes always come out of the surplus between the seller's cost of production and the value to the buyer, and who really pays depends on who would otherwise have had the market power to claim that part of the surplus, not whether you call the tax an income tax or a consumption tax.
In practice VAT is very similar to corporate income tax. The main difference (and benefit) is that VAT is paid to the jurisdiction where the end product is sold, rather than whatever arbitrary jurisdiction the company arranges for its profits to be declared in.
Well, no it's not. If you rent a room from Trump, it matters a lot whether you pay the VAT for the concrete or Trump does. And you're the one who ultimately pays. Trump pays and reclaims. You don't get to reclaim.
I get that you might not be concerned with who ultimately pays for this stuff, but it matters greatly if you're trying to design a progressive tax system.
Who pays the tax has nothing to do with who can reclaim what.
Suppose Trump has a local real estate monopoly. Then rents are high and the surplus is going to Trump. Any tax paid by anyone is really paid by Trump, because if it was "paid" by the tenants and Trump didn't lower rents by the same amount to compensate, the tenants would move out of the city because the rental cost would exceed the value of the real estate.
Now suppose the local real estate market is highly competitive. The rents are low and the surplus is going to tenants. Any tax paid by anyone is really paid by the tenants, because if it was "paid" by the landlords and they didn't raise rents by the same amount to compensate, the rents wouldn't be enough to cover costs.
Taxes are always paid out of surplus. Whoever would otherwise be getting the surplus is the one really paying the tax. If part of the surplus was going to landlords and part to tenants, they would each be paying part of the tax.
Now notice what happens with VAT. If Trump has a monopoly then he pays $100 in construction and the tenant pays $500 to rent, and VAT is owed on $500. If Trump is in a competitive market then he pays $100 in construction and the tenant pays $120 to rent, and VAT is owed on $120 even though the rental was worth $500 to the tenant, and the tenant gets to keep the $380 difference untaxed. So who pays VAT and who doesn't? It isn't collected on the surplus going to the buyer.
Obviously, I'm assuming for the moment that billionaires aren't chronic tax avoiders, which makes every system regressive. If you decide to only concentrate on the proportion of the population that pays their fair share, you'd still have problems, because the average person who earns $200k doesn't spend much more than the guy earning $150k. They'd also receive the same basic income, so the burden would be higher on the guy earning $150k.
Billionares aren't the 1%, they're the <0.0002%.
> the average person who earns $200k doesn't spend much more than the guy earning $150k
Yes they do. Someone who makes $200 million doesn't have much more personal consumption than someone who makes $150 million, but that effect doesn't kick in until you're at the "don't know how to spend this much money" level. At $200K/year you haven't even sent all your kids to private school yet, much less bought a mansion with a heliport and a fleet of sports cars.
That's what the UBI is for. You can have something like a 35% VAT with a $15K/year UBI and then the effective rate on someone at $60K/year is 10%, but at $100K/year it's 20% and it only goes up from there. This is very much in line with the existing effective rates, and you can make them whatever you want by adjusting the tax rate and the amount of the UBI.
It also replaces a huge swath of social spending programs because you're then giving someone who makes $20,000 a year $8000 more than they pay in taxes.
If a man is living in his ex-wife's house as part of a divorce settlement, and there's a 90% mortgage on the property, who should be paying? What's going to happen if it isn't paid to each party? Could a bad actor exploit this situation?
In terms of sheer complexity, Land Law is probably second only to Tort Law.
The identifier isn't great, but it's the pervasive use of this identifier that is the problem.
There is also an underlying problem of reliance upon publicly available information (and in many cases, one's SSN is publicly available, even before this breach) to authenticate that human body X claiming to be John Smith is in fact actually the John Smith.
Public facts, such as SSN, mothers maiden name, or name of first employer, etc. have been relied upon as "secret, known only to John Smith" items for authentication purposes when in reality those facts were never really secret in the first place. The only reason those facts even worked as authentication devices is that pre-internet/pre-google it was exceedingly hard to look most of them up in the public records. Doing so often involved physical travel to multiple disparate archives and physical search through archived paper. And so if unknown human X knew all three it was highly likely X was John Smith because otherwise X had put in an awful lot of effort. Today, with the internet/google, obtaining almost all of these facts from the public records where they have always existed to begin with involves typing in searches, zero physical travel, and no combing through archived paper.
The internet has simply exposed the Emperor's New Clothes [1] for what they really were all along.
[1] https://en.wikipedia.org/wiki/The_Emperor%27s_New_Clothes
http://www.politico.com/story/2017/10/03/equifax-irs-fraud-p...
- Former Equifax CEO is walking away with 90 million dollars.
- Equifax's stock price (NYSE:EFX) is recovering.
- Equifax is being awarded contracts and continues to serve as a credit bureau.
- The leaked information is being traded among fraudsters, and will remain to be traded for years.
Welcome to the golden age of bullshit.
Do we know that to be true?
My understanding was that we have no idea what's being done with the leaked data. Has there even been a spike in fraud?
Why wouldn't they sell the information when it is worth so much?
>Has there even been a spike in fraud?
Identity theft is at an all time high.
None of this would have come to fruition had the business model not been one of "lets gather and curate high value information and intelligence about individuals", without an appropriate "gee, we have high value intelligence and information on individuals, maybe we should design our systems so that in the event of a failure of a security system, damage would be minimal." When you aggregate, curate, sell access to high value information, you damned well better have a good and fail safe security model. So if your DCs are overrun with hackers, the data exfiltrated would be unusable.
More specifically, the principle I claim to be implicitly at play here is, with great power and/or information, comes great responsibility. Pointing fingers at lower level subordinates for their possible failings ... opening up and exposing the entire business model's core weaknesses in terms of data protection, and data access integrity and control ... means that the organization has simply failed to maintain, audit, test, and verify that its control systems are adequate to the task. Blaming an OSS component for all the damage means that the rest of the systems were not designed and built to the necessary level of safety and security.
This is part of what I find unconscionable. They attempt to absolve themselves of blame by pointing fingers.
When an organization does crap like this, you know they have many other problems. And yes, you cannot, and should not trust them going forward. If data was exfiltrated from them (and it was), is it possible that their data was altered in situ? Yes, yes it is.
They should not be allowed to have such data in their control again. Seriously, if you can't control access to the data, you can't have the data.
Horde those 0-days.
* Equifax won't have fines levied against it
* C-level staff won't have to pay fines (because they put in place or rewarded a corporate culture that made security a low priority)
* Banks and other institutional customers won't stop using Equifax
* No additional regulation will be created
It's all theatre; we'll have "thoughts and prayers" directed our way while nothing of substance changes.
Experian, Equifax, TransUnion, and any other credit bureaus are going to fail to protect people's personal data. There is no such thing as "unhackable", they are the biggest honey pots, and the majority of the Information Technology hiring pool is incompetent. The majority of competent candidates are underpaid or underappreciated and so they don't care as much as we need them to.
Put all these things together and you have inevitable disaster after disaster after disaster.
Credit Bureaus are old-think. They are unsafe, unsecure, and they don't fit with Future-Era lifestyle.
Something better is required.
In this case, the IRS is already using that service so when you see “no bid” that really means they didn’t want to take a production service offline while they re-bid it and/or hire the staff/contractors who would update the application to use something else. Remember that the rules government staff are required to follow are heavily based on up-front planning so putting out a bid means many months of delay.
All of the anger directed at the IRS for this really should be directed into a positive direction of reforming the acquisitions process.
I wish I had suggestions, but feel the something like a blockchain or other ledger is a step in the right direction. This Ted talk on the subject is interesting https://www.ted.com/talks/don_tapscott_how_the_blockchain_is...
I can understand pragmatic reasons to regulate exactly how they can go about that, but I don't see the connection to the Constitution.
A blockchain has no to negative value for the first problem – immutability means you'd need a way to force everyone to honor delete/update records — and since the whole point is not being anonymous, there’s no value for the second problem beyond what PKI does except that PKI has well-understood ways to deal with a compromise and the blockchain community is still working on the problem.