Hacker News Reader

Comment by peterlk | Hacker News Reader

Pure speculation ahead:

Suppose for a moment that the Equifax hack was carried out by a nation-state (like, say, North Korea). This is not an issue of consumer trust and safety. It is an issue of national (US) security and safety.

To give another analogy, imagine that in 1920, the Canadian military marched over the border and robbed some banks. Does it make sense for the patrons of that bank to be able to sue the bank? Maybe. It seems like that's less of an issue than the fact that Canada has seized assets that belong to US citizens.

My point is not that Equifax is innocent, or that the situation is being handled appropriately, but rather that this whole thing looks weird enough that there it's probably a lot worse (and more complicated) than we think it is.

View on HN

The way to get better security is to let the free market system work as its intended: Equifax should die a painful death by the masses, if necessary piecemeal one lawsuit at a time until the company coffers have been emptied (and preferably any directors, agents, vested entities, and anyone else within a legally-defensible stone's throw). It may sound harsh, but that's life and life ain't fair.

That's the only way to send a message strong enough that if you are going to operate an IT business, which is what Equifax is, and you have poor security, you will not be protected by the government.

In fact, protecting Equifax and other companies who fail to properly maintain adequate security will send a message to other corporations that this kind of behavior will be tolerated, and these companies may be incentivized to not invest in their security. I've seen situations exactly like this play out at companies before. If the rules of the market suddenly change, so will the industry.

And why should we risk the stability of an entire industry because of one company? The security problems aren't going away, even if we decide to create laws that say they don't matter -- they will still be there at the end of the day, and someone will be able to exploit them. It's bad for business, bad for consumers, and ultimately bad for whatever government is foolish enough to create such policy.

Your claim sounds good the way you put it, but less so when you consider that retributive justice seems ineffectual at deterring violent crime... unless you're also going to claim that shitty companies are generally smarter than felons.

The analogy does not work. People commit violent crimes for very different reasons than shitty companies commit economic crimes.

And at the end of the day, there is some amount of basic deterrence for people who are not in some kind of adverse mental state. How many more crimes of passion would there be if murder, or assault, were not so harshly penalized? The “deterrence does not work“ line as a matter of degrees, not absolutes, and only applies to a subset of the population. For the rest of us, it works just fine.

So to re-join the topic at hand, think of it this way: there will always be outright criminal corporate actors, and deterrence by corporate death will never stop them. These are the Bernie Madoffs and Jeffrey Skillings of the world. Their corporate actors, however, only act the way they do because they are simply are no consequences for doing otherwise, and upper management has evidently quashed their consciences entirely: AT&T (selling deanonymized data with token, non-retractable consent), BP (Gulf oil spill), Equifax (not caring about your security). Lest we forget that these businesses are in the business of making money, and they do so with terrifying efficiency, and their management is soullessly shrewd. If something is risky and expensive because it entails a high chance of a lawsuit or some other penalty, they will think twice about it.

Or to put it another way, the grandparent's analogy fails because tort law pivots on duty to others and negligence in carrying it out. Criminal law is about non-interference with others and intent in violating that non-interference, which is the polar opposite. Lawsuits (ignoring punitive damages) aren't about deterrence - they're about restoration to the plaintiff. There is no parallel in criminal law.

Actually, no. A massive amount of crime is either primarily or secondarily driven by economics.

That is, the crime is conducted for direct financial gain (various black markets, theft, burglary, fraud), to defend a criminal enterprise (turf wars), to gain resources to feed some criminal activity (drugs and gambling addictions, especially), or as a consequence of economic marginalisation (people pushed into desperate situations, or engaging in activities on account of those).

(There's also a tremendous amount of white-collar and corporate crime which is never prosecuted, a whole 'nother story. The dumb criminals are the ones who get caught.)

Even various forms of tribalistic / hate crimes are often related (with varying levels of justification, having a floor of zero) to economic perceptions. As are crimes of passion or pride or reputation.

There's not a whole lot of crime that isn't at least arguably connected to some economic motive or dynamic.

This is a good point, and it highlights where “corrupt and evil free-market economics“ diverges from the idealized Hayekian free-market economics that these politicians are pretending they adhere to.

If you have no choice of where to shop, and you have no recourse for making yourself whole when your only vendor abuses their monopoly power, that is not an “efficient“ free market.

Because that is ultimately the cover they use for all of this deregulation. “Deregulation hurts business“ is the only argument I have ever heard in favor of this kind of policy. But that is such an obvious lie at this point. That it seems they aren’t even trying t pretend policy has an economic basis anymore. But apparently the damage to the public’s ability to form an opinion has already been done.

>The way to get better security is to let the free market system work as its intended: Equifax should die a painful death by the masses, if necessary piecemeal one lawsuit at a time until the company coffers have been emptied (and preferably any directors, agents, vested entities, and anyone else within a legally-defensible stone's throw). It may sound harsh, but that's life and life ain't fair.

I'm not sure that's a good argument for the free-market. We just have to suffer security breach after security breach until companies clean up? It seems like a total willingness to admit security failures in the first place where regulation could help us here.

Your proscribed Freedom Markets™ silver bullet remedy reminds me of the left-wing preference for protests, civil disobedience, boycotts, etc.

That is not an apt analogy.

The resources of a nation state were not required to hack equifax.. a kid with a laptop could have done it.

This is a consumer trust and safety issue because basic care was not taken to protect the data that Equifax was trusted with guarding.

If it turns out that a nation state is the one that carried out the hack.. then that's a national security issue AND a consumer trust and safety issue. But that doesn't excuse gross incompetence.

Indeed. Just imagine the US uses Post-Its as bank notes.

To blame a foreign nation for printing your money is then not the right action. You'll have to look inwards.

“Trusted with guarding” Nope

If the banks left all their customers money protected by a wind screen door that was accessible in the alley, I think suing could be justified.

And if the banks had your money, even though you never gave it to them.

> even though you never gave it to them

You can argue you were coerced into giving it to them. But at the end of the day, you signed bank and credit card and employment agreements that let your information be transmitted.

Because the alternative would be opting out of employment?

(How many places wouldn't un-hire you as soon as you insist they can't pay your bank account because you don't have one?)

Most employers will pay you with a check, which doesn't require a bank account to be cashed.

Your example falls under the purview of negligence in tort law. Nevertheless an arbitration agreement may supersede a potential lawsuit.

The widespread use of forced arbitration seems ripe for examination by the SCOTUS. I'm no lawyer, but it seems like a fairly blatant violation of the 7th amendment.

> The widespread use of forced arbitration seems ripe for examination by the SCOTUS.

Given the current makeup of SCOTUS, I wouldn't hold your breath, sadly.

(Although I would like to hear Gorsuch claim that since the constitution didn't say anything about forced arbitration, it's out of the purview of SCOTUS. If only to hear him slapped down by RBG again.)

They looked at a related issue not too long ago.

https://www.classdefenseblog.com/2015/12/supreme-court-holds...

In your view is it ever permissible(enforceable) to forfeit the right to sue as part of a contract? Or are there just certain kinds of contracts or circumstances for which the right to sue is inalienable?

It's not in Europe, so I see zero reason why it should be permissible here.

They have examined it and found it's fine.

What looks weird about it?

Most Fortune 500 companies do not have bug bounties and have poor security. One was exploited using a disclosed vulnerability.

This is on the polar opposite side of the spectrum of things that would give you the idea of nation state, before ruling everything else out.

However, it would make some sense that politically connected individuals/companies would stand benefit from any claims of national security related to such incidences in order to protect them from liability, even if the exposure to severity of such incidences were preventable to some degree.

When national security claims protect your six, rational actors eventually will seek to exploit such…

at this point, why WOULDN'T you proxy through a server in Russia or even "just" Eastern Europe when you execute even a wordpress vulnerability

A server with an IP in Russia = Russian Hackers = State Sponsored Russian Hackers = Vladimir Putin destabilizing Democracy

While you are eating popcorn and have millions of dollars of cryptocurrency no questions asked.

Well, like I said, pure speculation, so I don't have much to back it up. Just musing

Equifax knew they were running a vulnerable version of Apache tomcat. To not fix it is pure incompetence, like a bank leaving it's doors unlocked overnight. What did they expect to happen?

Apache Struts, not Tomcat.

I think positing a nation-state is an unnecessary complication.

Let's imagine two different bank robberies, carried out by the same wicked bank robbers.

In the first, the bank robbers steal a bulldozer and a crate of dynamite, knock down half the bank in the middle of the night, blow the safe, and run away with the money.

In the second, the bank has left the safe and all the doors unlocked at the end of the day when everyone goes home. The robbers stroll in through the open door, take the money, and casually walk away.

In both situations, the robbers are fully culpable. They don't get a pass just because the money was left lying around where anyone could take it. They should be pursued and an appropriate punishment (or rehabilitation, if that's your thing) should be meted out in either case. But in the second scenario, the bank is also culpable - they failed to take reasonable precautions, they were negligent in their duties.

If someone is negligent in their duties and that negligence results in harm to others, they should be held responsible for it. The situation doesn't change if it was a nation-state that took advantage of the negligence; the hypothetical bank aren't being punished for being robbed, and it doesn't matter that a hypothetical determined robber could still have broken through nearly any security you could imagine, they were still negligent in their duties.

There should be such thing as "gross negligence" when it comes to security. If believe it applies to companies managing "critical infrastructure".

But, fortunately for Equifax, companies that manage social security numbers haven't been declared critical infrastructure. If they were, I'm sure Equifax could have been found guilty of gross negligence.

> imagine that in 1920, the Canadian military marched over the border and robbed some banks

The international law on this is rather complicated but I believe that those affected would have a case against the Canadian government, as well as being covered by the US bank insurance system.

However, in the case of Equifax, personal data isn't the property of the person (in the US system) and so you don't have a case. You'd need to have an EU-style data protection system rather than a US system which treats data as free speech.

Which is why military operations are conducted as an extension of policy, not as an isolated show of force.

It would be the mounties robbing the banks and then threatening to return with greater force if we show any attempt to recoup losses from canada, but then we steal their lumberjacks, then they strike out alaskan oil sites, oh boy are we at war?

National security advisors have long indicated civilian infrastructure to be the primary cyber vulnerability, not military assets. Its the german ballbearing factory all over again.

So to not hold these companies liable is genuinely generating a national security threat, where threat is defined as a risk with a real probability of being realized.

Couldn't that be left to a judge to decide?

Well if the FISA court decide(s|d) upon this (assuming that this would fall under some national security protocol), we (the public) would never hear of it… well anytime soon at least… outside of publicly visible aftershocks people would speculate upon.

The degree of fault is determined through investigation, and it's not all or none. If the banks had negligently lax security that should have resulted in only 75% of the actual robbed monies being lost, they'd be on the hook for the remainder.

How does that change things? Why does that mean that I should not be able to unite with my fellow consumers to hold them accountable?

Because collective action would level the battlefield.

> Does it make sense for the patrons of that bank to be able to sue the bank?

If they left the doors unlocked and didn't bother to hire security then sure.

Reply on news.ycombinator.com