This guy needs to be held personally responsible. But he won’t be and that makes me extremely mad.
It sucks that the rich and wealthy can be as morally bankrupt as they want without any/many consequences.
It sucks that the rich and wealthy can be as morally bankrupt as they want without any/many consequences.
Then there's this gem [0]: "Barros also led the company’s U.S. Information Solutions (USIS) business, which includes U.S.-based services that provide businesses with consumer and commercial information and insights related to areas of risk management, identity and fraud, marketing and a variety of industry-specific solutions."
[0] - https://www.equifax.com/about-equifax/corporate-leadership/
I dont expect them to be able to debate cipher strengths or argue key length, but I do expect them to know about Machine-To-Machine communication, Data at rest, One-way encryption and what it takes to be HIPAA compliant etc, it's their job to know this, and it's NOT HARD. I makes me mad too.
Here's the thing: short of some California disclosure laws, it isn't clear that Equifax broke any laws, or even any contracts.
They don't have any particular duty to protect the data they have about you, other than protecting their own IP. Equifax is a clearing house for information that people say about you.
Look, if I follow you around, reporting all your movements, write it down, and then my notes about you get posted on the internet, what law did I break? (Equifax used to report "his marital troubles, jobs, school history, childhood, sex life, and political activities", so it isn't that far of a stretch).
Given that perspective, it makes sense that they would protect the data as much as any data vendor would. Certainly they didn't predict the PR backlash such a failure would cause and should have factored that in.
They certainly do in much of the civilised world. The US is almost as far behind the norm in the modern world when it comes to privacy safeguards as it is in its banking and financial infrastructure.