Hacker News Reader

Comment by electrograv | Hacker News Reader

If we had the will to implement law, this would be laughably easy to solve: A 'checks and balances' approach of [personal criminal liability of the individual] vs [financial liability of the company] would work quite well:

Person(s) act to cover up a data breach -> Individual criminal liability -> A long time in federal PRISON.

A data breach is disclosed -> Massive FINES on the company (up to and including liquidating and shutting the company down), but no personal liability or criminal charges.

So, the only really hard part of this problem is the political will (vs lobbying / powerful people) to implement law at all to address this. Until we start taking privacy and data leaks VERY SERIOUSLY from the perspective of liability, nothing will happen. Sadly, to me this means nothing will happen :(

View on HN

So basically if I disclose a breach I lose my job because my company no longer exists?

Vs. Pretend I never saw any breach (how will you prove different?) and have a chance to avoid all penalties?

This is a very legitimate question if the corporate death penalty is on the table. Maybe a better option would be C-level or VP and above have to go?

If you disclose a breach you might lose your job as the company might go down (financial liability for the company for losing personal data). But if you try to cover up the breach (pretend you never saw it) then you risk going to jail (personal criminal liability).

You get the idea. If the legal system was setup like that, you would be better off disclosing the breach and losing your job rather then risking prison time. You can always find another job.

No, if you disclose a data breach you get a small part (1-10%) of the total liquidation of the company before it goes out to pay the rest of the claims. Perhaps have some sort of national unemployment insurance for the rest of the employees paid for by another small part of the liquidation.

How about just straight un-employment but higher benefits (initially 100% salary/wages as normal) for employees who's companies shutdown or restructure?

No, if you disclose a data breach you get a small part (1-10%) of the total liquidation of the company before it goes out to pay the rest of the claims.

That creates an incentive for employees to cause data breaches and then disclose them for massive profit.

> That creates an incentive for employees to cause data breaches and then disclose them for massive profit.

I think this is a false premise. What is to stop an IT employee from installing Oracle database in production without a license (assuming technical leadership is incompetent like at Equifax), waiting for a bit, and going to the BSA or Oracle and saying, "hey come get your pay day".

One, I think anyone with a shred of ethics won't do it and two, I think if we put the ceo AND the board in prison for the actions of the corporation and its employees (while following directions), then we create a strong incentive for corporations to be of manageable size. Now, I hear a lot from our politicians crow about how much they love small business and how much they hate "too big to fail". This will be a big boon for that. However, I am not holding my breath.

Reply on news.ycombinator.com