Hacker News Reader

The advantage of a fine is you offload all the costs of enforcement from the government to industry/ private insurance companies that underwrite the industry. Adding yet more bureaucracy to maintain solid regulations is a real cost, on the other hand you are going to need the same detection and enforcement ether way. So, we might as well save the taxpayer money and simply fine based on outcomes.

PS: It also simlifies the court cases as demstrating a data breach is more straightforward than demonstrating a company followed all reasonable precautions even though they failed.

I agree that is a real concern.

The disadvantage though is that thanks to zero-day vulnerabilities it means anyone who runs a software company can get hit my lightning at any time. And quite possibly through no fault of their own.

Though I suppose there could be insurance policies for that in the same way a home contractor has insurance for if they fall off a ladder.

At the same time, sending an auditor to an office for a couple days to assess their security readiness is cheaper for the tax payers than tying up the courts if/when a large company disputes the fine.

The feds already have a technology service provider supervision (i.e. 'audit') program through the FFIEC[0], which includes cybersecurity standards. The challenge for regulators is that companies not providing technology infrastructure for depository institutions are not covered.

[0] Supervision of Technology Service Providers examination booklet: https://ithandbook.ffiec.gov/it-booklets/supervision-of-tech...

Another possibility, is vendors that take responsibility for security flaws in their hardware or software.

To take your contractor falling off a ladder analogy, the company that built the ladder could be held partially liable for the flaw as well.

I like the approach of defining the cost of a breach, and letting the market figure out what is necessary to protect against it. If you prescribe something, all you’re doing is creating a regulatory moat.

And if a company decides that it can’t completely protect itself.. hey, what about not collecting so much bloody data?? Wouldn’t that be a lovely side effect? If (P.I.) data, by its very existence, became a toxic asset, to be handled only when absolutely necessary?

IMO, the specifics of how to secure are less important than ensuring proper cost of not securing your systems. I think having rigid rules like PCI would be significant burden and not allow flexibility as technology and business changes.

On the other hand, simply ensuring that the financial penalties are in line with the damage done should be enough to solve the issue. You said yourself that boards won’t agree to spend money. If they saw a huge financial downside risk they would be more likely to invest in security.

I agree. PCI is way too rigid. But you wouldn't want something like that for legislation anyway. I don't want Congress picking my security standards. But I think there should be some bar that companies can reach that protects them from the most serious penalties of any laws.

That bar may even move depending on factors like revenue, number of users, and sensitivity of data.

> On the other hand, simply ensuring that the financial penalties are in line with the damage done should be enough to solve the issue. You said yourself that boards won’t agree to spend money. If they saw a huge financial downside risk they would be more likely to invest in security.

I completely agree. Not sure if it came off correctly but that was the point of my edit at the end.

Yeah, that makes sense. You’re right there needs to be a reward for achieving some measure of security.

Companies that want to protect themselves from breaches should avoid collecting and quickly discard sensitive data.

Agreed completely. PCI and many data protection laws and industry frameworks already dictate that you should discard data as soon as you no longer need it and not collect sensitive data unless you legitimately need it.

That can be part of the law.

Right, but my point is that there isn't a deep need for a box checking exercise that gets a company out of liability, if they don't want liability they can just avoid creating it.

Conveniently this is most onerous for stupid business models.

It could also be a way to offload sensitive processing & storage to a third party; e.g. Stripe.

I'm leaning much more toward John Young's (Cryptome) viewpoint of information security -- smoke and mirrors. Maybe nothing is secure and it is only a question of how interested the adversary is in creating a break and then what they decide to do with the information after.

Robert Cringely has the most practical advice I've read -- keep secure communications off the internet.

>If a company is willfully negligent

I agree with a lot of the points in this post, but I think it's important to remove 'willfully' from this statement. If a company takes on this type of power and responsibility, it should not matter whether their negligence was willful.

My implication is that on a scale of 0 to 10 with 0 being completely unaccountable that companies that are willfully negligent should be at 10. I'm not arguing that that companies who are accidentally negligent should be at 0.

If I pre-meditate to purposely use my car to kill someone that is a different crime than if I am driving following all the rules of the road and I don't notice the person crossing the street until it is too late.

I understand. I just disagree. I don't think the car analogy is apt, because it doesn't capture the inherit risk (to so many) that these companies accept. They willfully accept that risk - when data breaches are inevitable. I'm saying they should both be 10.

There is something similar with cars, actually.

In many countries, when you injure a pedestrian through absolutely no fault of your own (i. e. they drunkenly stumbled onto the street and you had no time to react), you (or your insurance) are still liable for damages.

Why is that? Because when you drive a car, you get all the benefits of, well, driving. Pedestrians get absolutely nothing, except the "chance" to suffer whenever they don't pay enough attention.

Note that this is civil law. If you had no chance to avoid the accident, nobody is blaming you, nor will you face criminal charges. But the pedestrian suffered damages, and cash transfers can (re-)distribute those damages to more accurately represent what would be considered "fair".

I’d largely leave that to the courts: judges assess degrees of intention and responsibility all the time and generally do a good job with the flexibility.

Simply knowing that you can be sued and no TOS can prevent that would be a huge improvement. It’d tell everyone that they need to think seriously about security & privacy, and the costs would push many companies to question whether they should be storing as much data as they possibly can.

Have you ever dealt with PCI or HIPPAA compliance? It's all about checking boxes. This approach has not worked.

We need to adequately start pricing in the costs of externalised losses, and studying what actually works, otherwise nothing will get better.

That approach - safe harbors or a negligence standard - leads to compliance box checking, breaches, and shrugging of shoulders. Ultimately it leads to obsolete standards and regulatory capture that actively mandate insecure practices.

Strict liability leads to the market actually solving the problem. It's not just that insurers, who have skin in the game, will do a better job of coming up with standards and auditing them than regulators. It's not just that the cost of insuring excessive amounts of personal information will lead to companies not storing private information unnecessarily. It's also that this cost will create demand for actual secure hardware and software. Zero day vulnerabilities are not inevitable in a world where their costs are actually internalized. We could build secure systems, if we were willing to pay for it.

The liability for zero day vulnerabilities should fall on the vendor selling whatever product had the zero day vulnerability unless they prominently disclose to the buyer that the software is not fit for the purpose they are buying it for.

We don't let car companies sell cars and then just add some fine print saying "this car might blow up and kill you even if you use it correctly and we are not responsible for that". Why do we let software companies do the same?

If the companies that are actually leaking personal data had any liability, perhaps they would want to buy software that came with such a warranty!

I don't think software warranties should be mandated by law - if that were the case, open source software would probably never have come to exist. But I agree with you that software intended to sit in important security boundaries probably mostly should be available with a warranty. Again, imposing strict liability on the company leaking the data will find this equilibrium if it is the right one. You will go to buy "cyber insurance" for the 100 million user profiles you are storing- a $10 billion possible loss for the insurer- and they will read the fine print of your software licenses!

When we are talking about stuff sold to consumers- smartphones that lose your personal information or webcams that are part of botnets- it's a little less clear. The legal system probably isn't up to holding individual webcam owners liable for an attractive nuisance, and then having them turn around and sue the manufacturers, etc. It is more practical to impose liability on the manufacturer of the product by default (unless the consumer use is negligent). But again, any such regime needs to be crafted carefully to not effectively outlaw free software, hobbyist friendly hardware, etc. Be careful what you wish for.

Every other type of product sold has mandatory warranties (fitness for the purpose it was sold for). Why should software be exempt?

I personally believe companies should be fined regardless.

But one caveat I’d add to your point. Companies should not have a free pass for losing data that isn’t directly required for providing the service the user requested; or when storing data the user did not give them permission to acquire.

Data should be a liability not an asset.

We've had our Enron-scale disaster(s). We need Sarbanes-Oxley for security: all companies have to be audited by a responsible third party.

Fines aren't enough because the leadership of the company is often totally insulated from them (case in point: Equifax).

Fines have two different justifications, and I believe you're mixing them up.

One is a sort of punishment for what is considered a moral failure. For people there's criminal law, but when organizations "misbehave", fines are usually easier to assess rather than individual responsibilities.

That is the context in which you are concerned about fines, because it seems unjust to punish where no intent to harm (or gross negligence) existed.

But fines in this sort of civil law context also serve a different purpose: much like a carbon tax or late fees at the the video rental store, they serve to internalize negative external effects. In this light, there is no moral judgement or stigma attached to fines.

Put another way: the damage is already done when the data is lost. All that's left is to assign responsibility. "No fines" leaves all of the burden with the individuals whose data was lost, even though they are unlikely to have any power to stop such breeches. By fining the company (and possibly compensating the victims) the existing damage is only moved to the party that had at least some control over the situation.

Hold the Board criminally responsible.

It would be easier to get the board to agree to spend money on security if it was required by law, with serious consequences for non-compliance. Technically, accessibility is required by law, but the law has no teeth.