Let's Stop Giving Retailers a Free Pass on Data Breaches

It's data breaches all the way down, and there's only so many hours in the day. I choose to worry about just two:

* The OPM breach: https://www.opm.gov/cybersecurity/cybersecurity-incidents

* Equifax: https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breac...

In both cases the amount of data leaked per person is huge, way more than just an email address or credit card number. And in both cases there was no way for customers to opt out of their data being gathered. Those two characteristics seem related. The most valuable data isn't going to be somewhere that is subject to regulations like GDPR. And it's going to be running on the same insecure stacks and practices as everything else we see. If we want to plug holes, these are the sorts of places where we need to begin. Facebook is a child's bagatelle in comparison. MyFitnessPal doesn't even register.

"Let's Stop Giving Retailers a Free Pass on Data Breaches"? What a joke; the very headline conveys a sentiment that frames the debate around how out of touch corporate media (and thus any blind repeater site) is.

Corporate media has been giving passes with one-off coverage that often neglects to mention any proposals for remedying long-term public ramifications. But the public's interest isn't well served by corporate media nor is public interest properly evaluated by corporate media.

Let's also stop thinking the stock market is a proper means of evaluating something applicable to most people's interests, because that's never been true. The stock market has more to do with wealthy people than most people.

The corporate death penalty seems right and proper for very egregious offenses like credit rating agencies because the public will suffer the most and for the longest time (possibly the rest of their lives) when these records are insecure. Organizations will continue to lazily make evaluations based on these records but the records could have been tampered with. And judging by Equifax's successful lobbying, the ratings agencies get away with scarce punishment and therefore have little reason to care about fixing what they broke. Relatedly, it's time we stopped trusting so few organizations with something so precious. The market just isn't designed to handle truly important things, so we should stop trusting it to do so.

No, let's not give them or any other organization passes, but let's also realize that most of these organizations use proprietary software (untrustworthy by default) to keep that data secure where nobody (including the organization) simply can't do effective audits. How proprietary software works is a secret, so such software is structurally incapable of ever being reasonably considered a sound choice for data safety. And organization's choices affect user's data safety, so users have an interest in this but not enough control over how their data is stored.

It is very easy to stop data breaches. Make C-Suite executives and the board of directors personally liable for any breaches caused by failing to have appropriate security controls in place. I bet once a few of these executives were bankrupted for failing to implement adequate security controls, things would change pretty quick.

These executives get paid a large sum of money, and then skirt all responsibility when these things happen. They get fired and move onto the next gig like nothing ever happened. There is no accountability for these failings.

In Ancient Rome the builder/designer of an arch was required to stand under it as the wooden scaffolding was removed (the most dangerous time).

It is high time we re-introduced accountability into our governance systems.

Why make an exception for retailers? Let's not give any institution a free pass on Data Breaches, including governments, the Equifaxes of this world and so on.

Data breaches are definitely not ideal. If there were legislations where penalties, enforcement, and audits added a large cost of the underlying goods I purchase, however, I’m not sure I would like that either. There’s an inherent risk in online businesses, no matter what policies are in place. I would say that whatever progress is made shouldn’t impede new businesses to come in and challenge incumbents or make the overall cost a barrier for less affluent users.

One the huuuugely under-appreciated benefits of Apple Pay is that it is immune to these retailer hacks.

It never transmits your card number or name to the retailer. Instead it uses a token (substitute number) that is tied to iPhone-based authentication. Even if stolen, it's useless.

So I don't think we should give retailers a pass, but the bigger issue here is the whole PCI compliance architecture was a security nightmare to begin with. We should usher in modern methods like Apple and Samsung Pay ASAP that remove that retailer vulnerability altogether.

If one single judge would not give them a free pass, I think we would see a sea change in how computer security is handled across the industry. Put one CEO in prison for criminal negligence after a breach when it is found that they hired cheap, inexperienced, tiny staffs, overloaded them with work, and then ignored absolutely every warning they gave about insecure practices. Every company does this. It's how IT works in the modern world. Hire "engineers" as inexperienced and cheap as possible, give an MBA all the actual say in scheduling and release dates, and constantly complain about the technology that makes their business possible is too expensive.

It's amazing the effect a CEO locked in a cage for a few years like an animal has on the population of CEOs as a whole. Treat digital infrastructure like we treat real infrastructure. If people built bridges the way we build software infrastructure, rafts of executives would be rotting in prison.

It's not the price this article is asking for, but if you think that those companies who have had big public credit card data breaches recently haven't seen their credit card processing fees shoot up, you're crazy. that's not the sort of thing that the payment industry lets slide.

I've very mixed feelings about Amazon, but one reason they continue to get my business is that they appear to keep payment information secure.

This is going to be the long term "no free pass" effect of such neglect. Or, if we actually have a "marketplace" with consumer choice, it will be. People will avoid the threat and hassle, and show elsewhere.

Only so far, the larger retailers -- and their incompetent management -- seem to be getting away with their neglect.

P.S. I'm not arguing against better regulation and effective penalties. Rather, I guess, while pointing out the "risk" of poorly serving the market, I'm saying that it doesn't really seem to be working, so far.

Brutal fines needed.

If you can't keep data secure you don't need to be in business.

Data security should not be a concern for retailers. This is only an issue because the architecture of the credit card payment network is fundamentally incorrect. If consumers could push payments to merchants, sign transactions using captive private keys, etc. then merchants would have nothing of value to leak. Creating ever more responsibility to protect our insane shared-secret-number scheme is deck chairs on the Titanic.

Who's giving them a free pass to begin with? I'm still upset about Equifax and OPM/etc, but there's nothing that I can do about it. I don't really have choice but to participate in the credit bureau game. :/

And governments and utility companies, too, please.