Hacker News Reader

Comment by fatjokes | Hacker News Reader

Will they be penalized? Was Equifax ever penalized?

The cost to them so far is some bad PR which will probably blow over. Especially for companies like Marriott and Equifax which have near monopolies (Marriott owns several smaller chains like Starwood and Ritz Carlton), this probably won't affect their customer loyalty. Particularly when it's safe to assume that the other chains are probably not doing a better job.

Marriott currently has no incentive to spend money to do a good security audit.

They had incentive to do their recent migration of loyalty programs, since Starwood's program was notably generous.

View on HN

>Will they be penalized? Was Equifax ever penalized?

No and no.

Our Federal government is beholden to special interests, so no real legislation or regulation addressing this issue will ever occur. If Equifax (a brace of our economy) didn't receive the death penalty for what they were responsible for, nothing will occur to any future company.

Marriot likely leaked European customers information also, so there will likely be a penalty. Probably pretty small though.

I've been on the inside of some leaks and associated internal investigations. There may not be an external penalty, but these are a serious internal headache. You often have to bring in external people, who then always see the worst in everything. The board has to be kept up to speed. The meetings and late nights pile up. The absence of external penalty doesn't mean that those on the inside don't care. I'd say that most corporate infosec is motivated primarily by the desire to avoid internal investigations. Avoiding the need to report anything to shareholders and/or corporate partners comes second. External penalties is a distant third.

That’s only motivation for InfoSec, though. The CEO has to be motivated to practice good security by the bottom line implications; if having a security incident means less profit, a conscientious CEO will make sure to mitigate that risk, or at least factor it into the tradeoffs of what to do.

Without any significant monetary threat, the ultimate cost of security breaches to a company isn’t truly a big deal.

I just checked, and it looks like Equifax recovered to 95% of its pre-hack peak within about a year. (July 2017 peak of 145, then 137 last September, now 95.)

Sorry for the long link: https://finance.yahoo.com/chart/EFX#eyJpbnRlcnZhbCI6IndlZWsi...

One of our customers who works in the security space was discussing how 'professional' the CC resale industry is. They have customer service centers, will give you refunds if the CCs don't work, etc.

Really insane. I expected it to be shady but apparently it's a big business now!

It probably has better security.

I've never understood how it is that we can't detect and prosecute organizations when they're big enough to provide individualized customer support over the phone.

Are you referring to the credit card hackers or those who didn’t make much effort to secure customer details? Snark aside, both deserve consequences.

I know corporations should do better, but these attitudes strike me as victim blaming. End of the day, this data was stolen.

I see the victim as the customer, not the corporation. Yes they had data stolen from them, but if there is no consequence and it wasn’t their data, are they the victim?

Could a class action lawsuit on behalf of the 5M people who had their passport numbers stolen penalize them for punitive damages somehow, perhaps?

Crossing borders is stressful enough as it is.

If there is now added worry that you might be flagged as a terrorist or lord-knows-what because some nefarious person now has your passport numbers and personal details... surely that must be worth something?

Good luck with your free year of credit monitoring and a check for $5.00.

That's what might happen if you allow Marriott to dictate the terms... not the other way around.

The point isn't a personal payout, the point is to hold the negligent party responsible

Given that they have EU customers I imagine that yes, they’ll be penalised.

GDPR is very recent - do we know exactly when the compromise was? If it was before GDPR came in, they might be able to weasel out of any potential penalty.

And logging passports of foreign visitors is the norm in the EU - I suspect the national security exemption would apply - be interesting what the European court of justice would say if asked.

Exemption for being allowed to store them is arguable, but they could still be prosecuted under data protection.

I would not imagine even the legal requirement would reduce the safeguarding requirements nor allow an increase to the necessary retention period.

We can look at their precautions or lack thereof and see if that constitutes negligence. But regardless of negligence, Marriot and Equifax were victims of criminals. Were the perpetrators ever identified and punished?

"Marriott currently has no incentive to spend money to do a good security audit."

I bet they've had good security audits.

In cases where the 'victims' are corporations, punishing 'victims' is totally acceptable. Don't let rhetorical conflation between between humans and corporations fool you.

Put another way:

Marriott is the victim of "cyber" crimes.

Marriott's customers are victims of Marriott's negligence.

I'd argue it has nothing to do with corporation or non-corporation. If someone is injured in a car accident due to an unfastened seatbelt, the driver is also potentially both a victim (assuming they weren't at fault for the accident) and guilty of negligence (for not making sure safety equipment was used properly).

More like, if a car is caught in a pile-up accident, it is both guilty of hitting the car ahead and victim of being hit by the next car. If he was pushed by the back car into the front car, and took all necessary precautions, he can call for a kind of force majeure and make the back car pay for both, but the agressor has to be formally identified. Mariott didn’t take enough precautions to pretend being victim of a hacker.

"Mariott didn’t take enough precautions to pretend being victim of a hacker."

Marriott was literally, prima facie, the victim of a hacker. The data didn't steal itself. Someone trespassed into Marriott's network and stole data that did not belong to them.

Legal culpability, while certainly not the strong point of HN, is a thing. Negligent, grossly negligent, and reckless conduct are technical terms that exist and have meaning.

I'm sick of replying to this because I don't like defending Marriott in this case. I hope they get a painful class action ruling. I think legal reforms around this are needed, but I am entirely unconvinced anyone here has a reasonable framework of regulations that would benefit anyone.

I was confused by this comment but I think what you're trying to criticize is this: "Mariott didn’t take enough precautions to pretend being victim of a hacker."

I agree with that criticism. It's not a crime to be a victim, but being a victim also doesn't mean you're not guilty.

Marriott might, however, still be liable for some damages due to not following common security practices for sensitive personal information. Anyone from California, for example, would have § 1798.81.5 [1] and § 1798.91.04 [2] which would backup their right to have their data handled properly. The FTC might also get involved with their fairly broad powers to protect users privacy (though that agency has been limited in this administration).

[1] http://leginfo.legislature.ca.gov/faces/codes_displaySection... [2] https://leginfo.legislature.ca.gov/faces/billCompareClient.x...

For the record I didn't think anything you wrote warranted a downvote and hope my response (though sincere, and I definitely disagree with you) didn't cause anyone else to downvote your comment. I don't think it varies much from much of the sentiment expressed in this discussion.

This is what civil courts are for, there’s no need at all for a new law. A general frustration that’s pretty common in internet communities is how regulators and legislators deem it necessary to create so many new laws just for the internet. We expect that the 4th amendment should apply to our packets just as it does our mail, and houses, and persons. So I can’t help but see hypocrisy whenever I hear demands that companies should be financially or criminally punished after being a victim of a cyber crime. If there’s a legitimate tort, then you already have legal recourse.

Two things can be true. A company or service (sole proprietorship/lifestyle project can be hacked just as easily as a massive C corp) can be liable for negligence. But I'm emphasizing that one should never lose sight of who perpetrates and benefits from the crime. That would be the actual criminals/intelligence services who steal (and perhaps sell) the data.

Realistically consumers will only be protected once these corporations start facing severe legal penalties whenever their negligence allows them to get hacked. Nobody is interested in letting the hackers off the hook, so your concern is misplaced. But you'll never protect consumers by focusing on the hackers, that just isn't practical.

> " benefits from the crime."

These corporations are benefiting from their negligence every day when they save money by being negligent with security and facing no real consequences for it.

Penalties are too reactive. Regulation would be more proactive.

A huge corporation will mostly see a fine as a cost of doing business. It won't work when you're looking at negligence, or security, because you can hedge all of your bets on never being found out, or otherwise only being found out so far in the future that the negligence has already paid for itself.

Regulating the storage of sensitive information, same as you have with HIPAA and GDPR, presents a much stronger case for being more careful up front. You're no longer talking about negligence: the expectation for how you handle sensitive info is made clear right from the start, and you can treat egregious violations (like storing passport numbers alongside other account details like a physical address without securing the system) as malicious.

Corporations are ultimately just people; a large group of people.

Think of what would happen if we punished the hell out of Marriot. Many of those people could lose their jobs and be unable to provide for their families, for something that didn’t really have much to do with them other than they chose to work at the wrong corporation.

Most bankruptcies don’t result in liquidation, just total loss for shareholders and a haircut for creditors.

This line of reasoning can be used to defend virtually any conduct from a business that employs many people, and that alone should disqualify it from discourse. But in this case the ideal punishment would be unlikely to result in any real damage to careers, just would incentivize Marriot and other hotels to avoid a repeat of this.

> Will they be penalized? Was Equifax ever penalized?

No. And no.

Marriot and Equifax may be big but they're not even close to being "near monopolies". Neither has even 50% market share.

I would substitute the word 'monopoly' with something like 'unavoidable' or 'compulsory' or 'inescapable'. They're not the only options or even the majority option, but for many of the people impacted by this breach it makes no difference. Many of them were forced into it.

I've never been asked which credit bureau I preferred to have my information given to or taken from. And while I have some say over which business hotel chain I stay at, ultimately it's up to my client or my employer to set the policy. If the rates at the Hilton are out of compliance with the company's willingness to spend, I'm staying at the Marriott.

Monopoly is the wrong word, but the sentiment of hopelessness is the same.

>Will they be penalized? Was Equifax ever penalized?

Above a certain wealth threshold, corporations and their CEOs are above the law.

Reply on news.ycombinator.com