Hacker News Reader

Comment by giancarlostoro | Hacker News Reader

I said this on the other HN thread about CapitalOne but I found it ridiculous that Aaron Swartz was facing a hefty sentence and the culprit behind this hack last I checked is facing up to 5 years??? What the heck?

For every person exposed in this hack is a single victim to be added. Not to mention the numerous indirectly affected people part of small businesses. Aaron Swartz hacked some ebooks by comparison harming only a school.

Can the punishment for crimes stop being absurd. I am only reserving further outrage because those are the current charges against the hacker. We know more can pile up as they learn more.

Really though if that kind of PII can give you access to ruin someones financial life then it should be made harder to get credit cards. If you dont have a drivers license and other things to show you shouldnt get a credit card.

View on HN

Prosecutor discretion exists. Furthermore, AFAIK (IANAL, especially not a US criminal justice lawyer), US sentencing guidelines take into account first-party financial damages (low for CapitalOne) not diffuse third-party damages of the kind suffered that will be suffered by the 100M people whose PII was lost.

CapitalOne disclosed that this hack is going to cost them between $100mm and $150mm, which is a lot more than JSTOR would have lost from Aaron Swartz's "hack" of academic humanities papers.

Right, but it wouldn’t have happened if they hadn’t had such lax security, and I would argue that capital one are liable here for failing to adequately safeguard consumer data. If you properly secure your stack, you don’t get hacked.

If they had fallen victim to some undisclosed zero-day, I’d feel bad for them - but in this case it appears to be misconfigured VPC SGs. Their error. Inadequate processes.

We are also all labouring under the assumption that she was the only person to make off with this data.

I’m willing to bet that she’s just the first one daft enough to talk about it.

"If you properly secure your stack, you don’t get hacked." Thats absolutely not true. You do reduce the chances of being hacked and you might reduce time it takes for you to discover the breach and you will be able to contain it quicker.

You vastly reduce the chances. It’s the difference between bothering to close the bank vault’s door when you go home at night or not.

> Right, but it wouldn’t have happened if they hadn’t had such lax security, and I would argue that capital one are liable here for failing to adequately safeguard consumer data. If you properly secure your stack, you don’t get hacked.

If the system was designed by humans, it can be hacked.

Especially if the bad guy used to work for your vendor.

It seems likely that were the accused to be convicted, a fine will be part of the sentencing, and Capital One may opt to pursue separate civil legal remedy against the convicted person to seek damages given their cost is stated as being >$100M. Unclear to me if this somehow isn’t allowed under U.S. law because the federal prosecution may be where it all gets determined, and a civil case may be “double punishment”?

So after coming out of prison and finding a job, which is likely to be hard for a felon, and may not be highly paid, what wages they make will be garnished to pay the criminal/civil financial judgements.

For most people who’ve worked in technology, the potential punishment here would qualify as “destroying your life”. Enormous impact.

> Prosecutor discretion exists.

Which means she should've been held personally responsible/impeached over what she did to Swartz. But instead Obama protected her, just like he did with all of his other government criminals, as well as Bush administration's criminals, too.

"We need to move forward." and "No abuses were found." and other such BS needs to end when it comes to government criminals. No wonder more riots are popping up and the hatred towards authorities is increasing every year.

> If you dont have a drivers license and other things to show you shouldnt get a credit card.

In Europe everyone has to possess a personal ID card or a proper passport, and it is required to be presented to the bank agent (or a verification service). Yes, we do have some problems with faked ID cards and lately by fraudulent video identification, but still - not remotely comparable to the laughable "security" in the US.

That's not the case in the UK - we don't have any single government issued identity document/card that everyone has to have.

The UK is a special case and will not be "Europe" for long besides. Homogenisation of rules can take a while, especially when there is a cultural aversion to them. In this case I'd say there simply has not been enough time for this to happen.

Barring a rather spectacular feat of engineering, the UK won't be relocating itself from Europe any time soon (much to the chagrin of those who seem to want to plonk us next to Singapore ...)

England will not be less a part of Europe just because she leaves the EU. The EU was never perfectly cohesive to start with [0], and is made up of extremely disparate nations and cultures. Plus, England never adopted the Euro (which is probably for good reason, seeing as interest rates are now even further down because the ECB can't properly conduct monetary policy).

The EU was never comparable to, say, America in terms of unity. Europe had too much history for it to work perfectly - every one was on what had been at some point some one else's land.

[0] https://europedirectemn.files.wordpress.com/2018/02/treaties...

"The EU was never perfectly cohesive to start with"

You could say that about the UK - which lost a significant chunk last century and could well lose rather more this century.

Ireland also does not have mandatory ID, nor do the Nordic countries. I don't think it's as clear cut as you make it out to be.

The Irish (PSC) Public Services Card is getting close to being a de facto ID card at this point.

Agreed - it's turned out to be a privacy and security fiasco. Hopefully, the ICCL challenges will put an end to it.

One of many basic cultural differences between the UK and the EU. In the EU you must give up your biometrics (fingerprint) by law. Doesn't surprise me that they are leaving.

> In the EU you must give up your biometrics (fingerprint) by law

Generic and incorrect statement

Also, I'm not an UK citizen and I'm forced to give up my biometrics (face) whenever flying out of an UK airport. Or when flying into the US.

Please show which law this is, I've never had to give my biometrics to anyone but the US government when visiting there.

All the UK passports and non-national resident ID cards are facial biometric.

I think surveillance techniques and invasion of privacy are often spearheaded by the UK. I remember the CCTV cameras where everywhere long before other countries leveraged them at that scale.

Then great for the EU. God willing, y'all will roll back some of that stuff if she leaves.

But your identity is verified through some means when opening an account, even if there is no unique document, no?

Example https://www.tsb.co.uk/current-accounts/faqs/identity/

Yes it is. Electoral roll.

For which to get on you need an address to live at. For which to get one, you need a bank account (at least, but in 99.9% cases this alone is not enough), otherwise no agency is going to give rent you a house.

> For which to get on you need an address to live at. For which to get one, you need a bank account (at least, but in 99.9% cases this alone is not enough), otherwise no agency is going to give rent you a house.

At what age do you become eligible for the electoral roll? At least in the states most people register to vote before they leave the house of their parents.

Can't find a quick answer on gov.uk, but I somewhat loosely recall that they let you register when you're 16.

For many, it's a goal to avoid having a national ID, for privacy-from-the-government reasons. The ACLU has a decent writeup about the issue: https://www.aclu.org/other/5-problems-national-id-cards

Similar to constant surveillance, the psychological implications of mandatory ID are horrifying. It tips the scale from "You are born free, but you must fulfill certain obligations to cooperate with others" to "You exist first and foremost through the lens of the government. You are not permitted to live outside the bureaucratic abstraction of you."

Well then easy solution: you refrain from opting in into personal ID cards, but you're responsible for all fraudular and other activity that is done under your name and could have been prevented by having an ID card lock down your identity.

Holding victims civilly liable for fraud is not a fair or liberal alternative to government monitoring. Should I also have no recourse when my house is burglarized if I fail to install cameras that send a feed to the police?

> Should I also have no recourse when my house is burglarized if I fail to install cameras that send a feed to the police?

That comparison is wrong on multiple levels:

1) you may be automatically at fault already when not doing what the government is requiring you to do for public safety reasons (for example, your car has a rusty brake pipe, you do not do the yearly mandatory checkup, pipe explodes, car crashes into something)

2) contrary to a feed to the police, showing your federal ID card at a bank or car dealership when applying for a loan does not cause the government to know you were at the bank or the car dealership. Therefore it is not surveillance.

Go cry about it to Rousseau. If you want to continue enjoy the benefits of a modern society, to some small degree, you are going to have to play its little games.

> "You exist first and foremost through the lens of the government. You are not permitted to live outside the bureaucratic abstraction of you."

Aren't we already at that point?

Sort of, but generally not on the minute-to-minute basis that is being forced to carry government identification at all times. And in cases where that may de facto be the case, e.g. being a minority near a border, that's already abhorrent. That whole paradigm should be reversed rather than further generalized.

> being a minority near a border, that's already abhorrent.

That's abhorrent because they are targeted which force them to carry it.

Isn't driver license a government identification anyway? Sure no one is forced to have it, but that won't change much if everyone had it.

I'm not arguing about forcing carrying it either. Just about whether it would be bad if it existed.

I think that says a lot about how much vested interest powerful people have in enforcing copyright law.

That hefty sentence commonly mentioned for Swartz was using the whale sushi number [1], not a number he actually had even a remote chance of getting [2] [3].

[1] https://www.popehat.com/2013/02/05/crime-whale-sushi-sentenc...

[2] https://www.popehat.com/2013/03/24/three-things-you-may-not-...

[3] http://volokh.com/2013/01/16/the-criminal-charges-against-aa...

That a corporation worth multiple billions of dollars can't keep our information secure despite one individual.

That is the message here.

IMHO, the "punishment" trajectory should aim toward Capital One. After all they are the ones who ultimately fucked up.

Frankly; Oh dear my ex-employee, or someone "trusted" who was pissed off because I/We didn't think I/We did anything to piss them off is not an admissible excuse.

Why anyone should weep for a multi-billion dollar company while crowing "throw the bitch in jail" for exposing their lacking security practices is beyond me.

Who is the criminal. A large mega-corp who could not keep their shit straight or an individual who proved their security perfectly invalid, and then told us!

Cry me a river...

> Can the punishment for crimes stop being absurd.

The absurd punishment was Swartz’s, and was 8 years ago. Are you saying that, out of fairness, the punishment for all future computer crimes should scale up to make this one tragic event seem more reasonable?

We don't really know enough yet. My read is that Capital One was horrifically negligent, and none of the data was actually resold or used...

> none of the data was actually resold or used...

Yet.

Reply on news.ycombinator.com