Comment by cdrini | Hacker News Reader

Comment by cdrini | Hacker News Reader

Parent Full thread

It's stuff like this that reminds me that the internet is in many ways still in a loosely regulated, "Wild West" state. This is pretty clearly willful destruction (I.e. vandalism; https://legal-dictionary.thefreedictionary.com/Willful+damag...). It's illegal in the real world, and should be illegal in the digital world. A lot of people are saying that organizations that had these DBs in public "had it coming", or "now they'll learn." What's a real world parallel for this? If an organisation is putting its customers at risk, you can report them. In these cases, companies with insecure data stores are putting their customers at risk by exposing their data. Is there anyone you can report them to? Is there any organisation that will hold them accountable to actually make changes?

I'd also note that not all DBs contain other people's data. Those have no moral concerns with bring public. There is a risk that someone will destroy it, but I'd say that's the same risk taken with public art or something. Yes it's public; yes someone can destroy it; yes it's illegal for someone to destroy it (even though it's public); no, the fact that it's public is not illegal.

> It's illegal in the real world, and should be illegal in the digital world

It is illegal in the USA. And is easily an arguable civil case as well. The problem is identifying the perportrator.

Organizations are only way to hold poor actors accountable. Bad PR and going out of business cause data critical to operations has all been deleted are strong incentives. Unfortunately businesses typically lobby for harsh laws, tyrancial surveillance rather than the expensive and difficult process of improving their operational security.

Bad PR works to an extent, but bad PR can be combatted with good PR, not necessarily with changes. I think an independent regulator would be useful; one that can testify that a company is following best practices for data, etc. Although if the regulators don't have any teeth, or if they don't have a clear benefit for companies to allow a regular, comprehensive, internal audit, it definitely won't gain any adoption.

In the UK it's probably already illegal under the Computer Misuse Act, as it'd fall under "unauthorised modification of computer material".

I assume other countries have similar laws.

That said, enforcing it is a different matter.

Yeah, I think enforcement is probably a big part of what keeps the internet a "Wild West" for these cases; and improvements to enforcementability could fundamentally alter what the internet is :/

Yeah, I don't think the internet can be fundamentally altered to the extent that it could be regulated. Unless it somehow becomes a major priority for the world leaders - in which case I'll bet we can say goodbye to any privacy we still had.

It's been said before plenty of times, but I think the solution has to be sought in increasing awareness of the dangers of the internet. Compare it to the electrical grid. 99% of people would not mess with it without consulting/hiring an expert. Not just because it's illegal, but because of the obvious danger. But for the informational grid, "nobody" (exaggerating) cares because they cannot oversee the consequences.

Problem then is, how do you educate people about this... I don't know.

Actually, a good physical example is restaurant health inspections. They're responsible for testing the safety of an organisation, and making sure that data is publicly visible, and in extreme cases, shutting the organisation down for negligence.

Electrical and building safety code.

They are based on disasters, but at least we try not to repeat the same ones.

One of the things that drew me to software was the idea that you could fix a problem once and for all and then just keep reusing the solution for ever and ever. I don't think I'd have the heart to go back and tell myself what a stupid notion that turns out to be.

For people who pride themselves on going 'faster' than previous eras of innovation, we seem to ignore the fact that we have now been the 'Wild West' for longer than the actual Wild West...

Sort yerselves out.

1) This is not the "real world".

2) Even if it were, and my twenty-something assistant left my shop door open at night consistently, to me, the question of the legality of the resulting damage would be rather secondary.

What if your shop door was locked but was laughably easy to open with lockpicks? I get to victim blame you for choosing an insecure lock and browbeat you into purchasing more expensive and onerous security.

Who do you think should regulate the “public”? ISPs, police, government?

I don't know :( But this feels like some sort of terrorist tactic, and I don't think this should be the way things on the internet are regulated either.

Actually, that's one of things that makes this frustrating. Because there is no real regulation, a group/individual decided to "become" the law. The became lawmaker, judge, and executioner. They decided what was illegal, collected the guilty, and punished them for it. That's what makes this feel like a "Wild West" situation. The made themselves regulators of the internet.

Reply on news.ycombinator.com