Hacker News Reader

Comment by TechBro8615 | Hacker News Reader

My favorite part of this system is when they give you a year of it as compensation for a data breach, saying it’s worth 12x its monthly fee (which they make up). That’s not even touching on the fact that their solution to losing your data is asking you for more of it.

I’ve never been lucky enough to be compensated with such a service. But it wouldn’t surprise me if they were so helpful that they even auto-enroll you in another (paid) year at the end of your free trial!

One also wonders why reforming the credit bureaus is not a bipartisan priority in Washington. Congress is apparently only interested in fighting over the issues that nobody can agree on. Don’t hold your breath for any progress fixing systems that anyone except a lobbyist can clearly point to as broken.

The problems might get some attention if the corporate media chose to hype them, but guess who buys a bunch of advertisements on their news channels?

View on HN

I recently negotiated two service contracts, one for a company that helps administer employment verification (e.g., if an employee applies for a loan), and another with a company that handles COBRA documentation post-termination. Both of these require the service providers hold some confidential information concerning our employees. Both contracts explicitly provided (i) they will not indemnify me for state/federal penalties if they fail to do their job, and (ii) the only remedies they would provide following their data breach is one year of credit monitoring. I told them that was crazy, and if there's a breach they need to indemnify me for all losses and liability, full stop. Both companies refused so I had our broker approach different companies. Those companies proposed contracts with the same terms and also refused to change them. As the employer here merely contracting with service providers, I can't even find contractors who will take this liability on. I would 100% support legislation that would impose on these bastards penalties for the losses associated with their data breaches or failure to provide the services they say they are going to provide. I am also comfortable with the fact that may cost more, but at least then the costs will be internalized by the proper actor. And those who can efficiently provide secure services to me will get my business.

What a great story. Thank you to share you experience. I wonder if (i) is not enforceable. That said, it is the legal equivalent of David and Goliath to win that case. Even if the clause is legally enforceable, could you win a civil suit on the grounds of negligence (poor service)? Again, maybe, but probably very expensive to discover! I agree: These kinds of clauses should not be allowed. I cannot imagine this same thing happens in EU with GPDR.

(i) is enforceable. You could have a negligence claim, but customer (if a regulated entity) is generally required (on a principles basis, not necessarily prescriptive) to do their own due diligence on the adequacy of the vendor's security practices. The shift away from assigning liability to vendors was part of Dodd-Frank, and NYDFS has taken a similar tack with its cybersecurity rules.

> I am also comfortable with the fact that may cost more, but at least then the costs will be internalized by the proper actor.

The problem with these situations is that liability would induce bankruptcy by a factor of a thousand. If one of these companies screws up, likely they did so for each of their customers, who each have their own customers. Plausibly millions of people, for vendors that aren't exactly Google-sized. So for any non-trivial damages they're out of business and you get three cents on the dollar of your indemnity because so did everybody else. Which is all but worthless. It doesn't even give them much incentive to not screw up, because they're only paying 3% of the damages before they file bankruptcy and start over, which itself only happens if they're unlucky. Plenty of companies would be willing to take those odds and they'll still be the ones with the lowest price.

The only way for them to cover the full amount is to buy insurance, but then you have the liability on the wrong party again and they lose the entire incentive to avoid screwing up. We might like to believe that insurance companies have some magic to reduce claims, but mostly they don't and they just spread the cost of the liability across all their customers.

So really all you're asking for is a law that forces you to pay extra in order to buy insurance. But can't you already buy insurance from an ordinary liability insurance company instead of the vendor?

I can, but the vendor's negligence causes me to suffer higher insurance premiums without any ability to leverage them into better practices. If they were obligated to buy that insurance, the insurers could require that their insured observe the underwriter's mandatory security practices (or otherwise they would be uninsured, and in my ideal universe, out of business). As it stands, the vendors take unreasonable risks, and I'm on the hook trying to insure the bloody mess that results without any control over the vendor's security practices.

> If they were obligated to buy that insurance, the insurers could require that their insured observe the underwriter's mandatory security practices (or otherwise they would be uninsured, and in my ideal universe, out of business).

Then you're hoping that the insurance company's checklist does more good than the overhead in enforcing it costs.

Those type of guidelines generally fall into three categories.

The first is the ones that are sensible and cost effective, but mostly those are the ones that everybody does regardless. You might marginally increase the number of people who do these things. This is where the possible benefit comes from.

The second is the ones that are just ridiculous nonsense. Things insurance companies require because they're fallible entities. The typical "install antivirus on Linux servers" checkbox. It has no benefit but it has a cost and the cost offsets the benefit of the useful measures. The insurance company has minimal incentive not to do this, especially if insurance is required by law, because the cost is being paid by somebody else.

The third are measures that are marginally effective but not cost effective. They do a little and cost a lot. Insurance companies love these because they do marginally reduce the number of claims and the cost is hidden, but it still gets passed on to the customer (you), and the cost exceeds the benefit. It's a deadweight loss to you but the insurance company has a perverse incentive to require it.

When you put them all together you're lucky if you break even.

There's something wrong with a notion that a single actor can cause enormous damages, spread them out between community members and suffer no consequences, and I'm not even talking about only credit companies.

For example, take an action which makes everybody spend an hour of their time. Disposing snail mail for example. Lets say there's 300M people in USA. Lets say only 100M of them are affected. Lets also be charitable and say that an hour of their time is worth $10. That's a 1B damage right away. It is a Fukushima level damage.

I don't have a solution, but it is disturbing that we allow actors capable of causing such damage just go do their business, take risks, and if risks don't work out - just file for bankruptcy and suffer essentially no consequences

The underlying problem is that people are capable of causing more damages than they can cover. If you cause a billion dollars in damages, but you don't have a billion dollars, who pays? Not you, for sure, because you can't.

Some of these have decent solutions. We want people to recycle aluminum cans, so we have a deposit which you get back when you take the can to the recycling machine. If you're too lazy to do that, now it's a means for the homeless to make a buck, you don't get your deposit back, and the cans still get recycled.

For other things the solution isn't obvious. You could require anyone who wants to operate in these industries to post a massive bond of their own money to pay the claims if there are any, but that's just asking for market consolidation. You end up with an abusive monopoly or possibly even nobody willing to offer a product in the market at all. The cure is worse than the disease.

In some sense what you need is the opposite. If there are a thousand competitors then there is no one company who can breach a hundred million users. Moreover, there is plenty of competition, so companies that get breached have to worry about reputational harm and customers switching to a competitor. Then you would expect the companies with good long-term records to take over.

And then we're back to the problem with credit reporting agencies. The problem is that the victim has no way to opt out of the system.

One solid solution would be to eliminate social security numbers whatsoever and otherwise put them out of business. The entire credit system is just a zero-sum bidding war anyway. Making it harder for everyone to get credit only reduces the bidding war for housing and makes it more affordable to everyone.

> One also wonders why reforming the credit bureaus is not a bipartisan priority in Washington.

This is a classic “concentrated benefits, disperse costs” problem that is really hard to solve in society. The three credit bureaus have a huge incentive to maintain the status quo, while millions of people have a small incentive to change it. The three credit bureaus are going to fight a lot harder to maintain the system than everyone else will fight to reform it.

It is the same thing you see with our tax system. For individuals, it just isn’t worth it to try to change the system. The effort would cost more than the gain, but the overall cost to society is great.

> One also wonders why reforming the credit bureaus is not a bipartisan concern in Washington.

And one solution might be to simply create a statutory strict liability of $1000 per consumer per breach. The (possiblity of) class action lawsuits would do the rest to encourage correct behavior.

(It might encourage cover-ups as well, but you could penalize that, and incentivize and protect whistleblowing and well-intentioned security research.)

I can’t wait to get 10 free years of credit monitoring!

> One also wonders why reforming the credit bureaus is not a bipartisan priority in Washington.

It struck me how reflexively cynical I have become, that reading this question surprised me.

I hope my answer doesn't come off as snarky, but sincerely, there's a lot of good information here: https://duckduckgo.com/?q=credit+bureau+lobbyists&ia=web

Reply on news.ycombinator.com