Hacker News Reader

Comment by snapetom | Hacker News Reader

With so many data breaches occurring, we all probably have free credit report monitoring for life.

It's completely ridiculous. There's zero consequences for bad security. All companies need to do is report the breach to the government, buy "credit monitoring" for the victims which costs pennies, and deal with half a day of bad press on Twitter. Meanwhile, consumers have to deal with identity theft consequences, which in a court of law, is nearly impossible to tie back to a specific incident.

Until governments impose serious fines, even to mom and pop businesses scaled up to massive corporations, this will not change.

View on HN

There’s a requirement that buildings need to have building plans that are personally approved and vouched for by a credentialed Professional Engineer, who takes personal liability—up to and including criminal liability for negligent homicide—if the building collapses and harms people due to a design flaw. I think that’s a good model for this type of problem.

Yes - computer "science" is a joke. I'm certainly not one for rampant regulation, but this is an area that needs to get seriously beefed up.

Especially with the right systems far more people can be harmed than by a building collapse :p

Computer science is a real science and is fine. It is not however engineering. Anyway, the problems lie in the information security industry, which is amateur in comparison.

Yes, corporate IT is basically equivalent to 1800's era factory technology. It works, but there are massive safety issues.

The technology is there. You just have to use it. It does not help however, that the most popular mobile and desktop OSs make money with your data which leads to absymal security practices.

Perhaps it's indeed time for serious companies (these are definitely not MVPs) to have security insurance and they'd mandate some standard.

>identity theft consequences

>Until governments impose serious fines

Or maybe change the language? It's not possible to steal an identity; it's a fiction that is convenient for corporations handling personal information in ways that cost society.

Good IT and engineering staff is a lot more expensive than even a fine for 10% of your annual revenue. Hiring a single good security engineer might cost 400k or more.

Good luck getting your insurance company that pays $100k to senior engineers to do that.

That is definitely a key problem. Why pay for even one security professional when the consequences are just a few grand in credit monitoring for your customers?

I applied for a programming job with an insurance company once and then the first screening test involved interpreting flowcharts, looked like they were photocopied from a 1970s textbook. I decided then and there it wasn't worth it.

>$100k to senior engineers

Could be half that and no technical screening whatsoever.

Most technical operations are outsourced. They even have a separate company in india for obvious cost savings reasons.

Anthem specifically? Maybe, but insurance and other mundane companies in general hire Americans for IT jobs, only in places like Indiana, upstate NY, or the southeastern US. Often working with people who are in, say, New Delhi, but not being replaced by them.

Outsourcing frequently means outsourcing to people in the US who are paid enough less to be a logical option.

Since everybody already has free credit monitoring, it seems like maybe they should be paid cash for breaches in the future.

I bet a lot of people would sign up to pay lower premiums in exchange for not having their data be private. I probably would too depending on how much cheaper.

People already use GoodRx discount cards at pharmacies.

There's was an option to accept $50 in lieu of credit monitoring last time.

A lot of countries have solved this problem. I am a dual US|EU (Croatian) citizen.

On the EU side, we have smart chip national ID cards that are being adopted EU-wide.

In Croatia, you can use those smart chip national ID cards for governmental affairs with a USB smart chip reader (for authentication) on the e-citizens portal.

I need to buy shares in credit monitoring companies. It's the industry of the future!

Reply on news.ycombinator.com