Hacker News Reader

Comment by colechristensen | Hacker News Reader

First you have to establish who goes to jail, corporations are able to avoid this by having vague structures of shifting blame so a jury can't decide if any particular individual is actually at fault.

There probably should be laws establishing ultimately responsible people with the unenviable duty of being responsible for illegal things corporations do (sort of like an engineer signing off on the design of a bridge), but doubtful such a thing will happen.

We're left then with personal responsibility being limited to people stupid enough to leave pretty explicit records of nefarious intent to commit crimes.

View on HN

Meh, that's why the CEO makes the big monies. "The buck stops here" kind of thing. Charge the CEO. Make it the CEO's problem to prove they were not responsible only by giving up the person that was. I do believe sometimes CEOs are not fully aware of what happens below them in the org tree, but they are accountable for their people. If the CEO can't handle that, then they shouldn't be accepting the roles. Clearly, this has to be understood as part of the job description

Here is a fictional timeline of events:

* Problem: Spammers automate creation of accounts. Solution: Reuse the MFA infrastructure as some kind of "CAPTCHA". The phone number is not stored.

* Problem: Spammers use a single phone number to unlock 1000's of accounts. Solution: Store the phone number - so those kinds of misuse can be detected.

* Problem: Ads-Team wants to sell more targeted ads. Solution: There is possibly a phone number stored in the user profile, use that.

Who is to blame here? The Ads team that didn't check if the number can be used?

Solution #2 modified to be safer:

> Solution: Store A HASH OF the phone number - so those kinds of misuse can be detected.

If you don't need to store PII verbatim, don't store it verbatim.

> Who is to blame here? The Ads team that didn't check if the number can be used?

Yes. 100% yes. It's insane that we've normalized the idea that if you can physically get your hands on some data then that means you're allowed to do whatever you want with it. Anyone even remotely responsible working in advertising should be tracking provenance of the data they're using. I've heard all sorts of excuses about why this isn't practical, but with each year that passes I find them less convincing, and I've finally reached the point where I reject those excuses outright. If you don't _know_ you're allowed to use some PII for marketing, then you _can not_ use it for marketing. It's that simple.

The person or team who gave green light to storing phone numbers without giving the data appropriate access controls and protections to avoid it being used for anything that is not strictly related with security and fraud control. A system such that if the Ads team tried to access it, they would get an access denied error, or maybe a red alert warning stating that this field cannot be used for marketing operations.

If a system to provide such protections didn't exist, then that system should have been implemented before agreeing on collecting phone numbers. Again, whoever didn't have that insight, should be the one to blame.

(all this is just wishful thinking on my part, of course)

Problem: Bank wants to make more money. Solution: There is possibly some money stored in the customers bank account, use that

Do banks run like that? No. Do banks sell your details, your address, sign you up for random subscribtiona without your permission? No. Why should twitter get away with this

Go to your U. S. bank and get a mortgage, and after a month of emptying buckets of junk from your new mailbox, come back and tell me with a straight face that the bank didn’t sell every scrap of data they had on you.

Huh? That’s pretty much exactly what banks do: They loan out the customers' money to someone else, taking an interest..

Yes! There are now privacy laws that explicitly require you to check if user has given consent for such use of the data.

The team responsible for regulatory compliance is responsible. If the team doesn't exist, then legals should advise management to establish one or provide trainings to every team, and then the teams are responsible.

Ad team, 100%. There are all kinds of laws around advertising. GDPR, CCPA, etc. And all the ad teams I've ever interacted with are well accustomed to consulting with the attorneys before doing something like using a brand new piece of personal data to do a brand new thing.

How about the lowest common leader?

Doesn't the Sarbanes-Oxley act (Sec 906) mandate that publicly listed companies' CEO&CFO assume at least some personal liability when they sign each required SEC statement (10-Q, annual report, etc)?

Something new for them: """ CEOs are required to personally attest that they are responsible for changes to privacy practices and written policies. """

> mandate that publicly listed companies' CEO&CFO assume at least some personal liability when they sign each required SEC statement

It isn't really a "personal liability" until there's a good amount of jail term involved.

Has any CxO been to jail inviolation of SOX? If "no", then there's your answer how useful it is.

Somehow they don't have to figure that out with felony murder. Everyone who participates who is aware is liable to the same punishment, then. Why not in crimes of bureaucracy? Why make sure people who are just following orders are free from punishment?

Because killing someone is usually pretty explicit in the obviousness of a crime being committed.

Filling out forms, designing product features, and implementing them can have each individual contributor mostly ignorant that anything could possibly be wrong with the request and the few people who do have some idea only have a small one which is plausibly deniable. The person who does get caught in those circumstances is usually just a scapegoat anyway.

That's why you investigate. But awareness should be enough. And if we start to have trouble proving awareness (maybe employees aren't aware of a settlement), just require in settlements that employees are informed.

For felony murder, you don't have to know that the person you're with is armed, intends to kill, or if you're driving the getaway car you don't even have to know that they have killed anyone at all. You're participating in something that you're expected to know is wrong, and you're punished for anything that results from the entire event. If this were like felony murder, the engineers that implemented it (assuming awareness) would be as liable for the $150 million as anyone else involved.

> Because killing someone is usually pretty explicit in the obviousness of a crime being committed.

> Filling out forms, designing product features, and implementing them can have each individual contributor mostly ignorant that anything could possibly be wrong with the request

That's got nothing to do with felony murder. Felony murder occurs when you participate in a crime with someone else and they accidentally kill someone while you can't see them.

Because felony murder is an outrageous US-specific injustice. The fact that you're guilty of murder in the US if you rob a store and the store owner shoots your friend defies common sense!

Because I know it matters to some people: this rule is used mostly against young black men.

Pick a C-suite exec or VP at random then. "Nobody, it's too hard to unravel the organizational structure" isn't really cutting it.

That sounds kinda like the Mafia or Yakuza. Take the fall, do time, protect the organization, get respect, get promoted. Many people would gladly do a few years in minimum security prison in exchange for million dollar salaries, etc.

While I do think that would be better than nothing, it could create its own set of bad incentives.

Next interview... "Says here you spent time in federal prison?" "Yeah, at my last job, I broke the law and directed others to do so, too."

Ah so you have experience breaking the law? We have a number of projects where your skills would be useful.

All decision-makers should go to jail in such cases. Then they would work harder on making blame clear.

"All" is a vague term.

So jail everyone at Twitter who isn't an individual contributor and is even tangentially involved?

This is how you escape consequences as an organization: obfuscation. Make what you've done complex enough that it's too difficult for a jury to decide who is responsible for what, prosecutors won't be convinced they have a case and will decline to pursue the matter.

I think the CEO should personally be on the hook for widespread organizational fraud, and in cases should be held criminally responsible.

Yah, some personal risk might justify some of the salary package. Yah sure your going to make $50M a year, but you might have to sit in jail for 20 years sounds fair.

I don't think it has to be that hard; you just need to require that communication is preserved for companies over a certain size, e.g. meeting minutes, emails, etc. This is already the case for financial records and some employment records, and the case with politics ("but her emails!")

This way, a record can be subpoenaed if needed.

Don't keep records or don't have records of this particular decision? The person responsible for making sure the records are kept for that department will be in trouble.

There is some administrative "red tape" here, but it's not that bad, and much of these records already exist (or existed).

The problem is the political will to enact such a law; I agree that's not likely to happen.

"You have to keep a record of what happened during all employee interactions so that we can prosecute you some day" isn't exactly a likely-to-succeed plan. Already prevalent are coaching employees not to leave records of certain legally contentious topics.

I worked for a certain rainforest company and they specifically coached us on not leaving records or discussing certain subjects in any form of written communication.

Early in my career I worked at a company that stored customer credit card numbers in clear text in the database. When I learned of PCI compliance, I naively emailed my manager some links on the topic and a note that we might not be in compliance.

I was promptly rebuked for leaving a paper trail.

Yes, this was addressed with "don't have records of this particular decision? The person responsible for making sure the records are kept for that department will be in trouble."

> isn't exactly a likely-to-succeed plan

It doesn't have to gain popularity, be well-liked, or be agreed with by the companies. If it is law, they must follow it.

Hope they keep an eye on Truth Social that requires your phone number even to use it.

It would be more accurate to say that organizations avoid this with shifting blame. It happens just as much if not more in government, ngos, etc.

Reply on news.ycombinator.com