Hacker News Reader

Comment by e40 | Hacker News Reader

There is hopefully a special place in hell for people that do stuff like this. I can sort of see why people fall into computer-based crime, especially in developing nations (e.g., India), but this. It's despicable. Not only can it ruin lives, it can make people hesitate to get help when they need it, which can either lead to more suicides or just plain terrible life outcomes.

View on HN

The anonymity of it all, and how they got away with it, is what makes it stand out for me. There aren’t many crimes this atrocious that are seen publicly without due repercussions for the criminals. I’m sure some homicide detectives see some real messed-up stuff, but I’m just a rando who didn’t sign up to be exposed to this kind of society underbelly.

I'm in agreement but, after all, no one pays a ransom if you tell them you are going to release mildly incriminating information. When you've elected to pursue ransom as a career path, you've already either decided or have been forced to live a despicable life.

Do the people who neglect to secure their IT systems get a place nearby?

That's everyone. The IT department is a conventient scapegoat for failing to do the impractical.

Someone decided to put sensitive records unencrypted on a computer connected to the internet. In the past they'd be on paper in a filing cabinet, only available to Watergate style attackers.

No it’s unlikely that they decided that. More likely that they didn’t realize that’s what they were doing, or didn’t understand the possible consequences.

Are there any civil or criminal consequences for the people who did the atrocious acts of collecting the PII?

Even though companies routinely neglect security until they are forced to address it through breaches, "Shadow IT" is often a thing and can bypass company security standards. I've worked with multiple corporations where the business side of the house had all but lost trust in the technical side of the house and just started getting what they needed implemented by 3d parties and consultants instead bypassing any existing corporate security standards and review.

You can always hack a computer if you work hard enough. Even the airgabbed Iranian nuclear control facilitices were hacked.

What we need to do is keep sensitive data in paper form only, and make people who hold it responsible for its security with no limits, or ability to hide behind corporate structures.

The end result is that so sensitive information as this is simply not kept, as it isn't worth the trouble.

You dont even know what the end user is going to do with the data and you are already condemning them.

Why do you think the state are the good guys when they dont even teach law in a concept understandable manner so kids can protect themselves from criminals from primary school age onwards?

Can you show me any other entity which is actively commissioning weapons and then using them on people en-masse, killing, maiming and psychological harming generations as we see with wars around the world?

The state gets to hide behind its own secrecy laws, no other entity has the scope or reach of the state in order to protect and hide its criminal activity. The state is hardly leading by example now is it?

> You don’t even know what the end user will do with the data

Posting private notes from psych evals to a darknet leak site is unambiguously morally wrong in a society that stigmatizes mental health conditions.

> Blah blah blah the state is bad

Yes. And?

Mental Health is just a cover for abuse the individual has suffered, the fact that you then state society stigmatises it, suggests society has a problem. Maybe its their laws, regulations, education and religion thats at fault!

> You dont even know what the end user is going to do with the data and you are already condemning them.

What do you think they're going to do with this data? Send them Christmas cards? Sign them up for fruit of the month club?

I think you'll find if you read the news, most of these hacker collectives are run/coerced/manipulated by the security services of various countries! Their incentive is to provide a more secure computing environment for their own state needs, but also to provide a robust defence should any crimes come before the courts, otherwise how can the defence prove the individual operating the computing devices carried out whatever crime?

Reply on news.ycombinator.com