Comment by giantg2 | Hacker News Reader

Comment by giantg2 | Hacker News Reader

Parent Full thread

I find the story or incorrect archive settings/setup to be reasonably plausible and even likely. I work in finance and misconfiguration of systems are not that uncommon. Testing and reviewing archive settings is often not very thorough.

For example, I was working on a system that handles holdings and trading information at the fund level which covers AUM that starts with a T and ends in rillions. There was an SQL injection vulnerability with schema owner access. Luckily this was an internal app, but still there are trade desk devs who could accidentally paste a drop table statement with a name collison. Anyways, I brought all this up to the principal. I was told this isn't a real big deal because they have real-time backups. I asked if they ever tested the backups... no. Do they have procedures for restoring from backups... no. They go nuts if there's a 5 minute outage, so how long would it take to restore... no idea.

Trust me ignorance is very believable, even in regulated industries.

> I find the story or incorrect archive settings/setup to be reasonably plausible and even likely. I work in finance and misconfiguration of systems are not that uncommon. Testing and reviewing archive settings is often not very thorough.

GP's point stands: they should be fined to a degree that it becomes clear to management that these "not uncommon" practices must become very uncommon.

> they should be fined to a degree that it becomes clear to management that these "not uncommon" practices must become very uncommon

Why? Fining isn’t done for fetish, it’s done proportional to harm.

The article mentions twelve civil suits (four independent). JPMorgan will lose those. Any lawyer worth their salt, meanwhile, will be looking for claims which could reasonably involve the evidence which was deleted to file. In this way, the people actually harmed get compensated versus a government agency, which mitigates corruption concerns.

Don't get stuck on the word "fine'. The fines cans be judgment at court. The cost of doing business this way must go up, way up, so that these critical institutions are legally transparent* and motivated by a strong desire to avoid drastic haircuts.

*for example, no more "the dog ate our homework" excuses.

> Don't get stuck on the word "fine'. The fines cans be judgment at court.

All fines are subject to court supervision. This sentence makes no sense.

> cost of doing business this way must go up, way up

We want regulators thinking of the public, not randomly increasing the cost of business. This seems more motivated by hatred for a thriving industry than claims to specific damages. Regulators who pursue this path are rightfully overturned by courts for acting capriciously.

Regulators are not thinking of the public when they allow corporate sociopaths to neglect societal best interest while market fixing / mismanaging records / etc., activities that have demonstrably siphoned wealth from the lower class and moved it increasingly to the ivory towers of companies that do not deserve the influence that makes them "too big to fail".

The wealth inequality gap is widening and it's due to pussyfooted enforcement on white collar crime and strategic negligence.

> wealth inequality gap is widening

You can’t fine a business just to reduce inequality. Any jurisdiction that starts ruling that way fails basic definitions for rule of law. (This is in part what ruined Argentina.)

Also, in what universe would larger fines for banks decrease income inequality? The history of enforcement is capricious penalties increase incentives for cover-ups. If a record retention mistake means personal bankruptcy, you have zero incentive to correct mistakes. In practice, this leads to corruption among regulators, who are now the de facto commanders of private business.

> due to pussyfooted enforcement on white collar crime

Where is the crime here? The SEC investigated and found no wilful wrongdoing. Those twelve private plaintiffs are going to win judgements, as will everyone else who brings claims which could reasonably by covered by the missing records.

The crime was identified, which is why JP Morgan was fined. Once a corporate entity is operating at a sufficient scale, it does not matter if the people inside willingly mess up. The organization is required to be run properly. The problem is that slaps on the wrist for failure do not suffice as environmental stressors for corporate evolution.

As for what we can do, the possibilities are endless. We shape society however we like, and that is the highest form of art humans engage in.

> crime was identified, which is why JP Morgan was fined

The SEC is a civil agency. No crimes.

> organization is required to be run properly

It’s that easy? Just require good organization and you’ll get it by diktat? This entire thread seems to require a reading of Argentinian and modern Egyptian and Russian economic history.

Evidently you don't get well run organizations by simply having legislation, which is my point. We do not enforce that legislation appropriately.

I'm confused by your point regarding the SEC, how are they allowed to fine a company without legal basis? If my use of the word "crime" means something different to you, I mean "crime" as anything that breaks the law.

> you don't get well run organizations by simply having legislation, which is my point

Nobody argued as much.

> I mean "crime" as anything that breaks the law

This isn’t what “crime” means. Painting your house the wrong colour may be against code, but it isn’t a crime. Legally, the difference is starker, as nobody was shown to have done anything wrong here beyond the benefit of doubt.

> Just require good organization and you’ll get it by diktat?

This is what I was responding to. You seemed to be insinuating that I didn't understand that laws or rules are not sufficient deterrents.

> nobody was shown to have done anything wrong here beyond the benefit of doubt

I'm still confused as to how the SEC was able to fine someone for not committing any wrongdoing, exact definition of the word "crime" which I have clarified I used to mean "general rule breaking" aside.

Deleting records that are legally required to be retained is not “no wrongdoing”.

I agree. From my point of view there is definite wrongdoing, and it is not adequately punished. I'm trying to understand the other commentor's point of view as to how the bank was fined if there was no alleged wrongdoing. They had earlier asked "Where is the crime here?"

> I'm confused by your point regarding the SEC, how are they allowed to fine a company without legal basis?

There is a legal basis: retention requirements of the Securities Exchange Act of 1934.

From the SEC order: “As a result of the conduct described above, JPMorgan willfully violated Section 17(a) of the Exchange Act and Rule 17a-4(b)(4) thereunder, which require brokerdealers to preserve for at least three years originals of all communications received and copies of all communications sent relating to its business as such.”

100%

Allowing "smart" individuals to play dumb to benefit themselves is not smart at all at a societal level.

Strategists at these companies examine the costs of failure or cheating, and simply see that it's worth it to cut corners or pile on risk. Just look at JP Morgans history in getting fined for market manipulation.

I'm not saying they shouldn't. But it's a leap to attribute to malice what is easily explained by ignorance.

>I asked if they ever tested the backups... no.

THIS.

I briefly worked for a major European bank. There was a system that was backed up on tape. The way they checked the backups was to visually look at the tape spool - before sending the tapes off to a mountain to be preserved.

One day, they needed something from a back up. Sure enough, the tapes were simply blank due a bug in the back up script.

"The way they checked the backups was to visually look at the tape spool"

Lol

Reply on news.ycombinator.com