Hacker News Reader

Comment by egorfine | Hacker News Reader

[flagged]

> This is incredible. Government telling me how to backup my data. Incredible.

No more incredible than the government telling you that you need liability insurance in order to drive a car. Do you think that is justifiable?

The difference is that you cannot choose who you're sharing a road with while you can usually choose your IT service providers. You could, for instance, choose a cheaper provider and make your own backups or simply accept that you could lose your data.

Where people have little or no choice (e.g government agencies, telecoms, internet access providers, credit agencies, etc) or where the blast radius is exceptionally wide, I do find it justifiable to mandate safety and security standards.

> you cannot choose who you're sharing a road with while you can usually choose your IT service providers

You can choose where to eat, but the gov still carrier out food heath and safety inspections. The reason is that it isn't easy for customers to observe these things otherwise. I think the same applies to corporate data handling & storage.

It's a matter of balance. Food safety is potentially about life and death. Backups not so much (except in very specific cases where data regulation is absolutely justifiable).

If any legislation is passed regarding data, I would prefer a broader rule that covers backup as well as interoperability/portability.

Losing data is mostly(*) fine if you are a small business. If a major bank loses it's data it is a major problem as it may impact a huge number of customers and an existential way, when all money is "gone"

(*) From state's perspective there is still a problem: tax audits, bad if everybody avoids them by "accidental" data loss

As I said, a wide blast radius is a justification and banks are already regulated accordingly. A general obligation to keep financial records exists as well.

> liability insurance in order to drive a car. Do you think that is justifiable?

New Zealand doesn't require car insurance, and I presume there are other countries with governments that that don't either.

I suspect most people in NZ would only have a sketchy idea of what liability is, based on learning from US TV shows.

It seems New Zealand is one of very few countries where that is the case, and that's because you guys have a government scheme that provides equivalent coverage for personal injury without being a form of insurance (ACC). As far as I understand, part of the registration fees you pay go to ACC. I would argue this is basically a mandatory insurance system with another name.

Australia is the same. Its part of the car registration cost annually.

Nope: The other way around. If you are of a certain size, you are required to ensure certain criteria. NIS-2 is the EU directive and it more or less maps to ISO27001 which includes risk management against physical catastrophes. https://www.openkritis.de/eu/eu-nis-2-germany.html

Of course you can do backups if you are smaller, or comply with such a standard if you so wish.

It feels like you are being obtuse/arguing in bad faith. Of course there are standards on backups. Most countries have them.

Let's think what regulations does the 'free market' bastion US have on computer systems and data storage...

HIPAA, PCI DSS, CIS, SOC, FIPS, FINRA...

> HIPAA, PCI DSS, CIS, SOC, FIPS, FINRA

Those are related to _someone else's_ data handling.

They had standards for a variety of stuff, including how you architect your own systems to protect against data loss due to a variety of different causes.

Reply on news.ycombinator.com