<story><title>The privacy wars are about to get a whole lot worse</title><url>http://www.locusmag.com/Perspectives/2016/09/cory-doctorowthe-privacy-wars-are-about-to-get-a-whole-lot-worse/</url></story><parent_chain><item><author>ahartman00</author><text>&amp;quot;They&amp;#x27;re portraying the negligent company as the victim!&amp;quot;&lt;p&gt;While I agree that things like sql injection are negligent, there were also credit card hacks&amp;#x2F;leaks(and an nsa leak) that were the result of malicious contractors.  Saying &amp;quot;dont hire bad people&amp;quot; is easy, but how do you do that?&lt;p&gt;And the standard for best practices is constantly moving in our industry, how do we decide when it is negligence, and when there was nothing that could be done.&lt;p&gt;Not saying people are being harmed by this, Im just saying its not so black and white.  In some cases the companies that were hacked couldnt have reasonably stopped it.  I mean, how do you prevent contractors from setting up something that steals credit card numbers?  You hired the contractors because you dont have those skills in house.</text></item><item><author>ryandrake</author><text>&amp;gt; Eventually, some lawyer is going to convince a judge that, say, 1% the victims of a deep-pocketed company’s breach will end up losing their houses to identity thieves as a result of the data that the company has leaked, and that the damages should be equal to 1% of all the property owned by a 53 million (or 500 million!) customers whom the company has wronged. It will take down a Fortune 100 company, and transfer billions from investors and insurers to lawyers and their clients.&lt;p&gt;This highlights a major problem with tort law: It&amp;#x27;s monetary damages or GTFO. In other words, it&amp;#x27;s nearly impossible to make a case for damages when there is no obvious monetary aspect of the harm done. I can&amp;#x27;t sue Home Depot for giving up my credit card info to hackers unless I can prove that it led to someone running up my credit card bill. Either this needs to change, or it should be a crime for companies to release customers&amp;#x27; personal information to unauthorized third parties.&lt;p&gt;Part of the problem is how these data breaches are framed in the media. It&amp;#x27;s always &amp;quot;Company X was HACKED!&amp;quot; and &amp;quot;Company Y SUFFERED a major data breach!&amp;quot;. They&amp;#x27;re portraying the negligent company as the victim! It should be &amp;quot;Company A carelessly released their customers&amp;#x27; data.&amp;quot; or &amp;quot;Company B failed to protect 10 million credit card numbers.&amp;quot; Once we stop pretending these companies are victims, we can start making and enforcing tougher privacy laws.</text></item></parent_chain><comment><author>mattkrause</author><text>&amp;gt; How do we decide when it is negligence, and when there was nothing that could be done?&lt;p&gt;This isn&amp;#x27;t an insoluble issue: courts deal with similar decisions in car crashes, medical malpractice, and many other scenarios.&lt;p&gt;A plaintiff could argue that the respondent should have been aware of certain vulnerabilities because they were widely disseminated, or that certain practices are explicitly warned against in common training materials. Respondents might counter by arguing that they test for that type of vulnerability using a widely-accepted tool, but it failed to flag this one issue, or something like that.&lt;p&gt;I agree that it can&amp;#x27;t be a purely algorithmic process, but almost nothing in a courtroom is.</text></comment>
<story><title>The privacy wars are about to get a whole lot worse</title><url>http://www.locusmag.com/Perspectives/2016/09/cory-doctorowthe-privacy-wars-are-about-to-get-a-whole-lot-worse/</url></story><parent_chain><item><author>ahartman00</author><text>&amp;quot;They&amp;#x27;re portraying the negligent company as the victim!&amp;quot;&lt;p&gt;While I agree that things like sql injection are negligent, there were also credit card hacks&amp;#x2F;leaks(and an nsa leak) that were the result of malicious contractors.  Saying &amp;quot;dont hire bad people&amp;quot; is easy, but how do you do that?&lt;p&gt;And the standard for best practices is constantly moving in our industry, how do we decide when it is negligence, and when there was nothing that could be done.&lt;p&gt;Not saying people are being harmed by this, Im just saying its not so black and white.  In some cases the companies that were hacked couldnt have reasonably stopped it.  I mean, how do you prevent contractors from setting up something that steals credit card numbers?  You hired the contractors because you dont have those skills in house.</text></item><item><author>ryandrake</author><text>&amp;gt; Eventually, some lawyer is going to convince a judge that, say, 1% the victims of a deep-pocketed company’s breach will end up losing their houses to identity thieves as a result of the data that the company has leaked, and that the damages should be equal to 1% of all the property owned by a 53 million (or 500 million!) customers whom the company has wronged. It will take down a Fortune 100 company, and transfer billions from investors and insurers to lawyers and their clients.&lt;p&gt;This highlights a major problem with tort law: It&amp;#x27;s monetary damages or GTFO. In other words, it&amp;#x27;s nearly impossible to make a case for damages when there is no obvious monetary aspect of the harm done. I can&amp;#x27;t sue Home Depot for giving up my credit card info to hackers unless I can prove that it led to someone running up my credit card bill. Either this needs to change, or it should be a crime for companies to release customers&amp;#x27; personal information to unauthorized third parties.&lt;p&gt;Part of the problem is how these data breaches are framed in the media. It&amp;#x27;s always &amp;quot;Company X was HACKED!&amp;quot; and &amp;quot;Company Y SUFFERED a major data breach!&amp;quot;. They&amp;#x27;re portraying the negligent company as the victim! It should be &amp;quot;Company A carelessly released their customers&amp;#x27; data.&amp;quot; or &amp;quot;Company B failed to protect 10 million credit card numbers.&amp;quot; Once we stop pretending these companies are victims, we can start making and enforcing tougher privacy laws.</text></item></parent_chain><comment><author>CaptSpify</author><text>Do you regularly hire contractors and then never look over the work they do? Because I don&amp;#x27;t, and frankly, that&amp;#x27;s kind of idiotic. The data is your responsibility, not theirs. They also have no interest in the longevity of your company, why would you trust them without checking what they are doing? As a customer, I don&amp;#x27;t care how Home-Depot handed out my CC info, I care that they did.&lt;p&gt;Sure some hacks happened despite companies putting forth their best effort, but hand-waving the responsibility to contractors is not the answer.</text></comment>