<story><title>Senator to Ex-CEO: Equifax Can&apos;t Be Trusted with Americans&apos; Personal Data</title><url>http://www.npr.org/2017/10/04/555651379/senator-to-ex-ceo-equifax-can-t-be-trusted-with-americans-personal-data</url></story><parent_chain><item><author>sgustard</author><text>Is it a moral failing to be slow to update a Struts vulnerability? As an IT engineer that makes be nervous because I don&amp;#x27;t know which of a hundred actions I take or don&amp;#x27;t take in a given day will explode on me. Or was the moral failing to agree to build such a system in the first place?</text></item><item><author>Top19</author><text>This is the choice quote:&lt;p&gt;&amp;gt; &amp;quot;This simply is not a company that deserves to be trusted with Americans&amp;#x27; personal data,&amp;quot; said Sen. Sherrod Brown, D-Ohio,&lt;p&gt;Obviously this quote leaves out a lot of nuance, but I like
it and I like what Senator Brown has said in general. What Equifax has let happen is very bad, and I think moral judgments and perhaps even shame (which is how a society can enforce morality) should be brought onto its leaders individually.&lt;p&gt;I hate how businesses and business persons have been making horrible, destructive decisions for decades (not that humans in all fields weren’t beforehand) and have been escaping any kind of shame. Indeed they’ve been praised in many cases.&lt;p&gt;If you look at the top-level pages on Wikipedia (there are about 11 of them), one of them is for “Society”. About a third way down you’ll see “Business” listed under Society. I think this is a good reminder that business is a part of and functions for society, not the other way around.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Portal:Contents&amp;#x2F;Society_and_social_sciences&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Portal:Contents&amp;#x2F;Society_and_so...&lt;/a&gt;</text></item></parent_chain><comment><author>ska</author><text>It&amp;#x27;s a moral failing to be engaged in the collection of personal data of this type and scale without having a solid, well articulated, well communicated,  robust and redundant plan for managing security and mitigating the impact of security issues.&lt;p&gt;It&amp;#x27;s an ethical failure that this industry has so many examples of above.</text></comment>
<story><title>Senator to Ex-CEO: Equifax Can&apos;t Be Trusted with Americans&apos; Personal Data</title><url>http://www.npr.org/2017/10/04/555651379/senator-to-ex-ceo-equifax-can-t-be-trusted-with-americans-personal-data</url></story><parent_chain><item><author>sgustard</author><text>Is it a moral failing to be slow to update a Struts vulnerability? As an IT engineer that makes be nervous because I don&amp;#x27;t know which of a hundred actions I take or don&amp;#x27;t take in a given day will explode on me. Or was the moral failing to agree to build such a system in the first place?</text></item><item><author>Top19</author><text>This is the choice quote:&lt;p&gt;&amp;gt; &amp;quot;This simply is not a company that deserves to be trusted with Americans&amp;#x27; personal data,&amp;quot; said Sen. Sherrod Brown, D-Ohio,&lt;p&gt;Obviously this quote leaves out a lot of nuance, but I like
it and I like what Senator Brown has said in general. What Equifax has let happen is very bad, and I think moral judgments and perhaps even shame (which is how a society can enforce morality) should be brought onto its leaders individually.&lt;p&gt;I hate how businesses and business persons have been making horrible, destructive decisions for decades (not that humans in all fields weren’t beforehand) and have been escaping any kind of shame. Indeed they’ve been praised in many cases.&lt;p&gt;If you look at the top-level pages on Wikipedia (there are about 11 of them), one of them is for “Society”. About a third way down you’ll see “Business” listed under Society. I think this is a good reminder that business is a part of and functions for society, not the other way around.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Portal:Contents&amp;#x2F;Society_and_social_sciences&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Portal:Contents&amp;#x2F;Society_and_so...&lt;/a&gt;</text></item></parent_chain><comment><author>fish_fan</author><text>My issue is not that they had the vulnerability, but that the vulberability allowed full access to social security numbers and it wasn’t even the “critical” database!&lt;p&gt;You can take proactive efforts to minimize the risk of breaches; they appeared to store large amounts of unencrypted (or encrypted in aggregate) personally identifiably information together and allowed a single struts vulnerability unfettered access.&lt;p&gt;For instance, one could not duplicate social security numbers, or could allow you to encrypt your data so you need to provide a key for others to access it. The possibilities are endless.</text></comment>