governments should heavily fine companies that are subject to data breaches.
If it cost them real money (proportional to their market cap, the amount of customers affected, and/or the severity of the breach) to allow a data breach, I’m betting they’d shore up those holes REALLLLLLLLLL QUICK.
This is always the answer. “How do we solve x in y industry?” Make the fucking corpos responsible for their own asses and it will get fixed. If it costs them more money to be breached they will do everything they can to not allow that.
I’ve completely and irreparably broken up with electoral politics in the United States ever since my tax money started being spent solely on austerity and genocide. It’s about as likely for this to be introduced as a bill as it is for a third party to win a presidential election…ie IMPOSSIBLE.
Yeah, people shouldn’t look to their government to protect them from this. Hell, I’d be willing to bet no small amount of taxes go to purchasing the leaked info at places like the CIA, NSA, and FBI.
Nah, throw the board members in prison. If the punishment for crime is a fine then it’s legal for rich people/corps. Put 'em in solitary and feed them nutraloaf for one day for each person’s data they allowed to be leaked.
If they get all the money because they’re ultimately responsible, we should make them ultimately responsible.
if it means prison time for a middle/lower class person, it should mean prison time for everyone who is responsible for basically publishing logins and personal data.
no more geeting off scott free because you run a company. you’re a prisoner like everyone else now.
Here’s the summary for the wikipedia article you mentioned in your comment:
Nutraloaf (also known as meal loaf, prison loaf, disciplinary loaf, food loaf, lockup loaf, confinement loaf, seg loaf, grue or special management meal) is food served in prisons in the United States (and formerly in Canada) to inmates who have misbehaved, abused food, or have inflicted harm upon themselves or others. It is similar to meatloaf in texture, but has a wider variety of ingredients. Prison loaf is usually bland, even unpleasant, but prison wardens argue that nutraloaf provides enough nutrition to keep prisoners healthy without requiring eating utensils.
As much as I agree that something needs to be done to these companies, and that they deserve punishment, I think this approach would only result in leaks (even more) underreported, which makes it even worse.
Are these leaks even being reported by companies? Every article I have seen so far has just been compiling information off the new leaked data set someone picked up off the dark web or something.
As of December 18th of last year, publicly traded companies are now required to disclose breaches. (soz, material cybersecurity incidents).
Prior to that, they could …basically… just effectively sweep everything under the rug “like it never happened” minus a little handwaving and paper shuffling and nobody would find out about it until the information got sold and went public.
I’ll have to go looking but I would be SERIOUSLY surprised if the disclosures apply to credit card companies (the MOST breached, historically) because I’m not sure what exactly qualifies someone as an asset-backed issuer, but it’s at least a really good step for the REST of things.
Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.
Paragraph 2:
Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation
Article 24, paragraph 1:
**[T]he controller shall **implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation.
Article 5, paragraph 1f:
Personal data shall be: […] processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss,
Article 83, paragraphs 2 and 5:
Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive.
Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:
(a) the basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7 and 9;
Article 4, paragraph 7:
‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data
They won’t because fines are just a fee to allow them to run unethically. That way businesses get more profit than they would otherwise and government gets their cut to allow it. It’s broken by design.
This is the stupidest idea I’ve ever heard. You don’t fine a bank for getting robbed. This reeks of frontend engineer idiocy, which is ironically the exact type of idiocy that tends to cause breaches like this.
Every time some corporatist replies to me, they’re always kbin.
Your analogy falls apart with even a cursory thought about the differences between banks (which are required to be insured against loss which would make a customer whole again without any negative effects) and corporations that just throw all of their customers’ data onto a portal that lacks basic protection. Once that personal data is compromised, there’s no way to repay the customer and no amount of fines will EVER right that wrong. In a properly-regulated, just society, a bank would ABSOLUTELY be fined back to the Stone Age if they left their customers’ cash in the middle of a town square, for example.
Ok then, how about considering that this will only serve to benefit the big tech companies because they’re the ones that can afford the fines? A breach is usually enough to make a smaller company go out of business already between cleanup and lawsuits. Why make it easier for the big tech companies to maintain power?
Did you even read my comment? I specifically mentioned that the size of the fine could be tied to their market cap.
If you work in cyber security, you’d know that there are best practices in place for cybersecurity and it is a WELL UNDERSTOOD FIELD. The main advice everyone gives is to never roll your own cryptography…and that is EXACTLY what many of the hacked companies did.
Taking a shortcut and hiring shitty devs who just use some random NPM package for security and call it a day is exactly why there are so many breaches. Just as bridges need to be built to withstand double or triple their weight, there should be STANDARDS in place that if violated are subject to fines.
Companies like Google would basically have to build SUPER SECURE technologies lest they be bankrupted by a breach.
In conclusion, please try to remove your tongue from your exploitive employer’s back side.
I did miss that, but again, it’s additional fines on top of an almost guaranteed lawsuit for something that may not even be their fault. If they got owned by a Heartbleed exploit back when it was first announced and a fix wasn’t available yet, should a company be responsible for that? What about when they get hit by a vuln that’s been stockpiled for a couple years and purposely has no fix due to interference from bad actors? There are a lot of situations where fining someone for getting breached doesn’t make sense.
You make great points but my final point is this: if a company simply cannot guarantee protection of user data, it shouldn’t be trusted with user data in the first place.
And I’ll counter with this: no system is perfect, especially when major parts are made by non-employees. Mistakes can and do happen because corporations, regardless of size, are made up of humans, and humans are really good at fucking up.
Go back to my bridge analogy and test that against what you just said.
Your comment equates to: “oh well, that bridge falling killed thousands of people. At least we were able to allow them to fail in the crucible of the free market!”
I have a solution:
governments should heavily fine companies that are subject to data breaches.
If it cost them real money (proportional to their market cap, the amount of customers affected, and/or the severity of the breach) to allow a data breach, I’m betting they’d shore up those holes REALLLLLLLLLL QUICK.
This is always the answer. “How do we solve x in y industry?” Make the fucking corpos responsible for their own asses and it will get fixed. If it costs them more money to be breached they will do everything they can to not allow that.
That, or threaten to nationalize their industry. Corporations *hate * that.
Communications should always be nationalized. It was a mistake letting corporations gatekeep phones and internet.
Infastructure should be nationalized as a whole (roads, rails, water, heating, electricity, waste disposal and so on)
How about Intel?
Obviously a typo, nice one
Internet is also communication. works great in North Korea.
“Externalities” are just expenses that corporations incur that have to be paid by the public.
Make externalities losses again.
It’ll also screw over anyone trying to break into the market, ensuring that the big tech companies remain unchallenged indefinitely.
Disagree if you add the three different factors that I added to account for this in my original comment:
As I wrote in my edit, I think the size of fine should be dependent on:
size of company
the reasonable expectation of security (which would partially attempt to decrease fines for unfixable breaches)
the number of unique users affected
I think that’s a great starting point for effective legislation.
I also think this could easily be twisted to become yet another artificial barrier to entry.
I don’t know what to do with that knowledge…I think you’re correct, but I also think there’s no way to pass such a law with its spirit intact today
I’ll put the ball in your court.
I’ve completely and irreparably broken up with electoral politics in the United States ever since my tax money started being spent solely on austerity and genocide. It’s about as likely for this to be introduced as a bill as it is for a third party to win a presidential election…ie IMPOSSIBLE.
They’re too busy proposing legislation to create back doors that completely circumvent security in the first place.
Yeah, people shouldn’t look to their government to protect them from this. Hell, I’d be willing to bet no small amount of taxes go to purchasing the leaked info at places like the CIA, NSA, and FBI.
Nah, throw the board members in prison. If the punishment for crime is a fine then it’s legal for rich people/corps. Put 'em in solitary and feed them nutraloaf for one day for each person’s data they allowed to be leaked.
If they get all the money because they’re ultimately responsible, we should make them ultimately responsible.
if it means prison time for a middle/lower class person, it should mean prison time for everyone who is responsible for basically publishing logins and personal data.
no more geeting off scott free because you run a company. you’re a prisoner like everyone else now.
Here’s the summary for the wikipedia article you mentioned in your comment:
Nutraloaf (also known as meal loaf, prison loaf, disciplinary loaf, food loaf, lockup loaf, confinement loaf, seg loaf, grue or special management meal) is food served in prisons in the United States (and formerly in Canada) to inmates who have misbehaved, abused food, or have inflicted harm upon themselves or others. It is similar to meatloaf in texture, but has a wider variety of ingredients. Prison loaf is usually bland, even unpleasant, but prison wardens argue that nutraloaf provides enough nutrition to keep prisoners healthy without requiring eating utensils.
to opt out, pm me ‘optout’. article | about
HELL YEAH, comrade! 🌹
I was just working inside of the confines of shitliberalism because it’s seemingly all we have in the United Corporations that run America.
Hail Comrade!! 🙏🤞
As much as I agree that something needs to be done to these companies, and that they deserve punishment, I think this approach would only result in leaks (even more) underreported, which makes it even worse.
Are these leaks even being reported by companies? Every article I have seen so far has just been compiling information off the new leaked data set someone picked up off the dark web or something.
They weren’t, which is why the SEC updated 17 CFR Parts 229, 232, 239, 240, and 249.
https://www.sec.gov/files/rules/final/2023/33-11216.pdf
As of December 18th of last year, publicly traded companies are now required to disclose breaches. (soz, material cybersecurity incidents).
Prior to that, they could …basically… just effectively sweep everything under the rug “like it never happened” minus a little handwaving and paper shuffling and nobody would find out about it until the information got sold and went public.
I’ll have to go looking but I would be SERIOUSLY surprised if the disclosures apply to credit card companies (the MOST breached, historically) because I’m not sure what exactly qualifies someone as an asset-backed issuer, but it’s at least a really good step for the REST of things.
Article 82, paragraph 1 of the GDPR:
Paragraph 2:
Article 24, paragraph 1:
Article 5, paragraph 1f:
Article 83, paragraphs 2 and 5:
Article 4, paragraph 7:
(All quotes are excepts, emphasis mine
https://gdpr-info.eu/
I think we can both guess why these companies never really face penalties that hurt them materially despite this being codified into law in the EU…
I got lost in the comments… why did you paste that here? To show that it is possible to make the data controller liable for breaches?
Exactly. This is supposed to show that what @demesisx@infosec.pub demands is already law in the EU.
They won’t because fines are just a fee to allow them to run unethically. That way businesses get more profit than they would otherwise and government gets their cut to allow it. It’s broken by design.
The EU has proven time and again that fines can hurt.
This is the stupidest idea I’ve ever heard. You don’t fine a bank for getting robbed. This reeks of frontend engineer idiocy, which is ironically the exact type of idiocy that tends to cause breaches like this.
Every time some corporatist replies to me, they’re always kbin.
Your analogy falls apart with even a cursory thought about the differences between banks (which are required to be insured against loss which would make a customer whole again without any negative effects) and corporations that just throw all of their customers’ data onto a portal that lacks basic protection. Once that personal data is compromised, there’s no way to repay the customer and no amount of fines will EVER right that wrong. In a properly-regulated, just society, a bank would ABSOLUTELY be fined back to the Stone Age if they left their customers’ cash in the middle of a town square, for example.
Be better, you corporate cuck.
Ok then, how about considering that this will only serve to benefit the big tech companies because they’re the ones that can afford the fines? A breach is usually enough to make a smaller company go out of business already between cleanup and lawsuits. Why make it easier for the big tech companies to maintain power?
Did you even read my comment? I specifically mentioned that the size of the fine could be tied to their market cap.
If you work in cyber security, you’d know that there are best practices in place for cybersecurity and it is a WELL UNDERSTOOD FIELD. The main advice everyone gives is to never roll your own cryptography…and that is EXACTLY what many of the hacked companies did.
Taking a shortcut and hiring shitty devs who just use some random NPM package for security and call it a day is exactly why there are so many breaches. Just as bridges need to be built to withstand double or triple their weight, there should be STANDARDS in place that if violated are subject to fines.
Companies like Google would basically have to build SUPER SECURE technologies lest they be bankrupted by a breach.
In conclusion, please try to remove your tongue from your exploitive employer’s back side.
I did miss that, but again, it’s additional fines on top of an almost guaranteed lawsuit for something that may not even be their fault. If they got owned by a Heartbleed exploit back when it was first announced and a fix wasn’t available yet, should a company be responsible for that? What about when they get hit by a vuln that’s been stockpiled for a couple years and purposely has no fix due to interference from bad actors? There are a lot of situations where fining someone for getting breached doesn’t make sense.
You make great points but my final point is this: if a company simply cannot guarantee protection of user data, it shouldn’t be trusted with user data in the first place.
And I’ll counter with this: no system is perfect, especially when major parts are made by non-employees. Mistakes can and do happen because corporations, regardless of size, are made up of humans, and humans are really good at fucking up.
I’m not trying to get the last word, I swear! 🤣
Go back to my bridge analogy and test that against what you just said.
Your comment equates to: “oh well, that bridge falling killed thousands of people. At least we were able to allow them to fail in the crucible of the free market!”