Perhaps that's why Experia's little breach never made the headlines. They couldn't be framed as a victim as the guy bought all the data legally. It's less than reassuring to ponder, depending on the "how" the data is used, anyone with a shell company, a little diligence and, most importantly, cash could buy this info, too.
http://krebsonsecurity.com/2014/03/experian-lapse-allowed-id...
It's funny how personal data is so clearly valuable - if it weren't companies wouldn't spend resources to hang on to it - and yet that value is so hard to define.
I wonder if it would be helpful if personal information were treated like some kind of intellectual property which could be licensed out, and there were some kind of market for doing so. If a company leaked my data I could sue them like a record company suing individuals who share music files.
Of course, any one individual might not be able to make much money by selling access to their data. It's just a thought.
While I agree that things like sql injection are negligent, there were also credit card hacks/leaks(and an nsa leak) that were the result of malicious contractors. Saying "dont hire bad people" is easy, but how do you do that?
And the standard for best practices is constantly moving in our industry, how do we decide when it is negligence, and when there was nothing that could be done.
Not saying people are being harmed by this, Im just saying its not so black and white. In some cases the companies that were hacked couldnt have reasonably stopped it. I mean, how do you prevent contractors from setting up something that steals credit card numbers? You hired the contractors because you dont have those skills in house.
This isn't an insoluble issue: courts deal with similar decisions in car crashes, medical malpractice, and many other scenarios.
A plaintiff could argue that the respondent should have been aware of certain vulnerabilities because they were widely disseminated, or that certain practices are explicitly warned against in common training materials. Respondents might counter by arguing that they test for that type of vulnerability using a widely-accepted tool, but it failed to flag this one issue, or something like that.
I agree that it can't be a purely algorithmic process, but almost nothing in a courtroom is.
I am continually amazed by the simple solution bitcoin provides to this problem: instead of me giving you an account number that you (or anyone who gets the number) pull(s) money from, you give me a number that I push money to. It's going to be a long time before that kind of change in our payment systems (from pull to push, whether with bitcoin or some other system) can be widely implemented.
Maybe? I didnt see anything about home depot suing the contractors? Really, they should be held financially and criminally liable.(if they werent)
The public ledger part of bitcoin is great also. You can see where the stolen money went. Maybe if they added a way to flag money, so spending stolen bitcoin would trigger an alert at the merchant, the same way canceled credit cards do now.
EDIT: I should point out I don't know any details about the Home Depot "hack" and I might not be addressing all the pertinent points of that particular incident. Bottom line is still the same, it shouldn't be the customers who suffer when this happens. The people that made it so easy for my personal information to leak, the ones who necessitated that my personal information even be required as part of the transaction, should be the ones feeling the pain.
" it shouldn't be the customers who suffer when this happens. The people that made it so easy for my personal information to leak, the ones who necessitated that my personal information even be required as part of the transaction, should be the ones feeling the pain"
I get what you mean about some services collecting everything they can, and not taking the best possible care of it. I agree with you there. I was trying to point out an exception where there isnt anything that can be done. For example, try and stop finfisher :)[2] Companies will get hacked, and it is not always negligence. I was trying to point out that you wouldn't blame a shopkeeper if an armed robber stole credit card info, but if he left it in an unlocked room then we should. And I dont think either home depot or target were collecting more than they needed to.
PS, if anyone has a link as to how we can be more proactive about working with law enforcement to catch the fraudsters, I would love to see it. Either from the point of view of a consumer, or service provider.
1. http://krebsonsecurity.com/2014/09/home-depot-56m-cards-impa...
2. http://news.softpedia.com/news/finfisher-s-account-of-how-he...
That's how bank transfers work, though.
http://www.reuters.com/article/us-cyber-heist-swift-idUSKCN1...
http://nymag.com/daily/intelligencer/2016/06/the-hack-that-c...
Now if only someone would invent a mechanism by which a public and a private key could somehow be combined and only the public part shared....
Sure some hacks happened despite companies putting forth their best effort, but hand-waving the responsibility to contractors is not the answer.
I dont when it comes to software. For say legal services, I dont have many options, as I am not an expert. The point I was trying to make is that sometimes people hire contractors because they dont have the expertise. How are they supposed to review something they dont understand? Saying every organization should have top notch IT on staff so this doesnt happen is hand-waving as well.
If you provide sensitive information to anyone that you don't have legal recourse against, then I don't really have any sympathy for you. If you make a bad business decision and it leaks my info, I'm not upset because someone took it without your approval, I'm upset because it was leaked.
There's a cost/benefit risk to everything. If you want to take the route of working with contractors, you have to weight the risks for that as well.
Brilliant, I hadnt heard of/thought of that.
"There's a cost/benefit risk to everything. If you want to take the route of working with contractors, you have to weight the risks for that as well."
True, I would just like to point out that hiring your own staff might no work out either...
But if you take the less safe/secure option, you can't expect much sympathy.
Most people do this all the time. When you have your car serviced, do you look over the work? Some people do, sure -- those who know what to look for. Most people don't, because they have no basis upon which to judge the quality of the work.
As others have pointed out, that question is one that courts deal with every day in other industries.
IANAL but I have some familiarity with the architecture and construction industry, where there are lots of lawsuits around negligence. My understanding is that the question is generally framed as "what would a reasonable professional have done in this case?" Would any reasonable contractor have interpreted those drawings to mean the joists should be spaced 24" apart? Or would a reasonable professional have interpreted it to be 20"?
The same standard could be applied to software engineering and data breaches. Would a reasonable engineer allow a SQL injection vulnerability to persist in 2016?
I suspect as soon as any amount of precedent is set for lawsuits around "hacking" law firms will push open the floodgates and it will suddenly become very common.
In the construction industry the frequency of lawsuits has created a culture where people go to great lengths to reduce their risk of liability. Architects draw deliberately vague details around waterproofing and contractors push to have every detail for how to do things spelled out on paper, so they won't be on the hook if one of the steps in the process is wrong.
You are suggesting that a software engineer should be personally liable for the code he writes, just as a civil engineer is liable when he stamps a blueprint.
That would be quite a change for our profession.
And I say this as someone who's spent time in consulting. The prices would necessarily go up in the face of litigation. But I think it would be well worth it - I'd love to be able to financially justify taking extra time to make the systems I build secure. (I make systems secure anyway of course, but I'm competing with companies packed full of General Assembly grads who don't know what a hashing function is yet.)
Doesn't seem to line up very well with "Move fast and break things"
When it comes to security around my personal data, I don't want anyone to move fast or break things. Businesses should either not bulk collect identifiable data or treat it with the care and diligence it deserves.
And while we're at it if 20 year old self taught rockstar programmers don't have the skills to do that, maybe they should learn. If you're making web software which stores personal information and you can't name 5 of the OWASP top 10 without looking them up, you're a privacy time bomb. I want my personal data far far away from your product.
When it comes to security, move slowly and fix your shit.
Maybe "move fast and break things" isn't an unconditionally great idea.
There are pros and cons to it. It might lead to higher salaries for engineers - liability bringing licensing requirements which could restrict supply.
I don't think many architects would be comfortable taking risks with critical structural details. Also, even if a firm isn't found technically liable for a deadly building failure it can still be very bad for business.
That said I'm sure some architects still put people's lives at risk to avoid liability. I suspect it's similar any other industry where, sometimes, collectively people in a company put the public at risk for the sake of financial gain - pharmaceutical companies, manufacturers, mining companies, etc. No individual feels personally responsible.
The architect and engineer would presumably collaborate to ensure that the design is at least clear enough to be safely built.
Wouldn't the negligence just be that they had access to the unencrypted credit card numbers?
In the target hack, hvac contractors had their credentials stolen, and malware was installed on their pos system. The home depot hack was malware suspected to have been installed on their self checkout machines[1].
So no, they never allowed anyone access to the unencrypted credit card numbers. Negligence is failure to exercise reasonable care.[2] Bad things happen, and even more so when sophisticated criminals are attacking you. It is impossible to create a fully hack proof system. I would say allowing a sql injection is negligence, but when people are using sohpisticated attacks, there is nothing you can do.
1. http://krebsonsecurity.com/2014/09/home-depot-56m-cards-impa...
This highlights a major problem with tort law: It's monetary damages or GTFO. In other words, it's nearly impossible to make a case for damages when there is no obvious monetary aspect of the harm done. I can't sue Home Depot for giving up my credit card info to hackers unless I can prove that it led to someone running up my credit card bill. Either this needs to change, or it should be a crime for companies to release customers' personal information to unauthorized third parties.
Part of the problem is how these data breaches are framed in the media. It's always "Company X was HACKED!" and "Company Y SUFFERED a major data breach!". They're portraying the negligent company as the victim! It should be "Company A carelessly released their customers' data." or "Company B failed to protect 10 million credit card numbers." Once we stop pretending these companies are victims, we can start making and enforcing tougher privacy laws.