I get what you mean, but poor defense ain't no excuse to hack the hell out of company, neither legally nor morally. plus i don't buy the notion that some teenager had no clue what he was doing would harm other's livehood (if yes, then he should go through psychiatric evaluation).

if I don't put 3m electric fence with automatic sentry guns around my whole hypothetical house and land, does it mean everybody is automatically invited to freely try to break in, do damage, steal my stuff or post my private and legal data online for others?

state should have better use for these guys, but there should definitely be punishment, not reward in any way. that's how all countries run these days

I am not sure the analogy is very accurate. You do not advertise your house as a place where other people can come and freely store their valuables and then take it out as they please.

If you did, there is a name for what you have built: a bank. And you can be pretty sure people then will not have any issues with whatever security measures you take. Most of all, your cost of security installation is now covered by other people's money, which effectively gives you very precise calculations on what exactly you can and cannot spend. You are more than free to return the money and shut down shop if you feel you are in a completely unsafe neighborhood which makes your bank impossible to run at a profit.

To stretch this point a little further, imagine you did have a bank, and your customer comes and demands to take their money out, and you say "Oops. I had just left it out here on this desk, and when I went to pee, a kid just came in and ran out with all your money. I feel bad for you, but the cost of moving the stuff back and forth between front desk and the vault would make the service unprofitable. Its not my fault, its all these children in the neighborhood who keep pranking me".

The lowered barriers to hacking, combined with an ever moving target for what constitutes good security, are genuine concerns. But as a company, you are expected to shoulder the burden of security as a precondition of making the claim that you provide a good service. One way or another, people actually pay you to take care of their data as part of the service.

> You do not advertise your house as a place where other people can come and freely store their valuables

A house offers protection, no doubt about it and anyone but a social recluse will potentially offer it to others, although not foreigners. You are certainly not trying to say negligence would be OK as long as it concerns foreigners.

> I am not sure the analogy is very accurate. You do not advertise your house as a place where other people can come and freely store their valuables and then take it out as they please.

Your bank doesn't have weapons turrets in its physical branches, either.

I don't think the house analogy works. You don't keep other peoples stuff at your house. If you ran a storage warehouse, I'm pretty sure your customers would expect you to have adequate security. If a customer came in through the back door of my warehouse, and told me the lock doesn't work, I wouldn't punish him. I would fix the lock.

> If a customer came in through the back door of my warehouse, and told me the lock doesn't work, I wouldn't punish him. I would fix the lock.

And if that same customer smashed a bunch of stuff, vandalized the walls, and stole product that was being stored in the warehouse - you'd prosecute the hell out of him... and then fix the lock.

Indeed but if you don't build a fence around your swimming pool and a child wanders over and drowns that is often on you. I'd like to see some fines for negligence in examples like this. Both the attacker and the victim are at fault in my opinion.

If you have a swimming pool on your property, then yes you need to fence it, and fence it well. If some kid climbs that fence and drowns in your pool, kiss that property goodbye.

"Attractive Nuisance"

Which teenager hackers?

Yes, if the IT defenses are poor and they get in fair enough, another one is if they get the password list and shop around

You're saying like it's ok to rob the house with only one lock as opposed to the one with several locks and security cameras

More like, if you don't put locks on your doors, maybe no one should insure you and maybe the cops shouldn't waste their time when you couldn't be bothered to even take symbolic action to protect yourself.

How dare you! I put a note on the door that says that all unauthorized persons are forbidden from entering the house.

This analogy fails when you consider the complexities in securing a sprawling IT architecture for a massive corporation compared to putting a lock on a door.

Companies like Yahoo did try to secure themselves. They were just really bad at it.

The point of the analogy is that casual negligence of even the most basic security procedures should have built-in consequences... for the negligent party.

Consequences, yes. But the parent poster was suggesting the culpability should fall on the victim, not the attacker, which is just ridiculous.

They should be fined for negligence, but that doesn't mean the attacker is somehow morally right in any way.

Culpability can be shared, in the real world.

Sure, but when it comes to blame the bulk should still belong to the intruder.

Hacking is not the same as robbing. Hacker doesn't take anything away from you, except some reputation.

I don't understand the point your trying to make. In most recent high-profile hacking cases, hackers stole customer information (including credit card numbers) from the businesses. The financial fall-out for those customers could be much worse than a physical robbery.

Stealing money can be robbing, I agree.

But (this is unrelated matter) why is it possible to steal someone's money just by copying several short numbers? We have all kinds of advanced cryptography today but some payment systems still rely on transistor era technologies.

And even worse, companies can track customers using CC numbers. That is wrong too. The shop should not get your name or other unique identifier when you just buy something with a card.

They didn't steal money, they stole information which could be used to get money. What you're saying is equivalent to, "They stole the design for our car's master ignition key, but since they didn't steal an actual key or a car, no harm no foul." It's not the same as stealing a car, but it's also clearly about stealing cars.

If they're taking password from users (and maybe even other data like Credit Card numbers - regardless of the security failures of the site), they are taking something from you

Blaming the victim is easy.

I'd say that depends on the hack. The hacks just for prestige aren't really that prevalent any more.

These days it's hack for stealing creds or money or secrets or perhaps just putting ransomeware on all the comapanies systems to get a bitcoin payment out of them...

Even for prestige, is it ok for gang members to break and enter properties, even if they don't anything, for prestige? I suspect not so the same should apply.

Money, lost business, customer data are valuable things and hardly nothing.

An uncovered and unlocked hot tub in the back yard can be seen as an "attractive nuisance." Sure, the kid trespassed by climbing over the fence, but he wouldn't have drowned if the thing had been secured.

Sure, the hacker broke the law by hacking in, but I wouldn't have had my PII stolen if the thing had been secured.

You wouldn't say the same about a deadbeat teenager who smashes a car window and grabs someone's purse. "It's not because they're criminal masterminds, it's because of poor car defense."

Locks, physical and mathematical, are for the deterrence and convenience of the generally honest. Law enforcement, as an active defense, is for the deterrence of the actively attacking. At some point you're always going to have to stop turtling and build an army.

And I get downvoted for saying self-driving car companies should be fined signficant amounts of money for both car accidents due to poor self-driving software capabilities but also for security breaches.

What if it's "cheaper" for the car companies to let the cars crash than adopt stronger security? You may think that there's no way a recall would be worth it, but we're already seeing companies such as Tesla "fix" the issue over the air, and chances are most of the new self-driving cars will be fixed the same way, if not all.

The only thing that would be left is the "bad PR", which may be much smaller in the future, because there won't be any recalls. If only 2 people die, and then all cars are fixed, the outrage just won't be as big as when 100 people die due to a brake malfunction, and then 5 million cars have to be recalled, impacting 5 million people (as opposed to only the families of those two in the former example) that would then personally spread the bad news.

Also the "bad PR" doesn't seem to affect tech companies, or even retailers, or banks, all that much, so I doubt it would affect car companies that much more in the future (for the reasons I mentioned above).

You looked at PR and outrage but not a major cost: class-action lawsuits. It's what made Pinto risk assessment so wrong.

It's not illegal to have crappy IT but it is illegal to hack or exploit a companies computer systems.

Just because there isn't a fense around an area that says no trespassing doesn't make it legal to walk through.

"But they didn't have a fense and it was easy to walk into the area."

All that needs to happen is for a court to define poor IT security as an "Attractive Nuisance", and just generally make companies liable for their customer's information (and more broadly if possible).

Doesn't the attractive nuisance doctrine only apply to children?

Yes, but then, the discussion was about "teenage hackers". More broadly though, I was just trying to get the idea across using an existing bit of common law.

Why not both?