This sort of nationalistic flamebait (pro or con, doesn't matter) breaks this site's rules. Would you please read them and follow them when commenting here? https://news.ycombinator.com/newsguidelines.html
On HN we're hoping for at least a slightly higher standard of civility than is common on the internet. Given how strong the forces of polarization (of all kinds) have been as of late, that's something we need everybody here to pitch in with.
A lot of us here are engineers and coders. It's our responsibility to design better architecture, security conscious protocols and write securer softwares. And it's up to all of us (regardless which country you are in) to voice up and resist the idea of weakening encryption or allowing backdoors and instead advocate for adopting better and more securer encryptions to safeguard private and sensitive personal information.
I think we can significantly improve the situation though with increased data collection laws, and then also more cryptography. Equifax shouldn't have all that data in the first place. A lot of the reasons that companies need data (besides machine learning) can be covered with cryptographic arguments that exclude the data itself.
For example, cryptography exists that would allow me to use my driver's license to prove to you that I am over 21, without ever actually showing you my real birthday or name. You could be 100% convinced that I both have a valid ID and that ID indicates that I am over 21 without learning anything more than those two facts.
If you can do things like that, you can make it illegal for companies to hold more sensitive information. If there's a big data breach that loses sensitive information, the company at fault can be charged for illegal data collection.
I know it's a big step from the data driven world we currently live in, but I think it's the only way to avoid a scenario where pretty much all details of every person's life (including politicians, secret agents, military figures) are public knowledge. We're just collecting far too much data, putting it in far too many places, and it's technologically infeasible to protect all of that.
The very fact that all this data was accessed from their public site is very troubling. What's the chances this is a basic SQL injection issue? What's the chances they didn't invest in security at all?
What makes you think lack of investment in IT & security is the main reason they get hacked?
Vice versa, NSA has virtually unlimited (let's just say unlimited means tens of billion dollars) budget invested in IT and security. They have the top resources there too. Do they immune from data breaches and being hacked? The answer is a big NO!
Hacking humans is quite often the easiest point of entry.
[1]: https://www.equifaxsecurity2017.com/
This is inexcusable in 2017. Hacking humans may be easier but it's up to Equifax to figure out how to mitigate that risk. "It's hard" doesn't excuse their behavior.
However this is not an excuse for Equifax to not put more focus and investment on their security.
Sure, nothing is totally secure against a dedicated, motivated attacker with unlimited resources. Thankfully those are few and far between.
Based on that Equifax has said that this doesn't seem to be the case.
People pay credit rating agencies to retrieve their credit reports, get credit scores, and open disputes, and the best way to do all that is online.
An excellent example is how many companies are in panic mode right now to get GDPR compliant before next year. There's a lot of security engineers and developers that finally get the budgets and time they've asked for to improve customer privacy, because the potential fallout of non-compliance is too big to ignore.
If it isn't a solvable problem then we need to start talking about getting this data off the Internet.
If you're really so terrified of the government that you're against security regulations for the website of one of the largest credit card information collectors in America, then you deserved to be hacked too.
The problem lies in that security and efficiency have been historically at odds with each other.
This is what inspired us to work on bringing a novel data security technology from the University of Harvard to the market: www.f-lock.ca . Essentially we are allowing for querying functionality, while achieving homomorphic-level of security. Would love to connect with any people here who share the same vision!
1. Collect the minimum amount of information you actually need
2. Hash and salt the data you store
3. Tell the people the truth about what happened to their data within a reasonable time
These are all things that can potentially be enforced.
my point being, without guidelines, or regulations, or some sort of security rating standard, managers will continue to make these mistakes.
I think there's a few things that could be done:
1. Invalidate all SSN numbers.
2. Force people to get a new ID card; make it like the smart-card passport card (or make people get such a card). That becomes your ID and number.
3. Getting that card requires you to be present physically for fingerprinting. Put the fingerprint data on the card, and no where else.
4. Make regulations that only allow for loans to be done in person - no more mailings, nothing online - if you want credit, you have to show up in person.
5. To prove who you are: Fingerprint, your card (with picture - and fingerprint data on the card), plus your pin number. Essentially chip and pin identification, with a fingerprint scan (and maybe a face scan too).
6. Make it so if you want to do online transactions - or any transaction for that matter - you must provide all of this. Basically, at home, a card reader that can read the chip, allow you to enter the pin, scan your fingerprint and face, and if all of that matches what's on the card, then an "acknowledgement" is sent.
Essentially the above would implement a 3-factor auth. I am not saying the above is perfect (I am absolutely certain I have screwed something up there - but the basic idea is what I am trying to convey), but we essentially have to do a clean break away from all current ID and credit/loan/payment systems - and move to a system that introduces a TON of friction.
Physical Presence (Something you are)
Physical Token (Something you have)
PIN (Something you know)
And all the data about "who you are" (face scan, fingerprint) stored on the card (hashed of course) only, no where else. Basically - the card, your presence, and your knowledge all have to be present, and the card's processor authenticates you.
And these factors need to be presented each and every time you do a transaction of any sort involving money or identification.
And no online or by-mail signup for credit. That should be done in physical form only.
Finally - allow for at-will changes of the PIN, and yearly a forced change of the PIN.
The problem with the above, though, is many-fold. It would be extremely costly - for everyone. It is also (seems in a way) draconian. But something of the above nature would need to be done, post haste, if we wanted this to go away.
And basically not allow any kind of storage of credit information or whatnot by -any- entity (and I am not sure how that would even work or if it could). Maybe all they have is a hash value and your name, and the card can generate that hash value as "authentication"/"identity" - but you have to have everything there (you, card, pin), and only the card holds the information, and only generates a hash.
I dunno - but again, this is the idea. I'll leave the details to people smarter than I on these things.
I don't expect something like this to be ever implemented, though. One would think this breach would do it, but it won't.
Usually reserved for criminal cases, not civil ones.
> regulation in the way the data can be stored and processed
Have it.
> regular checks need to be conducted to ensure their adherence
Have it.
> I can already hear Americans preach to me how the free market is great and solves all your problems.
Please quote me the "solve all your problems" source.
Is this not? If that's the case I need to get out of this dumpster fire of a country.
I can tell because criminal cases are prosecuted by the state; civil cases are prosecuted by private parties. (And class action is always civil.)
But by all means, move to somewhere less dumpster-firey where large businesses and governments don't get hacked.
1. I assume the FBI is investigating the hack itself (who did it, etc.). Citation?
2. I assume the SEC is investigating the suspicious timing the executives who were selling stock before the announcement. I'd also assume it could turn into a criminal investigation. Cite?
3. The class action suit is a civil action asserting that Equifax was negligent (that's what the Bloomberg article that these comments are currently pointing to is about).
4. There could be criminal negligence in securing their networks. It seems like that could be either of a Federal or state issue. Anyone know if this investigation would take place with the FBI, or if there is another federal agency which would take the lead on that?
It's too early to know anything for sure about the breach and certainly holding pre-made assumptions prevents a more level headed, careful analysis of the facts.
That being said, I agree that on the face of it, this is pretty damning evidence that regulations were either not in place, or were not verified to an acceptable level.
Interestingly, Canada's financial industry is also mostly self-regulated which has always struck me as a foolish model.
https://www.nytimes.com/2017/09/08/business/equifax.html?rre...
Selling stock the day before the news makes these guys seem like absolute criminals, but (a) it's not what happened and (b) the soundbyte doesn't represent what is likely the case.
The reality:
- Breach happened between March - July 2017
- Breach detected July 29th (A Saturday)
- Executives sold stock August 1 (A Tuesday)
- Breach announced September 9th (5 weeks later)
From the company's own statement, which you can BET was vetted by a lot of attorneys:
"Equifax discovered the unauthorized access on July 29 of this year and acted immediately to stop the intrusion. The company promptly engaged a leading, independent cybersecurity firm that has been conducting a comprehensive forensic review to determine the scope of the intrusion, including the specific data impacted."
I would bet, dollars to donuts, this is just terrible timing optically for the executives.
What is much more likely reality is that they detect breaches on a regular basis, and until the forensic team came back with the bombshell - likely many weeks later - of the scope of the data loss, the executives were not even informed.
They make them shout over and over "MANAGEMENT ALWAYS LIES, MANAGEMENT ALWAYS LIES, MANAGEMENT ALWAYS LIES".
That scene took place in the early 90's, and I can't imagine anyone thinks it's gotten better in regards to the ethics of top management, their understanding of technology, or their desire to participate in insider training.
I don't see anything exonerating in the timeline you described. You are making assumptions here that could excuse the executives if they were true. These are nothing but assumptions though.
Your hypothesis is predicated on the fact that you trust their timeline, and make assumption that type of events could have occurred within each groups at Equifax on those days..
Difficult to prove, but I too suspect it’s just bad timing.
Note that the three executives sold relatively small portions of stock: 13%, 9%, 4% of their respective personal holdings.
Do we know that there aren't? Would it be public knowledge if there was an investigation?
It would be pretty stupid, considering how easy it would be to get caught, and to avoid a mere ~14% decline on your share value? Yes, people can be stupid and greedy. I guess we'll see if this applies to these execs.
The kind and amount of information warrant strong regulation in the way the data can be stored and processed (separate monitored networks not reachable from the internet would be the absolute minimum), governmental regulation needs to ensure the security of sensitive personal information like this and regular checks need to be conducted to ensure their adherence, especially in the case of a breach like this after the fact, you can't rely on the company conducting a forensic investigation.
But no of course not. I can already hear Americans preach to me how the free market is great and solves all your problems.