So a few years back, Equifax bought a company I cofounded. They assisted my former business partner in diverting ~$13 million of the purchase proceeds that were supposed to go to me over to him. Then they helped stonewall the resulting litigation for years.

While I am upset on behalf of all affected consumers, mere words cannot adequately express the unbridled joy that I experienced when I found out that they were likely, at a minimum, going to lose hundreds of millions (or more) over this. Having dealt with high level executives at the company, I can tell you that an event like this is wholly unsurprising given their nonchalant attitudes toward...pretty much everything. I absolutely hope you are right that this is an extinction level event for them. My admittedly biased opinion is that they are an irresponsible company with far too much power over peoples' lives, run by malevolent executives. The company should probably cease to exist, at least in its current form.

Did they have a specific reason for screwing you over? It just seems like a lot of effort to go through on their part with no tangible benefit. Sorry if this is too personal a question.

It's a very long story, but my business partner was running everything by the time they came into the picture and so their allegiance was to him. We had a personal falling out and based upon that he became hellbent on ensuring I got nothing once it was clear that the acquisition was going to happen. It was easier and cheaper for Equifax to take the position they took. If I were a corporate lawyer, I likely would have given Equifax the same advice. That doesn't make it right though.

Every generation is galvanized by serious injustices. But, it feels like we're far less effective at turning that anger into change; though maybe that's always how it feels at the time.

I'm almost sure I once saw a quote from Bill Clinton's press secretary that said something like "We knew that if we could survive the first 5 days of a bad story, it would get dropped."

That perspective solidified for me during the Occupy Movement. Granted, it lasted much longer than 5 days, but ultimately, what of it? The FBI didn't investigate the bankers, it investigated the protesters.

You see it with Flint. You see it with Climate Change.

I've always been politically apathetic. Moreso as a foreigner where I recognize that living in a foreign country is a privilege, not a right. Plus I'm a cynical person (not a healthy habit). Which means that whenever I hear about "boycotts", or "writing to your representative", or "held criminally responsible", or "..." I always think two things. First, that people are naïve, and second, what's it going to take to drive people to take un-ignorable action?

Brave New World.

American politics is driven by anger. Unfortunately, anger at "elites" and "immigrants" far outweighs any kind of desire for competence or real solutions, which is why you have Trump.

There is an entire industry keen to get people unconstructively angry about unrealistic threats so they can sell gold and ammunition.

> we're far less effective at turning that anger into change

The anger will become a mob that enacts change when a critical mass of people lose access to food and/or shelter.

> what of [Occupy]

Occupy was very successful at (re-)introducing class warfare into the public dialog.

> First, that people are naïve, and second, what's it going to take to drive people to take un-ignorable action?

3rd, why isn't this anger organizing into larger activist/political movements? Well, with enough surveillance data and modern data analysis tools it's easy to find the "leaders" or "organizers" that bring people together. Remember JTRIG[1]?

[1] https://theintercept.com/2014/02/24/jtrig-manipulation/

Oh, you're on the right track... but it's worse than you imagine. Those "leaders" and "organizers" are unimportant. You're familiar with the 'Six Degrees of Kevin Bacon', right? Say you were omnipotent and wanted to make it so that instead of only needing 6 links to get to Mr. Bacon, you needed 15 links on average. And you want to do as little disruption of the network as necessary.

What nodes in the graph of connections would you target? Intuition says go after the nodes with tons of connections to tons of people. Intuition is, as it almost always is, dead wrong. Removing those massively-connected people in a social network is basically useless. They are almost exclusively connected to people who are already connected to one another. They're the center of clusters, and you will almost never route through one in an attempt to find the path to Mr. Bacon.

Instead, what you want to look for are node which bridge clusters. People who are usually not strongly connected to one of the clusters they are associated with, but provide a conduit through which connections can be made. Because they are inherently a bit 'different' from the people in each of the clusters they bridge (few others bridge those two clusters), they tend not to be important figures. They're a member of a biker gang who hangs out with his great aunts knitting circle on Saturdays. They're the ones who facilitate the flow of ideas between groups that never speak to one another otherwise.

So you know who to target... but how many 'bridge' nodes like that do you need to really take out in order to significantly increase the 'distance' between nodes on the graph on average? Disturbingly few. Removing something like 25 nodes from the graph of tens of thousands of performers will make it so you need 15 or more connections on average to get to Mr. Bacon. (The book 'Linked: The New Science of Networks' details the research specifically, its been years since I read it though so I am fuzzy on exact numbers but it was definitely fewer than 30 you needed to remove)

Now, imagine a crazy scenario where you had access to the social graph of a country (somehow!) and knew who was talking to who. And your goal was just to maintain the status quo. Well, what does any large-scale social change require? An idea must spread to large numbers of extremely different, and almost entirely disconnected, groups. Any idea that remains sheltered in one or a few groups will die out of its own accord. A revolution doesn't happen because one minority wills it, there has to be buy-in from a wide array of groups. So remove those bridge nodes. Any widespread social change becomes very nearly impossible.

But what is "removing a node"? I'm not talking about black-bagging a person and dragging them off to some hole or blowing their brains out. Such things are entirely unnecessary and counter-productive. The more significant your action is, the more profound the unintended consequences will be and predicting the outcome quickly becomes intractable. Instead, notice that those bridges are usually connected more strongly to one cluster rather than the other. If their communication became more burdensome to the group they are less connected to... for how long would they persist in fighting to maintain it? If something nutty happened and they had to change their phone number, what're the odds they'll forget to give the new one to the contact in a group they're barely involved in?

You could have very quiet oppression through these means. I expect there would be unintended consequences, and have been trying to figure out for a few ways a good way to detect such changes in a social network, but its just a thing I keep in the back of my head, not something I actively work on. If you've got any ideas, I'd be happy to hear them.

What can you do when the businesses own the lawmakers? Outside of violence I'm not sure exactly who has the power to get justice here.

I honestly think that criminally they are going to get a slap on the wrist if anything. The majority of damages will come from civil suits.

I do wonder if America will see some kind of Red Brigades armed political group in the coming decade. There's already an extensive armed rightwing political movement.

cynicism == obedience

Disagree. I think the examples in the grandparent comment are spot on.

You can be cynical of the government and the regulators and still do something about it. If you are a landlord and running a credit check don't use Equifax. Maybe this will open the door for startup in the space.

I agree completely. The only reason for this company to exist is to maintain the data that now is compromised. This company needs to be brought down as quickly as possible for everyone's safety, and the other two companies need to be seriously monitored.

Just directing it at Equifax is much too narrow, though. At the very, very least some legislation should come out of this mandating that ALL credit bureaus should allow credit freezes, at any time, for free.

The thing that really incenses me about this whole debacle is the system is designed to benefit from its own incompetence! All these "identity theft solutions" that the big credit bureaus provide are just a way to charge consumers more for a problem that the consumer had nothing to do with in the first place!

North Carolina already mandates free online security freezes with all credit bureaus. Now if only we can get this passed nationwide...

http://www.ncdoj.gov/freefreeze

It's (unfortunately) far more likely that they'll simply re-brand as something else. For all intents and purposes, Equifax will cease to exist; except it will be exactly the same thing under a different name.

For more than a decade, a debate has been going on in the Communications of the ACM (as well as other places, thats just where I've read of it most often). You can't make charges of negligence stick against companies using technology. There are no 'standard practices' they are negligent of following. If they were building a bridge, they would hire licensed certified engineers, and they would be legally bound to give those engineers access to the tools needed to do their job, the time needed to do the job correctly, and even if the CEO wanted to push the project forward despite misgivings of the engineers over safety, he would be legally forbidden to do so (and criminally personally culpable if he did).

The same is not true of software-driven systems. There are no licensed developers, no regulatory body determining what tools must be made available, no guarantee of primacy of technical engineering concerns over business management. If a software engineer says "it needs more testing" or even "there is a bug that will kill people" and the CEO says "ship it", it ships and the courts will do nothing. This was proven to be true even in cases where incompetent management results in bad software that gets people killed in the case against Toyota with their "unintended acceleration" due to a firmware bug that would have been caught immediately if the developers had static analysis tools.

Companies fight against the establishment of any sort of standards because it would reduce their profit margins. Developers fight against the establishment of any sort of standards because it would raise the barrier to entry in the field and no matter who the standards body consists of, they will select standards which people disagree with, they will be reluctant and slow to change or update them, etc. Both sides are right. But the alternative is companies having free reign up to and including incompetence of the degree which gets people killed with no accountability. People are overall very bad at decisions between two scenarios with clear negatives on both sides. They feel entitled to a 'clean' option and are uncomfortable with saying "I embrace the negatives and accept the burden of working hard to try to minimize their harm in order to gain the benefits of this option." Accepting the negatives implies taking some responsibility for bringing them to fruition and no one wants to be responsible for that - even if the alternative is worse. Not every decision is easy.

This is a "too big to fail" event. Getting rid of or changing Equifax would disrupt too many other businesses, therefore any wrongdoing of theirs will be waived away and the costs pushed onto consumers.

Equifax were already in the process of having the law rewritten in their favour by the Republican party, at least that might be derailed or delayed for a few years. https://www.americanbanker.com/news/equifax-breach-may-kill-...

There's some claims here about the history of Equifax as a form of legal redlining, but they're a bit hard to substantiate with simple googling: https://twitter.com/matthewstoller/status/906257077215133696

While I certainly agree in spirit, Equifax is, as has been said elsewhere, unfortunately too big to fail. Too much infrastructure has been built around it.

So, instead of dissolution, I propose two very reasonable remedies that I would consider the absolute minimum in concert with whatever fines and sanctions may be levied:

1. Credit freezes/unfreezes must be offered free in perpetuity. “They cost us money to perform” is not a remotely appropriate objection - offering this for free should be a basic cost of doing business in the credit reporting industry.

2. Affected individuals (everyone, basically) must be granted a minimum of 10 years of credit monitoring following the breach. One year is a free sample you get with a coupon code from a podcast. Furthermore, the service must not auto-renew at the end of the term: send users a security report and let them decide if they want to opt-in to continued monitoring after the term ends.

Why 10 years? I mean, I don't see how one could defend any term shorter than the term of the validity and danger of the information stolen. I won't get a new SSN in 10 years. I won't get a new name. All the information will persist and still be useful. I'm personally in a worse position as my information was part of the OPM breach years ago and even images of my fingerprints are in the wild. And I got 18 months of free credit monitoring out of it.

When a charge of more than $100 is made on my credit card, I get a text message instantly. When I log into my banks web system, I get a text message instantly. I was able to set those things up. I don't see why it would be unreasonable to have a similar thing set up so that I could be alerted every single time my credit history is queried with information about who is querying it for what purpose, ideally with the ability to block it by replying to the text message.

How do you get a text message when crims setup a new credit account in your name?

That's what the 10yr monitoring is for?

This is an Enron-level event. Company executives need to lose their fortunes and some people probably should end up in jail.

The department of justice should break them. This is their job.

But this is a government with a grifter at the top, so I have almost no confidence attorney general Sessions will investigate this seriously, let alone destroy the company. He very clearly enjoys targeting e.g. black people who smoke weed with incarceration, destroying their lives, than punishing Equifax's officers, board, or shareholders with destruction.

I have more confidence in a handful of state attorneys general working on this effort.

Agreed. At this point, the only sensible thing to do is to assume that Equifax is -- and perhaps has been -- compromised indefinitely. If not by external agents, then by internal incompetence or malfeasance. They've not clearly demonstrated either the intention or the ability to handle this breach in a diligent, professional, ethically sound way. To me, that calls into serious question their ability to embody those qualities in their operations before the breach as well.

> 0.134 BILLION

So 134 Million then. I mean that's still an extreme amount of bits ofc. Just seems silly to use the "billion" signifier for something that is less than 1 billion.

Likewise it'd be strange to call something "1000 milliunits" instead of just 1 unit. (Unless ofc milli happens to be the frame of reference for some obvious reason like "15 millunits of x is a deadly dose".)

This is stylistic. It's basically setting a scale factor for you, that this isn't a small breach, but a noticeable fraction of a billion. I could have written it as 1.34E+08 though fewer people would have understood this, though it would have been as correct. 134 Million is obviously "alot", though from a psychological perspective, the billion gets more attention than the million, even though the number isn't changing.

Again, stylistic.

He could have also said ~2% of the world's population.