News for hackers. Stuff that matters.
Re:Equifax C.E.O. Richard Smith Retires After Huge Data Breach by bradleyjg on Tuesday September 26, 2017 @11:53AM (#15339743)
> but someone should still be motivated to go after me civilly for that.

In most (all?) other developed nations it is the role of the executive branch of the elected government to regulate and punish businesses so as to prevent defuse harms. This business with the civil justice system being distorted to create self appointed, profit seeking, ad hoc regulators is not the only way to skin the cat.

Re:Equifax C.E.O. Richard Smith Retires After Huge Data Breach by MarkPNeyer on Tuesday September 26, 2017 @12:50PM (#15340391)
Seconding this here.

If the state isn't going to prosecute big businesses for misbehaving, say goodbye to _any_ public support for business at all, small or bit.

There was a philosophy that said, 'markets are important, so when a big player misbehaves, make sure the state his them HARD, otherwise people will lose faith in the markets'

Now the prevailing attitude is 'these people can't be allowed to fail or the whole system will fall down.' And then, to nobody's surprise, they misbehave.

Re:Equifax C.E.O. Richard Smith Retires After Huge Data Breach by dokein on Tuesday September 26, 2017 @01:56PM (#15341039)
There are lawyers that actively search for businesses misbehavior in order to bring forward class action suits. In this scenario, the bigger the misbehavior (financially) the greater the incentive, independent of the magnitude of harm on the individual scale, i.e. you’re not dependent on someone being harmed enough to want to report to authorities. That strikes me as a market behavior that’s fairly well-aligned with the optimal behavior.

As to the question of criminal prosecution or harsher penalties (e.g. dissolving the corporation): to my knowledge, these suits actually draw AG attention to areas of civil misbehavior which often borders criminal misbehavior. They even surface which citizens were harmed and bring forth information gained by discovery, etc. Thus class action lawsuits actually make it easier for the government to act — that they should prosecute but do not is an independent problem.

Re:Equifax C.E.O. Richard Smith Retires After Huge Data Breach by jaggederest on Tuesday September 26, 2017 @02:50PM (#15341499)
> They even surface which citizens were harmed and bring forth information gained by discovery, etc.

I'm not sure, but is civil disclosure readily accessible to prosecutors? I thought normally it was kept confidential, and thus would only be available in the case of an active criminal case. I would expect that prosecutors wouldn't be able to trawl through it searching for evidence of wrongdoing, and there's some procedure around that in parallel construction, but I'm not a lawyer and I can't find any specific discussion of that matter particularly.

Re:Equifax C.E.O. Richard Smith Retires After Huge Data Breach by JoshTriplett on Tuesday September 26, 2017 @02:53PM (#15341519)
> If the state isn't going to prosecute big businesses for misbehaving

Under what law?

If there's some specific law they violated, then by all means, prosecute them. But you can't post-facto say "that seems like it was wrong" and prosecute; you can only say "we should pass laws to make that wrong in the future" and prosecute further offenders.

(For instance, they clearly violated insider trading laws. But what other laws, actually written and on the books, did they violate?)

Re:Equifax C.E.O. Richard Smith Retires After Huge Data Breach by BearGoesChirp on Tuesday September 26, 2017 @03:51PM (#15341967)
> But you can't post-facto say "that seems like it was wrong" and prosecute

We can and we have. There are a few justification loopholes that have been used in the past, but we can say something is so wrong that laws can be passed after the fact to punish people engaging in it. This power is dangerous, but so is many other government powers currently used.

Re:Equifax C.E.O. Richard Smith Retires After Huge Data Breach by JoshTriplett on Tuesday September 26, 2017 @04:38PM (#15342299)
> We can and we have.

Perhaps in another jurisdiction, but not in the US you can't. https://en.wikipedia.org/wiki/Ex_post_facto_law

It's a fundamental premise that you can't decide something formerly legal is illegal after the fact and go after someone retroactively. (Now, if they're still doing it, you can, which is also deeply abusable, but marginally less so.)

Re:Equifax C.E.O. Richard Smith Retires After Huge Data Breach by BearGoesChirp on Wednesday September 27, 2017 @09:01AM (#15347321)
>Perhaps in another jurisdiction, but not in the US you can't.

Yes you can. Even if there are rules banning it, like any system made by humans, exceptions are made when they are popular enough (or when the target is unpopular enough). In the US in particular, the way exceptions are made is to consider the punishments not being punishments. So while this does mean that extra prison time can't be used, things like indefinite involuntary commitment or extensions of no punishment actions are allowed. One example is extensions of time on the SOR, which has been ruled to not violate ex post facto even when the extension happens after the sentence has been given.

As I said, we can and we do. We just play creatively at it so we can pretend we don't violate ex post facto.

Re:Equifax C.E.O. Richard Smith Retires After Huge Data Breach by rz2k on Tuesday September 26, 2017 @01:54PM (#15341012)
Regardless of whether it is the optimal system for encouraging liability minimizing practices, other developed countries have found a perfect mechanism either.

American owners of diesel VWs might have their cars bought back from them and be offered up to $10k in additional compensation. Furthermore VW has portrayed this as an obvious decision they made because they love their customers and want to make things right again.

The same customers in Germany might get a free "upgrade" at the dealership which reduces airflow so that the car is compliant with pollution regulations, but less powerful.

Re:Equifax C.E.O. Richard Smith Retires After Huge Data Breach by bradleyjg on Tuesday September 26, 2017 @02:14PM (#15341212)
You don't need American style, lawyer dominated, opt-out class actions in order to right a wrong that caused $10k in damages to each consumer. You could use regular old joinder.
Re:Equifax C.E.O. Richard Smith Retires After Huge Data Breach by pdabbadabba on Tuesday September 26, 2017 @03:44PM (#15341919)
How does joinder solve the problem? You still need to motivate all those individual plaintiffs to hire a lawyer and sue, then get a court to join each one (with, presumably, opposition from the defendant every time), and then you don't have the benefit of the streamlined class action procedural rules (streamlined relative to a case with several thousand individual plaintiffs, that is). And you still have to pay the lawyers!

I'm not here to say that class actions are the best, or even a good way of regulating, but I really don't see how the joinder rules offer a useful solution.

Re:Equifax C.E.O. Richard Smith Retires After Huge Data Breach by bradleyjg on Tuesday September 26, 2017 @04:31PM (#15342247)
I don't think the situation described by rz2k is a problem of regulating. The problem he points out is not that Germany didn't sufficiently punish Volkswagen -- though it might not have -- but that the hurt German consumers were not made whole.

In terms of being made whole for a substantial tort (on the order of $10k) I don't think standard american tort litigation with joinder is perfect, but I think it is a better base to build upon than rule 23 litigation. With injuries of that size I think it is practical and desirable for cases to be client driven rather than hoping a judge reviewing a settlement will adequately protect the interest of the class as against those of class counsel.