News for hackers. Stuff that matters.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by fny on Tuesday October 03, 2017 @05:58PM (#15396583)
Using the black market as a standard, your identity-related information isn't worth enough to be taxable.[0][1][2]

The more common data you give away is worth even less. Your "gift" is akin to giving away a few grains of sand to a glassmaker who provides a free grain counting service.

Now let's say you dumped a lot sand that we could value at $10K. Any smart sand-counting glassmaker will claim his once "free" sand counting costs $10K, which amounts to an equal, zero-profit trade.

[0]: http://www.bankrate.com/finance/credit/what-your-identity-is...

[1]: https://qz.com/460482/heres-what-your-stolen-identity-goes-f...

[2]: http://www.businessinsider.com/heres-how-much-your-personal-...

Re:Yahoo Triples Estimate of Breached Accounts to 3B by soared on Tuesday October 03, 2017 @06:34PM (#15396773)
Value is derived from user data when its used to target ads. Black market data is never used for that purpose, so its value is much lower. (A company would never take the risk of using black market data)
Re:Yahoo Triples Estimate of Breached Accounts to 3B by fny on Wednesday October 04, 2017 @06:50AM (#15399521)
You (and every other responder) miss larger the point of my comment. Let's use Google as an example. Your clicks throughout the internet, like sand, don't amount to much of value. It's a very unrefined, raw material, with limited quantity. Even if Google were forced to value that raw material, they can argue they're trading it in equal exchange for whatever service they offer you, so there would still be no tax.

In any situation, potentially derived value is not taxable. A car is worth whatever a car was bought/sold for, not including some hypothetical such as whatever I could make by driving it for Uber/Lyft. What matter's here is what will actually occur in the transaction. If Equifax chooses to sell its data, that income will be taxed at whatever price Equifax chooses to sell the data.

Note this doesn't change that your "gift" of peanuts of data is not taxable because (a) your data alone isn't worth squat, (b) even if it was, you got something in exchange for it.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by notjoemama on Wednesday October 04, 2017 @12:27PM (#15401652)
I'll go one step further in saying the discussion framed around clicks being interpreted as a product is incorrect altogether. I think user metadata is part of a users identity and the friction we run up against is whether it ought to be legally protected. It's currently not illegal to sit outside a restaurant and records information about all of its patrons. You'd certainly be in hot water if you tried to do that at any federal building. At some level we know collecting that data is wrong because it can be used against us. Even the judicial branch knows this and requires the storage of user data to be encrypted by security agencies. That's not conclusive proof but evidence of our general outlook on the legality of tracking people.

If we agree in a truly free society then collecting and monetizing metadata should be illegal. If we don't mind giving up that freedom then there's nothing wrong with companies creating a profile on you and tracking you no matter where you go and what you do. But the internet has spoken and we're gladly, albeit unknowingly, giving up any right of protection. I find it worrisome to think of what society will be like in another 50 years if nothing is done to curtail the fleecing of user data.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by rhizome on Thursday October 05, 2017 @05:02PM (#15412564)
Aren't you describing the market research industry? Intent is the value, predicting intent is the goal.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by darkerside on Wednesday October 04, 2017 @07:54AM (#15399812)
Like data in general, user data is essentially worthless until aggregated en masse and refined into insights. But when you consider how much data companies are hoarding, it doesn't take much of an assessed value to create a nontrivial taxable asset.

Also, it doesn't matter that there's an exchange happening. Sales tax and income tax are assessed on fair exchanges of goods, services, and currency.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by fny on Wednesday October 04, 2017 @10:53AM (#15400867)
Sales tax isn't paid on trades. When you trade in a car for $2k off a $10k car, you only pay taxes on the difference: $8k.

And if you grow oranges on your property that you never sell, you never pay taxes on those oranges.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by panarky on Wednesday October 04, 2017 @11:13AM (#15401030)
Not in California.

If you accept a trade-in on the sale of a vehicle, the allowance for the trade-in cannot be excluded from the amount on which tax is based.

For example, if you sell a car for $20,000 and accept a trade-in valued at $4,000 as partial payment, tax is based on the $20,000 selling price.

Source: http://www.boe.ca.gov/pdf/pub34.pdf

Re:Yahoo Triples Estimate of Breached Accounts to 3B by fny on Thursday October 05, 2017 @02:38PM (#15411511)
I shouldn't have used vehicles since they are a special case in some states. At the federal level, taxes on barter income match my description. [0] Taxes are still zero if the company can claim the fair market value of the services they offer you equal the value of your clicks.

[0]: https://www.irs.gov/taxtopics/tc400/tc420

Re:Yahoo Triples Estimate of Breached Accounts to 3B by mkhalil on Wednesday October 04, 2017 @11:39AM (#15401255)
Never heard of this, probably because in my state it doesn't apply. In 42 out of the 50 states (excluding California, Hawaii, Kentucky, Maryland, Michigan, Montana and Virginia [Oregon has no sales Tax]) however, this does apply.

Still though, the example is a good one. You're trading your data for a service. There isn't anything to tax.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by BearGoesChirp on Wednesday October 04, 2017 @11:09AM (#15401005)
It isn't clear where the data comes from. A business in a non-US friendly jurisdiction can make an online business selling black market data in a way that looks legal to data warehouse groups who in turn sell it to the company using it. Once you get to the actual company using the data, there is no indication of it being black market data. The middle company, if it is buying enough data, only takes a few employees who care more about getting the data than verifying the ethics.

It's kind of like arguing a bank would never create fake accounts because the risk of doing so is too large.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by manigandham on Tuesday October 03, 2017 @07:19PM (#15397051)
Value is derived from the potential application of data. Ads as an application isn't worth much since you can still be shown ads just fine without any personal data targeting.

Black market data is worth way more because it's often more personal than just demographic markers and interests, and can potentially lead to large sums of money.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by lifeisstillgood on Tuesday October 03, 2017 @08:41PM (#15397471)
Personal information is less valuable on the black market due to the difficulty in monetising and extracting the cash. If I have your bank account login details I can move cash out of your bank, but almost no hope of sending cash from a U.K. Domestic savings account to my friendly philapines bank over the web UI. That's why Nigerian Princes still send out emails - the find the one idiot willing to walk into his bank and move the 5million that just arrived in his account

Alternatively you need real criminal gangs - dozens of people willing to walk up and down a London street withdrawing 5k at a time from a 1000 Pre-prepared cards and put the money in their rucksacks. They don't come cheap. And its still cash and still in the U.K.

Get Amazon to send you two dozen laptops to the same address with two dozen cards. All as "gifts". Yeah right. Now you gotta sell them - fences run at 10% if you are lucky.

The lowest effort are simple impersonation for loans, but still you have to take the money and move it somewhere. Into cash? Into the phillipines? See above problems. Open a credit card account? How to intercept it and the PIN number sent by post?

All in all, it's actually pretty darn hard to take personal details and monetise at the "real money" level. These things stop being scalable. You could probably fund a student lifestyle off any combination of the above but millions - not really.

Cf interesting Microsoft paper on this a few years back

Re:Yahoo Triples Estimate of Breached Accounts to 3B by manigandham on Tuesday October 03, 2017 @09:50PM (#15397721)
I guess we have nothing to worry about with all these data breaches then, right? Might as well tell equifax that it’s no big deal too.

These criminals trade data because it makes them money, otherwise there wouldn’t be much of a makrket.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by _jal on Tuesday October 03, 2017 @10:59PM (#15397989)
You're correct, of course, but missing the implications raised by the parent poster, and they are important.

Sensitive personal data is necessary but not sufficient to rip someone off. And if you want to try to make a living ripping people off, there is even more business overhead, making the cost of sensitive personal data an even smaller portion of overall operational costs.

From the point of view of the thief, our personal data is a vital but cheap input into an operation that tends to have very high security costs, viciously expensive liquidity issues and terrible personnel problems, among other more quotidian business headaches.[1]

I suggest trying to think like a crook now and then. Trying to try on other people's lives is a useful way of shaking up one's thinking habits, empathy (don't confuse with sympathy) is always useful, and it can help you keep yourself more secure.

[1] I am leaving out things like several potential fates far worse than bankruptcy and related issues because they aren't opex-related, but they probably do effect retirement planning.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by midwife_cry_sys on Wednesday October 04, 2017 @07:14AM (#15399644)
The black market value is like 10-$15 dollars for a basic credit card number I believe. But gold cards and plat cards can be several times more. But drivers ID and ss# that's worth way more for what I believe are obvious reasons. My prices might be a little off, haven't checked in ages. You get the idea. Say 130 million cards at $10 each. Isn't that almost one and a half billion. Not chump change. Ad
Re:Yahoo Triples Estimate of Breached Accounts to 3B by soared on Tuesday October 03, 2017 @08:34PM (#15397443)
Well no that's incorrect. A targeted ad is worth significantly more than one without targeting. I buy ads at a $0.25 cpm and a $40 cpm, the only difference is targeting data.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by fny on Wednesday October 04, 2017 @06:53AM (#15399544)
It still holds the data alone isn't worth much. If you've built an ad platform with customers, reach, and the ability to target people given data, then sure, you can convert that raw material into something more valuable. And once you sell the derived product (ads), you'll be taxed on your income.

I feel like you're arguing that dirt is worth as much as the farm that one could build with it.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by manigandham on Tuesday October 03, 2017 @09:46PM (#15397698)
You can still show the ads and there are a lot of other signals and context to use. Also other than Facebook or google with strong identity, 3rd party data on the open web is next to useless. If you’re paying $40cpm for data, you’re getting ripped off.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by soared on Tuesday October 03, 2017 @10:24PM (#15397838)
Sorry to be that guy, but: I spend over $5m a year on rtb ads. I literally spend 50 hours a week doing this. If the money I spend doesn't produce verifiable results, I lose it.

For example, that 40cpm is to reach a pool of <1000 users who are in charge of purchasing for networks of hospitals, and my ads are for MRI machines. 3rd party data is unbelievably valuable, probably $1.5 million of my budget goes to data costs alone.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by manigandham on Wednesday October 04, 2017 @06:53AM (#15399540)
That doesn't add up. I've managed budgets a magnitude higher, know the founders of every major SSP and DMP, and now specialize in B2B marketing for F1000 companies with long sales cycles. If you're really trying to reach a pool that small, open web advertising is incredibly inefficient.

This is well understood by the adtech community and even the flashy new "ABM" companies will tell you the same. 3rd party data is universally terrible. At best, it'll work at scale (of millions) on general demographic details but will definitely not recognize 1000 people on the open web.

That kind of list might work on Linkedin or Facebook with email targeting but it would be easier to focus on niche trade sites without any data, or just use a direct sales team. That $1.5M in data you're paying for would have much better ROI with a good VP of sales.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by erik_seaberg on Wednesday October 04, 2017 @03:02AM (#15398756)
They're swayed by ads? I'm surprised they don't need to do a formal RFP among the handful of companies who can make an MRI certified for medical use.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by willvarfar on Wednesday October 04, 2017 @04:01AM (#15398943)
The targeted viewer may see the ad and start thinking "we need a better modern MRI with whatever fancy feature I read about here" or "we could hire a new MRI from xyz cheaper than our current contract!".

Sometimes you can prod your potential customers into action.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by yread on Wednesday October 04, 2017 @03:23AM (#15398833)
Who do you send the RFP to?
Re:Yahoo Triples Estimate of Breached Accounts to 3B by lostlogin on Thursday October 05, 2017 @02:32PM (#15411460)
That anyone would be influenced in what MR scanner they buy due to Facebook advert is amazing. It would also explain things I hear from radiographers overseas. Wow. Are you able to state which vendors buy Facebook adverts (I assume you can’t)?
Re:Yahoo Triples Estimate of Breached Accounts to 3B by robertlagrant on Wednesday October 04, 2017 @02:11AM (#15398602)
Might be better off spending £5k+ on personal gifts for each decision maker than bothering with Web advertising if it's that few people you're targeting :-)
Re:Yahoo Triples Estimate of Breached Accounts to 3B by ben_w on Wednesday October 04, 2017 @02:46AM (#15398712)
I may not be a lawyer, but gifts of $5k to induce someone to purchase a thing for their workplace feels like it should count as corruption and bribery.

If someone tried to do that to me, I’d report the attempt to the company lawyer, and I’d doubt the quality of the thing they were selling was as good as the quality of the thing the other poster was advertising.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by manigandham on Wednesday October 04, 2017 @07:15AM (#15399645)
Welcome to the advertising industry. You'd be surprised what goes on when media buyers control so much money. There are 20 year old planners with control of 7+ figure budgets for major brands - you can bet they're getting plenty of gifts.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by sirk390 on Wednesday October 04, 2017 @04:37AM (#15399053)
5k+ per person would be bribery. I hope he meant 5k in total..., 1000 gifts of 5$ would be ok
Re:Yahoo Triples Estimate of Breached Accounts to 3B by midwife_cry_sys on Wednesday October 04, 2017 @07:03AM (#15399593)
I'm sure he meant what he said. Do the math. He was trying to point out that it would cost the same either way. But if you give the mark the money, it would have a much greater effect than 5k on silly web adds.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by diN0bot on Wednesday October 04, 2017 @05:01AM (#15399120)
what about a $5k rebate or discount?
Re:Yahoo Triples Estimate of Breached Accounts to 3B by ben_w on Wednesday October 04, 2017 @06:32AM (#15399448)
Difficult to say. My mental framing has, as a result of my previous post, become “be suspicious”.
[dead]
Re:Yahoo Triples Estimate of Breached Accounts to 3B by zentiggr on Wednesday October 04, 2017 @08:02AM (#15399848)
That honestly sounds borderline mafia or cartel style... "We're going to bribe you, you're going to take it, and since we all know it's illegal, you're on the hook with us all. Welcome to the game kid."
Re:Yahoo Triples Estimate of Breached Accounts to 3B by ben_w on Wednesday October 04, 2017 @08:26AM (#15399944)
If I’m ever in a position to be worth anyone trying to bribe me, I’ll try to make sure nobody is in a position to threaten me like that.

Fortunately for me, I don’t control any budgets.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by Spooky23 on Wednesday October 04, 2017 @06:30AM (#15399436)
In the old days, you would do that.

Now that’s not allowed in most places, plus you need to hire fancy salespeople to deliver those gifts.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by rhizome on Thursday October 05, 2017 @05:01PM (#15412556)
A company would never take the risk of using black market data

I bet LinkedIn does.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by rhizome on Tuesday October 03, 2017 @06:59PM (#15396938)
"None of us is as [valuable] as all of us," is a saying that has been around for decades, surely there are business rules that have cropped up to support a valuation of this scenario in the meantime.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by fny on Wednesday October 04, 2017 @06:30AM (#15399438)
I'm not saying anything different. Whenever a business/individual sells information at a value, they'll be taxed on the sale, just like anything else. OP mentioned selling a cars worth of his own data, which doesn't exist.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by bendews on Tuesday October 03, 2017 @06:05PM (#15396621)
It is when you have 3B records
Re:Yahoo Triples Estimate of Breached Accounts to 3B by fny on Tuesday October 03, 2017 @06:14PM (#15396669)
If one company sells anything to another company, that sale is taxed as income like any other sale. So yes, if Yahoo sold 3B records, that would be taxed, and the recipient company can choose to book that purchase as an asset on their balance sheet and will likely expense the purchase. Hell they could even choose to depreciate the value too for as long as they follow GAAP.

OP mentioned his data alone, which isn't worth squat unless the transaction says otherwise. Meaning, if OP sold his data to a company for a taxable amount, he would be taxed on that income.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by katastic on Wednesday October 04, 2017 @12:13PM (#15401548)
I think you have it backwards...

Wouldn't black market identities be worth MORE if they weren't so easy to get?

So the more we tax / regulate it, the harder it is, the more valuable they get. Win-win for everyone.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by fny on Thursday October 05, 2017 @02:25PM (#15411400)
> Wouldn't black market identities be worth MORE if they weren't so easy to get?

No. It's already illegal to buy and sell identities, so black market demand for identities is likely at a maximum already. I'm just using that number as a proxy for what your clicks on the internet must be worth. I'm basically making the assumption that Value(Clicks) < Value(Black Market Identity), which I'd say is a fair bet.

> So the more we tax / regulate it, the harder it is, the more valuable they get. Win-win for everyone.

Again, this wouldn't be true for black market identities, but let's look at clicks.

What I'm saying is that the click you give a way is worth too little to be taxed at all.

Say 1M click data points is worth $1K (which I think is still very generous given the amount of noise) that means each click is worth 1/10¢. Any company that sells the 1M clicks to another company will pay taxes on the $1K of income. So if you increased taxes, you would discourage them from selling your data to another company. This doesn't change your behavior though as a consumer. You still give away an untaxable 1 click at a time (1/10¢): which is not taxable as a gift because of the size of the amount (even 1K clicks is only $1) and because the company can easily argue they provided you with a service in exchange for that 1/10¢.

What you're looking for is a way to penalize companies for receiving data (i.e. for every data point you gain, you owe some $x in taxes.) This would need to be legislated since that's not currently how tax law works.