> Also, if you try to kill Equifax, companies will stop reporting breaches.

Equifax is a special case though. It isn't Equifax that needs to be killed, it's the concept of credit reporting agencies in general -- they inherently constitute systemic risk. The more private information is concentrated in one place, the more attractive a target it creates for attackers and the more severe the consequences of a breach.

We need to figure out a way to make data warehousing operations like this impractical so these dangerous targets no longer exist.

One good step would be to prohibit the use of social security numbers for anything other than social security.

> One good step would be to prohibit the use of social security numbers for anything other than social security.

That's already true, it's just ignored and not enforced.

> That's already true, it's just ignored and not enforced.

That should make it easier to start punishing people for doing it then.

Even if the penalty was only a $100 fine, multiply that by 320 million counts and it turns into real money.

> Also, if you try to kill Equifax, companies will stop reporting breaches.

The breach is not why I want the Equifax CEO (and everyone on the board) to go to prison. I want them to go to prison because of what they did and didn't do after the breach. The CEO is at best incompetent but that is a very generous reading of what took place.

> Also, if you try to kill Equifax, companies will stop reporting breaches.

The US government killed Arthur Andersen. Financial fraud is still reported. Equifax is not too big to dissolve.

https://en.wikipedia.org/wiki/Arthur_Andersen#Enron_scandal

Many reasonable people seem to believe that the backlash and horror inm response to the US government killing of Arthur Andersen and the subsequent job losses were what led to the later toothless reactions by the DoJ to subsequent corporate scandals:

http://www.npr.org/2017/07/11/536642560/is-the-justice-depar...

http://www.slate.com/articles/podcasts/slate_money/2017/07/t...

https://www.amazon.com/Chickenshit-Club-Justice-Department-C...

I mean this entirely seriously: perhaps its time we be less reasonable people.

Do you have any problem with the concept of credit bureaus, and is it possible that it's influencing your reaction?

edit: also, so this is topical, the CEO is clearly incorrect. Even if one employee were somehow responsible for the unpatched version of struts being present on a particular system, there is guilt by omission/neglect for at least 1) poor secure enclave design (attackers getting access to the system, degree of access that system had, lack of partitioning of sensitive data) 2) lack/deficiency of red team/pen testing 3) lack of process in static scanning of deployed code.. it goes on. As someone noted, seems like negligent process given the degree they were a target. Granted, I'm going off the publicly disclosed information, so who knows..

No problem with the concept, only the execution. If you can't secure the data, you don't get the data (by law). That simple.

This is Econ 101 (incentives matter). If you do not penalize negative behavior, there is no reason for it not to continue.

Those security vulnerability notifications should've gone into a tool to be actioned by a team (JIRA, PagerDuty, whatever) with follow up and verification (audit logs from their CICD pipeline confirming a patched version had been deployed to all environments dev through prod); that's an organizational and leadership failure, which should have consequences.

Disclaimer: I work in the financial services industry in security, but not CRAs.

EDIT: Agree with your assessment edit, its a total failure of risk management within the org. Again, you need dire consequences when that occurs.

I think someone else commenting on this story correctly noted that penalties create a reverse incentive for disclosure, and there could be negative externalities in that incentive structure (to riff on the Econ 101 them). Since you are in the field, have you heard if it was confirmed vector of CVE-2017-5638? I have heard so little confirmation/attribution here... it's really hard to attribute how much was negligence without knowing how long the attackers were present, how many systems were compromised. I added a comment (I think) before your reply that generally agrees that this had to be a systemic failure on several levels. I still struggle with the fact that on some level Equifax were the victims of a criminal action, though.

EDIT: hoping to do this quickly to avoid comment/edit race conditions, but I wish I knew the right answer in re. penalties. Think about the system that exists with doctors, malpractice insurance industry, medical liability, review boards and the benefits society gets from transparent disclosure from reviews of medical errors. Honestly, short of jailing people, it's hard to see how criminal liability in this case could be worse than potential civil liability.

Maybe or maybe not. What if employees could blow the whistle on negligent handling of user's data, and even get some kind of whistle-blower reward for it? This would strongly encourage companies to keep their houses in order, I imagine.

BS they already only report breaches when required by Law.

*and caught red-handed.

...years later.

Jail would be a leap. Has a company ever had to pay a financial penalty for neglent handling of customer information?