I'm Testifying to Congress about Data Breaches – What Should I Say?

Re:I'm Testifying to Congress about Data Breaches – What Sho... by ars on Tuesday November 21, 2017 @05:30PM (#15752231)

> Covering up data breaches should be straight-up illegal, as in prison time.

Is it also illegal to cause a breach? Do you understand the backwards motivations you are giving people?

He can disclose the breach, cause himself (or his co-workers) to risk prison, and cost his company $$$$, which is likely to get people fired.

Or,

Cover the whole thing up (i.e. quietly fix the bug), and no one will ever know.

And if they do find out, he can say "I didn't know anything about a breach, I proactively fixed a bug, I didn't realize someone had taken advantage of the bug" - i.e. he's safe either way.

[ Parent | on HN ]

Re:I'm Testifying to Congress about Data Breaches – What Sho... by jakelazaroff on Tuesday November 21, 2017 @06:11PM (#15752566)

There are two separate infractions here that shouldn't be conflated: allowing a data breach to occur, and failing to disclose a breach.

As far as I can tell, the perverse incentive you're describing is that the if the penalty for a breach occurring is too harsh, it could lead companies to cover up a breach rather than disclose it. A penalty for failing to disclose a breach would be meant to discourage that, and I don't see how that penalty is itself a perverse incentive.

The penalty for a data breach must be harsh enough that it would cost a company more than it would to guard against it. I don't believe that there exists a penalty that satisfies that condition yet is also light enough that a company wouldn't cover up any breaches that occurred.

[ Parent | on HN ]

Re:I'm Testifying to Congress about Data Breaches – What Sho... by simcop2387 on Tuesday November 21, 2017 @06:38PM (#15752775)

Triple the fines in the event of a coverup would probably help too.

[ Parent | on HN ]