News for hackers. Stuff that matters.
Re:I'm Testifying to Congress about Data Breaches – What Sho... by jackpirate on Tuesday November 21, 2017 @11:43PM (#15754293)
A potential downside to "entirely results-based" enforcement is that companies now have a negative incentive to monitor for and report data breaches.

Why install an intrusion detection system if it could potentially cost the company millions when it triggers? Better just to not know that data was exfiltrated. You don't even have to cover anything up if you never learn there was a problem to begin with.

Re:I'm Testifying to Congress about Data Breaches – What Sho... by saulrh on Wednesday November 22, 2017 @12:08AM (#15754407)
Twelve months ago I'd have called that a solved problem - c.f. entities like the EPA, OSHA, or NHTSA that conduct results-based inspections and investigations ("how much crap is actually in the water coming out of your pipes?", "was this injury/crash/accident a result of a violation") and come down on violators like a ton of bricks - but the suicide party is doing an excellent job of sabotaging our civilization's guardrails and sawing away at its fall-arrest lines.