Oh, interesting! I was a Sr. Software consultant for Starwood back in the day. They had an interesting, grandfathered, tax scheme that allowed for insane growth. Anyway, I wrote the Sales Management and Revenue Tracking System (their name, I pushed for Revenue Tracking For Management) that helped them to prioritize and track rates across all their properties in the mid-90s.

Got close to pushing them to a centralized database (instead of the per-property Access database), but left before we could finalize that project. Ugh, and the reports I had to design... they wanted smaller than 7 point font on legal paper that would then be faxed. Every property would fax quarterly reports generated by my software for board review.

Interesting times.

That's a really good point, Marriott just had an unlucky purchase.

That being said, between the recent Google+ breaches, to the older Target breaches, it increasingly feels like I'm flipping a coin when I trust companies with data.

Based on Marriott's handling of this breach, they seem to be decent at security. But I don't know how as a consumer I could tell that in advance of all of this.

> Marriott just had an unlucky purchase

M&A is a culprit in no small number of these cases, so let's be crystal clear: M&A does not absolve anyone of responsibility. Let me know when the underwriting bankers have their bonuses garnished for lack of due diligence, and then you can tell me about how "it wasn't actually Marriott that had the data breach". Let's say it loudly and clearly: no, it was Marriott that had the data breach.

Eh. The breach happened before Marriott had any control or agency to stop it. Their due diligence in buying the company wouldn't have protected any consumers, it would have just meant the breach was someone else's problem. My understanding (of course, correct me if I'm wrong) is actually that their purchase is the reason the breach was disclosed -- Marriott buying the company and doing its own internal audit on their systems is why we know about it now.

So I don't actually feel a ton of ill will to them, even though I agree that doesn't absolve them of the fact that they bought it, and it is now very much their problem to deal with. It may not be your fault that the puppy that you bought isn't house trained, but I'm still not going to clean your carpet for you.

Having said that, this kind of underscores what I was talking about above. If Marriott themselves couldn't tell in advance that the company they were buying was an insecure liability, how the heck am I supposed to be able to tell?

If it's not feasible for a company like Marriott or Verizon to know in advance of an acquisition which companies are secure and which companies aren't, consumers have no chance. There's no feasible way for a consumer to protect themselves in that world.

> The breach happened before Marriott had any control or agency to stop it.

Strongly disagree, this is playing with variables.

Marriott2016 + Starwood2016 = Marriott2017.

Marriott, the present day company, absolutely includes the company that had the "control or agency to stop it".

> it would have just meant the breach was someone else's problem

This isn't a wash. Tort is only effective if the party responsible gets punished, so it's very important which party gets punished. If Marriott had discovered the breach in due diligence, the Starwood investors' payout would have taken a big hit.

As it happens, there's two behaviors that need to be disincentivized: Starwood designed faulty systems, and pawned off its ramshackle legacy crap to the highest bidder; and Marriott2016 (much like Equifax) glommed together so many legacy systems that the likelihood of breach intensified (though to Marriott's credit, the attack doesn't seem to have escalated out of the former Starwood into the parent systems. I'd still like to see steep fines imposed, but way smaller than on Equifax, proportional to that contained scope).

The penalty on Marriott2017 should be steep enough to encourage future buyers to step up their due diligence enough to put the acquiree's payout at risk, while also rewarding Marriott for catching the leak before escalation.

> It may not be your fault that the puppy that you bought isn't house trained, but I'm still not going to clean your carpet for you.

I like your analogy a lot.

> Marriott2016 + Starwood2016 = Marriott2017.

This is a good point that I wasn't considering. It's not like Starwood vanished when it got acquired. It's still there, it just got rolled up into Marriott. So even if I wasn't mad at Marriott2016, most of the people who I am mad at are currently working at Marriott2017.

> Starwood designed faulty systems, and pawned off its ramshackle legacy crap to the highest bidder

Also agreed on penalties, and that's a good way of phrasing the problem. I don't think that Marriott should be let off the hook for having to deal with the breach. And while I've been trying not to criticize their security response, their social response has basically been, "look over there, free credit monitoring," which is clearly insufficient.

Maybe this is going to become a thing for future buy outs. Not only do the accounts have to dig into the financing and books, but the IT forensics teams will need to look for any unknown hack liabilities. If a hack is found, then the sale doesn't have to go through. Of course, the hack should have to be disclosed.

Won't happen if the incentives aren't there.

Wouldn't the incentive be to not have to take on the liability for it? Then again, if all a major breach results in a slap on the wrist, then I guess there's no real liability. Maybe you're right.

Exactly. I think we're in agreement.

You are 100%, and it's not just the data we provide to companies we buy products from. I got snail mail last week from an employer I haven't worked for in almost 3 years that said an administrator accidentally sent a mass email to a few thousand individuals with my bank account information, and the bank account information of everyone that was on that email chain (and I'm assuming a few other prior employees). WTF.

Is that not just a matter of Marriott failing to do their due diligence? How does buying an incompetent company absolve you from responsibility?

It doesn't absolve you from responsibility for the harms done as a result of an action and for the financial liabilities that follow from that. But if we as engineers are evaluating the competence of an organization, it does mean that "Marriott was incompetent at security" is false.