Just a thought, but you don’t store them in an unprotected S3 bucket.

If you’re required to handle this kind of sensitive information — for any purpose, but I would say this is even more true for anything tied to anything of a sexual nature or anything tied to health — you should take every precaution that that information is secure, encrypted when possible, and that your systems are regularly audited for vulnerabilities.

If the onus of properly protecting sensitive data — whether you’re legally required to hold it or not — is too much or too expensive, you shouldn’t be in that type of business. Period.

Until companies are made to feel the pain of data leaks, they won't bother.

It's a porn company, not a bank or other "respectable" business, so it's possible that they could actually face consequences.

And to counter that, the victims are porn actors/actresses, so the perpetrators probably won't face consequences for it.

I'd like to /s this comment, but I'm not sure I can.

I can chime in one as I was a systems administrator for one of those shady “Get sex tonight” dating websites.

The law of having to hold the identification of the models is pretty much the only law you need to uphold. These sites are created from shills of shells.

You have one company, from there you then have two or three other companies which create white label brands utilising one of the shell companies.

So the brand “bangshelia” would be registered with a shell company “adult dating world”. This brand would then be bought by a shill and branded as “purple dating” but registered by a company called “dating purple”.

You would then affiliate with “adult dating tonight” where they would provide the data for your brand.

To get anywhere near close to chasing the company, you need to launch a lawsuit against the active site, (the company registered to) and then the company behind that and from that the company providing the database. Which all costs money.

As my CEO did, you pack up shop on one of those brands and rebrand yourself. Claim your not associated to the previous company by registering another director.

There are no resources available to attempt to make anything secure. The website of the company I used to work for kept all passwords in plain text in a database that was accessible online publicly for other affiliates to borrow to create their own “brand”.

It took me a couple reads, but do you mean "shell" (as in a shell company that does nothing but exist to protect or obscure the operations of another company) instead of "shill" (a person who markets for someone while hiding that they are associated with them)?

Sorry about that, I’ve rehashed what I wrote and should now make more sense.

It’s shill of shells. The CEO makes one company, another “investor” buys a brand of the original company and registers it in their name and then sells that on.

The Experian settlement pretty well solidified security as a waste of money.

I watched "Laundromat" (*movie about the Panama Papers), towards the end of the movie, Antonio Banderas says: "In... In retrospect, uh... I think we... we could have spent more on cyber-security."

> Just a thought, but you don’t store them in an unprotected S3 bucket.

> If you’re required to handle this kind of sensitive information ... you should take every precaution that that information is secure, encrypted when possible, and that your systems are regularly audited for vulnerabilities.

None of that solves the problem, though.

You can protect an S3 bucket, but anyone who wants it simply checks it periodically.

Then one day someone is working with the data and changes the permissions to get access, and before they know it, it's downloaded in minutes. It just takes one attacker to get lucky and catch it before your audits do.

And S3 is not unusual, it's just an Internet service like any other, they all have this problem. Even if you have your own data center on a private network, it's only private until someone needs to transmit something and opens a route.

It's ultimately a human problem, there's no magic that can prevent it.

> If the onus ... you shouldn’t be in that type of business. Period.

Ending an unjustified opinion with "period" highlights the fact that you didn't justify the opinion. And it sounds fatuous.

If you're changing the permissions to public just to work with the data, there's your problem. Proper access policies solves all of this - the bucket should never have had public access enabled in the first place as there is literally zero need for it, just sloppy work.

> Just a thought, but you don’t store them in an unprotected S3 bucket.

That's pretty much a good rule of thumb for, well, everything.

(Sure, there are exceptions. But, there's a reason AWS not only doesn't enable public access to buckets by default, but actually by default has superceding policies in place which block setting normal policies to allow public access; it's almost always the wrong choice.)

I had never anything to do with this topic and have no expertise in legal topics but it sounds like you are referring to the Child Protection and Obscenity Enforcement Act [1]. I didn't read the entire thing but just searched for parts talking about keeping records, mostly § 75.2 [2]. Maybe I am interpreting the letters of the law a bit naively but I can not find anything that would require keeping this information anywhere close to the servers used for streaming. Quite to the contrary, it seems to me that you could keep the required records on paper if you wanted to - more or less a copy of the ID, name and aliases used by the performer, and a list of works the performer appears in, for example the URL a stream is available at. But maybe I missed something important.

[1] https://en.wikipedia.org/wiki/Child_Protection_and_Obscenity...

[2] https://www.law.cornell.edu/cfr/text/28/75.2

A file-cabinet next to the server?

There are rules on how the information has to be indexed and cross referenced; while you might be able to design a system of electronic-beside-hardcopy records that you could make a plausible argument for meeting all of the requirements, it's straightforward to do it if your data and media are in the same electronic system.

Considering that getting it wrong is a federal felony, the incentive set by the law is clear even if, arguably, unintended.

> Considering that getting it wrong is a federal felony, the incentive set by the law is clear even if, arguably, unintended.

I don’t think you’re wrong, but I would argue that if getting it wrong is a felony, not properly protecting the data should be a felony as well. I realize it isn’t, but incidents like this showcase just how poorly the laws around this type of thing are written. If you can’t properly protect the data, you shouldn’t be in this type of business.

Of course, in this case, this is a site registered in Andorra. So who even know what those laws required in the first place.

> I don’t think you’re wrong, but I would argue that if getting it wrong is a felony, not properly protecting the data should be a felony as well.

It probably should be; I suspect that it's not because making involvement in porn risky for adult participants (and thereby discouraging it), while not the central focus of the law, isn't actually undesirable to lawmakers.

> Of course, in this case, this is a site registered in Andorra. So who even know what those laws required in the first place.

My understanding is that the US applies it's rules to anything of an adult nature sold into or among the US states, regardless of origin, though in practice applying it to foreign entities with little US exposure is difficult; but certainly it wouldn't be the only law that applies, to the extent it might apply.

Eh, maybe it's irresponsible but I don't think that it needs to be a felony or that those people shouldn't be in business. People just shouldn't expect every shady website to have perfect data practices.

You shouldn’t need to ask if your employer is shady — and even then because it isn’t shady, not because someone tells you afterwards that it should’ve been obvious to you that it was bad before you started.

Sure, but that doesn't mean that because some data got leaked that it should be a felony.

Not being a legal scholar, I won’t make a distinction between felony and misdemeanor.

What I will say is that just as computers are a force-multipler for getting important stuff done, they are also a force-multiplier for causing harm. As the old saying goes: “to er is human, to really foul up requires a computer”.

This leak did not endanger just one or two people, which would be bad enough, but 4000. Even if the remedy is limited to a fine sufficient for each affected person to change their names and address, it is still a more serious harm than almost anything normal intuition will help with because of how many were involved.

I wish that being in the sex industry was socially neutral for men and women and that nobody would be assaulted or insulted for it. I don’t know why that isn’t the case already, but I do recognise that it isn’t — and given that it isn’t, this leak is still extremely likely to result in someone getting hurt.

Also not being a legal scholar, the distinction being that a felony is a much more serious crime and lands people in jail for long periods of time. Which is why I think this could be an over reaction when a data leak may possibly be a mistake or ignorance. I understand that the nature of the data may be sensitive, but I don't think it makes sense to ham handedly punish people for something they aren't directly responsible for. Like someone being hypothetically hurt by someone else because of a data leak they may not even have known about.

I strongly disagree. I’d expect the shadiest of shady websites to have the best security, but as demonstrated, the people that scooped up tonnes of my financial history without my permission, then charge me for access, and sell that data to other financial institutions that use that data to determine my access to credit, not only have terrible security, but aren’t really punished for it either.

I would love to implement an extreme version of this, where each night a cron job runs that prints directly into a slot of a locked box

Any time human labor is involved, that makes the startup less valuable to VC.

Anytime human labour that is required is ignored that makes the startup more deceptively attractive to VC - and may end up bordering on fraud if done with intent.

Fraud and the rule of law don't seem to factor into VC calculations lately.

Well, they do, just sometimes fraud positively and the rule of law negatively, instead of vice-versa.

In principle this problem should be solvable with a zero-knowledge proof system.

The law should allow for schemes that prove a performer is legal, identified, etc., but that don't keep individual private details. Even if the site was completely compromised, all the attackers would gain is a single bit of data on each performer. The data would be worthless for personal identification

Yeah the law (for very good reason) is made in a way that you can never hide behind "i don't have it now / it's not here / it wasn't me at the time", but in the day and age of live streaming and data leaks that's basically a matter of time until such leaks happen.

Store enough image data (e.g. the entire video archive) to do the mapping plus the user ID on the server.

Store all the identifying data they need to hold onto for compliance purposes plus the user ID in offline storage.

You store them wherever you like, encrypted with a public key. The important thing is the decryption key, which never has to leave the airgapped laptop or the printout in a vault. The law doesn't say the files have to be in a particular format or instantly viewable, any more than it says they need to be stored in an unprotected S3 bucket.

2257 record compliance can be done with a custodian.

A custodian can hold the records, but they still have to have all of the required records at the moment you sell any depiction if you don't want to commit a federal felony, and if your depictions are created live in real-time, that's going to be quite challenging to do offline.

Amazing law.

I don't have it here / I don't have it now / It's not me who keep them / It wasn't me at the time / I don't know

Just like banking regulations that seems stupid, they come from real abuses and a solution to it at the time. I doubt laws signed in 1988 had internet scale and access in mind, nor could they predict it.

When the law can't keep up with reality even after this long, that's not an excuse, it's an indication of a broken system.

Indeed. Especially when in cases like this, when you’re talking about fingerprints, passport information, gender, parents names, marital information — not to mention standard PII fare — all coupled with the fact that nude photos/videos can be tied to this data too.

This makes me physically sick.

2257 was passed well over a decade ago, with minimal public dispute. The only concerning thing is if the models don’t fully understand what the law entails. All affiliate publishers have to have that information under the law.

Also, because of face recognition there really is zero anonymity at this point. It would be very misleading to represent to someone otherwise.

The lawyers don’t even understand how the law says data is supposed to be segregated [1], how are the performers supposed to know.

Also, there is a very big difference between citing facial recognition tech (which while rapidly becoming more common, is still something that requires a degree of skill to use and has a real cost to using) as a reason for “zero anonymity” and having public records with direct ties to nude photos and videos leaked. It’s even more misleading to represent that these have the same risk profile.

[1]: https://lawofsex.wordpress.com/2014/03/25/keeping-your-recor...

> I don't have it here / I don't have it now / It's not me who keep them / It wasn't me at the time / I don't know

More like the state should not need it at all. Why support even more surveillance?

That's not a bug - that's a feature.

It's one data leak compared to all the abuse the law has prevented.

It's one data leak that will have life-changing consequences for a lot of people.

Age verification and privacy aren't mutually exclusive. The law can be amended in a way to remain effective without exposing people to such risks.

Back when the law was designed data breaches and being able to find everything online wasn't a thing so it wasn't a problem anyone thought of. Now it's time to fix the law to address the new risks.