I mean there is a whole range of possibilities here, at what point do you stop blaming the victim?
1- The front door was left wide open 2- The front door was closed, but left unlocked. 3- The back door was left unlocked. 4- All doors were locked, but with an easily picked lock. 5- All doors were locked and with a legit key, but a window was left closed, but not locked. 6- All windows and doors were locked, but the windows were easily broken. 7- The windows were reinforced, but a door was broken down or someone drilled the locks, or just forced the window until the lock failed. 8- The doors and window locks were reinforced, but they pried up the garage door and broke through the flimsy door between the house and garage. 9- The exterior entryways were all truly secured, but they found a way in through a chimney, a sewer pipe, or just sawz-alled through the exterior siding...
At what point do you stop calling the resident an idiot and start blaming the perpetrator? Personally I would say around #4 in the meatspace the world, but 2/3 I would say they are still being victimized depending on where they lived and whether they routinely left the door unlocked or not.
And then in the digital world, there are things like not setting a password or leaving a default one up, but what about patching known vulnerabilities? How long is too long once a patch is made available? What about zero days, and vectors of attack no one thought of... and maybe line employees who just don't know better?
Just in general, people are very quick to blame the victims in situations like this- I just had an argument about this with someone the other day when I heard the news that a neighbor's bike was stolen- from outside their door on the third floor. It was an exterior door/stairway, but not visible from the street, and the bike was locked but with a cheap one. They brought bolt cutters and took the bike. People were like "this is on you for using that cheap lock..." but I think he took reasonable precautions, but many had no sympathy for the guy. Personally I can't wrap my head around that mindset.
The parent poster is saying Funke and/or their software vendors are guilty of negligence. You, too, even go on to admit there might have been vulnerabilities in the software or processes of Funke group.
The parent poster is not the one being dishonest...
In the case of the SolarWinds attack, their management seemed to be quite technical and the attacker was just too strong/sophisticated, so SolarWinds is considered a victim.
But in the case of the Equifax, they're considered at fault because their head of security seemed unqualified for the job and the victims were actually the millions of users whose private data was put at risk of abuse.
The probability in this case is very high that the upper management at Funke was quite incompetent at how they've digitized their operations.
I don't think hacking/cracking should be illegal. If I send you a series of electrical pulses and that causes your systems to do something stupid, that's your problem. You are not a "victim".
Laws against physical violence and against stealing physical objects have good reasons to exist, because otherwise there would be no point in having any moral conception at all, because everyone would solve their problems through violence.
On the other hand, sending messages through a wire doesn't have good reasons to be outlawed. We could live peacefully sending each other all sorts of bytes, and each entity would make an effort for their own systems to behave correctly.
Most people disagree with me, but their abstraction is leaking, because even they agree with me on a fundamental level, they just don't know it. The moral discussion is so disconnected from concrete actions and formal definitions that it devolves into dumb analogies like "but if you left your door open blah blah".
Having a "right not to be hacked" is of the same nature as having a "right not to be offended".
That depends on your intent. If you purposefully send the pulses in order to cause damage, that would generally be considered a crime.
It's like saying no, I didn't shoot that person, I just gave momentum to a bullet that caused their body to do something stupid and they died.
I think these reductionistic arguments are naive. It is the information and intent that matters. Many times racist and sexist harassment only consists of “making pressure changes in the air with vocal cords.” However, those pressure waves have meaning(words) and there is intent behind them, so we condemn that behavior.
> Are Hackers criminals? Yes, because the law says they are.
You seem to be implying that "hackers are bad because the law says they are".
No, crackers, specifically, are bad because they act in bad faith and they can cause serious problems for people and organizations. We, as a society, codified that into law. If there were no laws, they would still be "bad".
> Does that matter? Not much outside the realm of law.
Yes, it does matter. The law was made for a reason. If it didn't matter, we wouldn't have the law in the first place. You might disagree with the reason the law was made, but even if you do, it mattered for the majority of people, so you're in the minority (not in an "underdog" kind of way, but in the "the earth is flat" kind of way of being a minority).
> If I send you a series of electrical pulses and that causes your systems to do something stupid, that's your problem.
Yes, but that's not where the story ends. It's also my family's problem. It may be my friends' problem as well. It might become a problem for all my contacts. It might even be a problem for my company. It might be a problem for the suppliers of my company. It might be a problem for their clients too. It may even become YOUR problem.
That's just thinking of 1 person. What if, by some miracle, the US Treasury gets hacked? Or the DHS? 328 million people have a new problem now
So we collectively got together we said that my problem could really quickly become everyone's problem and we said we'll start addressing it by making laws that say "hacking other people is bad".
Then you come around and you're like "boo hoo I don't think causing problems for other people is a big deal. They should just deal with it". Well, you're wrong, sir, and I hope you see why you also come across as a bit of an asshole.
> You are not a "victim"
Yes, you are. By definition of the word "victim".
> Most people disagree with me
Well there's your first clue, Sherlock.
> Most people disagree with me, but their abstraction is leaking, because even they agree with me on a fundamental level, they just don't know it
What does a leaky abstraction have to do with people disagreeing with you, but then somehow unknowingly agreeing with you on some fundamental level?
The legal system does not work very well for international crime.
'I don't think assault should be illegal. If I send a series of simple kinetic impacts to someone's unprotected body that causes their organs to do something stupid, that's their problem. They are not a "victim."'
Do you see how absurd this idea sounds?
In my opinion there are good reasons for physical property to exist (individual freedom), but avoiding violence is not the best theoretical argument for it.
Is physical property against freedom or in favor of freedom? I think both, depending how you look at it. I've though about this a lot, and tend to fall on the side of proprietarianism, because I think property is absolutely necessary for the fulfillment of human needs and desires.
If I leave my ground floor window open with cash sitting just inside and someone reaches in and steals it, that's my fault. It's dishonest to suggest that dishonest actors don't exist or are anything other than a fact of life/force of human nature.
As such they don't bear much discussion - I left the window open. That's on me.
I can get in your house even if you close the window. It's a window and can be opened. Are you still to blame? I can look for money even if you hide them, I'll search around. Are you still to blame? You could have taken the precaution of not having money in the house or at least not living on the ground floor if you do.
Many attacks are 0day, many others are supply chain attacks, many exploit the weakest of links, the human. There's a limit to how much you can protect yourself from one attack in an instant before you cause yourself harm slowly but continuously. No matter how many locks you put you're not guaranteeing anything. It's a calculated risk and sometimes the calculation doesn't pay off.
Claiming the contrary is exactly victim blaming.
But in a world that contains muggers, and that you know contains muggers, walking around the bad part of town with cash visibly hanging out of your pocket is not very wise. It's not a moral failure, but it is a failure of common sense and reasonable prudence.
In the case of murder, sure. But I'm with you. But bad actors (in the form of petty theft, exploitation, confidence tricks, etc) are a fact of life. Failing to account for them, just as failing to account for hurricanes if you live in hurricane alley, is completely on you. You can reduce that down to a blanket "but you're just victim shaming!" if you'd like, but it doesn't make it any less true.
Security incidents, viewed generally, are the conjunction of two factors: threats and vulnerabilities. It is a massive over-generalization to view all cyber attacks through a lens that focuses only on one factor.
Sure, there might have been vulnerabilities in the software or processes of Funke group. But it's a dishonest analysis that ignore the threat actor (a criminal in this case - let's not mince words) who exploits the vulnerability.