I'm curious for folks who like solutions like this, have you ever had a vulnerability in production? I would be shocked if most software engineers haven't had at least one outdated package, or one line of poorly-escaped javascript or similar at some point. It seems like luck (and maybe being a poor target) that these things are usually found before they are exploited. Should the companies we all work for cease to exist?

I agree broadly with regulations designed to raise the cost of security flaws and so on, but I feel like there's this expectation that if we make the punishment extreme enough, people will begin writing perfect software and operating perfect servers, and I just don't buy it. It seems sort of like saying if someone causes a production issue or accidentally leaks a database, they should be summarily fired. More likely it was a mistake, and we should understand why it happened so we can prevent it in the future.

If you’re billion dollar company’s application architecture is such that any one compromised system leaks the entirety of your customer data then you’re definitely doing it wrong. It’s not just a matter of one compromised package being able to wreak havoc, it’s the scale and blast radius of the havoc.

If you're a billion dollar company, your attack surface is insanely large. Just as per usual work, thousands of people need to have access to the data, hundreds of software developers write code processing it and it's distributed over a lot of places. Plus, if you lock it down too much, things like simple customer service become either insanely expensive or outright impossible (imagine you'd need to iterate all your account details and show your passport just to answer a question about your account in a store!).

That's not to say that breaches like this should just get punished by a slap on the wrist; this clearly must not happen. But especially when the company is so large you simply have an insanely large attack surface that comes with it. And it only takes one weak spot on there for an attacker to get in. People have casually carried out all data from Facebook, LinkedIn and even the NSA (multiple times!) - security at that scale simply is hard.

> things like simple customer service become either insanely expensive or outright impossible

This is true. It is hard to design a CS backend that user user friendly and privacy cognizant at the same time.

However, the other issue is sticky habit of the companies to grab on to as much data as possible and keep it just in case. For example, this breach had SSN next to user's phone number, name and address. Why does it need to store SSN at the first place after initial verification? It is not necessary for most of it's operation. The only reason I can think of is if they want to report defaulted payments to credits bureau. Although, storing SSN can be avoided in a similar way, how payment APIs allow you to minimize handling of credit card number, of course you need support for this from credits bureau. If they aren't cooperative, you can still design the system in compartmentalized way, that simply does not keep an association between SSN and other user info in one place, because SSN is used in very narrow scenarios. There is not enough pressure on the companies right now to do that.

Any time you get compromised, you're doing it wrong. What's discussed here is what should the consequences be for doing it wrong. In legal terms, the question is whether this was ordinary negligence or gross negligence. Gross negligence usually comes with pretty stiff penalties.

What's discussed in this thread is whether the larger a company is, the more likely it's gross negligence. The irony to me is that every large company I've worked with takes security very seriously. The only gross negligence I've seen has come from startups that willfully disregard security practices in the name of moving fast.

>The irony to me is that every large company I've worked with takes security very seriously. The only gross negligence I've seen has come from startups that willfully disregard security practices in the name of moving fast.

Couldn't agree more. I've done security consulting for many companies of varying sizes. The large ones almost universally have massive security budgets, constant pentesting, and security audits/processes out the ass. They still get breached because security is fucking hard, no matter how much money you throw at it.

I don't buy in to the whole "if only those evil MBA manager types would allocate more budget to security and take security more seriously, they wouldn't get hacked". Every company I've worked at is scared shitless of being hacked, and have enormous security budgets. The management chain usually takes it very seriously. IME, a huge part of the problem actually ends up being the individual development teams who skip things like encryption because they think it's too onerous or they just think it's frivolous.

I cannot even begin to tell you the amount of time I have had to spend with developers arguing with them that they do need to do things like encrypt PII or enable HTTPS. "But it's only a small database of SSNs, do we really have to encrypt it? We would rather spend the developer time building something else rather than implementing encryption!" they say, and then spend hours/days arguing about it rather than just doing it.

> I don't buy in to the whole "if only those evil MBA manager types would allocate more budget to security and take security more seriously, they wouldn't get hacked".

This is a corollary to "nine women can't make a baby in a month."

Also lack of isolation of critical systems, the biggest fault honestly. Basically isolate all PII and other systems from each other.

I could follow a far more secure development process than I currently do, but I'd get fired for not producing features quickly enough. Maybe it's impossibly hard to write perfect software, but we'd only find that out if we started actually trying to.

It's just victim blaming and anti-corporation rhetoric.

No one over 30 takes this position seriously.

I don't know. I'm over 30 & I think the punishments aren't severe enough for repeat offenders (maybe T-Mobile falls here?) or in the face of egregious violations of best practices & incompetence (Equifax). I think firing the board of directors & instantly selling off the shares of the majority stock holders on the open market might be better measures, but it requires the government bringing lawsuits & that's not popular in the US anymore.

I'm over 30 too, and I believe in not allowing corporations to externalize costs onto customers. If my data is compromised, that should be very, very expensive for the corporation.

When I was young, I wasn't a fan of this sort of policy, since I looked at things less holistically, and on shorter timeframes.

Holistically, higher damages aren't anticorporation, but just shift the ecosystem. Over time, companies who treat data securely will have a market advantage. Different, more secure programming practice will evolve, and companies will innovate and compete in security.

My thinking changed around the time GDPR passed. Before, I thought policies like that were anti-corporate. After, I saw how they changed market forces, but economies did just fine or better. Externalizing costs isn't good for economies.

> I'm over 30 too, and I believe in not allowing corporations to externalize costs onto customers.

They shouldn't be externalized onto the victims. The cost will, by principle, always be externalized to their customers, since that is were the money has to come from.

You're assuming perfect market transparency. That's a false assumption.

Company A has good security, which adds $5 in your costs.

Company B has poor security, which doesn't, which will lead to $500 down-the-line from a security breach and identity theft. It charges $2.50 less and otherwise has an identical product.

You have no way to know that. You will go with company B, and you will split the $5 gain, where you save $2.50 and they take $2.50 more in profit.

Company B externalizes costs onto the customer. Company A's customers have higher initial costs, but they wouldn't be defined as 'externalized.'

> You're assuming perfect market transparency. That's a false assumption.

The situation we have here is clearly company B. So we have two options:

- Let the victim (who is or was a customer) pay the $500

- Let the company pay the $500. They need to get that money [0], so they charge their current customers more money.

Either way, the bill goes to the customer. The only difference in the second scenario is that the company needs to increase prices, which will hurt them in the long run and (hopefully) justify the additional expenses in security. But they can't create money out of thin air [1].

> Company A's customers have higher initial costs, but they wouldn't be defined as 'externalized'.

You're right - I was wrong about the definition of externalized.

[0] Technically, they don't - they could go bankrupt. But that would be the first scenario all over again.

[1] Unless we're talking about a bank, of course ;)

I say charge company B, but I disagree with your analysis of where the money will come from. Companies charge to maximize future profits.

If company B tries to charge customers an extra $500, they'll be more expensive than company A, and customers will go to company A. They'll exactly go bankrupt. If they could have charged customers $500 extra and kept it, they would have done that from the get-go. The money won't come from customers, at least in a market with any competition.

Where will it come from? Well, the money will ultimately come from company B's investors. There are several mechanisms by which this can happen:

- Company B has a billion dollars in the bank. It spends $500 million on damages. It now has $500 million in the bank, and is worth $500 million less.

- Company B has zero dollars in the bank, but an otherwise solid business. It issues new equity, diluting existing equity, to raise $500 million. Existing shares are worth $500 million less.

- Company B has zero dollars in the bank, and a negative net worth. It files for bankruptcy. A court reorganizes it to pay the debtors (e.g. the customers). Old shares are worth $0, and the company is now owned by its debtors -- it's customers. The shares aren't quite worth $500 each, but customers get as much as possible, and the business keeps chugging along. No one loses their job.

Once investors notice, they'll start to include data security into company valuations. Insurance companies will do likewise. Keeping poor security will decrease profits, and security will improve. On the other hand, I don't think many companies will fold -- in the sense of letting customers and employees down -- based on this.

only as long as they stay in business.

Being a large company, they should at least demonstrate that they took appropriate measures. E.g. show the reports written by the pen-testers they hired.

I'm being downvoted without argumentation, but how will security ever be taken seriously if these measures don't become the norm?

Just because the problem is that cost of compromise < cost of security, the solution is not to raise the cost of compromise to infinity. That’s treating it in a very black and white, binary way. It also increases the incentive to spend more on covering up any compromise.

This doesn't make any sense. Capital punishment has existed since forever - yet the fact that they are still carried out means that they are not stopping all of the crimes punishable by death.

A lot of people fear losing their money more than they fear death. I think corporate capital punishment, in theory, could work. The other side of that coin, however, is the number of people put out of work if that were to happen.

Either way, there needs to be far stiffer penalties levied against companies who don't secure their systems better and lose sensitive customer data.

It does make sense. You're confusing corporate liability with personal liability. The parent's point is that if the investors / shareholders would be responsible. Stuff like this would be severely reduced because resources would be allocated to prevent it. Right now, the only damage is a financial one. And as long as the damage is lower than the cost of prevention, hacks like this will continue to happen.

So isn't the solution here to up the penalties, specifically with codified minimums ($X per leaked phone number, $Y for leaked SSN, etc)? The corporate death penalty would end up hurting the consumers significantly more than this method, which would primarily hurt the share/debt-holders, which is the intent. Corporate dissolution seems like a concern when fraud or malfeasance is specifically involved.

For context, I'm very likely in this breach, but it wouldn't make me any happier to hear T-Mobile was shut-down tomorrow.

No that wasn’t the point at all. Corporate death penalty was a completely overblown analogy by someone else. What this is about is that a manager / CEO / shareholder can be held personally accountable with punishment that could include jail time. As a deterrent.

Right now only the company is accountable as if it’s some sort of living creature, and the penalty is always money. Which as you aptly put, they have in abundance!

Yes, the solution are astronomical penalties.

And a corporate dissolution isn't the outcome. The outcome is that T-Mobile goes into bankruptcy, with its customers as the debtors. The outcome of that is that a bankruptcy court divides up the assets to maximize payout to you.

Most likely, this means:

- T-Mobile, as an entity continues to exist, as-is..

- Shareholder value is wiped out...

- And handed to customers, as the customers become shareholders.

T-Mobile has a 180B market cap, which probably means you acquire stock worth a grand or so.

If punishment for murder was sitting in a luxury European prison with a vintage PS3[0] and not death or life, I’d have whacked my former con-artist business partner years ago and likely be out by now.

Let’s not pretend there isn’t a deterrent.

[0] - https://www.google.com/amp/s/www.businessinsider.com/breivik...

It depends on the level of incompetence or negligence. There is a difference between premeditated murder and negligent homicide. But there must be a framework, that determines the punishment based on the impact and level of negligence.

> The trove includes not only names, phone numbers, and physical addresses but also more sensitive data like social security numbers, driver's license information, and IMEI numbers, unique identifiers tied to each mobile device.

Now, this seems like a lot. I hope we will see a detailed technical analysis of the break eventually.

Executing one of the few large US mobile providers will do nothing except raise prices by eliminating even the marginal remaining competition.

Want a monopoly? Hire the best hackers to destroy all your competition.

I agree with the principle of raising the cost of compromise, but disagree with your proposal of raising it to infinity (which is effectively what happens when you wipe out the shareholders). Getting hacked sucks, but surely consumers aren't experiencing infinite losses when that happens?

Feels like a better idea might be legally forcing some top X levels of management out as a form of corporate death, invalidating any golden parachutes on the way out too.

I’m this case, if the breach data is true, customers need to buy new phones, get new SSN, (and possibly change name) to have any sense of safety in the future. I wouldn’t use a compromised IMEI phone for 2FA anymore but most people would and it is not clear if the potential losses from the selling of this information have any real limit.

>customers need to buy new phones

>and possibly change name

>I wouldn’t use a compromised IMEI phone for 2FA

Why?

>get new SSN

That might be prudent to do, but at worse it's a few hours of hassle. I searched around and it looks like all you have to do is fill in a form (https://www.ssa.gov/forms/ss-5.pdf) and supply the required documents. At US median wages it's a few hundred dollars, max.

>the potential losses from the selling of this information have any real limit.

Well not really? Suppose someone crashed into your house, making a hole in the wall that allows thieves to steal potentially unlimited amounts of goods from your house. Should the driver be liable for all thefts from your house in perpetuity? Or only between the time of the crash and when you can reasonably get the wall fixed (or in the case of identity theft, changed your SSN)?

That form does not indicate that it's used to change a SSN.

Even if you do get a new SSN I wonder what the process is for changing it with the credit bureaus.

There is a million ways to keep critical data away from public (mostly) data like Name and Address. Seems like they weren't even doing the most basic separation of concerns here.

If any compromise wipes out a company automatically, you suddenly increase the incentive to hack a company by a huge amount. That doesn't seem like a good way to increase security.

1. short company

2. hire cyber-mercenaries to hack company

3. ???

4. profit

On the contrary, I think the settlements should result in shares transferred and board seats added

Instead of just cash

Then management gets replaced

> If you zeroed out all of the investors this type of mass compromise would immediately cease.

It absolutely would not. Yes we would see greater investment in cyber security and it would pay dividends, but the idea that we can totally eliminate data breaches if we just try really super hard is unrealistic.

This is absurd. There is a simple way to eliminate data breaches -- Don't keep data. Humans have been conducting businesses for thousands of years without the need to hoard large quantities of personal data.

If there was sufficient regulatory force to induce companies to make the choice between not hoarding data or not existing then I'm sure that business would carry on as it has for millennia.

Businesses have not reached economies of scale until recently, and economies of scale are supported by data.

Couple that with making engineers liable for what they build. Just like we do with physical engineering - build something that knowingly harms people? Get sued.

Knowingly is the key word here. The physical world is much easier to know and account for in engineering. Not so much for digital which is why security is a system of defense in depth via layers and nothing ever is 100% secure.