this post was submitted on 23 Jan 2024
257 points (93.3% liked)

Technology

60052 readers
3169 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 203 points 11 months ago* (last edited 11 months ago) (29 children)

I have a solution:

governments should heavily fine companies that are subject to data breaches.

If it cost them real money (proportional to their market cap, the amount of customers affected, and/or the severity of the breach) to allow a data breach, I’m betting they’d shore up those holes REALLLLLLLLLL QUICK.

[–] [email protected] 108 points 11 months ago (3 children)

This is always the answer. "How do we solve x in y industry?" Make the fucking corpos responsible for their own asses and it will get fixed. If it costs them more money to be breached they will do everything they can to not allow that.

[–] [email protected] 36 points 11 months ago (1 children)

That, or threaten to nationalize their industry. Corporations *hate * that.

[–] [email protected] 29 points 11 months ago (2 children)

Communications should always be nationalized. It was a mistake letting corporations gatekeep phones and internet.

[–] [email protected] 20 points 11 months ago* (last edited 11 months ago) (1 children)

Infastructure should be nationalized as a whole (roads, rails, water, heating, electricity, waste disposal and so on)

[–] [email protected] 7 points 11 months ago (1 children)
[–] [email protected] 3 points 11 months ago

Obviously a typo, nice one

[–] [email protected] 0 points 11 months ago

Internet is also communication. works great in North Korea.

[–] [email protected] 11 points 11 months ago

“Externalities” are just expenses that corporations incur that have to be paid by the public.

Make externalities losses again.

[–] [email protected] 3 points 11 months ago (1 children)

It'll also screw over anyone trying to break into the market, ensuring that the big tech companies remain unchallenged indefinitely.

[–] [email protected] 8 points 11 months ago (1 children)

Disagree if you add the three different factors that I added to account for this in my original comment:

As I wrote in my edit, I think the size of fine should be dependent on:

  • size of company

  • the reasonable expectation of security (which would partially attempt to decrease fines for unfixable breaches)

  • the number of unique users affected

[–] [email protected] 2 points 11 months ago (1 children)

I think that's a great starting point for effective legislation.

I also think this could easily be twisted to become yet another artificial barrier to entry.

I don't know what to do with that knowledge...I think you're correct, but I also think there's no way to pass such a law with its spirit intact today

[–] [email protected] 1 points 11 months ago

I’ll put the ball in your court.

I’ve completely and irreparably broken up with electoral politics in the United States ever since my tax money started being spent solely on austerity and genocide. It’s about as likely for this to be introduced as a bill as it is for a third party to win a presidential election…ie IMPOSSIBLE.

[–] [email protected] 28 points 11 months ago (1 children)

They're too busy proposing legislation to create back doors that completely circumvent security in the first place.

[–] [email protected] 8 points 11 months ago

Yeah, people shouldn't look to their government to protect them from this. Hell, I'd be willing to bet no small amount of taxes go to purchasing the leaked info at places like the CIA, NSA, and FBI.

[–] [email protected] 18 points 11 months ago (4 children)

Nah, throw the board members in prison. If the punishment for crime is a fine then it's legal for rich people/corps. Put 'em in solitary and feed them nutraloaf for one day for each person's data they allowed to be leaked.

If they get all the money because they're ultimately responsible, we should make them ultimately responsible.

[–] [email protected] 8 points 11 months ago

if it means prison time for a middle/lower class person, it should mean prison time for everyone who is responsible for basically publishing logins and personal data.

no more geeting off scott free because you run a company. you're a prisoner like everyone else now.

[–] [email protected] 2 points 11 months ago

Here's the summary for the wikipedia article you mentioned in your comment:

Nutraloaf (also known as meal loaf, prison loaf, disciplinary loaf, food loaf, lockup loaf, confinement loaf, seg loaf, grue or special management meal) is food served in prisons in the United States (and formerly in Canada) to inmates who have misbehaved, abused food, or have inflicted harm upon themselves or others. It is similar to meatloaf in texture, but has a wider variety of ingredients. Prison loaf is usually bland, even unpleasant, but prison wardens argue that nutraloaf provides enough nutrition to keep prisoners healthy without requiring eating utensils.

^to^ ^opt^ ^out^^,^ ^pm^ ^me^ ^'optout'.^ ^article^ ^|^ ^about^

load more comments (2 replies)
[–] [email protected] 17 points 11 months ago (1 children)

As much as I agree that something needs to be done to these companies, and that they deserve punishment, I think this approach would only result in leaks (even more) underreported, which makes it even worse.

[–] [email protected] 6 points 11 months ago (1 children)

Are these leaks even being reported by companies? Every article I have seen so far has just been compiling information off the new leaked data set someone picked up off the dark web or something.

[–] [email protected] 2 points 11 months ago

They weren't, which is why the SEC updated 17 CFR Parts 229, 232, 239, 240, and 249.

https://www.sec.gov/files/rules/final/2023/33-11216.pdf

As of December 18th of last year, publicly traded companies are now required to disclose breaches. (soz, material cybersecurity incidents).

Prior to that, they could ...basically... just effectively sweep everything under the rug "like it never happened" minus a little handwaving and paper shuffling and nobody would find out about it until the information got sold and went public.

I'll have to go looking but I would be SERIOUSLY surprised if the disclosures apply to credit card companies (the MOST breached, historically) because I'm not sure what exactly qualifies someone as an asset-backed issuer, but it's at least a really good step for the REST of things.

[–] [email protected] 11 points 11 months ago* (last edited 11 months ago) (2 children)

Article 82, paragraph 1 of the GDPR:

Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.

Paragraph 2:

Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation

Article 24, paragraph 1:

**[T]he controller shall **implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation.

Article 5, paragraph 1f:

Personal data shall be: […] processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss,

Article 83, paragraphs 2 and 5:

Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive.

Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:

(a) the basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7 and 9;

Article 4, paragraph 7:

‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data

(All quotes are excepts, emphasis mine

https://gdpr-info.eu/

[–] [email protected] 3 points 11 months ago* (last edited 11 months ago)

I think we can both guess why these companies never really face penalties that hurt them materially despite this being codified into law in the EU…

[–] [email protected] 2 points 11 months ago (1 children)

I got lost in the comments... why did you paste that here? To show that it is possible to make the data controller liable for breaches?

[–] [email protected] 6 points 11 months ago

Exactly. This is supposed to show that what @[email protected] demands is already law in the EU.

[–] [email protected] 5 points 11 months ago (1 children)

They won't because fines are just a fee to allow them to run unethically. That way businesses get more profit than they would otherwise and government gets their cut to allow it. It's broken by design.

[–] [email protected] 9 points 11 months ago

The EU has proven time and again that fines can hurt.

load more comments (23 replies)