Slashdot Mirror
One Year After Data Breach, Equifax Goes Unpunished (boingboing.net)
"It's been a year since Equifax doxed the nation of America through carelessness, deception and greed, lying about it and stalling while the problem got worse and worse," writes Cory Doctorow. Equifax's new CSO says they've spent over $200 million on security upgrades, in work being overseen by auditor from eight different states. An anonymous reader quotes Doctorow's response:
This all sounds very good and all, but it's still monumentally unfair. The penalty for Equifax's recklessness should have been the corporate death penalty: charter revoked, company shut down, assets sold to competitors... The fact that Equifax's investors and execs kept all the money they made by risking all America with shoddy security, and that no one went to jail for a monumental act of corporate recklessness, is a moral hazard, virtually guaranteeing that Equifax's competitors will not take the care they owe to the people on whom they have amassed nonconsensual, potentially life-destroying dossiers.
Equifax's CEO and several top officials did leave the company, notes Government Technology -- but that's about it. Thus far, no financial punishment has been imposed on Equifax itself. Despite contentious hearings, no Congressional action has been taken. A few months later, the Consumer Financial Protection Bureau tabled action against the company. And while the Federal Trade Commission said it opened an investigation into the Equifax breach in September, the agency has since named as chief of its consumer protection division a lawyer who has represented Equifax. This past week, Equifax asked a federal judge to reject the claims from 46 banks and credit unions for payment of damages because of the massive data breach. The companies claimed that Equifax owes them for all the costs they incurred protecting data after the breach was revealed, costs that could easily run into many millions of dollars....
Equifax had revenue of $876.9 million during the second quarter of 2018, up 2 percent from the same quarter of last year, officials said.
Equifax's CEO and several top officials did leave the company, notes Government Technology -- but that's about it. Thus far, no financial punishment has been imposed on Equifax itself. Despite contentious hearings, no Congressional action has been taken. A few months later, the Consumer Financial Protection Bureau tabled action against the company. And while the Federal Trade Commission said it opened an investigation into the Equifax breach in September, the agency has since named as chief of its consumer protection division a lawyer who has represented Equifax. This past week, Equifax asked a federal judge to reject the claims from 46 banks and credit unions for payment of damages because of the massive data breach. The companies claimed that Equifax owes them for all the costs they incurred protecting data after the breach was revealed, costs that could easily run into many millions of dollars....
Equifax had revenue of $876.9 million during the second quarter of 2018, up 2 percent from the same quarter of last year, officials said.
As a European, and with GDPR in force, can I demand that Equifax delete all the data they hold on me?
The penalty for Equifax's recklessness should have been the corporate death penalty: charter revoked, company shut down, assets sold to competitors
If this is truly a case of recklessness, lying and stalling, then it sounds like their reaction to the breach was a matter of policy or strategy set by upper management. So how come none of these guys are rotting in gaol?
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
I laugh when the shareholders say, "but what about me?". Possibly the biggest motivation to keep companies honest is to hurt the shareholders. We should be expecting people to consider the moral standing of companies they invest in and let them hurt when they have supported a company that will do something like this.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
Fuckers in congress cared more about the Facebook fiasco - and that was their business model. People signed up for FB. No one signed up for Equifax. They collected and lost our data, but no one gave a flying fuck.
Corporations haven't been accountable for anything in this country for years, because those in power (yes, Democrats AND Republicans) are in their pockets. If you want to see what happens when Government actually tries to strike back at corporations with these assholes in power, look no further than the CFPB, which has had its power castrated and is currently in the process of being de facto dismantled because it ruffled too many powerful feathers by actually punishing a company (Wells Fargo) for breaking the law.
What would have been news is if Equifax or its top brass received any actual meaningful punishment.
> the U.S. Supreme Court has waved for decades
I think you mean centuries. The first business corporations were for road building and other government contracts in ancient Rome. An individual mason couldn't build a road, a baker couldn't feed the army. Together, a thousand craftsmen could bid to do these things. If the project was late, or there were quality problems, the corporation so established would be penalized for the poor performance, rather than trying to figure out which of the many workers caused the delay. If it was finished ahead of schedule, the contract could include a bonus the bakers' corporation. If a road needed certain materials, the road building corporation could make a deal to buy 100 tons of pitch - you didn't need a single ultra-wealthy individual to personally buy enough material to build a road. The corporation meant ordinary workers, together, could do so. If there was a dispute with the pitch merchant, the merchant could bring an action against the corporation before the magistrate, rather than individually suing each of the 1,000 road workers.
> Throw their asses in prison for decades
Okay, which executives? How many decades should the head of accounting, the CFO, serve for the carelessness of some people in IT? The vice president of marketing? How about the head of HR? Penalizing the corporation, and thus the people who made money from it solves this issue.
fellow /.ers. The free market will punish them any minute now. Yep. Any. Minute. Now.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
You bring up some good questions. With a little investigation, you can discover that the CEO did not order the network security tech "be careless about how you configure the zones on the ASA". The CEO doesn't know what an ASA is, and the tech has never met the CEO. So it gets rather complicated.
When there is a specific law related to an overt act, such as dumping toxic waste somewhere, you may be able to follow the chain of command and figure out who knew what and who authorized what. The problem at Equifax was mostly not be careful on general. There was no one item that they did or failed to do which caused the breach. Their security just generally sucked all around, they were sloppy. Notice "they" is plural. Even if they had updated the application that was actually used in the breach, the bad guys would have just used one of their other security holes. Anyway, no boss sent out a memo saying "be sure to be sloppy about updating software".
So I don't think you can pin this on one person, or a few people. What you CAN do is identify who profited from their decision to be sloppy, to not invest in security. That would the shareholders. They can be penalized by taking the money that they inappropriately got by failing to pay for proper security, and perhaps more. The way you get money back from the shareholders is by fining the company.
That's a huge problem in the US: The corporation.
If a small business owner does something horrible that hurts, kills, or otherwise damages people, customers or not, that business owner will end up in jail.
Once that business gets a bit bigger, and becomes a corporation, the owners are now called "shareholders". In the US, "shareholders" of a corporation are not legally liable for anything the corporation does. That's the crux of the problem
Ideally, all of the owners of a company should be just as liable as the single owner of a company. In the US, money is King, so that's never going to happen. Corporations can do whatever they want, with no legal repercussions, but individuals can't.
It's really fucked up, and it's the cause of so many problems in our society. That's why our government is for sale. That's why bribery is 100% legal at the highest levels of government. Make the individual owners of every company liable, and watch how fast companies of all kinds clean up their acts. I doubt that Equifax would have done what they did, if every one of their millions of owners was looking down the barrel of some serious jail time. Or, Equifax wouldn't have millions of owners in the first place.
I don't respond to AC's.
Only us plebian nobody Poor could possibly be affected, so why should The Rich give a flying fuck about us? We can all go bankrupt and get our identities stolen so far as those cocksucking bastards are concerned, they don't have to care because all their shit was protected to the Nth degree. So rather than spank their other Rich buddies that run Equifax they just ignore the whole thing. Fuck them, sideways with a rusty chainsaw. It almost makes me wish Russian and Chinese hackers would crash the whole thing and destroy it, then while chaos ensues we can find these Equifax bastards and cut their gods-be-damned heads off.
> Did the IT director ever put in a request for additional personnel, funding, or authorizations to address their poor security?
Equifax, throughout the company, had a culture of sloppy. It was sloppy before that IT director arrived. More people doesn't fix sloppy.
The CEO *tried* to blame one of the techs. That didn't go over so well.