Slashdot Mirror
Elizabeth Warren Introduces Bill That Could Hold Tech Execs Responsible For Data Breaches (theverge.com)
On Wednesday, Sen. Elizabeth Warren (D-MA) introduced a new piece of legislation that would make it easier to criminally charge company executives when Americans' personal data is breached. From a report: The Corporate Executive Accountability Act is yet another push from Warren who has focused much of her presidential campaign on holding corporations and their leaders responsible for both their market dominance and perceived corruption. The bill, if approved, would widen criminal liability of "negligent" executives of corporations (that make more than $1 billion) when they commit crimes, repeatedly break federal laws, or harm a large number of Americans by way of civil rights violations, including their data privacy. "When a criminal on the street steals money from your wallet, they go to jail. When small-business owners cheat their customers, they go to jail," Warren wrote in a Washington Post op-ed published on Wednesday morning. "But when corporate executives at big companies oversee huge frauds that hurt tens of thousands of people, they often get to walk away with multimillion-dollar payouts."
not the girl but the bill. It's money right? Warren is not going to turn down money, possibly this source, but she's a survivor.
It's better to hold the executive responsible rather than the managers or developers who chose poor security practices because s/he's the rich one!
Taking guns away from the 99% gives the 1% 100% of the power.
Roll it up in online and maybe expanded individual privacy rights? The right to be forgotten? Banning shadows accounts (facebook) on people that never even joined your system/applicaiton/social media...?
Now something like that might actually be healthy and helpful to the average US citizen....
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
Awesome. Somebody needs to be held responsible.
Time is what keeps everything from happening all at once.
You can't treat us like people!
This won't pass anyway, but even if it did what's really going to change if we can't enforce existing laws against executives when they perpetuate fraud or break other laws?
If you really want to make companies care about security and data privacy, make it easier for consumers to sue companies in civil court for these kinds of breaches. Companies care far more about threats to their bottom line, and are going to respond far more quickly to things which threaten it.
All that will do is make people sign EULAs that they don't read to waive their rights to ensure that nobody gets sued, like the stupid little boxes at the bottom of webpages now that nobody wants to mess with.
Meet the CDBSO: Chief Data Breach Sacrificial Officer! Selected from the working peons, the CDBSO is catapulted from his labors in the basement IT room to the top floor with a plush closet and low 5 figure salary! Should a data breach occur, the CDBSO will lead the charge... sheet in a federal indictment.
I browse on +1 so AC's need not respond, I won't see it.
it about time someone proposed a bill like this.
I fully back this IF the politicians, like Elizabeth Warren, can also go to jail for their failures. I'm sure she will agree to this......
Otherwise, how will this be workable? So you're telling me a CEO who is sitting on top of a corporation, who is multiple layers of operations removed is to be held responsible for data leaks? What about the people who are supposed to be applying the privacy policies? What about the engineers and technicians? This just seems like a "witch hunt" and political posturing.
Her statements make it sound like the CEO is trying to "cheat their customers" by having a security breach? There's nothing in it for the CEO if there is a security breach. If a CEO is stealing from someone, then ya, book them.
This seems like a way to get some vote and wanting to stick it "to the man". I'm sure it will feel good, but it's not going to change security breaches in large corporations.
They hold more data on people than anyone on government computers. and they have proven they can be hacked. (OPM, etc.)
They should be required to take just as much care of it than any business. And they should face the same penalties. Maybe even retired Execs on whose watch systems stagnated for 10 or more years.
All successful legislation has some sort of memorable/cute/catchy acronym. "CEA" just doesn't cut the mustard. Something like the Corporate Responsibility After Pwnage Act would have had a much better shot.
Cowboys and Indians..
Do we charge homeowners for being burgled? This incentive would encourage companies to *never* report breaches, or minimize what they report even more than they do now.
I admire the sentiment, but this is not the way...
I guess someone needs to dox this AROS anus...
As long as congress members (house or senate) can be charged and jailed for data breaches in their respective offices...
Fuck you, you racist asshole.
Yes, it will make things more expensive for companies. I think it's worth it. I would imagine most sensible people think it's worth it. If you don't care, why don't you post your personal info here?
I don't respond to AC's.
What in the hell are you talking about? You have to hold the people in charge accountable, not the people who follow orders.
I don't respond to AC's.
Does it apply to the government also? Because they'd have to send themselves to jail due to the US voter database breach alone.
https://digitalguardian.com/blog/top-10-biggest-us-government-data-breaches-all-time
EU did this with their data protection act. The result was that every time you opened Google or any other Google service that a banner popped up telling you to authorize them to do whatever they were doing without your consent to that point. If you didn't confirm, you couldn't use any Google service anymore. Imagine telling that to your boss if work needs to be done...
Todd Weaver made an excellent speech approaching this very topic in a slightly different way:
https://puri.sm/posts/the-future-of-computing-and-why-you-should-care/
How about instead she proposes the "Politian Accountability Act"?
"The Politician Accountability Act is yet another push from Warren who has focused much of her presidential campaign on holding corporations and their leaders responsible for both their market dominance and perceived corruption. The bill, if approved, would widen criminal liability of "negligent" politicians when they commit crimes, repeatedly break federal laws, or harm a large number of Americans by way of civil rights violations, including their data privacy. "When a criminal on the street steals money from your wallet, they go to jail. When small-business owners cheat their customers, they go to jail," Warren wrote in a Washington Post op-ed published on Wednesday morning. "But when politicians oversee huge frauds that hurt tens of thousands of people, they often get to walk away with multimillion-dollar payouts."
APK's software is complete shit and hosts for security is a complete joke. APK Hosts File Engine is a glorified string sorting program and offers no real security. It can't even do wildcards like blocking *.facebook.com, let alone any sort of whitelisting to protect from unknown threats. Hosts just aren't a good solution. Plus, APK won't open the source to his program, so there's no telling what sorts of malware is lurking in those binaries. Avoid it at all costs. The software is complete shit and so is its author.
Very likely she knows NOTHING about technology.
God i luv /.
I know they paid no taxes, so I'm guessing they didn't.
Elizabeth Warren is a symptom of the problem in this country. We have a bunch of crap law makers and they have infected this country with crap laws.
Democrats have done everything they can to sabotage the current administration rather than looking for a way to get things done by compromising.
As a result, they will not get anything passed that they want. She knows this bill has zero chance of getting out of committee.
Why only above $1 billion? Make $0.999 billion and it's okay to be irresponsible with security?
SARBOX makes executives personally responsible for the accuracy of the financial data they put out. This has made them get serious about the source of that financial data within their own company. Maybe a bill like this would help with privacy the same way.
The problem with quotes on the internet, is that nobody bothers to check their veracity. -- Abraham Lincoln
I'm wondering, as our government has had data breaches in the past, does this apply to our government officials? They make well in excess of a billion dollars, repeatedly break federal laws and harm large numbers of Americans. Wikileaks would be a treasure trove of lawsuits.
You care about privacy to protect what you have, and what you have gets less and less every year.
This isn't a shot at tech companies. She just did that so it's harder to criticize her (after all, the tech companies just love liberals). No, this is a shot at the folks who crashed the economy in 2008. After that working class Americans lost trillions in wealth. That wealth wasn't destroyed, it was pocketed by the rich. It was the single biggest wealth transfer in my life. Maybe in history.
The trouble here is we focus to much on how Facebook knows what color car we like best or our favorite restaurant and not enough on the massive wealth grab that happens every 10 years when corrupt businessmen and politicians crash the economy and then buy up our assets at rock bottom prices while we're laid off.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
it applies across the board, and includes lots more provisions to punish corrupt CEOs like the folks who crashed our economy in 2008.
The reason she's focused on tech firms is that the media narrative is that the tech firms and the Democrats are in cahoots, so that anything she proposes to regulate to general businesses would be framed in that narrative ("why are you going after such and such and leaving Silicon Valley alone Ms Warren, hmmmm?"). This is a smart political move to defang one of the chief distracting narratives that would normally be used against her. It hurts the bill a little bit with techy nerds, but we're a tiny, tiny minority, and a lot of us (like me) see what she's doing there.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
A common problem with laws like this is it's hard to write legal verbiage precisely enough to have teeth yet not be so specific that it leaves work-arounds and loopholes.
If you use generalizations and leave interpretation to judges and juries, they'll confuse it every which way, often depending on the manipulation prowess of the lawyers involved.
It may do nothing but make lawyers rich and everybody else confused.
Table-ized A.I.
Pocahontas and Creepy Joe have no chance of beating Trump in 2020, sorry Slashdot libtards. Don't forget Israel can meddle and collude all they want and nobody will investigate shit.
This does nothing but shift the blame from the Hackers to the Execs while doing jack shit to address the issue. What the Government needs to do is introduce a National Data Security Standard and most likely an Agency to work with Universities and the Industry to Draft that standard as well as be proved a means of oversight and enforcement. The Government should also provide free tools, services and libraries that the public can use to secure their data in accordance to those standards. But I fear that anything the Government tries to do would result in more confusion and chaos than anything, and most likely harm or outright destroy tech innovation from small sized startups
Is there any candidate who both isn't corrupt and NOT an obnoxious rabid zealot?
the term 'covered corporation' means a corporation that generates more than $1,000,000,000 in revenue on an annual basis
Why should how much a company makes dictate CRIMINAL liability of executive officers? Why should during an off-year when yearly revenues dip below some magic threshold the same executive officer have less CRIMINAL liability or vis versa? Why should executive officer of a small million dollar company have less CRIMINAL liability for the same exact behavior as a larger company?
Making law that targets people you don't like so specifically in this way is a practice I find particularly sleazy and disgusting.
It shall be unlawful for an executive officer of a covered corporation to negligently permit or fail to prevent a violation of law described in paragraph
Leave it to the lawyers to keep trying to make everyone liable for something even if they had nothing to do with it. Its getting old.
(C) any criminal or civil violation of Federal or State law, for which the covered corporation was convicted or found liable, as the case may be, that was committed while the covered corporation was operating under a civil or
criminal judgment of any court
Nice a law that turns arbitrary uncategorized unspecified civil violations into criminal ones.
Define "negligent" executives - is it "negligent" to hire a competent staff, but the staff makes a mistake?
Ken
I'm all for this bill to be honest.
This is how the military operates. Take a ship for example.
If you are the Commanding Officer of a ship, then everything about that ship is ultimately your responsibility. Good or bad.
If something stupid happens it's YOUR fault because there is likely something YOU could have done to prevent it.
( Be it better training for your crew, better judgement from your Officers, knowing everything about your ship inside and out, etc. etc. )
You don't get to blame it on a scapegoat. YOUR command, YOUR responsibility. Period.
Your glory if you get it right, your shame if you don't.
The same thing should apply to the CEO's of any corporation.
If you want the big salaries, they should come with real risks. Not Golden Parachute retirements while everyone else goes down with the ship.
The risk alone will deter all but the most serious candidates to even apply for the job.
Hell, it may even ensure that CEO's take security seriously. ( for once )
Introduce one that sends Representatives and Senators to jail, and I'll listen.....
Send those corrupt Equifax executives to Vietnam. They will know what to do with them.
https://www.pri.org/stories/2014-04-03/vietnam-sentencing-corrupt-bankers-death-firing-squad
This would put the rest of the executives in the United States on notice.
If you think that this is a sarcastic post, think again. Corrupt executives have destroyed many lives recently, causing people to lose their homes, jobs, and life savings. Corrupt executives became rich while doctors prescribed their opioids that people become addicted to and died. These executives don't need golden parachutes, they need concrete shoes.
yay something else designed to take down companies that can compete with corporate China.
CEO calls corporate attorney in and asks what processes and paperwork need to be in place to 100% cover his ass under all circumstances, even cases of gross incompetence, negligence, malice, etc. somewhere within the organization. Attorney answers with Stuff That Looks Like Trying Really Hard. New committees to review all decisions, mandatory training for all sorts of people, prime placement in the company's Core Values statement, etc. CEO snaps his fingers and dictates that all of these should pop into existence. They do, in some godforsaken form or another.
Whether or not they accomplish anything is perfectly irrelevant. When a data breach occurs, the CEO's team of company-paid attorneys amasses a pile of Stuff That Looks Like Trying Really Hard, which is all it takes to beat a negligence charge. Unfortunately for the state, it isn't dealing with the namby-pamby bar of a civil case, here. This is "beyond reasonable doubt" territory. Oh, you'd get to kick a few folks with it every once in a while, but it would do little to change anything because they would only be those who ignored the need to paper over the risk. What the law would utterly suck at is prosecuting the difference between papering over the risks and actually mitigating them. Thus execs would only need confidence in their paperwork, not their actual security.
Good thing that's a straw man, then. If your network is attacked by a zero-day exploit, particularly one done by a state intelligence agency, then there's not much you could have done and thus you wont face prison time. You host critical customer data on an unpatched Windows 2008 Server machine that's open to the internet? You're going to jail.
Her people has been treated badly for too long!
I am 100% in support of this as long as we hold government responsible for every terrorist attack that it fails to prevent, and every murder that gun manufacturers fail to prevent, and every car crash that auto manufacturers fail to prevent, and every cut that knife manufacturers fail to prevent, and every harm conceivable from any product that its manufacturer fails to prevent.
But if a bank gets robbed, and the bank's customers' money is stolen, we don't put the bank manager in jail, we put the robber in jail. A corporation that got breached is far more like a robbed bank than it is a pickpocket.
If she wants to change the law to call a corporation that fails to do its due diligence in protecting user data criminally negligent, that's fine. If she wants to take a company that was taking reasonable precautions but got breached anyway, and send the executives to prison for having been robbed, that's absurd.
https://tech.slashdot.org/comm... too many others say differently (registered /. peers, security pros, results etc.).
* YOU? Lose...
REPOST EDIT You also do NOT want facts in that link I posted above shown (hence you tried to "downmod hide" it last time I posted this very post, here https://tech.slashdot.org/comm...
APK
P.S.=> You have issues libeling me that way... apk
Elizabeth Warren Introduces Bill That Could Hold Tech Execs Responsible For Data Breaches
2 words: Never Pass!!
By that token, perhaps politicians (e.g. senators) should be held responsible for government data breaches.
E.g. the Office of Personnel Management breach of 2015.
apk, you're a weird one, I won't deny that, but I gotta say... I'm actually glad to see you here participating in discussion, without having to throw in a promotion for your software. That was good of you. Please understand, why most people don't like you is mainly the hosts file stuff. I personally wouldn't mind seeing more of your opinions on here, but please find another place for promoting your creation.
Four or more.
Next we are going to make Execs take responsibility for Turing's Halting Problem, and for the correct interpretation of Quantum Mechanics.