> "This simply is not a company that deserves to be trusted with Americans' personal data," said Sen. Sherrod Brown, D-Ohio,
Obviously this quote leaves out a lot of nuance, but I like
it and I like what Senator Brown has said in general. What Equifax has let happen is very bad, and I think moral judgments and perhaps even shame (which is how a society can enforce morality) should be brought onto its leaders individually.
I hate how businesses and business persons have been making horrible, destructive decisions for decades (not that humans in all fields weren’t beforehand) and have been escaping any kind of shame. Indeed they’ve been praised in many cases.
If you look at the top-level pages on Wikipedia (there are about 11 of them), one of them is for “Society”. About a third way down you’ll see “Business” listed under Society. I think this is a good reminder that business is a part of and functions for society, not the other way around.
Is it a moral failing to be slow to update a Struts vulnerability? As an IT engineer that makes be nervous because I don't know which of a hundred actions I take or don't take in a given day will explode on me. Or was the moral failing to agree to build such a system in the first place?
It's a moral failing to be engaged in the collection of personal data of this type and scale without having a solid, well articulated, well communicated, robust and redundant plan for managing security and mitigating the impact of security issues.
It's an ethical failure that this industry has so many examples of above.
Whether or not this information should be collected at all may be a moral question, but how it's secured is about technical competence.
I also think we should keep in mind that, even if it was well-secured, there could have still been a breach. Would that have been less bad? The result would be the same.
The moral issue isn't one of technical competence, but rather of having the integrity to perform the appropriate due diligence required of a company handling such sensitive information.
No security professional is going to argue that you can or will prevent every vulnerability from being exploited. However, when you leave a critical vulnerability open for months on end, you knowingly and unnecessarily expose yourself, and any parties associated with you (by choice or otherwise), to a level of risk that is unacceptable.
If this were a 0-day exploit, then the conversation would be different. If their exec's hadn't sold off so much stock a such a suspect moment, then the conversation would be different. If the IT department had appropriately began remediating the vulnerability within a respectable timeframe but had already been exploited, then the conversation would be different.
To my view, collecting and storing that much information is presumptively immoral. It creates a public hazard, in the same vein as stockpiling explosives or toxic chemicals.
There is, however, a degree of respect for that hazard, demonstrated in concrete safety practices, that can override that presumption.
I don't think Equifax has demonstrated that respect. To a layman's view, not many companies do. It's possible that the amount of respect necessary for a hazard as large as the one Equifax created is too onerous for a for-profit entity to realistically implement, but I don't know that there's a fundamental reason that sufficiently paranoid engineering practices couldn't make this moral.
My issue is not that they had the vulnerability, but that the vulberability allowed full access to social security numbers and it wasn’t even the “critical” database!
You can take proactive efforts to minimize the risk of breaches; they appeared to store large amounts of unencrypted (or encrypted in aggregate) personally identifiably information together and allowed a single struts vulnerability unfettered access.
For instance, one could not duplicate social security numbers, or could allow you to encrypt your data so you need to provide a key for others to access it. The possibilities are endless.
My design would be a ZeroMQ message bus between the database server and the application server. Social Security numbers shouldn't need to be displayed to the user (as they should already know it) thus all the message bus should be carrying is "it matches" or "it doesn't match" in regards to them.
It seems dishonest to pretend struts was their only problem. That just happened to be the trick of the day. As others have mentioned, security is designed in layers. The fact that a single layer can fail and cause so much damage is simply bad design. Unfortunately there is a lot of bad design in IT. InfoSec may not be new, but I would argue up until about the last 15 years, it was really not considered outside of defense departments.
> Is it a moral failing to be slow to update a Struts vulnerability?
Yes.
As a professional engineer you are responsible for the systems you build and maintain. The security of the modern internet depends on engineers on the ground understanding and proactively fixing security issues.
There is no one else who can take responsiblity for code you deploy to production. The buck stops with you.
As a member of an unrelated professional body, the buck always stops with me on issues of ethical behaviour. I don't care how much the CEO wants me to do a thing that is good for the bottom line - if I want to keep letters after my name I have to behave in a way that is in line with the professional code of conduct I signed up to.
I'm not saying that such a model is the right one for devs, but it would certainly be an interesting move away from "not my fault - nobody would let me do it right".
CEOs would, of course, then have the choice to hire non-accredited engineers to work on their software, and then the buck does stop there because they made an active decision.
> I'm not saying that such a model is the right one for devs, but it would certainly be an interesting move away from "not my fault - nobody would let me do it right".
I would say I'm in a similar position, but that's because I'm more or less essential (no ego here, and can't explain obviously, but I am) and if I walk out, the company has a lot of BFPs to deal with.
Perhaps there should be some sort of guild? Some way that we could make it harder for ourselves to be replaced in such a way where we can actually stop bucks without just getting fired while they find some script kiddie to do what we wouldn't.
But ideally, "I was just following orders" should not be an excuse. Part of the reason we need proper professional accreditation is so that engineers can say "No, this is wrong.", and the CEO can't say "you're fired, I'm going to hire someone who will do what I say". We need to put loyalty to the profession ahead of loyalty to the business.
I'm not sure many IT Engineers are professionals (as in members of a professional body that they have to answer to, with training, licensing and code of ethics etc)?
That I think is the real problem? I mean how many of us on this thread alone are pushing around troves of consumer data today? Maybe just browsing habits or analytics or what have you but nevertheless, here we are, handling possibly terrabytes of data on people we don't know, who don't know us, and have no current way to hold us accountable if we do it wrong and they are subsequently affected.
I mean how many firms do we read about a DAY on here who are collecting by the truckload consumer data, either to be used or sold later? And how many of said firms are taking proper steps to anonymize or secure (or both) said data properly?
Bingo. That's why so much of HN doesn't want to be held to the same standards as actual Professional Engineers - all the shady shit Google and Facebook and their ilk do is enabled because of the lack of personal accountability among the mercenaries who enable the giant surveillance apparatus to exist by implementing it. Then they come here and hand-wring over why privacy is dead or why it's really not so bad what they're doing over there, honest. The cognitive dissonance is palpable.
Possibly a little more of a pessimistic view than I'd take personally, but I get what you're saying. Talking privacy and security is one thing, actually fighting for it in your own org is another.
I had an interesting debate a couple years back in another forum about this. The other person was saying that until people who build software are held personally responsible for our work the way other engineers are, we shouldn’t be calling ourselves engineers. I disagreed then but stuff like this makes me wonder.
* The executives selling stock before telling the public about the breach[1] — but "Equifax responded to TechCrunch’s questions about the timing of the transactions, particularly those of CFO John Gamble, with the following statement claiming that the executives in question were not aware of the hack which the company was made aware of on July 29"
* entering in phony name into the "Have I been breached?" site resulted in random answers; "Others have tweeted they received different answers after entering the same information."[2]
* Equifax hosted said "Have I been breached?" site, and services related to protecting oneself from the breach, on a domain that looked for all the world like a phishing site, and further, "What’s more, there is nothing tying the domain registration records for trustedidpremier.com to Equifax: The domain is registered to a WHOIS privacy service, which masks information about who really owns the domain (again, not exactly something you might expect from an identity monitoring site)." [4]
* Equifax wanted people to agree to a forced arbitration clause. [3]
* Equifax directed people to a fake phishing site [5]
If this Struts vulnerability can lead to the personal information of literally half of America? I'm not a lawyer, but that sounds pretty damn negligent to me.
I agree with your larger point that the system probably shouldn't be built in the first place, at least not the way it is now, but there are still plenty of things they could have done, like not store it in plaintext at rest.
If the data would be considered the customer's, it would have made sense to use application-level encryption [1]. Each user has a unique key which should be their property. If you need to give access to that data without the user's consent, you'll need to store their unique key for them. You'll better do that in a very secure manner.
If now somehow the database gets exposed, good luck! You'll also need to get the individual keys to decipher everything.
Then, although still you can be blamed for not using a vulnerability scanner, there is much less at stake.
The latter. It is a moral failing to build/market a product with failure modes that expose unconsenting victims to consequences they did not sign up for. And "we were just following orders" should not be a defense, either.
Failed to patch in a prompt manor. Waited to disclose the issue to the public. Set up a credit monitoring service that was insecure and would auto charge you (the auto charge was dropped after people were outraged). The CEO blamed the whole thing on one person (and that person was not him).
What part of that doesn't seem like a moral failure?
Then quit supporting these companies by working for them!
The elite have this country over a barrel, it sucks. All anyone that isn't rich can do is to choose to die before they will work for these companies.
We've got tons of young men and women that sign up to be in the armed forces who happily go die to enrich the already wealthy...and we celebrate them!
So as a society can we start shaming workers that work for Palanatir, Comcast, Pfizer, Equifax? You being on your death-bed and unable to afford food is not an excuse to make the world worse. Die with some fucking integrity.
It's very difficult, if not impossible, for society or government to enforce moral judgments, shame, punishment, condemnation, etc on every individual / company that deserves it.
The amazing thing about our society is that in most cases, the incentives of individuals are such that even bad people engage in good behavior. You say that businesses and business persons have been making destructive decisions "for decades" but there's definitely a reporting bias there; an overwhelming majority of businesses quietly ship bacon, pack boxes, deliver fertilizer, fold laundry, etc without any moral/shame oversight from senators or society at large. In fact, many of these businesses are likely ran by sonofabitches, but they still engage in good behavior because their incentives are aligned with their consumers.
The problem with Equifax and other headline news behaviors (pollution, bank crashes, etc) is not 'bad people made terrible decisions' but 'bad people had no incentive to make right decisions' because, for example, the credit bureaus are simply not motivated to protect consumer data. Legal and financial incentives are both aligned against consumers, not for them.
It's a little unfair to pile on the CEO of Equifax or the company because that's just fighting yesterday's battle too late. What we should be doing is fixing the incentive structures such that future Equifaxes don't happen.
Also, as other commenters have pointed out, we don't want to discourage good people from running credit bureaus out of fear that innocent mistakes may get them hung.
> Also, as other commenters have pointed out, we don't want to discourage good people from running credit bureaus out of fear that innocent mistakes may get them hung.
I couldn't agree more with the rest of your comment, but I draw an almost opposite conclusion.
We should discourage people, good and otherwise, from running credit bureaus. Collecting and holding sensitive personal data on millions of people is inherently a mistake, and after the last few years of data breaches it's getting hard to argue that it's an innocent one.
Companies have proved time and again that they can't be trusted with huge datasets on the general public. They don't have much incentive to apply the level of paranoia necessary to actually protect data that valuable, and even when they do they rarely have the level of InfoSec skills and, more importantly, culture to actually pull it off. In practice we see 2 or 3 nines of reliability when we actually need about 5 nines.
We should stop waiting until leaks happen. Holding sensitive personal data on hundreds of millions of people ought to be congressional hearing level scandalous whether that data has leaked yet or not.
My point was not that they don't deserve condemnation, but that punishing them doesn't help correct the system to prevent the same problem from happening again.
FWIW, and perhaps the best evidence of the strange new universe we live in, Steve Bannon called Republican tax cuts on Charlie Rose “an economic hate crime against America” back in early September.
That is HILLARIOUS coming from the government that spilled MILLIONS of classified background checks from the OMB offices a few years ago. Absolutely hilarious and ironic and hypocritical.
Also, the wife and I were one of the millions whose personal details were stolen from the OMB hack.
I have to say I think there's something to what you are saying.
The Senators are beating up on this CEO for a security breach that happened under his watch -- suggesting he ought to be fired. For the OMB hack they were the ones with the power to fire the CEO of the organization responsible, i.e. the President. Did even a single one of them call for impeachment? Did any senators resign for thier lack of appropriate oversight?
They attack equifax for having bad security policies and procedures and dismiss the claim that one misfeasant employee is responsible. Well they are the organization largely in charge of writing and overseeing policies and procedures for the federal government. Did they attack themselves for doing a bad job after the OMB hack? Did they change any of those policies and procedures in response?
They are calling on equifax to fully compensate people whose information was released. What laws did they introduce and pass to fully compensate people whose information was lost by the organization they are in charge of?
Technically the identity of the speaker is of no moment, but it's a little hard to avoid rolling ones eyes in the face of such blatant hypocrisy.
> The Senators are beating up on this CEO for a security breach that happened under his watch -- suggesting he ought to be fired. For the OMB hack they were the ones with the power to fire the CEO of the organization responsible, i.e. the President. Did even a single one of them call for impeachment? Did any senators resign for thier lack of appropriate oversight?
Katherine Archuleta was in charge of the OMB during the time of the hack, lawmakers _did_ call for her to be fired, and she ultimately resigned due to the breach.
I disagree with your analogy. Obama's job concerned way more things than the OPM. However, it was Katherine Archuleta's only job to lead that organization. When considering the OPM only, Archuleta was much more akin to the CEO than Obama was.
I think a more appropriate analogy would be that Obama was the "board of directors" of the OPM.
OPM isn't an complete organization. It doesn't have a mission that makes any sense independent of the rest of the federal government. It only makes sense as a department serving as part of larger organization. Like HR or IT in a particular company.
Equifax on the other hand is a complete organization. It has a bunch of different departments that all work together to accomplish the overall goal. Just like OPM, the State Department, and the Treasury all work together to accomplish the overall goal of governing the nation.
Therefore, the proper analogy for Equifax is the USG, not OPM, and the proper analogy for Equifax's CEO is Obama, not Archuleta. The group that is analogous to the Equifax Board of Directors is Congress.
I see your point with the OPM. Your analogy is logically consistent, but I still don't find it to be realistic.
Equifax fits into the relatively tidy box of credit reporting, identity theft protection, and maybe a few other services that I missed. The OPM fits into the relatively tidy box of investigating and managing security clearances, hiring Administrative Law Judges, and maybe a few other services that I missed. I can't even reasonably estimate the number of these services (to the same level of granularity) that the entire USG is responsible for.
Getting rid of the business structure analogy, really I just disagree with the sentiment that Obama should have been fired or pressured to resign over the OPM hack. I don't think there is much to be discussed there, so perhaps we should agree to disagree.
I think they have to be careful not to focus on Equifax only. Instead they should think about systems where such a breach is just not possible. It's only a matter of time until other companies like credit card companies get breached. Same for Google and Facebook. We need a system where an individual can hand over information one a case-by-case basis and revoke that information anytime.
> Instead they should think about systems where such a breach is just not possible.
The underlying problem is the existence of centralized identity, as opposed to decentralized identity. It's the practice of identifying people by a single global identifier (e.g. SSN) instead of having your bank identify you with your bank card and your employer identify you with your employee ID.
People are focused on identity theft here, but there are two points about that. The first is that identity theft doesn't exist without centralized identity, and the second is that identity theft isn't even the main issue.
Centralized databases know very private things about you. They know if you've paid for services at an abortion clinic or a cancer treatment center or a mental health facility. They know if you've ever been on the payroll of a police department, or paid tuition at a police academy, even if you're currently working undercover. They know whether you patronize gay establishments, even if you're in the closet. They know your current address, even if you have a crazy ex who doesn't.
That kind of information is inherently dangerous. In the wrong hands it can get innocent people fired or blackmailed or killed. Which means any central database containing all of it for everyone is inherently a huge vulnerability waiting to be exploited. And none of that goes away even if you replace the SSN with some kind of public key that doesn't itself need to be kept secret.
But centralized identity is the linchpin of those databases and it isn't really needed for anything else. So we should get rid of it.
> The underlying problem is the existence of centralized identity, as opposed to decentralized identity.
There is also an underlying problem of reliance upon publicly available information (and in many cases, one's SSN is publicly available, even before this breach) to authenticate that human body X claiming to be John Smith is in fact actually the John Smith.
Public facts, such as SSN, mothers maiden name, or name of first employer, etc. have been relied upon as "secret, known only to John Smith" items for authentication purposes when in reality those facts were never really secret in the first place. The only reason those facts even worked as authentication devices is that pre-internet/pre-google it was exceedingly hard to look most of them up in the public records. Doing so often involved physical travel to multiple disparate archives and physical search through archived paper. And so if unknown human X knew all three it was highly likely X was John Smith because otherwise X had put in an awful lot of effort. Today, with the internet/google, obtaining almost all of these facts from the public records where they have always existed to begin with involves typing in searches, zero physical travel, and no combing through archived paper.
The internet has simply exposed the Emperor's New Clothes [1] for what they really were all along.
There is no reason to have Bank A release your credit history with them to Equifax just so Equifax can release it to Bank B. Cut out the middle man and just ask Bank A release the information to Bank B.
But how does Bank A know to ask Bank B? That’s what Equifax and friends help with: aggregating the data (and then putting a number to it). It’s a great idea, but how would you implement it? If you cut out the middleman, banks will just form their own centralized system that holds all that data making it easier to access, and... oh, we’re right back where we started.
Because you tell them to. When you're applying for credit with a new bank, you ask the existing bank to vouch for your history of making timely payments.
In theory the person applying for credit could keep one set of accounts that they always pay and another set which is delinquent but not disclosed, but not disclosing delinquent accounts would be fraud and anyone willing to commit fraud has been able to commit identity theft this whole time without the system collapsing.
Some taxes are made difficult by the lack, but land taxes, wheel taxes, property taxes, sales taxes, VAT taxes, GET taxes, service taxes, recycling taxes, employment taxes, gas taxes, hotel taxes, ticket taxes, vice taxes, excise taxes, fishing/hunting/sport license taxes, food and beverage taxes, marriage license taxes, luxury taxes, parking taxes, stadium taxes, vehicle taxes, watercraft registration taxes, zoning permit taxes and tolls are all capable of being effected without a centralized identity.
> There's no way a VAT or flat tax would be progressive enough to fund the government without crippling vast portions of the taxpaying base.
That's what the UBI is for. You can have something like a 35% VAT with a $15K/year UBI and then the effective rate on someone at $60K/year is 10%, but at $100K/year it's 20% and it only goes up from there. This is very much in line with the existing effective rates, and you can make them whatever you want by adjusting the tax rate and the amount of the UBI.
It also replaces a huge swath of social spending programs because you're then giving someone who makes $20,000 a year $8000 more than they pay in taxes.
I don’t think it is possible. The effective tax rate for billionaires under a scheme such as you propose would still be pretty much zero. The only way to make that a progressive tax scheme is to have zero or negative tax revenue.
If they spend the money they would have to pay VAT. If they invest it in something then the invested in company spends it and they would have to pay VAT. The only way to avoid it is to stick the cash in a mattress, which nobody really does because it's more profitable to make $1 in profit at the cost of paying $.35 in VAT than to make no profit and pay no taxes.
They could avoid local taxes by investing offshore, but they do that already.
I think you're misunderstanding me. I'm not denying you can raise income through VAT, I'm saying you can't do it in a progressive manner, basic income or no basic income. The reason for this is that the more you earn, the less you spend as a proportion of your income. Billionaires spend almost nothing compared to either their income or their wealth. The poorest in society spend everything, because some things are essential.
Any progressive system would make it so that the less well off paid _at most_ as much as the 1%.* Income tax may not work very well, but it's one of the most progressive forms of taxation there is.
*And yeah, as you point out, tax avoidance makes a mockery of this anyway.
> The reason for this is that the more you earn, the less you spend as a proportion of your income. Billionaires spend almost nothing compared to either their income or their wealth. The poorest in society spend everything, because some things are essential.
That's only true when you crib the definition of spending to mean only personal consumption.
Donald Trump owns Trump Tower. It generates rental income. He is obviously not spending all of it on hamburgers and hair products for his own personal self.
But it still gets spent, just not on himself. He doesn't put the cash in a mattress, he uses it to go out and build another tower somewhere. For that he has to buy steel and concrete and elevators and HVAC systems, which are all taxed in the usual way. Essentially all of the "unspent" income is spent doing things like this, because it's more profitable than holding cash that generates no returns.
Most of the time there will be a corporation in the middle. Trump doesn't buy concrete, he buys shares in a newly formed corporation which uses the money to buy concrete. But that doesn't change the fact that the money is used to buy concrete and concrete is subject to VAT.
Concrete is subject to VAT, but it's _reclaimable_ when you charge rents for rooms. The effective rate of VAT for successful businesses is zero. This is by design and is why it's so efficient: each part of the chain has an interest in making sure it's collected as opposed to a sales tax like India has.
In short, Donald Trump's net VAT bill is pretty much exactly his VAT on personal consumption. (It could be lower, depending on how exactly his personal finances are laid out wrt his business's expenses, but it won't be higher.)
> Concrete is subject to VAT, but it's _reclaimable_ when you charge rents for rooms.
That just prevents it from being charged twice. It's the same thing as saying that the tenant doesn't have to pay the VAT that the landlord has already paid.
> The effective rate of VAT for successful businesses is zero.
There is clearly some kind of fallacy happening if a transaction occurs, the government receives non-zero tax revenue, yet the effective rate is calculated as zero.
Income taxes and consumption taxes are effectively the same thing. The seller's income is the buyer's consumption. The taxes always come out of the surplus between the seller's cost of production and the value to the buyer, and who really pays depends on who would otherwise have had the market power to claim that part of the surplus, not whether you call the tax an income tax or a consumption tax.
In practice VAT is very similar to corporate income tax. The main difference (and benefit) is that VAT is paid to the jurisdiction where the end product is sold, rather than whatever arbitrary jurisdiction the company arranges for its profits to be declared in.
> That just prevents it from being charged twice. It's the same thing as saying that the tenant doesn't have to pay the VAT that the landlord has already paid.
Well, no it's not. If you rent a room from Trump, it matters a lot whether you pay the VAT for the concrete or Trump does. And you're the one who ultimately pays. Trump pays and reclaims. You don't get to reclaim.
I get that you might not be concerned with who ultimately pays for this stuff, but it matters greatly if you're trying to design a progressive tax system.
> If you rent a room from Trump, it matters a lot whether you pay the VAT for the concrete or Trump does. And you're the one who ultimately pays. Trump pays and reclaims. You don't get to reclaim.
Who pays the tax has nothing to do with who can reclaim what.
Suppose Trump has a local real estate monopoly. Then rents are high and the surplus is going to Trump. Any tax paid by anyone is really paid by Trump, because if it was "paid" by the tenants and Trump didn't lower rents by the same amount to compensate, the tenants would move out of the city because the rental cost would exceed the value of the real estate.
Now suppose the local real estate market is highly competitive. The rents are low and the surplus is going to tenants. Any tax paid by anyone is really paid by the tenants, because if it was "paid" by the landlords and they didn't raise rents by the same amount to compensate, the rents wouldn't be enough to cover costs.
Taxes are always paid out of surplus. Whoever would otherwise be getting the surplus is the one really paying the tax. If part of the surplus was going to landlords and part to tenants, they would each be paying part of the tax.
Now notice what happens with VAT. If Trump has a monopoly then he pays $100 in construction and the tenant pays $500 to rent, and VAT is owed on $500. If Trump is in a competitive market then he pays $100 in construction and the tenant pays $120 to rent, and VAT is owed on $120 even though the rental was worth $500 to the tenant, and the tenant gets to keep the $380 difference untaxed. So who pays VAT and who doesn't? It isn't collected on the surplus going to the buyer.
Dunno, 1% of the world seem to hold 50% of the assets. That sounds like a pretty big impact to me.
Obviously, I'm assuming for the moment that billionaires aren't chronic tax avoiders, which makes every system regressive. If you decide to only concentrate on the proportion of the population that pays their fair share, you'd still have problems, because the average person who earns $200k doesn't spend much more than the guy earning $150k. They'd also receive the same basic income, so the burden would be higher on the guy earning $150k.
> Dunno, 1% of the world seem to hold 50% of the assets. That sounds like a pretty big impact to me.
Billionares aren't the 1%, they're the <0.0002%.
> the average person who earns $200k doesn't spend much more than the guy earning $150k
Yes they do. Someone who makes $200 million doesn't have much more personal consumption than someone who makes $150 million, but that effect doesn't kick in until you're at the "don't know how to spend this much money" level. At $200K/year you haven't even sent all your kids to private school yet, much less bought a mansion with a heliport and a fleet of sports cars.
Then perhaps tax processing should be the exception and use of the unique tax identifier for other puposea made illegal. IMHO, it would not be an impossible task to generate a unique tax identifier for each person that is kept private to the government
and then print a unique identifier on tax forms sent to each person to use for filing (that changes every year).
The identifier isn't great, but it's the pervasive use of this identifier that is the problem.
Possible, maybe Easy? Not really. You have problems of homelessness, problems of enforcement cost, problems of beneficial ownership.
If a man is living in his ex-wife's house as part of a divorce settlement, and there's a 90% mortgage on the property, who should be paying? What's going to happen if it isn't paid to each party? Could a bad actor exploit this situation?
In terms of sheer complexity, Land Law is probably second only to Tort Law.
Bear in mind we're talking about these in the context of a no-identity scenario. This isn't about the practicalities of Land Taxation as it stands, but the practicalities of land taxation if you can't identify the owners or beneficial owners.
Consumption taxes (like sales taxes) are heavily regressive and result in the poor shouldering a much heavier share of the tax burdem than the wealthy, proportional to their share of income (let alone disposable income).
Displaying data necessarily means copying data. Once data is copied and transmitted you have lost control of it. There isn’t a technical solution to stopping data from being copied and potentially stolen. You can mitigate the risk that it will be stolen with technical solutions, you can put processes in place that mitigate the risk, and you can deter by punishing thieves and negligent data processors. But ultimately it is risk mitigation and not elimination. Unfortunately there are no perfect solutions.
The bulk of the risk is created by the outdated credit system itself and it’s reliance on easily obtained personal information as keys to the kingdom.
Solve for x where x is “why can’t I just post my social security number on Facebook?”
Meanwhile, 'The IRS will pay Equifax $7.25 million to verify taxpayer identities and help prevent fraud under a no-bid contract issued last week, even as lawmakers lash the embattled company about a massive security breach that exposed personal information of as many as 145.5 million Americans.'
While it is always "fun" (for some definition of the word fun) to pile on, and sometimes watch the otherwise clueless elected officials to get soundbites at the expense of a hapless CEO of a company that did bad things, or allowed bad things to happen on their watch ... the bigger picture is one of what sequence of events enabled this to occur. Placing the blame on an OSS component, or a "sole IT" person is both unfortunate, and generally wrong.
None of this would have come to fruition had the business model not been one of "lets gather and curate high value information and intelligence about individuals", without an appropriate "gee, we have high value intelligence and information on individuals, maybe we should design our systems so that in the event of a failure of a security system, damage would be minimal." When you aggregate, curate, sell access to high value information, you damned well better have a good and fail safe security model. So if your DCs are overrun with hackers, the data exfiltrated would be unusable.
More specifically, the principle I claim to be implicitly at play here is, with great power and/or information, comes great responsibility. Pointing fingers at lower level subordinates for their possible failings ... opening up and exposing the entire business model's core weaknesses in terms of data protection, and data access integrity and control ... means that the organization has simply failed to maintain, audit, test, and verify that its control systems are adequate to the task. Blaming an OSS component for all the damage means that the rest of the systems were not designed and built to the necessary level of safety and security.
This is part of what I find unconscionable. They attempt to absolve themselves of blame by pointing fingers.
When an organization does crap like this, you know they have many other problems. And yes, you cannot, and should not trust them going forward. If data was exfiltrated from them (and it was), is it possible that their data was altered in situ? Yes, yes it is.
They should not be allowed to have such data in their control again. Seriously, if you can't control access to the data, you can't have the data.
I was thinking, would it be a viable solution for the government to employ pen testers to test companies like banks/ISPs etc? It would more than pay for itself from the fines they would impose to those that hold sensitive citizen data and fail to hold high standards of security.
That cynicism is often self-fulfilling: the best way to ensure that outcome is to treat it as a given and not contact your representatives and state prosecutors asking for more.
Duh, Senator. We knew this when Experian got hacked.
Experian, Equifax, TransUnion, and any other credit bureaus are going to fail to protect people's personal data. There is no such thing as "unhackable", they are the biggest honey pots, and the majority of the Information Technology hiring pool is incompetent. The majority of competent candidates are underpaid or underappreciated and so they don't care as much as we need them to.
Put all these things together and you have inevitable disaster after disaster after disaster.
Credit Bureaus are old-think. They are unsafe, unsecure, and they don't fit with Future-Era lifestyle.
In this case, the IRS is already using that service so when you see “no bid” that really means they didn’t want to take a production service offline while they re-bid it and/or hire the staff/contractors who would update the application to use something else. Remember that the rules government staff are required to follow are heavily based on up-front planning so putting out a bid means many months of delay.
All of the anger directed at the IRS for this really should be directed into a positive direction of reforming the acquisitions process.
This whole credit tracking industry is so unconstitutional it's crazy. I hope that this awakens people to the fact that their identities and personal data _should_ be theirs, and that they should fight tooth and nail to grant access to it. Centralizing information such as this is a "single-point-of-failure", or it is in spirit.
What value does a blockchain add? Beyond the obvious problems with privacy, the problem isn’t that there’s trouble getting personal info but rather two areas without effective corrective pressure: there isn’t an effective check on mistakes or a way to force errors to be corrected, and large financial organizations have successfully conned most of us into thinking that the cost for their failure to authenticate someone shouldn’t be their responsibility.
A blockchain has no to negative value for the first problem – immutability means you'd need a way to force everyone to honor delete/update records — and since the whole point is not being anonymous, there’s no value for the second problem beyond what PKI does except that PKI has well-understood ways to deal with a compromise and the blockchain community is still working on the problem.
> "This simply is not a company that deserves to be trusted with Americans' personal data," said Sen. Sherrod Brown, D-Ohio,
Obviously this quote leaves out a lot of nuance, but I like it and I like what Senator Brown has said in general. What Equifax has let happen is very bad, and I think moral judgments and perhaps even shame (which is how a society can enforce morality) should be brought onto its leaders individually.
I hate how businesses and business persons have been making horrible, destructive decisions for decades (not that humans in all fields weren’t beforehand) and have been escaping any kind of shame. Indeed they’ve been praised in many cases.
If you look at the top-level pages on Wikipedia (there are about 11 of them), one of them is for “Society”. About a third way down you’ll see “Business” listed under Society. I think this is a good reminder that business is a part of and functions for society, not the other way around.
https://en.wikipedia.org/wiki/Portal:Contents/Society_and_so...