Servers Seized at Ukrainian Firm Where Petya Attack Began, Charges Considered
gizmodo.com
gizmodo.com
Criminal charges for not fixing known vulnerabilities? That's a risky road to travel down. Especially given the general state of infosec among various governments around the world and the offensive first mindset of their security agencies.
This sounds like the result of being pressured to appear to be doing something about a very public problem rather than using the justice system to set a meaningful precedent. Especially if enforcement is going to be arbitrarily based on only exceptionally bad cases.
People love to use the courts as a knee jerk reaction to every problem without considering more effective or efficient alternatives first.
Why not? Incompetent vehicle operators regularly face criminal charges too.
To me this is an emotional reaction that has no regard for cause/effect.
Not exactly, but I do feel that entities recklessly handling PII or possibly in this case their update servers should face consequences.
>Enforcing this arbitrarily after big hacks is hardly an equivalent analogy to enforcing traffic violations. It'd have to be consistent, well defined, and widely enforced to be at all effective.
We definitely agree on this.
>To me this is an emotional reaction that has no regard for cause/effect.
This particular raid? Undoubtedly.
This is why I'm highly doubtful about the ROI of burdening companies, courts, and law enforcement with this 'solution'.
Even though it feels good to punish a faceless corporation for making a seemingly obvious mistake.
Rubber stamps like PCI compliance might look like time wasters. Not all of them are. Given the huge increase in the amount of online credit card transactions, the number of cases where payment information is compromised is very low. That is partly due to PCI compliance IMO.
"Consistent" and "widely enforced" don't apply to traffic violations either.
I think this is absolutely necessary in these days where vulnerable IOT devices are made into botnets, that people are held responsible for neglegience. The damage this can cause is potentially huge.
There should also be a way to punish people if they find a vulnerability internally, and willfully neglect to fix it. The bar for this should be reasonably high, but it is IMHO the same as if a car manufacturer finds a problem with their brakes and ignores it.
Also, there probably would have to be a way for a manufacturer to throw their hands up and say "sorry, we can't fix this" - declaring technical debt bankruptcy. In that case, I think it should not necessarily result in criminal charges, but it must have some consequences. Maybe allowing third parties to take the code and deploy fixes, maybe banning sales, you lose IP, or have to pay a fine.
If it's the most insecure OS, then tell me some unknown vulnerability, on the spot. See, you don't know one, so it's gotta be at least a bit secure...
Well, that's what authoritarian governments do. They also use raids to project their power and get loyalty from the police in return for ignoring all the corruption and extortion.
You can go to jail because you speak russian in public. I suppose they will send you to Soros' mansion if you criticize them xD
Nobody said that when we invented the Internet, yet here we all are, tromping down this dusty dangerous road.
You just described the current state of Ukrainian government there.
Conversely, is it reasonable that software TOS can exclude all liability for damages? Vehicle manufacturers, for example, can't do that.
It is a risky road, but I believe that something (not necessarily this, and certainly not "criminal" charges) needs to be done to make these firms have some responsability.
Instead of the road comparison, let's make another one, you have an electrician (certified/authorized/whatever) come to your house, enter it and replace a wall socket.
By mistake (not intentionally) he mis-wires something or doesn't notice that the wires insulation is not good and as soon as you insert a plug, the wires go on fire and the fire extends to your home.
Would you ask him to reimburse the damages?
I would guess yes, and most probably he has a suitable insurance to cover this (hopefully rare) cases.
Wouldn't this infection by malware be a similar form of malpractice by someone that should know what they are doing?
This is not the case of someone downloading a new phone ringer from some unknown site, it is a professional software firm that provdes tax software to an almost whole country that sends you an update.