>Criminal charges for not fixing known vulnerabilities?
Why not? Incompetent vehicle operators regularly face criminal charges too.
Why not? Incompetent vehicle operators regularly face criminal charges too.
To me this is an emotional reaction that has no regard for cause/effect.
Not exactly, but I do feel that entities recklessly handling PII or possibly in this case their update servers should face consequences.
>Enforcing this arbitrarily after big hacks is hardly an equivalent analogy to enforcing traffic violations. It'd have to be consistent, well defined, and widely enforced to be at all effective.
We definitely agree on this.
>To me this is an emotional reaction that has no regard for cause/effect.
This particular raid? Undoubtedly.
This is why I'm highly doubtful about the ROI of burdening companies, courts, and law enforcement with this 'solution'.
Even though it feels good to punish a faceless corporation for making a seemingly obvious mistake.
Rubber stamps like PCI compliance might look like time wasters. Not all of them are. Given the huge increase in the amount of online credit card transactions, the number of cases where payment information is compromised is very low. That is partly due to PCI compliance IMO.
"Consistent" and "widely enforced" don't apply to traffic violations either.
I think this is absolutely necessary in these days where vulnerable IOT devices are made into botnets, that people are held responsible for neglegience. The damage this can cause is potentially huge.
There should also be a way to punish people if they find a vulnerability internally, and willfully neglect to fix it. The bar for this should be reasonably high, but it is IMHO the same as if a car manufacturer finds a problem with their brakes and ignores it.
Also, there probably would have to be a way for a manufacturer to throw their hands up and say "sorry, we can't fix this" - declaring technical debt bankruptcy. In that case, I think it should not necessarily result in criminal charges, but it must have some consequences. Maybe allowing third parties to take the code and deploy fixes, maybe banning sales, you lose IP, or have to pay a fine.
If it's the most insecure OS, then tell me some unknown vulnerability, on the spot. See, you don't know one, so it's gotta be at least a bit secure...