The Difficulty of Disclosure, Surebet247 and the Streisand Effect | Hacker News Reader

The Difficulty of Disclosure, Surebet247 and the Streisand Effect

troyhunt.com

96 pointsweinzierl17 comments

Really great write-up as usual from Mr. Hunt! Some bits that I found especially amusing:

Auto-response email from the company says "To add additional comments, please reply to this email". The email address it came from is "noreply@surebet247.com".

Troy's opinion of gambling: "Granted, gambling merely amounts to a tax on people who can't do maths"

The specific of online gambling business is there are lot of shady things going on. You just aren't competitive if you're all legal and honest. When something goes wrong, something you can't immediately fix, the optimal strategy often is cover things up and not attract the attention of regulators at all costs. Because once you did, it's better to dump your company, save whatever assets you can and start over.

This might explain their attitude.

Tangentially related: I’ve always considered the “Streisand effect” to be vaguely immoral, even though I usually agree with the side it’s ostensibly helping.

That’s because it’s fundamentally (and often gleefully) negating people’s legal rights, and replacing it with the mob’s moral convictions.

Telling people they may have some legal right, but they better not even try using it is dangerous. I’ve heard about it’s abuse in smaller settings, i. e. “of course they did not give you a promotion because your are (black/white/woman/old/...). But if you complain about it, working here will become miserable”.

According to the article they were contacted via email and DMs first, many days before it went public. They were given enough time to verify this and respond accordingly. Also due to GDPR they are obliged to inform the users (at least those from EU) about the data breach - it is not their right to decide whether to inform or not anymore. They do not have to make a public announcement and could just send emails directly to affected users, but considering the total number of affected users I really doubt it would not become a public issue anyways.

But one thing holds: it is still not their legal right to remain silent, they are required to inform the affected users (at minimum those from EU)

Not only based on GDPR, but also Nigeria's NDPR. They failed horribly. See here - https://www.iafrikan.com/2020/01/06/nigeria-data-protection-...

Do you know what possible fines or other consequences they could be facing? I'm really corious about that.

(this paragraph does not refer to NDPR or Nigeria) I have a general impression that very often the possible fines are far too low and it could be perfectly sound business decision to ignore the security or just keep it to a very minimum. Why spend a lot of money on auditing, improving the software, buying additional infrastructure when the cost of ignoring those and even the probability of anything happening is relatively low. For example why spend hundreds of thousands or possibly millions of dolars on security when the worst thing that could happen is a low fine with a marginal probability of breach happening then being discovered, then being reported, then being investigated and then actually a legal action actually being taken.

My point is that it might actually be a lot cheaper to face the consequences of a breach than to improve security. I'm not sure what could be done to improve that situation.

I think you might be conflating the Streisand effect with something else?

The Streisand Effect describes the case where a party (business, person, etc) attempts to tell people to ignore or not look at something they disapprove of, which then causes people to go look at that thing. The origin of the term comes from Barbara Streisand filing lawsuits to attempt to suppress photos she didn’t want publicized, which ended up popularizing the photos (because people heard about the lawsuit). For more context: https://en.m.wikipedia.org/wiki/Streisand_effect

I’m thus not sure how it could be immoral, given that the effect is perpetrated by the person who ends up negatively impacted, not by the resulting people who learn about the disputed content.

If you’re referring to the mob mentality that often follows the public becoming aware of something (either via the Streisand effect or otherwise), I agree that the morality of using quantity-of-displeased-humans-on-the-internet as a tool for changing behavior is a dangerous and often misused method.

  I’m thus not sure how it could be immoral

What if, rather than Streisand suing someone distributing an aerial photo of her house, instead she sued someone distributing a revenge porn video, or leaked medical records?

If trying to get your privacy protected in such a case has the opposite effect, how can any privacy law work?

In our current environment, that would be a different thing. People have a right to privacy with respect to images of our naked bodies. We don't have a right to privacy with respect to pubic knowledge of horrible things we've done.

However, there is a tension here, and it might be resolved in the long run by doing away with any privacy whatsoever, at least for regular people.

OP got the point, and you’re just repeating “mob justice is ok because these are horrible people”.

The point I’m advocating for is that the Streisand effect isn’t the part of that which is immoral, it’s just the concept that the methods of taking action against some information inherently draws attention to it. The revenge porn video being posted is definitely immoral, and the mob looking at the video is immoral, but the concept of the Streisand effect is at best inconvenient, it’s not immoral.

> If trying to get your privacy protected in such a case has the opposite effect, how can any privacy law work?

I've only really seen the term applied to trying to squash perfectly legal activities like, for example, putting online California coastal images which very few people even knew about before hand.

Morality is not a feature of the Streisand effect, it merely describes a cause and effect relationship: the act of attempting to conceal something causing it to become more widely known that it would have if not for the attempt to conceal it.

Morality doesn't enter in to it.

In the original case, if Streisand had done nothing, far fewer people would have seen the photos than actually did despite her actions.

> I'll refrain from posting the entire messages he received as they were a bit, well, "legal"

So... why?

Have you ever noticed that photos of lawyers typically have a backdrop of volumes of books with reams and reams of text?

That’s why - because it was probably reams and reams of legalese bullshit

The lovely thing now is they will possibly face GDPR scrutiny after this --> https://www.iafrikan.com/2020/01/07/surebet247-nigeria-sport...

Assuming that all the information in the troyhunt article is true I wish them the worst possible outcome from the bottom of my heart

Reply on news.ycombinator.com