Hacker News Reader

Comment by Nextgrid | Hacker News Reader

It seems like the data brokers did most of the dirty work of collecting, storing and giving away the data to anyone who asked nicely. This guy managed to get access to all that sensitive data by just a single instance of social engineering. The data brokers' executives should be rotting in jail alongside him on much longer sentences.

View on HN

The data brokers have accumulated towering piles of toxic data, creating a situation where spillage — and the resulting terrible harm to the innocent — becomes statistically inevitable.

Some people consider such piles of data a liability.

Probably including your parent comment, given that they described them as piles of toxic waste.

"Data is a toxic asset."

— Bruce Schneier

It is an asset, not waste.

Not to the people who view it as an asset.

I've noticed that if I am very careful people will often skip authentication steps and even just ignore them if they're lazy.

In my opinion we need to value these positions more. Higher salaries for these positions and more prerequisite education should be required. I don't think it'll happen without regulation though.

Everything he did to Experian doesn't sound like a crime, more like a violation of TOS.

And that's the problem. Experian has insufficient incentive to keep this data safely stored away. Experian acts as if the data belongs to Experian, allowing them to sell it under a TOS, but when criminals get a hold of it, no harm comes to Experian — it's not a physical asset they can lose ownership of entirely. Instead, all the harm crashes down on the individuals whose identities are swimming in that data.

One solution would be to have PII, especially sensitive PII, be owned by the person it identifies. Of course, this would cause lots of problems for businesses like credit reporting agencies.

Oh, darn.

This really, really pisses me off about society today. Never once has my identity been compromised by my actions, in the 4 times it happened, it was due to credit card companies and credit agencies. I have zero control over how they protect my data.

But their ad campaigns would have me believe that I have to take control of my data to protect myself. How? I don't even know what you have about me, where it's stored, how it's stored, how it's accessed, why it's accessed, and how to lock it. How could the individual possibly be on the hook for this nonsense? Why is this allowed?

This could be fixed by a change in the law that required data brokers and privacy farmers to carry insurance to cover the loss of information.

Suddenly you’d turn an “asset” that motivates surveillance capitalism into a liability you’d want to offload as soon as your business can.

Reply on news.ycombinator.com