Accountability is rarely something that a person or organization will spontaneously adopt of their own free will. It generally has to be forced from the outside by way of additional consequences.

Right now, it would appear that the strongest external consequences for fucking up a CA are strongly-worded posts in a web forum. I would hesitate to call the wind-down of a business unit a "consequence" in this context because it's the default outcome. Everyone was already playing that game. We need an additional layer of pressure to encourage good behavior.

▲

Vaushite an hour ago | parent | next [-]

No, it's not limited to strongly worded posts. The external consequences are usually immediate bankruptcy of the CA after the investigation concludes. An untrusted CA has absolutely no business model whatsoever, and may have to refund its former customers.

▲

bob1029 an hour ago | parent [-]

> The external consequences are usually immediate bankruptcy of the CA after the investigation concludes.

It would seem that we have different definitions of "wind-down". Everyone in the business operated with this consequence already on the table and it did not seem to provide the desired outcome.

▲

Vaushite an hour ago | parent [-]

So you want jail time for people whose certificates get revoked? Or what else could there possibly be? Deterrence doesn't actually prevent mistakes and accidents, that's why bridges still collapse even with the consequences you described on the table. And I haven't seen it on HN yet, but Dread, the front page of the dark web, covering many illegal topics, where the potential consequence of a private key leak is death, leaked their private key.

	▲	iamnothere an hour ago \| parent [-]
		And whose jail? Is India going to allow extradition to the US for this? I doubt it. The company has strong ties to the government and provides services to the BJP’s pet Aadhaar system as well as the military. Unless their failures harm the government extensively, I don’t think you will see any accountability. Like it or not, CA infrastructure is global, and there’s no single set of laws that can or should govern it.

▲

throwaway7356 an hour ago | parent | prev [-]

> Right now, it would appear that the strongest external consequences for fucking up a CA are strongly-worded posts in a web forum.

No, the strongest consequence is their stock value. It has gone down a lot and if they continue not following their agreed obligations as shown I hope that trend will continue.