That’s not an excuse. They chose to operate an online service, one that collects personal information. That entails the responsibility to secure it. If they can’t do that, they shouldn’t have offered the service.

▲

Steve16384 6 hours ago | parent | next [-]

Can any online service guarantee security?

	▲	p-e-w 6 hours ago \| parent [-]
		The relevant part isn’t whether they can guarantee security, it’s whether they followed best practices in attempting to ensure it. No restaurant can “guarantee” that you won’t die from eating their food, but that doesn’t mean anything goes in the kitchen.

▲

piker 6 hours ago | parent | prev | next [-]

Sort of a "she was asking for it" kind of situation, I take it?

	▲	dspillett 6 hours ago \| parent \| next [-]
		Not really. The victim here is the people whose information has been distributed, not the system (and the people running it) the information was exfiltrated from. If we are going to use an SA analogy, this is closer to the recent case of a hotel chain where there were several instances of staff giving “randoms” keys to rooms that they should not have. Best practise procedures were not being followed, the ne'er-do-wells took advantage of this, someone else suffered as a result.
	▲	p-e-w 6 hours ago \| parent \| prev [-]
		If you process personal data, you must secure it against attacks. Are you suggesting that they could just put the addresses of their customers on their website with a warning not to download them, and if someone downloaded them anyway then it would be the fault of that person that they were leaked?

▲

account42 6 hours ago | parent | prev [-]

Or alternatively we could hold criminals responsible and return to a high trust society where you can provide public services without having your own military department.

You are aware that personal information is routinely stored in places that you can break into with a literal brick to smash a window? Somehow its only computers where people turn off their brains and argue that proactive measures need to be 100% effective at blocking all attacks no matter how high the cost.

	▲	Geezus_42 5 hours ago \| parent \| next [-]
		> Somehow its only computers where people turn off their brains and argue that proactive measures need to be 100% effective at blocking all attacks no matter how high the cost. I don't think I've ever seen anyone say they should be 100% effective. Even those physical locations follow some physical security practices. The difference is that computers can be attacked from literally anywhere in the world, and good luck finding the people who did it.
	▲	p-e-w 6 hours ago \| parent \| prev [-]
		> Or alternatively we could hold criminals responsible Ok. Where are the criminals who did this?