I am so looking forward to getting my 2.99 USD check from this suit. Of course I need to apply for that check via an on-line site and give them all my personal information.
Great time to be alive.
How much should National Public Data have to pay the people affected by this breach? The article says there are 2.9 billion people impacted. Let's take that at face value and assume that there are no duplicates in there. How much should each person receive? The article also says that USDoD tried to sell the data for only $3.5 million, so they value it at roughly $830/person.
Now, in class actions, not everyone takes the deal. Most people ignore it or never pay attention to the notice. Let's say, very generously, 10% of those affected take the deal. That would be 290 million people. If you gave each of them $100, that would be $29 billion dollars. Do you think National Public Data even has that kind of money? What if we gave everyone just your $3? That's $870 million. I don't think this data broker probably even has that much money.
Your only real hope of getting a sizable payout from this class is either a) NPD is sitting on a mountain of cash or b) a very small percentage of users get paid. Anything else and the money isn't there.
When people say that there need to be criminal, go-to-jail type repercussions for not securing data, this is why. People value their freedom much more than businesses value staying solvent.
Planet Money just did a great episode on how class action lawsuits actually work, from both sides[1].
When I divide 3,500,000 USD by 2,900,000,000 people, I get $0.0012/person. How do you get $830/person?
Instead, I’d like to force this company (and others similarly) to put all kinds of precautions in place. Also warn them that the next breach would result in severe penalties, assuming they could’ve prevented the breach in the first place.
If they don't have insurance for this precise problem then I think we should go after the owners personally. I'm sick of the shell game. Pierce the veil.
This suit opens the company to discovery in which several jurisdictions get access to their books and methods, opening them up to litigation and prosecution in places like the EU.
The $2.99 check is not the only benefit I get from a class-action lawsuit.
I should not have to do anything nor give any information. Why 7 years, that is equal to the Statue of Limitations for saving US Tax Documents.
That alone will end these breaches almost over night.
Motherfuckers asked my wife her SSN when she was getting a store card the other week. Not a credit card, a store card.
I left empty handed, even though I think SSN shouldn't be used as a password.
The store cards I have seen are simply store-branded credit cards.
After the first year, you'll be asked to pay for monitoring.
Unrelated but similar: I live in a rural area, so we don't get street delivery of mail. Instead, we need to apply for a PO Box. Every year, to verify that only residents are using the PO Boxes, the Post Office sends out a renewal form, and you have to show up with a current bill and your driver's license. The latter makes sense—the State, presumably, goes through the validation of your address, and you sign their forms under penalty of perjury, etc., the the former is hilarious.
So, to receive the very bill used to authenticate "current residency," the bill has to go through the Post Office (remember what I said about no street delivery? anything that's mailed to our street address goes... to our PO Box!), and then we show it to them to validate that we are receiving email to that address—which cannot be independently validated outside the driver's license.
The PO Box we're renewing is therefore used to validate itself. And the fun part is that if you delay in returning the form, they'll block off your box.
Maybe they should allow people to request a new number any time they wish and even hold multiple SSNs. Or create a virtual number system like some credit cards have where you would give every company that asks for a SSN a unique number that only they have. It would be cool to be able to tell exactly who had the data breach when your number shows up in a dump.
The fix should be simple: stop taking companies seriously when they only used an SSN for authentication. Ideally there’d be a law adding penalties: try to bill someone for a loan authenticated only by common metadata and they have to pay the target a penalty fine, allow insurers to deny claims, etc. As soon as it costs them money, they’d suddenly find the money to check ID like everyone else.
Until that happens, companies will still pretend they're private information.
Relatedly, is there an up to date guide on how I am supposed to freeze my credit? Last I looked, it required handing over all of my PII, which I found super distasteful, but I should accept none of it is secret and do the minimum to protect myself from ~financial institutions falling for fraud~ identity theft.
I have to wonder what systems other countries use for identifying citizens and how secure they are compared to SSNs.
It can also be done with ID card (which is a smartcard) or mobile certificate (https://mobiilivarmenne.fi/en/) if the service supports it.
Then you have solutions of increasing robustness such as certificates for e-signature.
The national "id" (of there is one) is just to make it easier to find you. Poland has one, France does not have any for instance.
This seems to slowly be improving because so many people have been breached by now that they don’t enjoy the assumption of security. In the 90s, if they took you to court saying you weren’t paying a loan it’d be assumed that a crook wouldn’t have known your SSN but now it’s at least a lot more likely that nobody will believe that without additional proof.
https://www.usatoday.com/story/news/politics/elections/2024/...
But 2.9B is a number so high that the only way it can be true is that they got some Facebook data or the method they used for scraping data led to A LOT of duplicates
It will need to be something public, scandalous and, ideally, affecting someone powerful enough to effect change and privacy-conscious enough to be pissed off enough to want to do anything about it.
edit:[1]https://www.reuters.com/legal/government/illinois-governor-a...
edit2: By scandalous I mean something that average person cares about. Based on initial reaction to this particular breach, I do not think it meets the criteria.
At this point the only thing I think that could happen to change the status quo is a full blown war against a country that's going to use hacked data against the United States in such a disruptive way that the legislators would have to react due to national security concerns.
WHen it comes to it, the US gov has incredible leverage with the data they have access to. If they forced all the major tech companies to release everything they have on the most powerful politicians of some country, including email contents, text messages, full search and location history and so on, they could cause quite a scandal.
You can probably overthrow quite a few governments with a judicious use of that power alone.
https://ia800801.us.archive.org/26/items/gov.uscourts.flsd.6...
