Needs to be at the level of enforcement by regulatory agencies, large scale lawsuits backed by state governments, and maybe even congressional action
These companies have scale as their moat and that's called a monopoly. We need to be aggressively pursuing corporate malfeasance, closing loopholes, and breaking up companies. In my ideal world the entire doctrine of the "corporate veil" would be overturned, but that seems unlikely to happen without drastic upheaval. Antitrust action and large-scale suits can happen and to some degree those wheels are already in motion, but it would help a lot to stop buying this bullshit about how we should think of this as a "crime" for which we should uniquely blame hackers. These megacorps want to pretend that they and their customers are in solidarity as victims of the hackers. In reality, these companies get hit with essentially none of the consequences, and their practices are most of the relevant causal factors. A better model would be that the customers (and often non-customers on whom they collect data without even the figleaf of manufactured consent) are victims of the companies and the hackers
These companies are so massively large that they price in the risk of databreaches as a cost of doing business.
Insurance Underwriters pour through corpo infosec documents, and require only the most basic level of protections.
I think instead, a stricter certification standard needs to be created, and all these large companies must pass ANNUAL audits, or simply lose access to government leased spectrum.
It seems that we agree that regulatory enforcement is a great framework through which to make this happen. I think we should regulate both security and data retention far more aggressively, and be willing to destroy companies if they fail to comply. The lack of an existential risk makes it easier for them to maneuver around other solutions
These companies have scale as their moat and that's called a monopoly. We need to be aggressively pursuing corporate malfeasance, closing loopholes, and breaking up companies. In my ideal world the entire doctrine of the "corporate veil" would be overturned, but that seems unlikely to happen without drastic upheaval. Antitrust action and large-scale suits can happen and to some degree those wheels are already in motion, but it would help a lot to stop buying this bullshit about how we should think of this as a "crime" for which we should uniquely blame hackers. These megacorps want to pretend that they and their customers are in solidarity as victims of the hackers. In reality, these companies get hit with essentially none of the consequences, and their practices are most of the relevant causal factors. A better model would be that the customers (and often non-customers on whom they collect data without even the figleaf of manufactured consent) are victims of the companies and the hackers