Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FTC Takes action against Drizly and CEO following security breaches

ftc.gov

Post reply on HN
Print view View original

11–20 of 23 posts

Re: FTC Takes action against Drizly and CEO following security breaches

#11

Post by akira2501 »

adrr wrote: post #10
ferrocarraiges wrote: post #7

I am genuinely curious: why did the FTC take this enforcement action? There is no fine, no prosecution, no consequences of any sort. Essentially, they're just asking the executive to "implement an information security program" at any companies they head. This seems to send the message that there are absolutely no consequences for getting caught hiding an extremely negligent data breach. Was that the FTC's intent?

FTC isn't the DOJ. They can't prosecute anything.

They can file for injunctive relief and issue cease and desist orders. If those orders aren't followed, they can proceed with monetary relief as well.

The FTC can do whatever congress authorizes them to do. The supreme court decided that what congress laid out in law required the FTC to file the cease and desist first, and then if that order is violated, then they can peruse further action.

Re: FTC Takes action against Drizly and CEO following security breaches

#14

Post by jnorthrop »

ferrocarraiges wrote: post #7

I am genuinely curious: why did the FTC take this enforcement action? There is no fine, no prosecution, no consequences of any sort. Essentially, they're just asking the executive to "implement an information security program" at any companies they head. This seems to send the message that there are absolutely no consequences for getting caught hiding an extremely negligent data breach. Was that the FTC's intent?

There is this condition

> Recognizing that reality, the Commission’s proposed order will follow Rellas even if he leaves Drizly. Specifically, Rellas will be required to implement an information security program at future companies if he moves to a business collecting consumer information

I'm not aware of any other decree following the CEO to other companies.

Re: FTC Takes action against Drizly and CEO following security breaches

#15

Post by fragmede »

raunak wrote: post #12

Honestly, somebody should take action against Drizly for how easy they make buying alcohol underage if anything (not that I care).

How does Drizly change that? I've had to show ID to prove age for the few Drizly orders I've made (even if there wasn't alcohol in the delivery). If the teenager already has a fake ID, how does Drizly move the meter on how easy it is to get alcohol?

Re: FTC Takes action against Drizly and CEO following security breaches

#17

Post by fragmede »

jnorthrop wrote: post #14
ferrocarraiges wrote: post #7

I am genuinely curious: why did the FTC take this enforcement action? There is no fine, no prosecution, no consequences of any sort. Essentially, they're just asking the executive to "implement an information security program" at any companies they head. This seems to send the message that there are absolutely no consequences for getting caught hiding an extremely negligent data breach. Was that the FTC's intent?

There is this condition > Recognizing that reality, the Commission’s proposed order will follow Rellas even if he leaves Drizly. Specifically, Rellas will be required to implement an information security program at future companies if he moves to a business collecting consumer information I'm not aware of any other decree following the CEO to other companies.

That's an interesting thing to hang around his neck. You'd hope all companies like that (25k+ customers) already have an information security program though. Maybe Relias can take it as a selling point and has a future as an infosec CEO?

Re: FTC Takes action against Drizly and CEO following security breaches

#19

Post by philip1209 »

jnorthrop wrote: post #14
ferrocarraiges wrote: post #7

I am genuinely curious: why did the FTC take this enforcement action? There is no fine, no prosecution, no consequences of any sort. Essentially, they're just asking the executive to "implement an information security program" at any companies they head. This seems to send the message that there are absolutely no consequences for getting caught hiding an extremely negligent data breach. Was that the FTC's intent?

There is this condition > Recognizing that reality, the Commission’s proposed order will follow Rellas even if he leaves Drizly. Specifically, Rellas will be required to implement an information security program at future companies if he moves to a business collecting consumer information I'm not aware of any other decree following the CEO to other companies.

Interesting - as cybersecurity insurance becomes more popular, I'm curious how orders like this will affect that. Maybe there will be a new checkbox on insurance forms saying "I'm not personally sanctioned by the FTC for information security lapses"

Re: FTC Takes action against Drizly and CEO following security breaches

#20

Post by hayst4ck »

lancesells wrote: post #16

Is there any sort of browser extension that shows number of known security breaches when you visit a website? Would be interesting.

How would you propose tallying up the number of security breaches?

You would need a way to collect breaches by company, and then a way to tie companies to their URLs. Additionally, is solarwinds a Microsoft breach?

If there were a repository of known security breaches, I think the rest could be done manually or fairly easily for a specific list of websites.

Post reply on HN