These companies crying foul, and crying about losses are almost certainly companies that had pathetic security. If I parked $10 million dollars worth of china next to a football stadium with drunks and then complained why I kept losing merchandise no one would be sympathetic. It is only because computers are "mysterious" to the general public, and computer security is arcane to even many computer users that this goes on. The internet is too interconnected to provide a "deterrent" to the worlds population. Even if there were a death sentence for hacking/vandalism it wouldn't deter a computerized "suicide hacker" from syria or palestine would it? The only recourse is defensive, not offensive. The volume of crime in the US is an example of the ineffectiveness of our so-called justice system anyway. All of these companies would be better off a)publicly announcing and admitting all computer security problems, and perhaps even being forced to by law and b)taking a "super hardened defence" model for their security. I have worked at many companies and they story is always the same: temps, contractors and perm employees have 0 training in secure computing, default passwords are weak, patch levels are low, internal security measures are sparse or non-existent. In a dangerous factory that hurts employees, we don't blame the employees for losing a hand from a saw with no safety cover, or lacking training. But the virus writer is doing the equivalent of promulgating dangerous saws. They won't hurt the properly trained. Smart employees and companies would avoid them. But stupid companies suck up the dangerous saws and hands and feet go flying. Traditionally we sue dangerous manufacturers (except Microsoft for some reason), but lawsuits assume physical(legal) proximity, and the internet doesn't have that. We have no world court. And the US has a lot of enemies and every time that idiot Bush opens his mouth we have a few more. The "Axis of Evil" will be glad to sponsor some electronic data mischief, I am assuming. Are we to jail or sue Iran, Iraq or muslim extremists in Kashmir, Pakistan or Palestine?

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/81/12784#12784