I'm Testifying to Congress about Data Breaches – What Should I Say?
To me, the main issue is accountability.<p>A citizen&#x27;s data can be collected, badly secured, stolen, and used by criminals without the user ever being aware of step 1. Just like a citizen can get ill from swimming in a river without ever being aware of the factories upstream.<p>The solution is not to force citizens to constantly be on the lookout. It&#x27;s to severely punish polluters and leakers.<p>When a CTO says &quot;let&#x27;s collect geolocations&quot;, the CEO should  should have legal and business reasons to say &quot;no way, it&#x27;s not worth the financial risk of losing them; it could destroy our company.&quot;<p>---<p>Update: I do <i>not</i> think the government should mandate specific practices; it&#x27;s too complicated, too fast-changing, and too hard to police.<p>It should be entirely results-based. You lose people&#x27;s data, you pay big bucks. Figuring out how not to lose it is <i>your</i> problem. The government sets the rules, and the market plays the game.