Schneier on Security

Clive Robinson • August 20, 2021 10:57 PM

@ Dean, Bruce, ALL,

That’s likely because of the PCI Compliance that companies have to adhere to when dealing with payment gateways and credit card companies. While those aren’t law, companies will lose access to these facilities if they don’t adhere.

Partially true, but there is rather more to it than that. Because the real reason is more down to with the “when, what, and how” of the regulating entity’s actions.

Compare the Government based legal/regulatory process and it’s outcome, and the Payment Card Industries(PCI) process and it’s outcome.

The legal/regulatory process is,

Very slow, mostly non interfering with core business, can be negotiated/appealed for a very long period of time with absolutly no change to the business, and results in a comparatively small fine (see the effect the EU GDPR had with just a real increase in fine size).

Whilst the PCI process is,

Very fast, shuts the business down, is hard to negotiate/appeal without change and reaults in at best a significant cost in business transactions making the company less profitable if not bankrupt in short order.

From a senior manager on bonus and the like, the Government action costs them personally next to nothing. The business is likely not effected in any meaningfull manner and the manager might actually have a boost in their income. The eventual fines will in all probability be relatively small to non existant. Because they will be treated as just another cost of doing business and deductable business costs at that. So whilst looking good on paper for a Government entity, such a fine will in reality have little or no real effect.

However the PCI action stops the business “dead in the water” very rapidly. Because as paymants can not be processed the business quite literally “stops dead” and has all the running costs but no income. The effective closing of the business will have significant costs in customer confidence thus brand name. Like having a “fire” it’s not at all certain the business will recover.

You can see why Government action brings little fear to a large technology or telecommunications corporation they have likely prepared for it, and may almost certainly have a business plan ready to go, with PR campaign etc already scripted etc.

However having the money flow, which is the life blood of many of these corporations “turned off” like a tap is a major fear as is the major loss in customer confidence.

Look at it this way, why should a corporation worry about a paper-cut from a Government legislator / regulator in the far future, when another corporation has the equivalent of a knife up against the jugular and would be happy to cut more than a little if it does not get what it wants as it would keep others in line?

It should tell legislators that the way to bring these corporations to heal as and when required, is not by protracted court cases and effectively inconsequential fines. But by freezing their money supply / transactions so “income stops” but “costs continue”, just as it does with ordinary human suspects who are held pending bail etc who can not work or otherwise meet their bills.

There is a “legal nicety” that corporations are equivalent to individual humans. They are clearly not when it comes to crime and punishment, thus addressing this so corporations do get treated a little more like humans might make them behave a little more like ordinary humans. You never know till you try, and I can think of a few big “brand names” that could be experimented on with little real harm…