[alexis_fr]

More like, if a car is caught in a pile-up accident, it is both guilty of hitting the car ahead and victim of being hit by the next car. If he was pushed by the back car into the front car, and took all necessary precautions, he can call for a kind of force majeure and make the back car pay for both, but the agressor has to be formally identified. Mariott didn’t take enough precautions to pretend being victim of a hacker.

[throwaway5752]

"Mariott didn’t take enough precautions to pretend being victim of a hacker."

Marriott was literally, prima facie, the victim of a hacker. The data didn't steal itself. Someone trespassed into Marriott's network and stole data that did not belong to them.

Legal culpability, while certainly not the strong point of HN, is a thing. Negligent, grossly negligent, and reckless conduct are technical terms that exist and have meaning.

I'm sick of replying to this because I don't like defending Marriott in this case. I hope they get a painful class action ruling. I think legal reforms around this are needed, but I am entirely unconvinced anyone here has a reasonable framework of regulations that would benefit anyone.

[crandycodes]

I was confused by this comment but I think what you're trying to criticize is this: "Mariott didn’t take enough precautions to pretend being victim of a hacker."

I agree with that criticism. It's not a crime to be a victim, but being a victim also doesn't mean you're not guilty.

Marriott might, however, still be liable for some damages due to not following common security practices for sensitive personal information. Anyone from California, for example, would have § 1798.81.5 [1] and § 1798.91.04 [2] which would backup their right to have their data handled properly. The FTC might also get involved with their fairly broad powers to protect users privacy (though that agency has been limited in this administration).

[1] http://leginfo.legislature.ca.gov/faces/codes_displaySection... [2] https://leginfo.legislature.ca.gov/faces/billCompareClient.x...

[throwaway5752]

For the record I didn't think anything you wrote warranted a downvote and hope my response (though sincere, and I definitely disagree with you) didn't cause anyone else to downvote your comment. I don't think it varies much from much of the sentiment expressed in this discussion.