During the 17th and 18th centuries, pirates dominated the high seas—raiding ships and seizing whatever they chose. They menaced the waterways, then sold their protection services, cleaning up on both sides. Pirates were the ultimate crony capitalists, taking advantage of favorable political and economic winds to chase spectacular profits and cultivating relationships with high-status officials. Blackbeard, one of the boldest buccaneers, cultivated a notoriously cozy relationship with the governor of North Carolina, who is thought to have shared the booty and kept the law at bay.
The days of buccaneers and cutlasses may be behind us, but the legacy lives on in other forms—as the Equifax data breach scandal vividly illustrates.
Old Blackbeard himself would have admired the ingenuity of a business set up to grab sensitive information about citizens without their consent, conjure property rights over that data by concocting proprietary formulas, and sell it to the highest bidder. So much the better if private information falls into the hands of criminals—companies can sell protection services to the same hapless citizens.
Indeed, credit bureaus are designed to take you coming and going. Their reports, often based on suspect and opaque data-mining techniques, are riddled with falsehoods that can rob consumers of favorable loans. Yet the companies have mostly succeeded in escaping liability for these errors. Even worse, they can handily profit from these same errors by charging for monitoring services and credit freezes. Anyone who has tried to get a correction to a credit report knows that the process is slow and onerous. And if you do have the time to dispute an error on your report, it can actually negatively affect your credit score until the dispute is resolved.
The oligopolistic “Big Three” credit bureaus—TransUnion, Experian, and Equifax—exist to reap billions in profit from your personal information and make it easy for lenders to charge you the highest possible interest rates. Their use of your data could result in the loss of a potential home or a job. Yet when they screw up, they have little more to fear than a negligible fine.
Back when Equifax was known as the Retail Credit Company (founded in 1899), it collected and sold information about things like the sexual proclivities and drinking habits of Americans to anyone that would pay. Now, in the digital age, it has allowed hackers to steal the private information of almost half the US population: Social Security numbers, driver’s license numbers, birth dates, credit card history, and more.
Rather than investing in appropriate security measures, Equifax has spent a pirate’s treasure lobbying Congress to help the company force consumers to settle disputes in arbitration, rather than suing them for harm. And hardly had the news of the hacking broken before the company tried to lure consumers into signing up on a “help site” to see if their data had been compromised—slipping in a fine-print clause robbing the victims of their rights to class-action suit. Equifax backed off when social media went ballistic, though the legal status of the hedge is still untested.
Meanwhile, we learn that Equifax executives dumped their stock overboard three days after the company learned of the hack — but a month before it went public with the news. That is, they appear to have eagerly protected themselves, but not the rest of us.
All told, the behavior of Equifax has been so high on the pirate-scale that it even managed to solicit criticism from JP Morgan chieftain Jamie Dimon, who told Andrew Ross Sorkin that he wasn’t surprised at what happened with Equifax and noted that if a company allowed such a breach through negligence that “you’re going to pay.”
Indeed. The Equifax data breach scandal is something more grotesque than simple market failure. This is total regulatory breakdown: Moral hazard on steroids.
Back in the late 1960s and early 1970s, Congress tried to regulate the bureaus. But the deregulation frenzy and Wall Street power plays that started in the 1980s and remain with us have rendered laws and enforcement a joke.
Back in July, the Consumer Financial Protection Bureau tried to step in by finalizing a rule prohibiting companies from forcing the arbitration abuse onto consumers. The House then promptly voted to repeal the bill. The Senate has not voted, and it remains to be seen if Equifax and its fellow corporateers have enough political partners to deliver this black eye to consumers even after the infamous hacking episode. Like the cleverest pirates, they know who their friends are. (The credit bureaus give wealthy people, like members of Congress, special protection and preferential treatment when anything goes wrong with their reports).
Meanwhile, a new bill introduced by senator Elizabeth Warren and senator Brian Schatz, aptly named “The Freedom from Equifax Exploitation Act,” would require credit reporting agencies to provide Americans with stronger fraud alert protections and an additional free credit report. That’s a start. But it’s not enough.
Nor is it enough that Equifax replaced a couple of senior staffers. We need serious fines—fines that are big enough to potentially put a company out of business if it harms citizens on a massive scale. More fundamentally, the entire structure and purpose of the industry is due for a serious rethink. One idea is to break up the credit bureau oligopoly. Or just nationalize the entire industry, so that citizens could at least expect some accountability when problems arise. And companies should also be on the hook for directly compensating victims—you and I aren’t customers, since we don’t have a choice about whether our data is collected—when their derelictions harm us.
But as long as money flows freely in our political system and politicians like Warren are few and far between, the bad guys will go on plundering and holding all of us hostage. It’s Pirates of the Caribbean, always showing at a theater near you.