Tech Musing 1: Casino Sues Cybersecurity Company

http://thehackernews.com/2016/01/casino-hacker.html

Recently, the casino company Affinity Gaming, owner of over 11 different casinos across the US, sued their third-party IT Security firm, Trustwave, on the grounds that they conducted a "woefully inadequate" investigation into a previous data breach. In late 2013, Trustwave was hired after an initial hack to the Casino's systems in which over 300,000 credit cards were compromised. Trustwave was brought on to analyze the Casino's network and contain and eliminate any problems. Their result was a report in which they identified the source of the intrusion, as well as eliminated the malware that was responsible. Nearly a year later, the casino was hit with another similar credit card data breach. Affinity Gaming then hired another IT security firm, Mandaint, to investigate the new breach and Trustwave's report. Now, Affinity Gaming suing Trustwave for a minimum of $100,000.

This is an interesting situation that brings up some ethical questions. The first being 'Should the casino company sue Trustwave even thought they allegedly fixed the problem and erased the malware?' It could be possible that they did everything in their power to correct the systems, but hackers were simply more experienced and found a different way in. Another thought I had was 'What exactly was Trustwave hired to do?' It could have been in the contract that the only goal was to resecure the systems and eliminate the intrusion. In this case, was Trustwave responsible to go over their goal and add more security to the entire system? My last two thoughts I have are 'Does Affinity Gaming owe anything to its customers if it wins? And if it doesn't, then does the customer have grounds to sue Affinity Gaming?' As we get further into this semester, I will be curious to see the established laws and requirements that go into these sort of things, as well as the outcome to this case.

-Dixon Anthon