INTRODUCTION
Ron Lieber’s 2017 New York Times article “Why the Equifax Breach Stings So Bad” examines the response of the general public to Equifax’s data breach, which involved the compromise of private credit records of over 140 million Americans, along with sizable numbers of British and Canadian citizens. Lieber presents responses about the breach, solicited from members of the general public. Responses included expressions of disillusionment at the idea of personal data being treated as a commodity in which we have little to no say over how this information is used. Others expressed “resentment…over being trapped in Equifax’s vast web of data, with no recourse and no ability to opt out.” Still more people wrote to express deep distrust that the remediation process was being run poorly by the people who allowed this to happen in the first place. In this Case Analysis, I will argue that the Confucian tool for moral reasoning shows us that the Equifax breach harmed the general public by not only failing to adequately secure important personal information vital to life as an economic entity in the modern world, but also by mishandling almost every aspect of the response in the aftermath, including disclosure of the breach and remediation, and that this was morally bad.
Anshen: “Changing the Social Contract: A Role for Business”
Before discussing Melvin Anshen’s article “Changing the Social Contract”, I would like to point out a few things brought up in Lieber’s that illustrate how bad the Equifax breach was. Lieber compares this breach to similar scandals committed by Wells Fargo and Volkswagen, but he points out that “even though those companies committed similarly egregious offenses,” the an issue he had not seen come up that people were expressing “a sense of helplessness, the recognition that we are at the mercy of an industry that makes money off our data, treats us with disdain and answers to no one.”
Later in the same article, Lieber outlines what I believe is the most painful underlying issue laid bare by this breach:
If you want to do business with just about any financial services company, you must agree to allow it to report your payment history to the credit reporting agencies. This is reasonable in theory: An accurate central repository of data ought to make getting credit easier and cheaper. But there does not appear to be any way to step out of the system unless you can live a life completely free of the need for credit, mobile phones and many jobs (since employers often make a credit check a condition of employment).
These two points serve to underscore a point made by Anshen, “the social contract is continually up for renewal, its terms under continuous negotiation.” Anshen argues that the social contract has always existed as an extension of nature, and that it is being continually revised as new technologies and economic ideals are introduced to society at large. The best way to amend the contract, he says, is through slow, incremental changes to the mutual benefit of all parties. The alternative is violent revolution, or heavy-handed government regulation, which can stifle innovation or produce other, deadlier consequences.
In the case of the Equifax breach, we can see how there was slow, incremental change made to the social contract. Simply put, the current state of credit reporting and its influence on society did not exist as it does now until the late 1980s. However, this change was not implemented in a balanced way. As reflected in the responses Lieber received, we suddenly find ourselves in this financial panopticon, which has far-reaching consequences in the ability of individuals to have choice of where to live, what automobiles to purchase, where they can attend educational institutions, and even whether or not they can be employed. Consider an individual who is “credit invisible”, meaning there is no credit history on record. If there are employers who make a credit check a condition of employment, as Lieber points out, the choices a credit-invisible person has for employment have suddenly become severely limited. Could you consider this social progres? Is this advancement of the social contract? I think that the Confucian tool for moral ethics shows us that it is not.
Equifax (and the credit reporting industry in general) has insinuated itself in a position where they have a quiet but immense power over an important aspect of people’s lives. As the saying goes, “with great power comes great responsibility”. In the social justice-aware climate of the last couple of years, we are also learning how institutions like these can practice a form of “economic discrimination,” whereby things like credit invisibility and low credit scores seem to disproportionately affect historically marginalized minority populations. I think the Confucian tool for moral reasoning shows us that Equifax is not acting in the best possible manner for the role they exercise in society: their methods are not transparent; it is difficult to contest erroneous information that makes its way onto people’s records; and they’ve exhibited a lackadaisical, “let them eat cake” response to serious breaches of personal financial data for which they were directly responsible.
Liebman closes his article with a discussion of how politicians have set their sights on regulating the credit reporting industry to make it a more balanced experience for “users” and their data, to give people more autonomy over what types of data can be collected, if at all. I think this fits Anshen’s model of amending the social contract, although I think it’s unfortunate that it requires a punishment-minded solution. I have long been of the opinion that people should do the right thing because it is the right thing to do, and not because they seek reward or fear punishment.
Friedman: “The Social Responsibility of Business Is to Increase Its Profits”
As is pointed out in the various annotations, Milton Friedman’s landmark essay “The Social Responsibility of Business Is to Increase Its Profits” laid the basis for the “greed is good” economic policies of the 1980s, a period of time characterized by “government-bad business-good” economic policies in the Western world. Friedman was responding to outrage expressed by communities and organizations that were pointing out the harm businesses were doing to the environment and to economically depressed populations (especially minorities). The argument from this camp was that there is a social responsibility for businesses to take responsibility for the part they play in the harm they’re causing to these entities.
Friedman could not disagree more with this premise. In the essay, Friedman asserts that there is no such requirement for a business or its Chief Executive(s) to even care about anything other than increasing profits for shareholders. “Only people can have responsibilities,” he writes.
I believe Friedman would have a poor opinion of the Equifax breach, but only insofar as it exposed Equifax to damage which could reduce its profit share. I don’t believe Friedman would have any sympathy for the damage to which its user base was exposed, except perhaps for the fact that it might reduce customers’ interest in doing business with Equifax and thereby reducing profits. I don’t believe he would support the position that Equifax has any responsibility to make things right, or change their way of doing business, especially if it reduces profits. Friedman would strongly oppose any regulation of the business or the industry.
I think Friedman’s position is in opposition to the Confucian tool for moral reasoning. Friedman points out that, legally speaking, a corporation’s purpose is to shift liability and risk off of the individuals who have created the business, onto the business itself. Legally speaking, there is no distinction between a corporation and a living person. If we consider this mindset, we can think of a business or a corporation as a member of the community. I think the Confucian tool for moral reasoning makes it clear that members of a community should be acting in the best way possible for the role they have.
If we consider a business as a member of the community, or a neighbor, we can ask ourselves some questions about their behavior. Would we tolerate a neighbor who pollutes the air we breathe, who poisons the water we drink? I should hope not. Would we tolerate a neighbor who follows us around and tracks who follows us around, jotting down our spending habits and who we spend time with? Again, I don’t believe we would. Would we be okay with a neighbor who has all this information insinuating himself as a gatekeeper to economic prosperity? Again, I think it would be difficult to find someone who would agree with this position.
Again, we find ourselves at a point where it’s clear that Equifax was not operating according to the Confucian tool for moral reasoning by not acting within their role as a “good neighbor,” or a good member of society.
CONCLUSION
The 2017 Equifax breach demonstrated a prime example of an organization acting in contravention to the Confucian tool for moral reasoning by not behaving in the best manner for its role at all times possible. Friedman would argue that there is a distinction between a business and a person, and therefore the social contract doesn’t apply to businesses, whose singular and primary interest is maximizing profits. Anshen would disagree, arguing that because a business is composed of people, and itself functions as a person within society, that there is an obligation for a business to adhere to the norms of the social contract, including the social responsibility of doing the least harm possible.
Looking back at the history which has passed since Friedman published his essay, I can’t help but feel as though his mindset prevailed. The 1980s were a period of time famously characterized by excess, a byproduct of the “greed is good” mindset which is rooted in the philosophy Friedman outlines: make the most money possible and everything else be damned. I wonder what the world might look like today if, instead of money being the highest priority, people’s welfare took the top spot.