I hacked a dating app (and how not to treat a security researcher)

I would like to see laws that make storing PII as dangerous as storing nuclear waste. Leaks should result in near-certain bankruptcy for the company and legal jeopardy for the people responsible.

That’s the best way I can think of to align incentives correctly. Right now there’s very little downside to storing as much user information as possible. Data breach? Just tweet an apology and keep going.

> I would like to see laws that make storing PII as dangerous as storing nuclear waste.

This is a little extreme IMO. PII encompasses a lot of data, including benign things like email address stored only for authentication and contact purposes.

I mean, we could consider email like light waste, can't dump it in the environment like plastic trash, but if you handle it correctly with cheap disposal methods it will be ok.

Things like photos of IDs/passports should be considered yellowcake.

White collar jail?

That might be the only way to give the issue the attention it deserves.