I have one area / worry that I would like Troy to introduce as a question and to give his advice / opinion as a subject matter expert: 1) The role and responsi

I have one area / worry that I would like Troy to introduce as a question and to give his advice / opinion as a subject matter expert: 1) The role and responsibilities of security researchers in discovering and investigating data breaches (maybe also discuss the spectrum from white-hat to black hat, yet the tools they all use are effectively the same). 2) The role and responsibilities of journalists in reporting the said breaches. 3) The impact of laws and litigation leveraged by governments and corporations to protect themselves in the event of data breaches. 4) Why a fair and happy balance between the interests of 1), 2) and 3) is a necessary part of mitigating and reducing the possibility of data breaches along with unhappy examples and their consequences. I'll admit that four questions above are a kind of scope creep to the intended discussion, but my concern is pretty real. The laws and norms that we have today, while imperfect, are the reason why Troy is being asked to appear as a subject matter expert. Whatever the laws and norms of the future are, they will need to sufficiently flexible to allow future subject matter experts to learn and operate, so that they too can make meaningful contributions to the issues of their time. Edit: formatting