3 ms·

Not because you got hacked. No. Hell no. I never suggested that and reject it totally. We're talking about cover up, if you cover up the fact someone stole pri

by harry8 9y ago

Not because you got hacked. No. Hell no. I never suggested that and reject it totally. We're talking about cover up, if you cover up the fact someone stole private data belonging to other people you took responsibility for. If you try and pretend it didn't happen because you might get away with it then claim you didn't know when it comes out? Then yes, absolutely, you deserve to risk jail time for that. As does your board of directors. CSOs, senior management, boards of directors should be personally responsible for their own actions. They need to have something at stake that they really dread losing when making the decision "perhaps we can get away with this?"

jbob2000 9y ago
The problem with jail time is that the courts need to assess how much damage was done to determine what a fair sentence is. How do you assess the damage done during a data leak? Do you get one hour of jail time for each person's data you leaked? Do you get a day per gigabyte leaked? What if nobody does anything with the stolen data? And how do you make that scale? If I miss a semicolon and leak 5 people's data, then I'd hardly get any jail time. If I miss a semicolon and leak 150,000,000 people's data, I will die in prison. In both scenarios, I made the same error, but the outcomes were insanely different!
- Atheros 9y ago
  The law as plenty of experience dealing with sufficient nuance to distinguish a mistake from negligence.
dboreham 9y ago
Covering up isn't done by the CSO. It'll be driven by lawyers, or worst-case by a rogue CEO. Mind you the CSO would be expected to resign under those circumstances, if they were kept in the loop on the cover up plan.
whack 9y ago
IANAL but isn't it already the case that if you knowingly break a law, you can be convicted and sentenced to jail? In this case, I'm assuming that it's not against the law to cover up a hacking incident, in which case there's no basis to suggest putting someone in jail.

by harry8 9y ago

jbob2000 9y ago

The problem with jail time is that the courts need to assess how much damage was done to determine what a fair sentence is. How do you assess the damage done during a data leak? Do you get one hour of jail time for each person's data you leaked? Do you get a day per gigabyte leaked? What if nobody does anything with the stolen data? And how do you make that scale? If I miss a semicolon and leak 5 people's data, then I'd hardly get any jail time. If I miss a semicolon and leak 150,000,000 people's data, I will die in prison. In both scenarios, I made the same error, but the outcomes were insanely different!

Atheros 9y ago
The law as plenty of experience dealing with sufficient nuance to distinguish a mistake from negligence.

dboreham 9y ago

Covering up isn't done by the CSO. It'll be driven by lawyers, or worst-case by a rogue CEO. Mind you the CSO would be expected to resign under those circumstances, if they were kept in the loop on the cover up plan.

whack 9y ago

IANAL but isn't it already the case that if you knowingly break a law, you can be convicted and sentenced to jail? In this case, I'm assuming that it's not against the law to cover up a hacking incident, in which case there's no basis to suggest putting someone in jail.