4 ms·

What law obligates a company to report a breach? Is this only applicable for publicly traded companies?

colechristensen 6y ago
You get an obstruction charge when it seems easier to convict or you can't make a solid case on the crime being investigated, and you don't have to be guilty of the investigated crime to be guilty of obstruction. I could imagine crimes being committed might include securities fraud, money laundering, bribery... Most states have data breach laws. for California: >California law requires a business or state agency to notify any California resident whose unencrypted personal information, as defined, was acquired, or reasonably believed to have been acquired, by an unauthorized person. https://oag.ca.gov/privacy/databreach/reporting https://oag.ca.gov/privacy/databreach/reporting
iagooar 6y ago
Know this is not the case here, but any company in the EU must report a breach involving personal data. This was introduced with the EU-GDPR: https://gdpr-info.eu/art-33-gdpr/ https://gdpr-info.eu/art-33-gdpr/
kube-system 6y ago
This is the law cited in the article: https://www.law.cornell.edu/uscode/text/18/4 https://www.law.cornell.edu/uscode/text/18/4
- DaniloDias 6y ago
  So this expectation is that Americans know all the possible felonies the people around them are committing? What a law. “ It has been reported that the Congressional Research Service cannot even count the current number of federal crimes. These laws are scattered in over 50 titles of the United States Code, encompassing roughly 27,000 pages. Worse yet, the statutory code sections often incorporate, by reference, the provisions and sanctions of administrative regulations promulgated by various regulatory agencies under congressional authorization. Estimates of how many such regulations exist are even less well settled, but the ABA thinks there are ”nearly 10,000.” https://www.wired.com/2013/06/why-i-have-nothing-to-hide-is-the-wrong-way-to-think-about-surveillance/ https://www.wired.com/2013/06/why-i-have-nothing-to-hide-is-...
  - kube-system 6y ago
    > So this expectation is that Americans know all the possible felonies the people around them are committing? When relevant case-law is taken into account, it appears that is not the case. Courts require active concealment of a known felony for conviction under that statute. https://en.wikipedia.org/wiki/Misprision_of_felony#cite_note-6 https://en.wikipedia.org/wiki/Misprision_of_felony#cite_note... In this case, a CISO certainly is aware of the CFAA.
    - DaniloDias 6y ago
      >> In this case, a CISO certainly is aware of the CFAA. That is a fair counterpoint

You get an obstruction charge when it seems easier to convict or you can't make a solid case on the crime being investigated, and you don't have to be guilty of the investigated crime to be guilty of obstruction. I could imagine crimes being committed might include securities fraud, money laundering, bribery... Most states have data breach laws. for California: >California law requires a business or state agency to notify any California resident whose unencrypted personal information, as defined, was acquired, or reasonably believed to have been acquired, by an unauthorized person. https://oag.ca.gov/privacy/databreach/reporting https://oag.ca.gov/privacy/databreach/reporting

iagooar 6y ago

Know this is not the case here, but any company in the EU must report a breach involving personal data. This was introduced with the EU-GDPR: https://gdpr-info.eu/art-33-gdpr/ https://gdpr-info.eu/art-33-gdpr/

kube-system 6y ago

This is the law cited in the article: https://www.law.cornell.edu/uscode/text/18/4 https://www.law.cornell.edu/uscode/text/18/4

DaniloDias 6y ago
So this expectation is that Americans know all the possible felonies the people around them are committing? What a law. “ It has been reported that the Congressional Research Service cannot even count the current number of federal crimes. These laws are scattered in over 50 titles of the United States Code, encompassing roughly 27,000 pages. Worse yet, the statutory code sections often incorporate, by reference, the provisions and sanctions of administrative regulations promulgated by various regulatory agencies under congressional authorization. Estimates of how many such regulations exist are even less well settled, but the ABA thinks there are ”nearly 10,000.” https://www.wired.com/2013/06/why-i-have-nothing-to-hide-is-the-wrong-way-to-think-about-surveillance/ https://www.wired.com/2013/06/why-i-have-nothing-to-hide-is-...
- kube-system 6y ago
  > So this expectation is that Americans know all the possible felonies the people around them are committing? When relevant case-law is taken into account, it appears that is not the case. Courts require active concealment of a known felony for conviction under that statute. https://en.wikipedia.org/wiki/Misprision_of_felony#cite_note-6 https://en.wikipedia.org/wiki/Misprision_of_felony#cite_note... In this case, a CISO certainly is aware of the CFAA.
  - DaniloDias 6y ago
    >> In this case, a CISO certainly is aware of the CFAA. That is a fair counterpoint