4 ms·

A news source will at least try to get the other side of things.

ameliaquining 5y ago
In a criminal case like this, the other side is unlikely to say anything very specific in their own defense, to avoid jeopardizing their case in court. So the press release is most of what a news outlet will have to go on.
hluska 5y ago
It’s an indictment so it’s really the only (palatable) side available right now. The person indicted is unlikely to give a statement because anything they say could harm their defense. Their attorneys certainly will not speak in any substantive way. That leaves media outlets with options like ‘contact their grandma’ to try to get a statement. Some journalists will try stuff like that, but that’s arguably worse than a press release.
- ianhawes 5y ago
  This case has implications across the board for CISOs that have to deal with incidents like this. I believe this case also dealt with a payout for a "bug bounty".
  - hluska 5y ago
    It did. If you're interested, the congress hearing is here. That hearing is still the primary source for this story. It's worth some time - some journalists have tried to cover this but mostly just cherrypicked quotes. The entire hearing is better than any of the coverage. https://www.commerce.senate.gov/2018/2/data-security-and-bug-bounty-programs-lessons-learned-from-the-uber-breach-and-security-researchers https://www.commerce.senate.gov/2018/2/data-security-and-bug... You can watch the hearing on that page (it's more interesting to watch than to read) or find links to the various witnesses and their testimony. For example, if you want to read John Flynn's testimony, it is available here (.pdf): John Flynn - CISO @ Uber - https://www.commerce.senate.gov/services/files/7D70E53E-73E9-4336-A100-67B233084F12 https://www.commerce.senate.gov/services/files/7D70E53E-73E9... At this point, the only real lesson for CISO's seems to be 'report'.

In a criminal case like this, the other side is unlikely to say anything very specific in their own defense, to avoid jeopardizing their case in court. So the press release is most of what a news outlet will have to go on.

hluska 5y ago

It’s an indictment so it’s really the only (palatable) side available right now. The person indicted is unlikely to give a statement because anything they say could harm their defense. Their attorneys certainly will not speak in any substantive way. That leaves media outlets with options like ‘contact their grandma’ to try to get a statement. Some journalists will try stuff like that, but that’s arguably worse than a press release.

ianhawes 5y ago
This case has implications across the board for CISOs that have to deal with incidents like this. I believe this case also dealt with a payout for a "bug bounty".
- hluska 5y ago
  It did. If you're interested, the congress hearing is here. That hearing is still the primary source for this story. It's worth some time - some journalists have tried to cover this but mostly just cherrypicked quotes. The entire hearing is better than any of the coverage. https://www.commerce.senate.gov/2018/2/data-security-and-bug-bounty-programs-lessons-learned-from-the-uber-breach-and-security-researchers https://www.commerce.senate.gov/2018/2/data-security-and-bug... You can watch the hearing on that page (it's more interesting to watch than to read) or find links to the various witnesses and their testimony. For example, if you want to read John Flynn's testimony, it is available here (.pdf): John Flynn - CISO @ Uber - https://www.commerce.senate.gov/services/files/7D70E53E-73E9-4336-A100-67B233084F12 https://www.commerce.senate.gov/services/files/7D70E53E-73E9... At this point, the only real lesson for CISO's seems to be 'report'.