5 ms·

> My analysis will treat this as an accident. How does that work for a scenario where specific and intentional actions were taken by an individual or group of

> My analysis will treat this as an accident. How does that work for a scenario where specific and intentional actions were taken by an individual or group of individuals, that may or may not have been illegal? You can’t analyze an armed robbery prosecution as an accident without ignoring all of the most significant aspects of the case.

projektfu 4y ago
In fairness, this is a conviction for failing to call the police (misprision) when your boss decided to cover up a data breach, not for committing armed robbery. Obstruction of justice as well. On another note, future whistleblowers could, I suppose, cite this as a reason why they cannot keep their mouth shut.
tptacek 4y ago
The point of the postmortem is to educate people as to what to do differently. You get more value out of the "accident" frame than out of the "malice" frame, which has already been intensively explored by the DOJ. Most organizations aren't going to be in a position of having a formal federal prosecutor serving as CSO and Deputy General Counsel making grave errors in fitting a report to a bug bounty process instead of a criminal investigation, but it's easy to imagine a variety of organizations landing in a variety of different scrapes about how to route reports that might trigger breach report liability.
atoav 4y ago
> You can’t analyze an armed robbery prosecution as an accident without ignoring all of the most significant aspects of the case. Depends on the scope of the analysis. You can analyze why the security systems allowed for that armed robbery to happen and recommend how to prevent this from happening in the future. You can analyze what societal factors and incentive structures lead to this and similar robberies and how to reduce the likelyhood of that occuring in the future. For all of this the question of guilt doesn't matter at all.
ineptech 4y ago
The purpose of a retro is to identify a process that will keep some bad thing from happening again; a process that keeps the bad thing from happening for any reason is strictly better than a process that keeps the bad thing from happening due to malice. If your infra engineers can't expose your PII on accident, they can't expose it on purpose either. To extend your analogy, it's the difference between locking your house (which protects your valuables from thieves, but not your garden hose and wheelbarrow from your drunken neighbor) vs. locking your shed as well.
- remram 4y ago
  > If your infra engineers can't expose your PII on accident, they can't expose it on purpose either. That sounds exactly backwards.
  - geraldyo 4y ago
    Both are true
    - remram 4y ago
      Definitely not. Many things are designed to prevent accidents and are not secure against attacks, even in the data landscape.
nimbius 4y ago
from the perspective of someone who did time for cannabis its real simple. crimes are and always have been for the poors. rich people do profound esoteric actions with unfortunate outcomes that merit long study and rumination with post mortem analytics and an academic conclusion. unless you did a sex crime like weinstein or took a lot of rich people money like madoff. this whole article is just the rich people version of ' yeah my cousin beat up a mascot once but in his defense that mascot was awful too'

projektfu 4y ago

In fairness, this is a conviction for failing to call the police (misprision) when your boss decided to cover up a data breach, not for committing armed robbery. Obstruction of justice as well. On another note, future whistleblowers could, I suppose, cite this as a reason why they cannot keep their mouth shut.

tptacek 4y ago

The point of the postmortem is to educate people as to what to do differently. You get more value out of the "accident" frame than out of the "malice" frame, which has already been intensively explored by the DOJ. Most organizations aren't going to be in a position of having a formal federal prosecutor serving as CSO and Deputy General Counsel making grave errors in fitting a report to a bug bounty process instead of a criminal investigation, but it's easy to imagine a variety of organizations landing in a variety of different scrapes about how to route reports that might trigger breach report liability.

atoav 4y ago

> You can’t analyze an armed robbery prosecution as an accident without ignoring all of the most significant aspects of the case. Depends on the scope of the analysis. You can analyze why the security systems allowed for that armed robbery to happen and recommend how to prevent this from happening in the future. You can analyze what societal factors and incentive structures lead to this and similar robberies and how to reduce the likelyhood of that occuring in the future. For all of this the question of guilt doesn't matter at all.

ineptech 4y ago

The purpose of a retro is to identify a process that will keep some bad thing from happening again; a process that keeps the bad thing from happening for any reason is strictly better than a process that keeps the bad thing from happening due to malice. If your infra engineers can't expose your PII on accident, they can't expose it on purpose either. To extend your analogy, it's the difference between locking your house (which protects your valuables from thieves, but not your garden hose and wheelbarrow from your drunken neighbor) vs. locking your shed as well.

remram 4y ago
> If your infra engineers can't expose your PII on accident, they can't expose it on purpose either. That sounds exactly backwards.
- geraldyo 4y ago
  Both are true
  - remram 4y ago
    Definitely not. Many things are designed to prevent accidents and are not secure against attacks, even in the data landscape.

nimbius 4y ago

from the perspective of someone who did time for cannabis its real simple. crimes are and always have been for the poors. rich people do profound esoteric actions with unfortunate outcomes that merit long study and rumination with post mortem analytics and an academic conclusion. unless you did a sex crime like weinstein or took a lot of rich people money like madoff. this whole article is just the rich people version of ' yeah my cousin beat up a mascot once but in his defense that mascot was awful too'