5 ms·
What a magnificent snarl of incentives for the SEC. The SEC wants disclosure for good reasons, but if you disclose because the hacker group is the one that repo
by jerf 3y ago
What a magnificent snarl of incentives for the SEC. The SEC wants disclosure for good reasons, but if you disclose because the hacker group is the one that reported it, that is essentially the "negotiating with terrorists" incentive structure. Ignore the report because it's the hacking group and it opens the defense for all companies to claim the report is made by the hacking group (because they can easily be deceptive about who is reporting). And so on and so on... what a mess.
- AlotOfReading 3y ago"Pay up or we'll report you to the government" is a textbook example of blackmail. The gordian knot is easy to cut here though. The SEC can to refer illegal activities to the DOJ for prosecution separately from however they deal with the reporting issues.
- jerf 3y agoWell, the SEC can refer all they want, but the DOJ is going to have jurisdiction over approximately 0% of the referrals.
- RandomLensman 3y agoWant to refer it to the DOD instead?
- brewdad 3y agoInterior? Education? We can keep referring until we hit the right department.
- nvy 3y agoThe joke is that DOD is the long arm of US foreign policy. Can't prosecute? Invade.
- jerf 3y agoDefinitely closer to what I mean. Intelligence agencies is probably closer to the reality though. To those mystified by my crypticness, yes, my point is that the criminals are going to not be in the US and be where the US can't simply prosecute them, and this is not just a coincidence. They are in those places for that very reason. They may even be actively supported by their local government, so don't count on extradition or anything else like that. Even nominally friendly governments that we have treaties with are perfectly capable of 100% coincidentally simply not being able to find those guys, so sorry, we feel really bad for you though, if they want to. Paper is only worth the actions it produces.
- bluGill 3y agoThat depends. Most countries you refer to the department of state who in turn talks to law enforcement in the country where the hackers are from and that country takes care of the problem. However most hackers seem to be from countries like Russia, or North Korea where law enforcement will tell the state department to go away. DoD probably is the only option we have (though intelligence/CIA should get involved) - is it worth war?
- JumpCrisscross 3y ago> the DOJ is going to have jurisdiction over approximately 0% of the referrals Why? A U.S.-listed company was hacked.
- hiatus 3y agoI think they are referring to jurisdiction to enforce any judgement against the actor, which is likely in a foreign state with no extradition agreement with the US.
- JumpCrisscross 3y ago> jurisdiction to enforce any judgement against the actor, which is likely in a foreign state with no extradition agreement with the US Justice has a long memory. A common theme, when new extradition agreements are struck, usually in the context of trade or security arrangements, is how to deal with the backlog of overdue enforcement.
- hiatus 3y agoI agree in general, but I won't hold my breath for any agreement to be made between the US and Russia, Iran, North Korea, or China in my lifetime.
- anonymousDan 3y agoYes, I don't see the issue. If I understand correctly then reporting doesn't necessarily mean you are going to be in trouble (so long as you report in time)?
- koolba 3y agoPlus you can use any SEC whistleblower money for your legal defense against the hacking.
- autoexec 3y ago> "Pay up or we'll report you to the government" is a textbook example of blackmail. It's hard to feel too bad about companies who are actually doing illegal things that the government should be notified about anyway. It's like someone reporting their drug dealer to the police because they discovered their dealer was lacing their drugs with fentanyl. Sure, they're a snitch, but people are safer knowing the truth.
- FireBeyond 3y agoExactly. The desired outcomes may be different, but the incentives are temporarily, perversely aligned.
- marcosdumay 3y agoHum, no, your example is not blackmail. It would be like the customer asking for free drugs or else he would report the dealer. Anyway, the obvious course of action is to persecute the company and arrest the hacker. The problem here is probably that arresting the hacker is difficult.
- sonicanatidae 3y agoOh I think they'll managed to figure out a way to keep corporations safe, at the expense of the citizens. That's the historical precedent.
- JumpCrisscross 3y ago> at the expense of the citizens The SEC doesn't work for "the citizens," its mandate is in respect of investors. Especially small investors. U.S. law, broadly, prioritizes first consumers, then investors, and way, way, way below that, workers.
- sonicanatidae 3y agoCitizens are investors and routinely take it in the shorts. The SEC's role is to manage the market, you know, with the fairness and all that.
- RationalDino 3y agoI don't see any snarl. The law requires disclosure so that companies can't hide material information from investors. The SEC wants all incentives lined up so that companies will choose to report. The primary way that the SEC catches them now is that the data showed up somewhere like a data breach. So ultimately, the behavior of the hacker group is the source. This hacker group just cut out several steps in the middle. The SEC verifies it, the company gets punished, and companies are on notice that they really should report. Just like the law says. What WOULD be a problem is if the hacker group got rewarded for reporting...
- nickff 3y agoIf the SEC pursues prosecutions based on reports from hackers which uses the threat of SEC reports to extract payments, the SEC will be enabling and enforcing blackmail. The SEC would essentially be an accessory to the crime.
- elefanten 3y agoThat’s not how the law would see it. Blackmailers incorporating otherwise-legal third party activity into their threat does not add legal liability for that 3rd party. Nor does it excuse any pre-existing liability for the blackmail target.
- nickff 3y agoI'm not sure whether there'd be legal liability; that would probably depend on whether the third-party was aware of the scheme, and how often they 'enabled' it. I doubt that the SEC would be found to be an accessory the first time this happened (unless they'd been specifically warned), but if this happened frequently, I think they'd likely be found guilty by way of 'reckless or wanton negligence'. They might even be subjects of civil actions by victims of these blackmail schemes at a later date (if the circumstances were right).
- fooker 3y ago>What WOULD be a problem is if the hacker group got rewarded for reporting Insider trading? But without being an actual insider.
- djyaz1200 3y agoAgree the incentives are a mess. SEC needs to change the incentives. For example, the process for filing complaints could include a $1M fee refundable at 2X if you're right and a tax-paying citizen and/or entity. These types of hackers exist outside of a society ruled by law, and it's unacceptable to let them leverage the tools of a civilized society if they don't live within its rules and pay taxes. If someone has a better idea for how to fix the incentives, I'd be sincerely interested to hear it.