3 ms·

"Pay up or we'll report you to the government" is a textbook example of blackmail. The gordian knot is easy to cut here though. The SEC can to refer illegal act

"Pay up or we'll report you to the government" is a textbook example of blackmail. The gordian knot is easy to cut here though. The SEC can to refer illegal activities to the DOJ for prosecution separately from however they deal with the reporting issues.

jerf 3y ago
Well, the SEC can refer all they want, but the DOJ is going to have jurisdiction over approximately 0% of the referrals.
- RandomLensman 3y ago
  Want to refer it to the DOD instead?
  - brewdad 3y ago
    Interior? Education? We can keep referring until we hit the right department.
    - nvy 3y ago
      The joke is that DOD is the long arm of US foreign policy. Can't prosecute? Invade.
  - jerf 3y ago
    Definitely closer to what I mean. Intelligence agencies is probably closer to the reality though. To those mystified by my crypticness, yes, my point is that the criminals are going to not be in the US and be where the US can't simply prosecute them, and this is not just a coincidence. They are in those places for that very reason. They may even be actively supported by their local government, so don't count on extradition or anything else like that. Even nominally friendly governments that we have treaties with are perfectly capable of 100% coincidentally simply not being able to find those guys, so sorry, we feel really bad for you though, if they want to. Paper is only worth the actions it produces.
  - bluGill 3y ago
    That depends. Most countries you refer to the department of state who in turn talks to law enforcement in the country where the hackers are from and that country takes care of the problem. However most hackers seem to be from countries like Russia, or North Korea where law enforcement will tell the state department to go away. DoD probably is the only option we have (though intelligence/CIA should get involved) - is it worth war?
- JumpCrisscross 3y ago
  > the DOJ is going to have jurisdiction over approximately 0% of the referrals Why? A U.S.-listed company was hacked.
  - hiatus 3y ago
    I think they are referring to jurisdiction to enforce any judgement against the actor, which is likely in a foreign state with no extradition agreement with the US.
    - JumpCrisscross 3y ago
      > jurisdiction to enforce any judgement against the actor, which is likely in a foreign state with no extradition agreement with the US Justice has a long memory. A common theme, when new extradition agreements are struck, usually in the context of trade or security arrangements, is how to deal with the backlog of overdue enforcement.
      - hiatus 3y ago
        I agree in general, but I won't hold my breath for any agreement to be made between the US and Russia, Iran, North Korea, or China in my lifetime.
anonymousDan 3y ago
Yes, I don't see the issue. If I understand correctly then reporting doesn't necessarily mean you are going to be in trouble (so long as you report in time)?
- koolba 3y ago
  Plus you can use any SEC whistleblower money for your legal defense against the hacking.
autoexec 3y ago
> "Pay up or we'll report you to the government" is a textbook example of blackmail. It's hard to feel too bad about companies who are actually doing illegal things that the government should be notified about anyway. It's like someone reporting their drug dealer to the police because they discovered their dealer was lacing their drugs with fentanyl. Sure, they're a snitch, but people are safer knowing the truth.
- FireBeyond 3y ago
  Exactly. The desired outcomes may be different, but the incentives are temporarily, perversely aligned.
- marcosdumay 3y ago
  Hum, no, your example is not blackmail. It would be like the customer asking for free drugs or else he would report the dealer. Anyway, the obvious course of action is to persecute the company and arrest the hacker. The problem here is probably that arresting the hacker is difficult.

jerf 3y ago

Well, the SEC can refer all they want, but the DOJ is going to have jurisdiction over approximately 0% of the referrals.

RandomLensman 3y ago
Want to refer it to the DOD instead?
- brewdad 3y ago
  Interior? Education? We can keep referring until we hit the right department.
  - nvy 3y ago
    The joke is that DOD is the long arm of US foreign policy. Can't prosecute? Invade.
- jerf 3y ago
  Definitely closer to what I mean. Intelligence agencies is probably closer to the reality though. To those mystified by my crypticness, yes, my point is that the criminals are going to not be in the US and be where the US can't simply prosecute them, and this is not just a coincidence. They are in those places for that very reason. They may even be actively supported by their local government, so don't count on extradition or anything else like that. Even nominally friendly governments that we have treaties with are perfectly capable of 100% coincidentally simply not being able to find those guys, so sorry, we feel really bad for you though, if they want to. Paper is only worth the actions it produces.
- bluGill 3y ago
  That depends. Most countries you refer to the department of state who in turn talks to law enforcement in the country where the hackers are from and that country takes care of the problem. However most hackers seem to be from countries like Russia, or North Korea where law enforcement will tell the state department to go away. DoD probably is the only option we have (though intelligence/CIA should get involved) - is it worth war?
JumpCrisscross 3y ago
> the DOJ is going to have jurisdiction over approximately 0% of the referrals Why? A U.S.-listed company was hacked.
- hiatus 3y ago
  I think they are referring to jurisdiction to enforce any judgement against the actor, which is likely in a foreign state with no extradition agreement with the US.
  - JumpCrisscross 3y ago
    > jurisdiction to enforce any judgement against the actor, which is likely in a foreign state with no extradition agreement with the US Justice has a long memory. A common theme, when new extradition agreements are struck, usually in the context of trade or security arrangements, is how to deal with the backlog of overdue enforcement.
    - hiatus 3y ago
      I agree in general, but I won't hold my breath for any agreement to be made between the US and Russia, Iran, North Korea, or China in my lifetime.

anonymousDan 3y ago

Yes, I don't see the issue. If I understand correctly then reporting doesn't necessarily mean you are going to be in trouble (so long as you report in time)?

koolba 3y ago
Plus you can use any SEC whistleblower money for your legal defense against the hacking.

autoexec 3y ago

> "Pay up or we'll report you to the government" is a textbook example of blackmail. It's hard to feel too bad about companies who are actually doing illegal things that the government should be notified about anyway. It's like someone reporting their drug dealer to the police because they discovered their dealer was lacing their drugs with fentanyl. Sure, they're a snitch, but people are safer knowing the truth.

FireBeyond 3y ago
Exactly. The desired outcomes may be different, but the incentives are temporarily, perversely aligned.
marcosdumay 3y ago
Hum, no, your example is not blackmail. It would be like the customer asking for free drugs or else he would report the dealer. Anyway, the obvious course of action is to persecute the company and arrest the hacker. The problem here is probably that arresting the hacker is difficult.