4 ms·

This seems to be missing the whole mens rea element on multiple fronts. To commit fraud requires intent. First, it's silly to expect a company to be making pu

This seems to be missing the whole mens rea element on multiple fronts. To commit fraud requires intent. First, it's silly to expect a company to be making public disclosures before it has its ducks in a row and can explain precisely what happened with a reasonable degree of accuracy. Second, the idea that the act of being hacked is prima facie evidence of prior securities fraud is absurd. Assuming that a company took good-faith efforts to secure its systems, it wasn't lying (see mens rea above) when it said things like "we use strong passwords." I'm sure there's a point of gross incompetence or negligence that could get the company in hot water, but barring that, sometimes you just lose. Sometimes the robber picks your house and sometimes the hacker picks your company.

ethanbond 3y ago
The actual issue at (this) hand is the lack of reporting the breach, and the rule is not that you have to disclose "once you have your ducks in a row." You have to disclose soon after determining that it's material. Still a little squishy, but not quite as squishy as ducks.
- bastardoperator 3y ago
  Exactly, someone is lying big here.
- NoPicklez 3y ago
  The challenge I guess is determining what is considered material. Companies find it challenging enough in complex breaches whether a breach has actually occurred within a short period of time. Let alone identify that a breach has occurred AND it was also material.
  - ethanbond 3y ago
    Well usually ransomware attacks make you pretty aware of the severity in very obvious ways, per the "ransom" part.
    - NoPicklez 3y ago
      When it comes down to brass tax, companies will pull any lever they can they avoid negligence when it comes to penalties. If there is any ambiguity on what is considered Material, they're going to try that. Furthermore, if you have identified a breach in your systems, you may not have even received a ransom notice at that point. Materiality in other aspects in relation to SEC reporting has a definition, because there needs to be a consistent understanding of where to draw the line.
gizmo 3y ago
Not disclosing when you have an obligation to disclose is sufficient to establish intent. Businesses disclose all sorts of obscure risks because of this in their SEC filings: earthquakes, health risks, pirate attacks (real ones), terrorism, etc. Disclosures are simply required when some criteria are met. "Having your ducks in a row" or "being able to explain what happened" is not what determines whether a public disclosure is required. If a failure to disclose results in shareholders losing money they will sue and the business will have a bad time.
- NoPicklez 3y ago
  Subsequently, disclosing the wrong thing due to trying to meet the timeframes, where it might look like a breach but isn't can result in shareholders losing money.
resolutebat 3y ago
"Everything is securities fraud" is a running gag at Money Stuff, which has for years now collected actual cases of shareholders suing companies for securities fraud for all sorts of increasingly wacky reasons. And yes, many of these claim with a straight face that it's "fraud" if a company knew about a risk (like getting hacked), didn't warn shareholders about it, and then they get hacked.

ethanbond 3y ago

The actual issue at (this) hand is the lack of reporting the breach, and the rule is not that you have to disclose "once you have your ducks in a row." You have to disclose soon after determining that it's material. Still a little squishy, but not quite as squishy as ducks.

bastardoperator 3y ago
Exactly, someone is lying big here.
NoPicklez 3y ago
The challenge I guess is determining what is considered material. Companies find it challenging enough in complex breaches whether a breach has actually occurred within a short period of time. Let alone identify that a breach has occurred AND it was also material.
- ethanbond 3y ago
  Well usually ransomware attacks make you pretty aware of the severity in very obvious ways, per the "ransom" part.
  - NoPicklez 3y ago
    When it comes down to brass tax, companies will pull any lever they can they avoid negligence when it comes to penalties. If there is any ambiguity on what is considered Material, they're going to try that. Furthermore, if you have identified a breach in your systems, you may not have even received a ransom notice at that point. Materiality in other aspects in relation to SEC reporting has a definition, because there needs to be a consistent understanding of where to draw the line.

gizmo 3y ago

Not disclosing when you have an obligation to disclose is sufficient to establish intent. Businesses disclose all sorts of obscure risks because of this in their SEC filings: earthquakes, health risks, pirate attacks (real ones), terrorism, etc. Disclosures are simply required when some criteria are met. "Having your ducks in a row" or "being able to explain what happened" is not what determines whether a public disclosure is required. If a failure to disclose results in shareholders losing money they will sue and the business will have a bad time.

NoPicklez 3y ago
Subsequently, disclosing the wrong thing due to trying to meet the timeframes, where it might look like a breach but isn't can result in shareholders losing money.

resolutebat 3y ago

"Everything is securities fraud" is a running gag at Money Stuff, which has for years now collected actual cases of shareholders suing companies for securities fraud for all sorts of increasingly wacky reasons. And yes, many of these claim with a straight face that it's "fraud" if a company knew about a risk (like getting hacked), didn't warn shareholders about it, and then they get hacked.