4 ms·

I'm not sure what to make of that out of context. Is it saying that if I, as a corporate officer, copy some sensitive information onto an unencrypted USB drive

I'm not sure what to make of that out of context. Is it saying that if I, as a corporate officer, copy some sensitive information onto an unencrypted USB drive, in direct violation of explicit company policy, and accidentally drop it someplace, and someone picks it up and trades on the information, I have not committed a breach of duty? That would strike me as a counterintuitive conclusion.

rayiner 11y ago
I guess I should provide a fuller quote for context: "Whether disclosure is a breach of duty therefore depends in large part on the purpose of the disclosure. This standard was identified by the SEC itself in Cady, Roberts: a purpose of the securities laws was to eliminate 'use of inside information for personal advantage.' 40 S.E. C., at 912, n. 15. See n. 10, supra. Thus, the test is whether the insider personally will benefit, directly or indirectly, from his disclosure. Absent some personal gain, there has been no breach of duty to stockholders. And absent a breach by the insider, there is no derivative breach." There is a fiduciary duty of care, though that has mostly to with care in the execution of corporate policies and transactions. I do not know how that has been interpreted in the context of information security. The reasoning of Dirks seems to be that the relevant duty is the duty of loyalty, because the purpose of the law is to eliminate the "use of insider information for personal gain." So while copying sensitive information into a USB may breach one's duty of care, it's not a breach of the duty of loyalty and not within the scope of the law.
- gohrt 11y ago
  This is a massive loophole that has been exploited for decades. Here's how it plays out, from board rooms to halls of Congress: I breach my loyalty so that you make $1million profit. Your spouse buys my child a $50K car as a birthday present. In the cloudy eyes of the law, I received no benefit from giving you the tip.
  - deleted 11y ago
    [deleted]
  - mannykannot 11y ago
    Indeed. Dirks v. SEC touches on loophole-creation in at least one place: "The SEC argues that, if inside-trading liability does not exist when the information is transmitted for a proper purpose but is used for trading, it would be a rare situation when the parties could not fabricate some ostensibly legitimate business justification for transmitting the information. We think the SEC is unduly concerned." The last sentence is not immediately followed by any argument in support, so at this point I have no idea why the majority would dismiss the SEC's concern, which looks plausible to me. Perhaps they think it is not a relevant concern, but if so, why not say so? Irrelevance would seem to offer a stronger counter-argument than a disagreement over the magnitude of an effect. Perhaps they are uninterested in considering this issue because they have already decided the case on what they think are logical grounds.
- ScottBurson 11y ago
  I see. So one might get fired, and maybe even sued, but it's not a matter for the SEC.

rayiner 11y ago

I guess I should provide a fuller quote for context: "Whether disclosure is a breach of duty therefore depends in large part on the purpose of the disclosure. This standard was identified by the SEC itself in Cady, Roberts: a purpose of the securities laws was to eliminate 'use of inside information for personal advantage.' 40 S.E. C., at 912, n. 15. See n. 10, supra. Thus, the test is whether the insider personally will benefit, directly or indirectly, from his disclosure. Absent some personal gain, there has been no breach of duty to stockholders. And absent a breach by the insider, there is no derivative breach." There is a fiduciary duty of care, though that has mostly to with care in the execution of corporate policies and transactions. I do not know how that has been interpreted in the context of information security. The reasoning of Dirks seems to be that the relevant duty is the duty of loyalty, because the purpose of the law is to eliminate the "use of insider information for personal gain." So while copying sensitive information into a USB may breach one's duty of care, it's not a breach of the duty of loyalty and not within the scope of the law.

gohrt 11y ago
This is a massive loophole that has been exploited for decades. Here's how it plays out, from board rooms to halls of Congress: I breach my loyalty so that you make $1million profit. Your spouse buys my child a $50K car as a birthday present. In the cloudy eyes of the law, I received no benefit from giving you the tip.
- deleted 11y ago
  [deleted]
- mannykannot 11y ago
  Indeed. Dirks v. SEC touches on loophole-creation in at least one place: "The SEC argues that, if inside-trading liability does not exist when the information is transmitted for a proper purpose but is used for trading, it would be a rare situation when the parties could not fabricate some ostensibly legitimate business justification for transmitting the information. We think the SEC is unduly concerned." The last sentence is not immediately followed by any argument in support, so at this point I have no idea why the majority would dismiss the SEC's concern, which looks plausible to me. Perhaps they think it is not a relevant concern, but if so, why not say so? Irrelevance would seem to offer a stronger counter-argument than a disagreement over the magnitude of an effect. Perhaps they are uninterested in considering this issue because they have already decided the case on what they think are logical grounds.
ScottBurson 11y ago
I see. So one might get fired, and maybe even sued, but it's not a matter for the SEC.