Either the CEO is incompetent and didn't know about a huge failure of his organization or he's a criminal, either way the verdict of public opinion is not going to be kind.
This is a common recipe for disaster when the actual product quality/security is no longer a core value.
The CEOs in these environments honestly have no clue what an "outdated Struts patch" is... so it's difficult to hold them criminally responsible.
I'm not excusing this behavior. In fact, quite the opposite. More indictments and congressional pressure on Equifax will hopefully persuade future CEOs to make IT security, data privacy, and consumer trust foundation product values.
How could you not hold the CEO criminally responsible for this much damage just because they neglected to get informed on these topics or get expert opinions if they didn't have the ability to become informed.
If that's the case every company should have a head "CEO" who knows nothing and just does what a shadow CEO tells him to do. Then no one would be responsible ever!
https://en.wikipedia.org/wiki/ImClone_stock_trading_case#Rep...
> On Friday, August 25, 2017, Ying texted a co-worker that the breach they were working on “Sounds bad. We may be the one breached.” The following Monday, Ying conducted web searches on the impact of Experian’s 2015 data breach on its stock price. Later that morning, Ying exercised all of his available stock options held at UBS Financial Services, resulting in him receiving 6,815 shares of Equifax stock, which he then sold.
And again, innocent until proven guilty is a good principle, and we need to let the justice system do its work.