That is a terrible idea. Imagine sentencing programmers to jail for security issues in their code.
Yes, if the security failure is grossly negligent, you should face criminal proceedings. As a C level executive, you are responsible for your chain of command.
https://en.m.wikipedia.org/wiki/Liebeck_v._McDonald%27s_Rest...
Your culture is set by your leadership. Make good choices.
I agree with your principles in theory but it's just impractical.
You must hold systemic negligence and corruption accountable, or it perpetuates the cycle.
B) They were prosecuted for the very specific crime of obstruction of justice after they were caught destroying evidence. It wasn't some backlash against a nebulous problem.
C) Their conviction was overturned!
I'm not sure you could have picked a worse example for arguing your point.
There seems to be an unlimited supply of people always popping up to "debunk" the "myths" about the Liebeck case who seem to deflect from the fact that it is normal for coffee to be brewed at near boiling temperatures[1] that cause the sort of damage that was at issue. I could burn myself severely while draining pasta too, if I pour hot water all over my pants and don't remove them; it doesn't mean boiling water is too hot for cooking nor that say, a manufacturer of a non-defective pot is to blame.
Added reference due to downvoting:
[1] http://www.ncausa.org/About-Coffee/How-to-Brew-Coffee
"Your brewer should maintain a water temperature between 195 to 205 degrees Fahrenheit for optimal extraction."
I make coffee nearly every morning by boiling water in a tea kettle and pouring it over coffee grounds in a Melitta filter. If I poured or spilled it on my genitals, that would be bad. Doesn't make an approximately 200F temperature incorrect though.[1]
[1] See the National Coffee Association on how to brew coffee at http://www.ncausa.org/About-Coffee/How-to-Brew-Coffee
And in the modern security context we're pushing deadlines just to race to the latest features with almost no regard for security in the process.
Something has to change. If this kind of negligence were causing similar problems in physical realms there would be regulations.
The tech companies behind these mistakes won't have that free roam forever. Every major screw-up is a step closer to regulations and everyone will cry about it when it happens... But so many companies today don't seem like they're ready to behave responsibly.
The reality is that it is vanishingly rare for any engineer to face criminal charges for their professional actions. It doesn’t seem to me that software is held to much lower a standard.
Watching the SEC closely to see how many ICOs they prosecute. Also was helpful to see someone involved with their breech response who attempted to profit from non public material information prosecuted (although that’s tangential to the breach itself).
Someone relatively important is going to have to get burned before more software professionals are pursued for grossly negligent security failings.
It only happens in the most egregious of negligence cases as it is and even then convictions are rare.
I'm saying your impression that software engineering is protected is wrong, because no engineers (to any normal approximate) are brought up on criminal charges.
The title 'software engineer' without any notion of liability is an exercise in stroking ones ego.
[0] https://mylicenseattorney.com/california-board-for-professio...
[1] https://design.insureon.com/news/3-reasons-engineers-get-sue...
[2] http://caselaw.findlaw.com/ca-supreme-court/1671856.html
Software engineers can be held liable in civil suits, as can other engineers even if there is no professional accreditation body for their industry.
It is less common in software than civil engineering for a few reasons, one of which is that customers literally have no problem signing away their liability. No one would sign a contract from a bridge designer that said “this might fall over in a stiff breeze” but that happens all the time with software.
the only crime was not fixing the problem and keeping it a secret AFTER IT HAD BEEN DISCOVERED. in this case, it wasn't the mistake that was the crime, it was the cover up.
To be fair, they have several hundred (if not thousands of) years of trial and error, documentation, etc. behind them to (try and) help people avoid the mistakes.
Computer Science has barely 70 years of half-arsed fumbling about.
But there isn’t an equally trained engineer dedicating his energy to taking down the bridge - it only has to not collapse under normal usage.
When a bridge is intentionally destroyed by enemy action, it’s engineer is not held liable.
They were eventually acquitted, but the very fact that they were even charged in the first place is ridiculous.
Jr. Developer - automatic pass. Low money
Sr. Developer - likely a pass, provided 'i' are dotted and 't's are crossed - decent money
Tech Lead - no pass unless tried very hard to get it resolved, big money
Exec - no pass, very big money