Hacker News Reader

Comment by psunavy03 | Hacker News Reader

This seems to be missing the whole mens rea element on multiple fronts. To commit fraud requires intent.

First, it's silly to expect a company to be making public disclosures before it has its ducks in a row and can explain precisely what happened with a reasonable degree of accuracy.

Second, the idea that the act of being hacked is prima facie evidence of prior securities fraud is absurd. Assuming that a company took good-faith efforts to secure its systems, it wasn't lying (see mens rea above) when it said things like "we use strong passwords." I'm sure there's a point of gross incompetence or negligence that could get the company in hot water, but barring that, sometimes you just lose. Sometimes the robber picks your house and sometimes the hacker picks your company.

View on HN

The actual issue at (this) hand is the lack of reporting the breach, and the rule is not that you have to disclose "once you have your ducks in a row." You have to disclose soon after determining that it's material. Still a little squishy, but not quite as squishy as ducks.

Exactly, someone is lying big here.

The challenge I guess is determining what is considered material.

Companies find it challenging enough in complex breaches whether a breach has actually occurred within a short period of time. Let alone identify that a breach has occurred AND it was also material.

Well usually ransomware attacks make you pretty aware of the severity in very obvious ways, per the "ransom" part.

When it comes down to brass tax, companies will pull any lever they can they avoid negligence when it comes to penalties. If there is any ambiguity on what is considered Material, they're going to try that.

Furthermore, if you have identified a breach in your systems, you may not have even received a ransom notice at that point.

Materiality in other aspects in relation to SEC reporting has a definition, because there needs to be a consistent understanding of where to draw the line.

Not disclosing when you have an obligation to disclose is sufficient to establish intent. Businesses disclose all sorts of obscure risks because of this in their SEC filings: earthquakes, health risks, pirate attacks (real ones), terrorism, etc.

Disclosures are simply required when some criteria are met. "Having your ducks in a row" or "being able to explain what happened" is not what determines whether a public disclosure is required. If a failure to disclose results in shareholders losing money they will sue and the business will have a bad time.

Subsequently, disclosing the wrong thing due to trying to meet the timeframes, where it might look like a breach but isn't can result in shareholders losing money.

"Everything is securities fraud" is a running gag at Money Stuff, which has for years now collected actual cases of shareholders suing companies for securities fraud for all sorts of increasingly wacky reasons. And yes, many of these claim with a straight face that it's "fraud" if a company knew about a risk (like getting hacked), didn't warn shareholders about it, and then they get hacked.

Reply on news.ycombinator.com