Slashdot Mirror
Should Hacked Companies Disclose Their Losses?
derekmead writes "By law, US companies don't have to say a word about hacker attacks, regardless of how much it might've cost their bottom line. Comment, the group of Chinese hackers suspected in the recent-reported Coke breach, also broke into the computers of the world's largest steel company, ArcelorMittal. ArcelorMittal doesn't know exactly how much was stolen and didn't think it was relevant to share news of the attack with its shareholders. Same goes for Lockheed Martin who fended off a 'significant and tenacious' attack last May but failed to disclose the details to investors and the Securities Exchange Commission. Dupont got hit twice by Chinese hackers in 2009 and 2010 and didn't say a word. Former U.S. counterintelligence chief Joel Brenner recently said that over 2,000 companies, ISPs and research centers had been hit by Chinese hackers in the past decade and few of them told their shareholders about it. This is even after the SEC has made multiple requests for companies to come clean about cyber security breaches in their quarterly or annual earnings reports. Because the potential losses, do hacked companies have a responsibility to report security breaches to investors?"
You're responsible toward your shareholders. If you don't have any, at least the board & upper management should be in the know.
Religous speak to God. Insane are spoken to by God. When all shut up, one can finally hear Shostakovich in peace
if the hack causes material changes in business or profitability, a public corporation is required by law to disclose what is known about the effect on continuing operations to the SEC, which 10K form is a public document. especially if a "going concern" warning is required by financial regulations.
if this is supposed to be a new economy, how come they still want my old fashioned money?
If they have an obligation to report losses by fire, storm, vandalism, or theft in meatspace, they should have the same obligations regarding over-the-net attacks.
Sheesh, evil *and* a jerk. -- Jade
Must they report to investors and the SEC every time a building is physically broken into?
Of course not.
You could convince me, though, that they should be reported to the local gendarmes who should then forward it on to the FBI where it must be made public.
"I don't know, therefore Aliens" Wafflebox1
The hackers will say yes and then comment on what is claimed in losses
The company POV is to only disclose losses verified to the tax man and other authorities, but not public (unless its indirectly done as a requirment to stock holders)
Unless there is a fear of further aggravating the loss,there is no reason why they shouldnt share it
If they have an obligation to report losses by fire, storm, vandalism, or theft in meatspace, they should have the same obligations regarding over-the-net attacks.
Businesses don't report these tings to their customers or account holders or even their shareholders. They report these things to the police and their insurance companies in the hope of recovering from their losses. Even then, they are not obligated to do so, it is simply the most logical and prudent action.
So, I guess your answer to the question of; Should Hacked Companies Disclose Their Losses? your answer is no.
That claim is only true in a narrow and impractical sense. Several US states have mandatory data-breach reporting laws. A company doing business in those states, generally meaning buying or selling to/from persons or companies in those states, must comply with those laws. Generally they require notifying customers whose personal data is at risk. I have received two such letters myself since my state's law went into effect.
IANAL but really I don't think it takes a lawyer to be aware of these laws. Anyone who is informed about computer security should at least know of their existence, as should any IT manager employed in those states.
[Sir Garlon] is the marvellest knight that is now living, for he destroyeth many good knights, for he goeth invisible.
Is there serious evidence that these hackers are Chinese or more importantly working for Chinese interest? Or is just the last determined hop or code comments? I see these statements all the time but is the evidence really solid?
The SEC should start doling out stout fines for publicly-traded entities that do not release information that impacts their returns; to say massive security breaches don't hurt the books is a lie so large as to be indictable.
[Generalization] Companies are not ethical, they are rat bastard pieces of crap that care only about profits and money and give a fuck all about consumers.[/Generalization].
As such, being hacked doesn't immediately mean a financial or business impact. Hackers stole 100,000 encrypted database tables, well so what? Do you disclose worst case scenario if they attackers can decrypt them or do you just assume they won't be able to break the encryption. My bet would be companies would go the later route. Also translating lost data into dollars usually looks really bad. For example.
When prosecuting the case and determining damages, they will include the cost of reporting to each individual effected, labor, envelopes, stamps, etc. At a 2-3$ per person this adds up quick. That doesn't cover loss of revenue, business deals and who knows what. So on one hand you want to stick it to the people who attacked you but not spook your investors. Tricky situation, most companies instead just sweep it under the rug.
California actually has laws governing this if personally identifiable information or medical info is breached. Unfortunately many companies do not know about these laws or do not follow them. Also, by the nature of how the law is worded, it may effectivly affect companies all over the US (anyone that does buisness with CA or a CA resident)...
1798.29
http://www.dmv.ca.gov/pubs/vctop/appndxa/civil/civ1798_29.htm
1798.82
http://www.dmv.ca.gov/pubs/vctop/appndxa/civil/civ1798_82.htm
--
Time is on my side
This should be covered for public companies in the U.S. by Sarbanes-Oxley Section 404, which is the top-down risk assessment. Basically, management is required to have certain internal controls in place (IT Security is one of the named categories), and the required risk assessment is supposed to evaluate those controls. If someone has "hacked" in and stolen sensitive information, your controls have failed and the auditor's report should reflect that. At the very least, Sarbanes-Oxley would require the disclosure of attacks that could impact the company's financials at the end of the quarter, but there may be a threshhold for reporting earlier to ensure shareholders are not blindsided by something really big. I am not a lawyer or an auditor, but if I were looking for that threshold, this is where I'd expect to find it.
(How ironic that they chose 404 to be the title of a report in which an auditor is looking for missing files)
to suit their financial requirements/incentives.
Should you report it? Yes
Do you actually have to? No
Same concept?
It's very likely the knee-jerk overreaction that followed the announcement would end up being far more detrimental than any hack ever could have been. We'd get to a point where a novice hacker would be able to wreak economic turmoil with minimal effort through ignorance and fear. The cost outweighs the benefits imo. I'd love to see that scenario reversed, but it's not there right now.
Gonna play the: people "CAN'T HANDLE THE TRUTH" card.
but filling out all those damn reports while they drag out the body is a horrible waste of time.
if this is supposed to be a new economy, how come they still want my old fashioned money?
The seven-figure suits who head up IT for these companies, and the CEO's they report too, have a vested personal interest in not having "Stupid" prominently displayed on their foreheads.
This alone is enough to satisfy Occam.
Just as much as they have to report claims on insurance, bonds, OSHA, or other regulatory findings. If they're subject to any PCI or HIPAA complaince, they should be subject to a standardized PR report describing the incident.
"do hacked companies have a responsibility to report security breaches to investors?"
No, but they do need to let their customer base know that their information was taken, and pay for identity theft for a minimum of 2 years for each customer who's data was exposed, if they're real people (not businesses).
Beyond the whole Shareholders argument, you have a duty to protect the data that you've asked for, and in some cases demanded of your customers. This is their data that they agreed to share with your company only. The rest of this discussion should be moot, but if you insist upon another reason, if the people of this country realized how much hacking is going on they have a chance to defend themselves against identity theft, bank account theft, outright fraud against them.
With all these corporations holding this information secret they are in essence assisting criminals in stealing their customer's data.
With this said, I also believe that if more of our talented hacker type folk were aware of this shit, they might show their abilities by going after the initial hackers with a vengeance.
The citizens of this country are being used by corporations for our personal information at every turn and they are not willing to protect this information, as such they should be fined $100.00 per day per customer information stolen until reported. So if you have 100 customers and it takes you 3 days to report a hack then your company should see an instant fine of $30,000. This would severely hurt a small company. Now make this a more realistic number for large corporations: 1,000,000 customers and 3 days, and BAM $300,000,000.00 fine would wake up some boards real fucking quick.
Life takes interesting turns, but the most interest is when you're off the beaten path.
There are reasons not to make some things public, such as cost for hacking. It's kind of like we see in criminal law, as a method of reducing hacks.>/p>
Many people hack for attention/publicity. Take that away, they lose incentive to "hack" your site. Make a stink, and more will go at it to get their names in the paper.
Many don't understand that there are financial incentives to be hacking. Not always in a negative context either, consider penetration testers and how much money they can make. It can still pay to go in to a place and say "see how insecure you are? I can help".
Many simply don't know. Okay, we can give you head count for people required on Network and System teams to monitor and try to counter, but that's not the real cost. The real cost is in what actually gets leaked more often than head count. If you have no idea what was leaked, how do you determine value?
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
I'd say they were guilty of false representation of damages, costs and lost Intellectual Property towards their shareholders and possibly even leaking secret information about weapon systems and other military intelligence in some cases. They don't have to tell, but they'd sure would be liable for any damages occurred to their share holders and customers by not doing so. No need to change laws, just make sure they get sued hard for keeping their mouth shut and they will do it voluntarily the next time something happens.
I was promised a flying car. Where is my flying car?
The entire summary is a lie. Securities laws already require companies to report security problems that affect shareholders. Data breach laws in 49 states require problems to be reported, either to the victims or directly to the government. Federal laws require hacking of medical records or financial records to be reported. State common law imposes duties related to invasion of privacy, negligence or malpractice by a programmer, etc.
Just because there isn't a law that literally says "security breaches must be disclosed" doesn't mean they security breaches don't have to be disclosed. We have laws of GENERAL applicability so that every single scenario that could possibly happen doesn't have to be written out in advance. Sadly, this inaccurate summary is no worse than 99% of the other inflammatory Slashdot summaries related to legal issues.
A corporation is owned by the stockholders no matter how small. They should have the right to be privately informed on losses and bad business practice, and failure to protect their assets. Does every corporation do that No, but the corporations that do, they increase the loyalty of their owners
No one fits the bill more correctly than the chinese. If we had any brains, we'd be killing them already.
private medical info, dob, etc.
It is a shock to shareholders, and annoys your customers, but 'tis better than the alternative.
Imagine a few hundred thousand credit card numbers being quietly stolen. Imagine waiting two years to admit to this theft. I imagine that that would be more damaging than admitting it immediately.
See, the true source of flack a company is going to receive is not that it has been hacked, but that it had such poor security measures in place to begin with. No one wants to be the captain of the ship who kept unencrypted user-names and passwords in a publicly accessible database. As such, the hit for that is unavoidable once it happens.
I am John Hurt.
Usually those 'costs' were caused by companies trying to make the hacker pay for all the work surrounding the case and all the backlog in securing systems done as part of the clean-up operation in the aftermath of the break-ins.
I wonder if companies will overstate costs under these rules too or whether they will understate them because the numbers aren't used to make someone else pay.
The Virtual Bookcase: book reviews
the world just cuts China off from the internet as a whole until their government starts doing something...
Healthcare has to report any breach, including those perpetrated by hackers.
By law, US companies don't have to say a word about hacker attacks
That implies there's a law that says they don't have to, not that there's no law that requires them to.