[HN Gopher] Ransomware Group Files SEC Complaint over Victim's F...
___________________________________________________________________
Ransomware Group Files SEC Complaint over Victim's Failure Disclose
Data Breach
Author : LinuxBender
Score : 120 points
Date : 2023-11-16 16:16 UTC (6 hours ago)
(HTM) web link (www.securityweek.com)
(TXT) w3m dump (www.securityweek.com)
| jerf wrote:
| What a magnificent snarl of incentives for the SEC. The SEC wants
| disclosure for good reasons, but if you disclose because the
| hacker group is the one that reported it, that is essentially the
| "negotiating with terrorists" incentive structure. Ignore the
| report because it's the hacking group and it opens the defense
| for all companies to claim the report is made by the hacking
| group (because they can easily be deceptive about who is
| reporting). And so on and so on... what a mess.
| AlotOfReading wrote:
| "Pay up or we'll report you to the government" is a textbook
| example of blackmail. The gordian knot is easy to cut here
| though. The SEC can to refer illegal activities to the DOJ for
| prosecution separately from however they deal with the
| reporting issues.
| jerf wrote:
| Well, the SEC can refer all they want, but the DOJ is going
| to have jurisdiction over approximately 0% of the referrals.
| RandomLensman wrote:
| Want to refer it to the DOD instead?
| brewdad wrote:
| Interior? Education? We can keep referring until we hit
| the right department.
| nvy wrote:
| The joke is that DOD is the long arm of US foreign
| policy. Can't prosecute? Invade.
| jerf wrote:
| Definitely closer to what I mean. Intelligence agencies
| is probably closer to the reality though.
|
| To those mystified by my crypticness, yes, my point is
| that the criminals are going to not be in the US and be
| where the US can't simply prosecute them, and this is not
| just a coincidence. They are in those places for that
| very reason. They may even be _actively supported by
| their local government_ , so don't count on extradition
| or anything else like that. Even nominally friendly
| governments that we have treaties with are perfectly
| capable of 100% coincidentally simply not being able to
| find those guys, so sorry, we feel really bad for you
| though, if they want to. Paper is only worth the actions
| it produces.
| bluGill wrote:
| That depends. Most countries you refer to the department
| of state who in turn talks to law enforcement in the
| country where the hackers are from and that country takes
| care of the problem.
|
| However most hackers seem to be from countries like
| Russia, or North Korea where law enforcement will tell
| the state department to go away. DoD probably is the only
| option we have (though intelligence/CIA should get
| involved) - is it worth war?
| JumpCrisscross wrote:
| > _the DOJ is going to have jurisdiction over approximately
| 0% of the referrals_
|
| Why? A U.S.-listed company was hacked.
| hiatus wrote:
| I think they are referring to jurisdiction to enforce any
| judgement against the actor, which is likely in a foreign
| state with no extradition agreement with the US.
| JumpCrisscross wrote:
| > _jurisdiction to enforce any judgement against the
| actor, which is likely in a foreign state with no
| extradition agreement with the US_
|
| Justice has a long memory. A common theme, when new
| extradition agreements are struck, usually in the context
| of trade or security arrangements, is how to deal with
| the backlog of overdue enforcement.
| hiatus wrote:
| I agree in general, but I won't hold my breath for any
| agreement to be made between the US and Russia, Iran,
| North Korea, or China in my lifetime.
| anonymousDan wrote:
| Yes, I don't see the issue. If I understand correctly then
| reporting doesn't necessarily mean you are going to be in
| trouble (so long as you report in time)?
| koolba wrote:
| Plus you can use any SEC whistleblower money for your legal
| defense against the hacking.
| autoexec wrote:
| > "Pay up or we'll report you to the government" is a
| textbook example of blackmail.
|
| It's hard to feel too bad about companies who are actually
| doing illegal things that the government should be notified
| about anyway. It's like someone reporting their drug dealer
| to the police because they discovered their dealer was lacing
| their drugs with fentanyl. Sure, they're a snitch, but people
| are safer knowing the truth.
| FireBeyond wrote:
| Exactly. The desired outcomes may be different, but the
| incentives are temporarily, perversely aligned.
| marcosdumay wrote:
| Hum, no, your example is not blackmail. It would be like
| the customer asking for free drugs or else he would report
| the dealer.
|
| Anyway, the obvious course of action is to persecute the
| company and arrest the hacker. The problem here is probably
| that arresting the hacker is difficult.
| sonicanatidae wrote:
| Oh I think they'll managed to figure out a way to keep
| corporations safe, at the expense of the citizens. That's the
| historical precedent.
| JumpCrisscross wrote:
| > _at the expense of the citizens_
|
| The SEC doesn't work for "the citizens," its mandate is in
| respect of investors. Especially small investors. U.S. law,
| broadly, prioritizes first consumers, then investors, and
| way, way, way below that, workers.
| RationalDino wrote:
| I don't see any snarl.
|
| The law requires disclosure so that companies can't hide
| material information from investors. The SEC wants all
| incentives lined up so that companies will choose to report.
| The primary way that the SEC catches them now is that the data
| showed up somewhere like a data breach. So ultimately, the
| behavior of the hacker group is the source.
|
| This hacker group just cut out several steps in the middle. The
| SEC verifies it, the company gets punished, and companies are
| on notice that they really should report. Just like the law
| says.
|
| What WOULD be a problem is if the hacker group got rewarded for
| reporting...
| nickff wrote:
| If the SEC pursues prosecutions based on reports from hackers
| which uses the threat of SEC reports to extract payments, the
| SEC will be enabling and enforcing blackmail. The SEC would
| essentially be an accessory to the crime.
| elefanten wrote:
| That's not how the law would see it. Blackmailers
| incorporating otherwise-legal third party activity into
| their threat does not add legal liability for that 3rd
| party. Nor does it excuse any pre-existing liability for
| the blackmail target.
| nickff wrote:
| I'm not sure whether there'd be legal liability; that
| would probably depend on whether the third-party was
| aware of the scheme, and how often they 'enabled' it. I
| doubt that the SEC would be found to be an accessory the
| first time this happened (unless they'd been specifically
| warned), but if this happened frequently, I think they'd
| likely be found guilty by way of 'reckless or wanton
| negligence'. They might even be subjects of civil actions
| by victims of these blackmail schemes at a later date (if
| the circumstances were right).
| fooker wrote:
| >What WOULD be a problem is if the hacker group got rewarded
| for reporting
|
| Insider trading? But without being an actual insider.
| dmoy wrote:
| > It's worth pointing out that the new SEC data breach disclosure
| rules will only go into effect in mid-December 2023. In addition,
| companies will be required to notify the SEC within four business
| days of determining that a cybersecurity incident is material to
| investors, which, based on MeridianLink's statement, has yet to
| happen.
|
| And there's the rub. Not so much the December bit, but the
| "material to investors" part. That has specific meaning, and
| until there are external requirements/penalties/whatever around
| security breaches, simple data theft may not rise to the level of
| materiality for the company. Since they e.g. don't really get
| hurt if their customers' private info is leaked.
|
| "We'll pay for three years of identity protection services if you
| sign up at XYZ link" is about all that happens today, if you're
| lucky. Well, multiply the cost of that (in bulk rates) by the
| number of customers who will actually bother signing up (pretty
| low %), and you get a number which is, to no surprise, probably
| not material for most companies.
|
| (Ransomware, e.g. physically stopping the business from
| functioning, probably does rise to the level of materiality, if
| no quick backup and recovery can be done)
| lainga wrote:
| > Since they e.g. don't really get hurt if their customers'
| private info is leaked
|
| I don't know, that could depress future customer retention and
| hurt the business. Seems like it would run afoul of the Matt
| Levine Everything is Securities Fraud theory.
| dmoy wrote:
| > that could depress future customer retention and hurt the
| business.
|
| But it doesn't really though, does it? People largely dgaf.
|
| My info has been leaked by my hospital, medical insurance
| company, three major retailers, two social networks, etc etc.
| None of them appear to be impacted much, if at all. For some
| of them (insurance, the grocery store (!!?)), I don't have
| realistic choices to stop using the service anyways.
| brewdad wrote:
| Unless the event is especially egregious that seems unlikely.
| Firstly, most consumers won't even know the breach happened.
| Secondly, you can quickly run out of places to go. Lets say I
| leave Target because they get hit by a ransomware attack. A
| year later Walmart gets hit. Do I go back to Target? Shop
| exclusively online? Most likely, I continue to use whatever
| company or service is cheapest and most convenient. All of my
| PII is already on the Dark Web from a hundred other breaches
| by now.
| lainga wrote:
| You're not thinking the Matt Levine way. None of that
| matters. What matters is whether said (undisclosed) event
| could be _construed_ to have materially harmed the
| business, and thus form grounds for a shareholder suit.
|
| The Theory is half tongue in cheek. But the other half is a
| serious representation of what happens in reality. Levine
| makes the case clearer than I do how the line of thinking
| can extend to catch-22s where disclosure _and_
| nondisclosure could both arguably be grounds for a suit.
| gustavus wrote:
| Ya because it hurt Experian so bad.... I'm still bitter about
| that.
| JohnFen wrote:
| > Since they e.g. don't really get hurt if their customers'
| private info is leaked.
|
| They don't? They do at least a little. I know that I, at least,
| avoid doing business with companies that have suffered such
| leaks. Also, bigger picture, that such leaks happen makes me
| think hard about doing business with _any_ company that stores
| any data about me.
| rossdavidh wrote:
| Matt Levine (of Bloomberg) has an ongoing joke: "everything is
| securities fraud". Essentially, if anything bad happens (data
| breach discovered, CEO caught in sexual harassment complaint,
| whatever), and you didn't say in your previous quarterly
| filings that it was happening, then there is a case for suing
| you in court and claiming that was material info you didn't
| disclose. So far, the courts have not often been willing to say
| "that isn't securities fraud". Not saying it's impossible in
| this case, but I wouldn't count on it.
| civilitty wrote:
| Isn't that the same as mail and wire fraud?
|
| Defraud someone for financial gain over the internet or by
| using USPS mail and those umbrella charges apply.
| philipov wrote:
| It's different because in the case of mail and wire fraud,
| everything begins as fraud. A CEO having an affair isn't
| inherently fraud, but it becomes fraud when you don't admit
| to it.
| philipov wrote:
| Someone just posted this
| [https://news.ycombinator.com/item?id=38293817] by Matt
| Levine: "Hackers Know Everything Is Securities Fraud"
|
| I note that it was published less than 20 minutes ago, well
| after the above comment was written.
| rossdavidh wrote:
| Yeah, I got it in my inbox after making that comment, and
| thought "well that was a pointless comment", but I suppose
| it does help that you linked to the Levine column. It is no
| doubt a sign of the times (and not a good one) that the
| funniest columnist is a guy who works at Bloomberg who
| writes about "Money Stuff".
| bastard_op wrote:
| After having been part of various hacking cover-ups over the
| years, usually in some sort of triage for these sorts of things,
| I almost welcome the behavior vs. mega corporations or even
| state/local government getting away with it. Shame the fools that
| let it happen.
| ceejayoz wrote:
| The really funny follow-up will be applying for a whistleblower
| award. https://www.sec.gov/whistleblower/claim-award
|
| (They won't get it; there's an exemption "If you obtained the
| information by a means or in a manner that is determined by a
| United States court to violate applicable Federal or state
| criminal law", but it'd be hilarious to try.)
| Chris2048 wrote:
| what if a third party disclosed the leak, and merely received a
| tipoff from the hackers. Would a tip-off count as illegal?
| jtokoph wrote:
| So you could have two hackers who each tip each other off to
| companies that they have independently hacked. They can just
| claim each other's rewards since they had nothing to do with
| the actual attack?
| Chris2048 wrote:
| I guess. The old "Hackers on a train" dilemma.
| fbdab103 wrote:
| I guess everyone is looking for new revenue streams in this
| market.
| tcbawo wrote:
| I wonder how many ransomware/hacking groups are being
| clandestinely paid by the sort of firms that would short the
| stock and benefit from such a disclosure. Or maybe these groups
| already plugged into the option markets and are profiting on both
| ends.
| raincom wrote:
| Almost all middle-eastern governments hire ransomware/hacking
| groups to take on firms/companies they don't like. [1]
|
| [1]
| https://www.thebureauinvestigates.com/stories/2023-01-15/hac...
| miga wrote:
| It is logical for the ransomware (or any lawbreaker) to minimize
| lawbreaker in order to reduce risk and penalty.
|
| It is also a legal act that may be considered to mitigate the
| guilt in the eyes of the court. Much safer than actually
| releasing the data.
|
| Why did other ransomware gangs did not think of this first?
|
| Is it because they are irrational or just lack proficiency in the
| law?
___________________________________________________________________
(page generated 2023-11-16 23:01 UTC)