Hacker News Reader

Comment by chollida1 | Hacker News Reader

I'm re minded of when baseball was pulled infront of congress and players were questioned about steroid use.

There was one player Sammy Sosa who had for years conducted interviews in English who suddenly could not speak English when questioned by congress.

This seems to mirror whats going on at Equifax now. The executives only way of staying out of jail is to claim that they suddenly have no idea what's going on not only in their company but in the case of the IT people, also in the very division they are supposed to be running.....

Hmmm

Time for Matt Levine to update his rules of insider trading to add rule 11, if caught insider trading after a a security breach don't try and claim that you as a C Level executive don't know whats going on in your own company.

View on HN

I have wondered if the SEC could finesse this by saying "Ok, you can stick with your 'I didn't know' defense and we'll drop the insider trading case but we'll require that the company separate you for cause and invalidate all post separation agreements." (aka the golden parachutes).

Since the benefits of such contracts often dwarfs the value they receive from trading it should help 'remind' them of what they did and didn't know. But they should not be allowed to have it both ways.

Invalidate golden parachutes due to proven incompetence/negligence? I'll take that :)

Though, I don't know if it's even gonna be an option on the table.

Never going to happen. Corporate boards are all stacked with C-level execs of other companies. These people went to the same business schools, socialize together, serve on boards together.

It's a small world where everyone knows one another and I rub your back so you rub mine.

A true meritocracy, in other words.

... and earn 7 figures annually.

If you testify to the SEC that you didn't manage you division well enough to even know that basic security was being handled appropriately, as a shareholder, can I sue you for negligence?

Cause it sounds like you're testifying that you're just not doing your job in any meaningful capacity, and I should be able to include that as a fact in a civil suit, since you swore in public record that it was the truth.

Forcing them to testify that they didn't fulfill their duties to the shareholders in order to not be responsible personally for the breaches may introduce enough liability all on its own.

You can sue anyone for anything in our legal system. It's just a matter whether you have the time and funds and a good case, of course.

Nobody ever asks if they can open a lawsuit against someone.

They ask if an opened suit can possibly succeed. That is what "can I sue" means colloquially, one hundred percent of the time.

I wouldn’t say 100%; maybe 99.9%

I think so? Doing bad things and then not informing shareholders about it tends to turn "these guys should be prosecuted" into securities fraud cases.

Its probably far easier to organize with your other shareholders to get that person fired. Suing is an option but you should probably try what I suggested in the mean time.

No need to organize your own lawsuit:

https://www.usatoday.com/story/money/2017/09/11/equifax-hit-...

Nothing forces the accused to testify about anything.

They need to go to prison and their company broken up.

I resonate with the sentiment but I expect taking away the golden parachutes of affected C level execs will go further to improving accountability than any amount of prison time will.

But who would ever take a C-level position then? Since they're the face of the company they're fired ceremoniously as a PR move whenever the something bad happens.

In my experience a lot of people would take the job believing that they wouldn't allow something like that to happen on their watch. That said, you do have a point about the added pressure. Much like the '3 strikes' rule in California, the unintended consequence might be even more egregious and illegal behavior in order to avoid losing their contractual exit commitments.

If you kill their company, other companies will stop reporting breaches.

Or maybe they'll report in a more timely manner. They knew for the entire month of August a breach had occurred and they didn't report it.

It shouldn't take more than a couple days. That's enough time to verify you had a problem and get a good picture of the extent. You might not have all the details nailed down, but you put out the information you know and say "We'll provide more details as they become available."

It seems unlikely that anyone would've cared. The big problem is that they lost everyone's SSNs. The timing around the reporting isn't really why their company is under the guillotine.

Whoever dismantles their company could try to frame it that way, but the rest of the industry will see through that. It won't be a good situation for us to be in.

I wish more folks would use this as an example for why it might be time for us as a society to move on from having identity security hinge on a 9-digit number and a few other pieces of "flimsy" information.

You mean like the Social Security Office advised when social security numbers were first assigned?

They can advise all they like. When a law gets passed that says private companies cannot refuse or degrade service to any consumer that refuses to disclose certain categories of information that are not directly relevant to the operation of the business with respect to that specific consumer, then I will believe that the government is serious about this.

Right now, a baker can refuse to sell you a cupcake if you won't tell them your SSN. Your electric company can refuse to sell you power if you don't tell them your SSN. The phone company can refuse to give you dial tone. They can even refuse to serve you if your SSN has too many fives in it, or not enough. The character of the SSN currently assigned to you is simply not a protected class for anti-discrimination purposes, even though the difficulty in changing it is somewhere between one's race and one's religion.

So if I as a business wanted to discriminate against a protected class, I could ask for the person’s SSN and refuse service when they don’t provide it?

No because judges are smart people and not easily tricked by games like that.

You would have to ask everyone for their SSN.

I agree, though it's not clear to me what we should use for identity security. Any piece of information related to a person is going to get out eventually.

If they had a requirement to report each breach promptly, we'd have known far sooner there was a problem there, and the pressure to improve security would have been higher. They have been leaking for years.

How do you cover up a leak on this scale without being criminally liable (assuming public company)?

White collar crime is difficult to prosecute. If you give people the choice between the certainty of losing millions of dollars and the somewhat remote possibility of prison, they may not make the right choice.

I'd argue factors that push such details out would overrule that worry. When there are three companies with the sort of power that credit ratings hold over people society is already suffering.

The people need to reign in the corporate interests of the world. Companies are already larger and more powerful than governments. People should be freaking out. This event just underscores that need.

So the goal here is similar to DMCA striking Pewdiepie: To use a legal measure against an entity you don't like because it's convenient.

That seems like a dangerous, slippery road with a lot of unintended side effects.

Individuals will always utilize the power granted to them in whatever way is most convenient to them.

This is why it's important we not allow laws to be passed with the assumption that overly broad permission grants are OK, because they'll only be used 'correctly'.

Perhaps we should be paying much higher rewards to whistleblowers, then.

Not exactly sure what you're driving at. If there's enough evidence that these guys knew despite their protestations to the contrary, it doesn't matter what they say. It's not like they need to confess to get convicted. And if there's not enough evidence, the SEC can't make companies fire its executives or revoke golden parachutes.

The point is that if they claim that they didn't know better, and that is to be taken at face value, then they're plainly not competent to hold their jobs.

So, if they testify that they knew - they're liable.

If they testify that they didn't know, and SEC can prove otherwise - same as above + perjury.

If they testify that they didn't know, and SEC cannot prove otherwise, then at least it is treated as them confirming their incompetence. So if they get, say, a bonus later, or a "golden parachute" for outstanding service on retirement, that is treated as evidence contradicting their claims.

No. Jail + fine >= golden parachute.

"Ok, you can stick with your 'I didn't know' defense and we'll drop the insider trading case but we'll require that the company separate you for cause and invalidate all post separation agreements."

And a fine/penalty for not doing their job and putting so many lives at stake. They should literally be driven down to middle class mediocrity for their negligence.

There has to be some example set for future transgressions.

When did the government get the authority to tell a company who they can hire and under what conditions?

Either there's enough evidence to convict those execs of crimes, or there isn't. If there's not sufficient evidence for that, then how can you suggest that the government should still have the authority to have them punished?

The US Government has always had that authority, the Government insists you only hire people who are allowed to work (by their rules) in the US, the Government insists you hire people without discrimination (regardless of how much you might want to), and the Government insists that when you hire someone you will will not exploit them in any number of ways. Further, the Government has given itself the authority to forfeit civil assets, whether or not they get a criminal conviction.

Clearly it doesn't apply to non US governments but the government of the United States has all of the tools already at their disposal to unilaterally implement just this sort of policy.

The policy question is a bit deeper than that, governing is ideally equal parts carrot and stick, and when there is clear evidence of a harm (and there is in this case) where it is impractical for the citizen to prosecute their own defense (could be debated either way) then the last line of defense for the citizen is the enforcement by their collectively empowered authority. That is perhaps the fundamental source of authority for any government.

You're saying that like all companies are just widget manufacturers and who cares whether they succeed or fail? But some companies make their money based on a public trust and if you turn out to be abusing that, the government should come down on you with the full weight and measure of their power. We've spent so long in the middle and upper-classes of the First World kneeling at the altar of Shareholder Value we don't see any difference between Someguy's Ditch Digging Service and Arsenic Baby Votamins, Inc.

If they fess up to insider trading do they get to keep their golden parachute? If not they wouldn't really have any more incentive to be cooperative.

> There was one player Sammy Sosa who had for years conducted interviews in English who suddenly could not speak English when questioned by congress.

Do you know how stressful it is being questioned? I was waiting to pick someone up from a train station in Spain when security approached to tell me the station had closed, and why was I still there. All the Spanish went out my head. I imagine being questioned by congressional investigators is probably even more stressful.

Good point. Fortunately he had the foresight to bring an attorney along to testify on his behalf. And an artfully worded statement that avoided a perjury charge, as he did not 'inject' anything -- the trainer's drug of choice was available as a tablet after all.

Sometimes people's lawyers will also advise them not to accept being questioned in a foreign language even if they're relatively fluent because small language nuances may make a big difference in legal proceedings. I've given lectures and press interviews in Portuguese before, but if I were giving an oral deposition in a Brazilian court case or being questioned by police, I would ask for an interpreter.

I was once on a jury in California in a case where several witnesses gave testimony through a Spanish interpreter. It seemed clear that some of the witnesses who testified through the interpreter were fluent in English, and so it seemed a little gratuitous to me at the time. Later on I understood that it made sense both for reducing the stress in the situation and for avoiding any minor linguistic misunderstandings in cross-examination that a lawyer might try to make a big deal out of. It's quite possible that the lawyers encouraged their witnesses to use the interpreter.

I am fluent in English. I have been for many years. But until a couple months ago, I thought throw in throwing a game was similar to throwing a party. One is a fun activity, the other could be a criminal offence. If I were being questioned in a court, I would definitely request an interpreter. I wouldn't want to inadvertently confess to a crime I didn't commit because I didn't quite understand the linguistic nuances of the question.

If you were a professional baseball player, you'd now what "throwing a game" was.

The problem is I don't know what I don't know, and I wouldn't want to risk finding it out in a court. I would never take that chance with my freedom. It's one of those cases where what is the worst thing that could happen can be quite bad.

Aren't you worried about your story not quite coming through because you're speaking through someone else?

Well, being fluent/conversational means you can still hear what words the translator chooses, and can verify it means what you meant. It's just that their word choice would be more precise.

You would lose so much nuance. And I dont think you are in a position to verify anything since you claim not to speak the language.

It sounds like a bad idea all around.

I wouldn't pretend I don't speak the language. I would simply request to have an interpreter present similar to how I would request a lawyer. I would check with my lawyer to see if I have the right to an interpreter. If I do, I would absolutely use it.

I'm more concerned that the persecution, understanding how stressful the situation is for me and how not being a native speaker I wouldn't necessarily be familiar with legalese or very formal lexicon, uses it against me to extract a confession due to my confusion, than I am that the nuances would be lost through an interpreter.

I'm an American in Germany, and I speak German with the immigration office (want them to see how hard I'm trying).

I speak English with the police, even for trivial things where I'm the one requesting service, like when I lost my wallet. That is not a context where I want to get anything wrong, and where there is absolutely nothing to be gained from showing off what I learned in language class.

You know what, I actually hadn't' thought about it and I think you make a very good point.

Though to be fair, the Sammy Sosa anecdote was more for humor than anything else. Oddly it turned into a comment that got 50 upvotes.

I appreciate the response, I think you've flipped my thinking on this:)

Matt Levine has already stated that this won't result in a new rule; that there is nothing new here and everything falls under rule #1: "don't insider trade"

He also said this (which, scanning through this thread, appears to be a rare voice of reason):

> Also, though, I found it hard to imagine that those Equifax executives were consciously insider trading. It would just be too dumb. Equifax's press release reporting the breach says that it "discovered the unauthorized access on July 29 of this year and acted immediately to stop the intrusion," though it didn't announce it until yesterday because it was still investigating. The three executives filed Form 4s reporting sales on Aug. 1 and 2, days after the discovery. You could just about imagine them learning of the security breach, panicking, and selling everything -- except that they didn't sell everything. One sold about 4 percent of his stock holdings, another about 9 percent, another about 13 percent. Why do such comically obvious insider trading if you're only selling a small percentage of your stock? And indeed the company explained that these executives "had no knowledge that an intrusion had occurred at the time." I guess the time between "tech person discovers a security breach" and "top executives discover it's a huge embarrassing crisis" is more than a couple of days.

> I guess the time between "tech person discovers a security breach" and "top executives discover it's a huge embarrassing crisis" is more than a couple of days.

That's exactly right. I can imagine the gradual motion up the chain of command, with the progress actually slowing down as the size of the breach and potential exposure becomes more and more apparent, and each level trying to minimize the damage. I'd have hated to be the guy that had to tell the CEO...

Silicon Valley did it best, and it's funny because it's true: https://www.youtube.com/watch?v=ddTbNKWw7Zs

C-levels aren't notified of anything until there are concrete details to share. They don't want to be notified of every port scan or bruteforce attempt, nor do they want to deal with the scope of a confirmed breach changing on a daily basis ("yesterday you told me only N consumers were compromised, now you're telling me it's worse?!")-- a bad situation that gets reported as worse and worse every day is great for Fox News, but bad for shareholder confidence.

It's better for them that they don't know anything until they know everything.

"The guy that had to tell the CEO" (actually woman) was one of the two parties who resigned the other day.

Depends on the industry. Companies in certain highly-regulated industries are required to escalate even a minor breach of security ("We think something could possibly have happened, but there' no evidence anything did.") to C-level ASAP. One place I worked, if a breach was discovered by a janitor should make it to the C's within 24 hours or everyone in-between would be reprimanded, if not sacked.

But that was a very specific (and again, regulated) industry.

Owen Davis of Dealbreaker is skeptical:

When did the company learn of this incident? "We learned of the incident on July 29, 2017, and acted immediately to stop the intrusion and conduct a forensic review."

The trades in question took place between three and four days later. During this time, Equifax would have us believe, these three senior managers were kept in the dark about the fact that hackers had undertaken what may be the largest-ever private security breach right under their noses. Moreover, we’re to understand that even the chief financial officer remained unaware as the company “acted immediately” to right the ship.

http://dealbreaker.com/2017/09/equifaxs-execs-explaining-to-...

> Why do such comically obvious insider trading if you're only selling a small percentage of your stock?

Because then it makes it look innocuous and fools those who would scrutinize the behavior, like it did may have for anyone expressing the above opinion. It would be so blindingly damning to sell-off all of one's holdings, but selling off a small portion could allow for partial benefit of your asset at peak value before it declines.

If it were me, I'd do it exactly this way. I'd be trying to find the perfect intersection of mitigating the upcoming asset value decline and maximizing perceived innocuousness. Selling everything? That'd be a sucker's move.

The point is you're still going to be investigated, and it's not going to be fun, and probably not going to be worth the relative small gain you'll make even on the off chance you manage to get away with it. [That said, if it's me, I'm making a point of disclosing all future stock sales well in advance just to make sure this kind of thing can't come back to bite me.]

But they've spent their careers building up layers of untouchable-it is, and assuming since nothings bitten them before, they can do what they want... what's a minor investigation when you can grab a few mil? And get the probes quashed by just mentioning in a closed hearing how many SEC officials and congresspeople were involved in the breach, or maybe they weren't? Hard to figure out when I'm spending so much time in these hearings...

(I hate myself for having written that but ugh Too damn much tit-for-tat.)

This assumes none of them traded in the options market. An open question is who made the highly irregular $4.2M trade with such foresight.

It is indeed a puzzle, but not yet an exoneration.

Where is his list of rules? Sounds like a fun read but can't find anything on Google.

Anyone got a link?

> I think we are up to the Seventh Law of Insider Trading. The first six are: (1) don't do it, (2) don't do it by buying short-dated out-of-the-money call options on undisclosed merger targets, (3) don't text or email about it, (4) don't do it in your mother's account, (5) don't do it by planting bombs at a company and shorting its stock, and (6) don't do it while employed at the Securities and Exchange Commission. I hereby declare the Seventh Law: (7) If you are going to insider trade, don't Google "how to insider trade without getting caught" before or after you trade.

https://www.bloomberg.com/view/articles/2017-07-13/main-stre...

Here's the most recent run-down with links to where the Laws are established: https://www.bloomberg.com/view/articles/2017-07-13/main-stre...

In any company of significant size, there is an approval process for trading in own company stock precisely to capture this scenario, where an employee may not be aware of a price moving event. I am not suggesting that they knew or didn't when they traded. Just that if they didn't it's a pretty massive failure in their procedure that would need an investigation on its own.

I might conduct interviews in a second language, but I would certainly not testify under oath in a second language.

Samsung's heir and acting chairman, Lee Jae-yong, attempt the same approach in the S. Korea bribery scandal. Pleading ignorance didn't work out so well for him. I foresee the same here. You cannot be at that level within a corporation and dismiss all accountability.

Matt Levine already opined on this case, and his take was that nobody would be stupid enough to commit such an obvious crime for the rather low monetary advantage they got from selling a minor fraction of their shares (I believe it was around 4% of their respective stocks in Equifax).

Matt Levine actually wrote about this already and suggested that it's not likely to be insider trading. Buried in the details (according to him) is that these guys moved like <5% of their stock.

Depending on the charge and the defendants' jobs at Equifax, a standard of conduct that could be applied is "knew, or should have known".

Interesting comparison.

I think in this case the execs are going down. I will be shocked if we don't see some jail time after this is all done.

I envy your optimism. Consider me thoroughly carborundum'd by the illegetimi

What charges?

Perhaps they were just cashing in options that matured.

Perhaps, but their defense isn't what will be investigated. First they will collect and sift through all the evidence before even asking why they might have sold the stock at that point in time.

The executives only way of staying out of jail is to claim that they suddenly have no idea what's going on

Hire a lawyer, no interviews with the FBI, but "me know nothing" might be a problem if they got memos on the breach, attended meetings, drew up plans on dealing with the fallout etc. It's hard to keep such a secret, especially from the top level execs.

What are the odds this doesn't just end in fines? What are the odds of C levels facing a custodial sentence?

Reply on news.ycombinator.com