Hacker News Reader

Comment by jerf | Hacker News Reader

What a magnificent snarl of incentives for the SEC. The SEC wants disclosure for good reasons, but if you disclose because the hacker group is the one that reported it, that is essentially the "negotiating with terrorists" incentive structure. Ignore the report because it's the hacking group and it opens the defense for all companies to claim the report is made by the hacking group (because they can easily be deceptive about who is reporting). And so on and so on... what a mess.

View on HN

"Pay up or we'll report you to the government" is a textbook example of blackmail. The gordian knot is easy to cut here though. The SEC can to refer illegal activities to the DOJ for prosecution separately from however they deal with the reporting issues.

Well, the SEC can refer all they want, but the DOJ is going to have jurisdiction over approximately 0% of the referrals.

Want to refer it to the DOD instead?

Interior? Education? We can keep referring until we hit the right department.

The joke is that DOD is the long arm of US foreign policy. Can't prosecute? Invade.

Definitely closer to what I mean. Intelligence agencies is probably closer to the reality though.

To those mystified by my crypticness, yes, my point is that the criminals are going to not be in the US and be where the US can't simply prosecute them, and this is not just a coincidence. They are in those places for that very reason. They may even be actively supported by their local government, so don't count on extradition or anything else like that. Even nominally friendly governments that we have treaties with are perfectly capable of 100% coincidentally simply not being able to find those guys, so sorry, we feel really bad for you though, if they want to. Paper is only worth the actions it produces.

That depends. Most countries you refer to the department of state who in turn talks to law enforcement in the country where the hackers are from and that country takes care of the problem.

However most hackers seem to be from countries like Russia, or North Korea where law enforcement will tell the state department to go away. DoD probably is the only option we have (though intelligence/CIA should get involved) - is it worth war?

> the DOJ is going to have jurisdiction over approximately 0% of the referrals

Why? A U.S.-listed company was hacked.

I think they are referring to jurisdiction to enforce any judgement against the actor, which is likely in a foreign state with no extradition agreement with the US.

> jurisdiction to enforce any judgement against the actor, which is likely in a foreign state with no extradition agreement with the US

Justice has a long memory. A common theme, when new extradition agreements are struck, usually in the context of trade or security arrangements, is how to deal with the backlog of overdue enforcement.

I agree in general, but I won't hold my breath for any agreement to be made between the US and Russia, Iran, North Korea, or China in my lifetime.

Yes, I don't see the issue. If I understand correctly then reporting doesn't necessarily mean you are going to be in trouble (so long as you report in time)?

Plus you can use any SEC whistleblower money for your legal defense against the hacking.

> "Pay up or we'll report you to the government" is a textbook example of blackmail.

It's hard to feel too bad about companies who are actually doing illegal things that the government should be notified about anyway. It's like someone reporting their drug dealer to the police because they discovered their dealer was lacing their drugs with fentanyl. Sure, they're a snitch, but people are safer knowing the truth.

Exactly. The desired outcomes may be different, but the incentives are temporarily, perversely aligned.

Hum, no, your example is not blackmail. It would be like the customer asking for free drugs or else he would report the dealer.

Anyway, the obvious course of action is to persecute the company and arrest the hacker. The problem here is probably that arresting the hacker is difficult.

I don't see any snarl.

The law requires disclosure so that companies can't hide material information from investors. The SEC wants all incentives lined up so that companies will choose to report. The primary way that the SEC catches them now is that the data showed up somewhere like a data breach. So ultimately, the behavior of the hacker group is the source.

This hacker group just cut out several steps in the middle. The SEC verifies it, the company gets punished, and companies are on notice that they really should report. Just like the law says.

What WOULD be a problem is if the hacker group got rewarded for reporting...

If the SEC pursues prosecutions based on reports from hackers which uses the threat of SEC reports to extract payments, the SEC will be enabling and enforcing blackmail. The SEC would essentially be an accessory to the crime.

That’s not how the law would see it. Blackmailers incorporating otherwise-legal third party activity into their threat does not add legal liability for that 3rd party. Nor does it excuse any pre-existing liability for the blackmail target.

I'm not sure whether there'd be legal liability; that would probably depend on whether the third-party was aware of the scheme, and how often they 'enabled' it. I doubt that the SEC would be found to be an accessory the first time this happened (unless they'd been specifically warned), but if this happened frequently, I think they'd likely be found guilty by way of 'reckless or wanton negligence'. They might even be subjects of civil actions by victims of these blackmail schemes at a later date (if the circumstances were right).

>What WOULD be a problem is if the hacker group got rewarded for reporting

Insider trading? But without being an actual insider.

Agree the incentives are a mess. SEC needs to change the incentives.

For example, the process for filing complaints could include a $1M fee refundable at 2X if you're right and a tax-paying citizen and/or entity.

These types of hackers exist outside of a society ruled by law, and it's unacceptable to let them leverage the tools of a civilized society if they don't live within its rules and pay taxes.

If someone has a better idea for how to fix the incentives, I'd be sincerely interested to hear it.

Oh I think they'll managed to figure out a way to keep corporations safe, at the expense of the citizens. That's the historical precedent.

> at the expense of the citizens

The SEC doesn't work for "the citizens," its mandate is in respect of investors. Especially small investors. U.S. law, broadly, prioritizes first consumers, then investors, and way, way, way below that, workers.

Citizens are investors and routinely take it in the shorts. The SEC's role is to manage the market, you know, with the fairness and all that.

Reply on news.ycombinator.com