Hacker News Reader

We could (and should) create a personal criminal liability for management over cybersecurity.

Specifically one that flows past the CISO and prevents that role from being a firebreak to insulate the CEO.

The "fall guy" problem strikes me as nontrivial. Even if you add to the law that the CEO always has liability for any data leak, a sufficiently well capitalized company run by someone aware of the liability would simply create a shell company that owns all of that data. You could disallow company transmission of said data at all but that is going to cause problems when trying to actually verify said information . . .

Reply on news.ycombinator.com