RE: Re: Your One-Stop Site For Sony Lawsuit Info

[Paul Schmehl <pauls () utdallas edu>]

Not just SOX.  HIPAA and GLB will do the same thing.  HIPAA will hold an 
individual practioner liable for security failures, if the corp had an 
acceptable plan but the implementation either never took place or was done 
shoddily.  If the plan isn't in place, then the admins are liable - 
personally liable.

--On Tuesday, November 22, 2005 12:20:33 -0700 Christopher Carpenter 
<ccarpenter () dswa net> wrote:

> Hi Jason, Paul:
>
> While Jason's point may _currently_ be valid in reference to
> programmers, legislation like Sarbanes-Oxley is reiterating individual
> accountability for auditors and executives.  We may see a trickle-down
> effect to lower level management and/or project managers if other
> corporations infringe on personal liberties or "pull a Sony."
>
> Chris
>
> -----Original Message-----
> From: full-disclosure-bounces () lists grok org uk
> [mailto:full-disclosure-bounces () lists grok org uk] On Behalf Of Jason
> Coombs
> Sent: Tuesday, November 22, 2005 12:13 PM
> To: Paul Schmehl
> Cc: intertwingled () qwest net; bugtraq () securityfocus com;
> full-disclosure () lists grok org uk
> Subject: Re: [Full-disclosure] Re: Your One-Stop Site For Sony Lawsuit
> Info
>
> Paul Schmehl wrote:
> > So, all those corporate execs walked out of the court house in
> handcuffs
> > weren't really going to jail?
>
> There's a huge difference between a financial crime committed by an
> individual and a crime committed by a corporation.
>
> Let me know if the distinction confuses you and we'll discuss this more
> privately. You are aware that not every action of a person employed by a
>
> corporation is considered an action of the individual, right?
>
> No individual programmer who writes spyware will ever be prosecuted for
> doing his or her job on behalf of a corporation. No exec who instructs
> said programmer to author said spyware will ever have personal criminal
> liability for giving said instruction.
>
> If you don't like the world you live in, change it or get out.
>
> Regards,
>
> Jason Coombs
> jasonc () science org
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/



Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/ir/security/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/