I feel that this question is primarily related to information security and of great interest to information security professionals.



  1. Sometimes the fields overlap. I'm more likely to get an answer from a security person here who has dealt with this situation. I kinda already know the legal answer. But I'm not interested in what a lawyer would say about it.
  2. the question is about a situation that someone in a position of working in security might find themselves: "a laptop has ransomware! should I report it to legal? or just re-image it?"
  3. The answer is likely to resonate with security people who are caught in a murky area of "we are keeping this a secret" So, it might not make it to legal.
  4. the root of the question is about security. malware. infection. data exposure. I think we should be allowed to post related legalese to a question without it being sorted.
  5. My central question is "where are the disclosures" and I am more interested in the answers that security people would give than what lawyers would say.

A good analogy could be: I'm a doctor. A doctor I know in another hospital had a bad experience with some equipment and his patient died. If I say, "are you warning people about this equipment?" and he says "ask a lawyer", then I'd be hurt.

I think that it fell victim to a destructive sorting instinct and that it was sorted without a chance for discussion or editing.

I tried following @MarkBuffalo's suggestion to:

chillconfig /release_anger -> chillconfig /renew

but got following:

error module did not self-register
  • A question about disclosure of ransonware attacks might be on topic, but I suspect it would get relatively few professionals answering, since they may well not be allowed to by their company's legal agreements. Furthermore, the specific question was asking relating to a specific jurisdiction, which tends to be another close or move reason. Should they be reported? Don't know - would depend whether a specific ransomware app exfiltrated any data, presumably. Are they being? Can only tell in areas with mandatory publication of reports.
    – Matthew
    Mar 3 '16 at 18:20

The question, as currently worded, is most definitely a legal issue. Even if it were not, it falls very close to being close-worthy as "too broad" or "primarily opinion-based" anyway. So, it's probably better that it got migrated than just shut down.

Here, you have a security incident where a certain amount of impact has been assessed. (In this case, some files being encrypted by unauthorized code running on the system.) It is very possible, perhaps even likely, that the incident's actual impact is greater than what has been assessed - and, depending on the resources available to the assessors, greater than what can be assessed in the absence of a public disclosure from the attackers or their clients. (In this case, the files could possibly have be exfiltrated and the affected organizations may not have the logging/monitoring tools needed to recognize this.)

If you had asked how the security team should react, in terms of recovery & reconstitution, mitigating the vulnerabilities that were exploited to cause the scenario, or restoring the system to a secure state, then it would be closer to on-topic for IT Security. It's still a bit subjective as to whether or not it would be appropriate, in any given situation, to treat the incident as if it had higher impact than what can actually be seen. But at least it would be more on-topic.

Instead, your question is about how the security team is or should be required to report this. And that is very much a legal matter, subject to corporate policies and local laws. You're even specifically citing references to U.S. federal and California state laws. While security experts may often conduct work affected by these, and are frequently even called to testify regarding them, the best people to offer reliable advice on any subject pertaining to law are experienced lawyers. Always. Without exception.

Let's generalize this a bit, to another possible scenario. Instead of having files encrypted, let's say the system just started to suddenly get ads for porn or gambling sites popping up on its screen randomly. There's obviously something unauthorized running on the system, and (absent certain monitoring/logging capabilities) we can't really be sure what else it might be doing.

A question like this might be acceptable here: "I got infected with some malware that did ABC. Antivirus detected it as XYZ. I think I got it all out, since the bad behavior stopped and I don't see file foobar.exe or any registry entries with bazquxnorf in them anymore. Should I return the system to production, or are there other measures I should take to lock it down and ensure it is clean?"

It would be a fair bit subjective, and most likely get a bunch of responses like "nuke from orbit", "uninstall Java", "upgrade to Linux", etc. But it would be a bit more on-topic.

However, your question is more like: "I got infected with some malware that did ABC. I wiped the machine and rebuilt it from a known-good image. Should I report this to legal?"

Even if that didn't get migrated to Law.SE, answers around here would be more like "it depends on [long list of factors that we don't know the answer to]", or "you need to check your company's policy", etc. So, it would still end up closed here as too broad or primarily opinion-based.

  • fair enough. I guess a better wording would be : Without knowing anything else other than the fact that private patient data got encrypted, should an organization assume that a ransomware infection is also a data breach.
    – mcgyver5
    Mar 3 '16 at 22:25
  • 2
    Which is a very different question
    – Rory Alsop Mod
    Mar 3 '16 at 23:09
  • @RoryAlsop And still, we have the other issues - too broad/opinion-based/(probably one or two others could fit in too).
    – Iszi
    Mar 4 '16 at 0:37

I hadn't seen your question before this, but I frequently vote to close question on this site as asking for legal, rather than professional information security advice. Had I seen this question, I would have placed it solidly in this camp.

Yes, there certainly are areas of overlap, I agree. But to wit, your question specifically asks about legal responsibility, and references both a previous court case and several laws. It's hard to see any overlap here at all. This is a legal question.

  • 2
    Agreed - this is a legal question, definitely not a Security question.
    – Rory Alsop Mod
    Mar 3 '16 at 21:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .