People aren't mad that his contract is being honored, they're annoyed that there are no provisions for gross failure.

As for actively facilitating the breach, almost no CEO ever does. One of his jobs is to solve problems indirectly before they show up by appointing the right people to react to them. Appointing his college buddy as the chief of InfoSec was a gross failure to do that.

Totally fair response.

Do you think the board failed to minimize the total financial impact, and that shareholders will now vote to replace most of the board seats?

Shareholders run the company. Are we mad at the CEO, or mad at the shareholders?

It's hard to say what will happen, but the shareholders would be justified in replacing board members over this. Shareholders don't run public companies directly, I think the farthest that you can logically assign blame is with the board.

Did the board fail to minimize total financial impact? In this case, yes. At the same time, adding a "failure" provision to the contract may have scared off good CEOs. I find it unlikely that this CEO has created more value than an overall worse CEO who would have avoided this, but it depends on the outcome of the lawsuits and PR fallout.

Isnt't it implied as part of any work contract? I am pretty sure it is the case everywhere in older Europe.

I'm not a lawyer, so I can't say, but with numbers like that the former CEO could afford to have an entire law firm working on the case for him. I can't imagine that implications would go very far.

I agree that the shareholders might be justified in assailing the board.

> And, you do realize the CEO didn't actively facilitate the breech?

As CEO he is responsible for his company. If a breech happens, it’s because he mismanaged it. They take home huge salaries, stock options and other forms of compensation, supposedly because their job carries so much responsibility, then he should also take responsibility when the shit hits the fan. Not only should he not get a cent, every single dollar that the company loses as a result of this should be recovered from him. Bankrupt the fucker and have him live the rest of his days in a box under a bridge.

You cannot claim ridiculous amounts of money because of your responsible job and then not be held responsible.

Where is the CIO/CTO in all of this? Would we expect a US President (or any Chief Executive of any country) to understand the importance of two-factor authentication? Or to audit his Nuclear Football? How many breaches of the VA occurred and we do not blame the President. We do criticize the response to these breeches and this CEO's response is "Thanks for all the fish," but we do tend to like it when heads roll; so I have no idea who is to actually be blamed and I think it is unreasonable to even begin assessing blame at this time.

> Would we expect a US President (or any Chief Executive of any country) to understand the importance of two-factor authentication?

No, but I would expect him/her to hire competent people who do.

Either you are responsible for the performance of the company or you aren't. If you are you can be richly rewarded when it performs well, but that should also include penalties when you fuck up.

I agree that he is responsible. But his contract doesn't read, "if any big bad thing happens, we pay you $0!"

That would surely be a great contract, but they would have a tough time hiring a CEO.

By analysis, every landlord should put a "if anything really bad happens at this property, you are fully responsible."

> "if any big bad thing happens, we pay you $0!"

No, it should read 'if big bad things happen, you pay us the damages'.

The question is simple: Is the CEO (directly or indirectly) responsible for how the company operates ? If (s)he is, then it's fair (s)he gets a decent bonus when the company does well, but that would also mean they are responsible when everything goes south, and then they should pay for the damage. Otherwise they can basically take huge risks with the company in the hope they score a big bonus, and there will be no consequences when it goes tits up.

You cannot only be responsible when things go well, that's not how responsibility works.

>No, it should read 'if big bad things happen, you pay us the damages'.

It would be utterly ridiculous for any person to sign a contract that said "In the event this company gets hacked, you a personally liable." I wouldn't, and you wouldn't either.

That's fine, but then you get a normal salary.

If you claim you are responsible for the performance of the company, that goes both ways. You can't claim responsibility ONLY when things go well (and rake in large amounts of cash) and then when things go to shit suddenly act like you had nothing to do with it.

Such a contract would attract charlatains -- guys like Bernie Madoff. And then, when they found a data breech, they'd pull every trick to keep it hidden.

No doubt that CEOs should be held responsible. And here the board would say, yes, that's why we fired him.

> Such a contract would attract charlatains

No it wouldn't. The current contracts do that. The CEO can basically take huge risks with the company at zero personal risk. If it pans out, he gets a huge bonus, if it fails he bails out with a huge severance package and no personal consequences.

It's the same mechanism that got us into the financial crisis. Executives have every reason to take huge risks and none to play it safe.

> It would be utterly ridiculous for any person to sign a contract that said "In the event this company gets hacked, you a personally liable." I wouldn't, and you wouldn't either

Same claim was made before SOX forced attestations.

I did this frequently when I was a contractor/consultant. I also retained insurance to mitigate the risk to myself.

Landlords often require renters insurance for this exact reason and definitely try to hold tenants liable for damage. Many states have laws to prevent landlords from doing exactly this.

Right -- many states have laws to prevent landlords from writing such clauses.

> By analysis, every landlord should put a "if you burn the fucking house down, you are fully responsible."

FTFY.

I propose the CEOs payment is put on hold, behind all other creditors. Until all lawsuits are settled and all the creditors arising from them are paid in full he shouldn't see a dime of that money. In several years time, if anything remains of the company, he can collect.

Why is the employment contract structured so that the CEOs pay goes up with shareholder value but doesn’t go down when shareholder value is destroyed? It doesn’t have to be this way. Companies used to be structured as partnerships in most cases with the executives personally liable for harm to the company and caused by the company.

Because otherwise they couldn't hire a good CEO. Unless the shareholders and the board are making bad hiring decisions.

We could also decide, as a society, that this is a problem; that the perverse incentives in place are harmful and change how companies are allowed to operate. For example, until the 90’s investment banks could only be general partnerships, meaning each banker was personally liable for the debt of the firm. What do you think that meant for how seriously they took underwriting risk? Similarly, law firms cannot sell stock and must only be owned by lawyers because society believes any other ownership structure would have a conflict of interest and harm clients.

You're right that we could collectively define new laws and rules. But what would they be?

Their are downsides to investment banks being private partnerships. On the other hand, I've talked with execs that wish the banks hadn't gone public. Yet they had strong incentives to go public.

> Because otherwise they couldn't hire a good CEO.

Yet they expect to hire good lawyers / engineers / team managers / janitors etc without such golden parachutes.

Why is the CEO position rewarded so greatly? Because the board comprises CEOs of other organisations.

They are the nobility of our era and look out for one another.

Maybe companies should filter CEOs based on their own confidence in their performance. I wouldn’t hire a sales person that wanted a large salary or guaranteed bonus; that means they don’t believe they will perform and earn a larger bonus.

The thing is they _didn’t_ hire a good CEO. This happened on his watch.

>The thing is they _didn’t_ hire a good CEO. This happened on his watch.

I guess nearly every US President and global leader, along with 80% of global CEOs aren't "good" either, because bad things happened on their watch. Some much, much worse than a data breach.

I'm not saying this guy was good, but that your standard is impossible to reach.

I disagree. The "this" that happened on his watch was not, in my opinion, that there was a breach, but rather the shitstorm about how it was handled - this happened on his watch and he did not handle it well and that is what makes him a bad CEO in my opinion.

Things happening isn't necessarily an indicator that the person is bad, but how they deal with it (in this case, he didn't for many months!) is an indicator. That's not an impossible standard to reach.

Well if CEOs aren’t responsible for the negatives they shouldn’t claim responsibility for positives.

Something tells me this guy had no problem collecting performance related bonuses.

Have we seen his contract? There's likely a clause about gross misbehavior that would be grounds for termination.

"You make a huge scene and have the CEO exit furiously?" That would probably be very popular and maybe increase the stock value.

Put him on trial for criminal negligence.