Where is the CIO/CTO in all of this? Would we expect a US President (or any Chief Executive of any country) to understand the importance of two-factor authentication? Or to audit his Nuclear Football? How many breaches of the VA occurred and we do not blame the President. We do criticize the response to these breeches and this CEO's response is "Thanks for all the fish," but we do tend to like it when heads roll; so I have no idea who is to actually be blamed and I think it is unreasonable to even begin assessing blame at this time.

> Would we expect a US President (or any Chief Executive of any country) to understand the importance of two-factor authentication?

No, but I would expect him/her to hire competent people who do.

Either you are responsible for the performance of the company or you aren't. If you are you can be richly rewarded when it performs well, but that should also include penalties when you fuck up.

I agree that he is responsible. But his contract doesn't read, "if any big bad thing happens, we pay you $0!"

That would surely be a great contract, but they would have a tough time hiring a CEO.

By analysis, every landlord should put a "if anything really bad happens at this property, you are fully responsible."

> "if any big bad thing happens, we pay you $0!"

No, it should read 'if big bad things happen, you pay us the damages'.

The question is simple: Is the CEO (directly or indirectly) responsible for how the company operates ? If (s)he is, then it's fair (s)he gets a decent bonus when the company does well, but that would also mean they are responsible when everything goes south, and then they should pay for the damage. Otherwise they can basically take huge risks with the company in the hope they score a big bonus, and there will be no consequences when it goes tits up.

You cannot only be responsible when things go well, that's not how responsibility works.

>No, it should read 'if big bad things happen, you pay us the damages'.

It would be utterly ridiculous for any person to sign a contract that said "In the event this company gets hacked, you a personally liable." I wouldn't, and you wouldn't either.

That's fine, but then you get a normal salary.

If you claim you are responsible for the performance of the company, that goes both ways. You can't claim responsibility ONLY when things go well (and rake in large amounts of cash) and then when things go to shit suddenly act like you had nothing to do with it.

Such a contract would attract charlatains -- guys like Bernie Madoff. And then, when they found a data breech, they'd pull every trick to keep it hidden.

No doubt that CEOs should be held responsible. And here the board would say, yes, that's why we fired him.

> Such a contract would attract charlatains

No it wouldn't. The current contracts do that. The CEO can basically take huge risks with the company at zero personal risk. If it pans out, he gets a huge bonus, if it fails he bails out with a huge severance package and no personal consequences.

It's the same mechanism that got us into the financial crisis. Executives have every reason to take huge risks and none to play it safe.

> It would be utterly ridiculous for any person to sign a contract that said "In the event this company gets hacked, you a personally liable." I wouldn't, and you wouldn't either

Same claim was made before SOX forced attestations.

I did this frequently when I was a contractor/consultant. I also retained insurance to mitigate the risk to myself.

Landlords often require renters insurance for this exact reason and definitely try to hold tenants liable for damage. Many states have laws to prevent landlords from doing exactly this.

Right -- many states have laws to prevent landlords from writing such clauses.

> By analysis, every landlord should put a "if you burn the fucking house down, you are fully responsible."

FTFY.