The purpose of a retro is to identify a process that will keep some bad thing from happening again; a process that keeps the bad thing from happening for any reason is strictly better than a process that keeps the bad thing from happening due to malice. If your infra engineers can't expose your PII on accident, they can't expose it on purpose either. To extend your analogy, it's the difference between locking your house (which protects your valuables from thieves, but not your garden hose and wheelbarrow from your drunken neighbor) vs. locking your shed as well.

> If your infra engineers can't expose your PII on accident, they can't expose it on purpose either.

That sounds exactly backwards.

Both are true

Definitely not. Many things are designed to prevent accidents and are not secure against attacks, even in the data landscape.

The point of the postmortem is to educate people as to what to do differently. You get more value out of the "accident" frame than out of the "malice" frame, which has already been intensively explored by the DOJ. Most organizations aren't going to be in a position of having a formal federal prosecutor serving as CSO and Deputy General Counsel making grave errors in fitting a report to a bug bounty process instead of a criminal investigation, but it's easy to imagine a variety of organizations landing in a variety of different scrapes about how to route reports that might trigger breach report liability.

> You can’t analyze an armed robbery prosecution as an accident without ignoring all of the most significant aspects of the case.

Depends on the scope of the analysis. You can analyze why the security systems allowed for that armed robbery to happen and recommend how to prevent this from happening in the future. You can analyze what societal factors and incentive structures lead to this and similar robberies and how to reduce the likelyhood of that occuring in the future.

For all of this the question of guilt doesn't matter at all.

In fairness, this is a conviction for failing to call the police (misprision) when your boss decided to cover up a data breach, not for committing armed robbery. Obstruction of justice as well.

On another note, future whistleblowers could, I suppose, cite this as a reason why they cannot keep their mouth shut.

from the perspective of someone who did time for cannabis its real simple. crimes are and always have been for the poors. rich people do profound esoteric actions with unfortunate outcomes that merit long study and rumination with post mortem analytics and an academic conclusion. unless you did a sex crime like weinstein or took a lot of rich people money like madoff.

this whole article is just the rich people version of ' yeah my cousin beat up a mascot once but in his defense that mascot was awful too'