I suspect what he is saying is that people who probably had no visibility into the state of the Sony's security and certainly had no ability to influence it are unfortunate victims here. While security is difficult to measure and therefore difficult to manage and improve, it remains the responsibility of executives to allocate resources against that problem and it is they who ultimately bear the majority of the blame when the security posture falls short.

This.

IMO the higher up the chain you are, the more responsibility you have to secure the systems you are responsible for.

I feel like it's a perceived lack of accountability (from the perspective of the hackers) of the executive team that leads to these kinds of leaks. When they feel they aren't seeing justice - as defined by them - then I think they're more motivated to do something about it themselves.

What do you mean the people? Do you mean the brain cell that was responsible for their decision to work there? Or the one that was responsible for their decision to work at all? Or the one that...

Of course you can have sympathy for a company. What is a person if not a bunch of semi-autonomous systems working together to make decisions and perform actions? What is a company if not the same thing?

There are the people who work at Sony. There is Sony as an organization. They are not the same thing, but they can each be described independently. The decisions and actions of a company is a product not of individual humans but of a group of humans working in conjunction to do more than one could do by itself. You can't blame the person. That's not fair. You have to blame the organization.

However, blame is exactly the job role of the executive team, since a company can't be fired. You blame Sony. You fire their CxO.

> The decisions and actions of a company is a product not of individual humans but of a group of humans working in conjunction to do more than one could do by itself. You can't blame the person. That's not fair. You have to blame the organization.

So we can never again blame a CEO (or other executive) for the actions of the company? If the organization is a separable entity from the people it must be so?

Strongly equating a company and its employees only really makes sense if the employees also control the company, and therefore in some significant sense the company's decisions and interests can be said to be the aggregate of its employees' decisions and interests. Except maybe in a workers' cooperative, that's not usually the case.

I think it's unfair to punish someone for a decision they had no part of. How many of the people who had their info leaked had an a part in making the decision to go with the security precautions they chose, or even were aware of them.

The higher up the chain of command you are the more accountable you should be, but harming the poor folks at the bottom isn't doing anyone any favours.