Two Memos on Pressure: The CTO Who Wants Silence and the Intern Who Was Nudged

Disclosure: The scenarios in this post are hypothetical. The companies, executives, and intern are invented, and the memos are written as if from a coworker in each situation. The laws cited are real. The post presents them as a way to think through how to respond when someone more senior asks you to bend the truth.

Incidents are hard enough on their own. They get harder when someone with more power than you wants the story told differently. Here are two scenarios, and the memos I'd write in each.

Scenario One: "No Evidence It's Been Used, So Why Tell Anyone?"

A company in North Carolina has suffered a cybersecurity incident in which customer PII was stolen. The new CTO has decided the company doesn't need to report it publicly or to law enforcement, because there's no evidence the data has been used against customers. Reporting, she argues, would only generate bad publicity. State law requires disclosure, but she believes a loophole could let the company skip it. The Legal Department is understaffed and has no director, and the junior staff are worried about what happens if they object to her.

If it falls to someone to say something, it might look like this:

MEMO

Dear Ms. Headinsand,

It has come to my attention that you intend not to notify customers or the state Attorney General's office of a recent data breach. My understanding is that you hold this belief because there is no evidence that customer PII has been exploited. There is no loophole or exception for this.

I would remind you that unreasonable delay in notification to both customers and the NC Attorney General violates N.C. Gen. Stat. §§ 75-61 to 75-65, the Identity Theft Protection Act.

Furthermore, according to the NC Attorney General's guidance on this matter, customers do not have to be harmed before notification is required. The trigger is unauthorized access to the data where illegal use has occurred or is reasonably likely to occur, or where there is a material risk of harm. I believe customer data stolen by an attacker clearly meets that standard. Every further day of delay increases our risk of violating this statute.

Some negative press is unavoidable at this point, though it could be much worse if the state were to take legal sanctions against the company, or individuals responsible.

Let this memo serve as notice that I am against violating this reporting statute, and I urge you to reconsider your stance, and act as ethically as possible moving forward.

Thank you,

-QiO-:$

Why the "loophole" doesn't hold

The CTO's argument is the most common one in breach response: nobody has been hurt yet. It sounds reasonable, but it doesn't match how North Carolina's law is written. A "security breach" under the statute includes unauthorized access to unencrypted data where illegal use "has occurred or is reasonably likely to occur or that creates a material risk of harm to a consumer." Data taken by an attacker is, almost by definition, at risk of misuse, so waiting for proof of damage isn't an option.

The statute does allow some flexibility. Notice has to be given "without unreasonable delay," which makes room for law enforcement requests and for time to work out the scope of the breach. Hiding the breach to avoid bad press isn't one of those allowances. A violation is treated as an unfair and deceptive trade practice under G.S. 75-1.1, and the Attorney General's Consumer Protection Division is the agency that has to be notified.

One more point: the statute requires notice to affected people and to the Attorney General, but it doesn't require a report to the police. Contacting law enforcement is a separate decision. It's usually the right one for stolen data, and it's often a source of help, not just trouble. But it isn't the part of the law the CTO is actually breaking.

Scenario Two: The Intern and the "Probably"

A different company has suffered an incident. An intern was one of the first people on the scene and didn't follow the organization's policy for preserving evidence. Now a senior vice president is pressuring him to say he "probably" did follow it. He's anxious, it's his first incident, and he's afraid he'll lose his internship if he doesn't go along. He comes to you in private and asks for advice.

MEMO

Dear Intern,

I've heard that you have come under pressure by the Senior VP to state that you "probably" followed the procedures to preserve evidence. I want to offer you, as an intern, a piece of advice:

All further statements by you, either written or verbal, should be along these lines:

"When the incident occurred, I did what I could until my superiors took over, and I did not complete the evidence-preservation steps."

Leave it at that. Do not lie, and do not trust anyone to look out for you.

You are an intern, and mistakes can happen. You shouldn't be in this position in the first place and the pressure from management is unfair.

Good luck.

-QiO:-$

Why "probably" is the dangerous word

"Probably" sounds harmless, but it asks the intern to put a guess on the record as if it were a fact. That matters because evidence-handling statements get relied on later: by the investigation, by legal, and possibly in court. A shaky chain of custody can be explained. A false statement about it is much harder to explain, and it lands on the person who made it, not on the executive who suggested it.

That's why the advice is to stay plain and truthful. A first-timer who made a mistake and says so is a training problem. An intern who goes along with a vague claim and gets caught is an integrity problem, and the senior VP isn't the one whose name is on the statement.

The Takeaway

These two scenarios have the same root: someone with authority wants a convenient story, and someone with less authority has to decide whether to go along with it. The right answer in both is to stay honest, and to write it down. In the first case that means pointing to the statute. In the second it means a short, accurate statement. The pressure is unfair, but the person who signs the statement is the one who answers for it.

Sources

• North Carolina General Assembly. N.C. Gen. Stat. § 75-65, Protection from security breaches.
• North Carolina General Assembly. N.C. Gen. Stat. § 75-61, Definitions.
• North Carolina Department of Justice. Security Breach Information.