I completely agree with you...the crux of the matter is truly what constitutes "knowledge". IMHO, the standard should be whether or not the entity should have knowledge of the compromise based upon industry standards and common practices. Companies that fail to review logs (or, even worse, don't log) or fail to implement NIDS or HIDS to identify potential compromises shouldn't be given a "free pass" by this law...they should be treated as if they knew about the compromise but failed to disclose it if it is reasonable to believe that these common practices would have alerted them to the compromise. This would in the very least counteract the negative impact this could have on security advocacy within companies.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/1984/17564#17564