A Target to the Heart of the First Amendment: Government Endorsement of Responsible Disclosure as Unconstitutional

Bergman, Kristin M | May 1, 2015

Brian Krebs, a former reporter for the Washington Post who is now known for his blog Krebs on Security, remained relatively unknown for most of his career. But in December 2013, Mr. Krebs found that hackers had exploited a data vulnerability in Target’s electronic-payment system, compromising millions of credit-card numbers that had been used to purchase goods from the second-largest discount retailer in the United States. In the following months, an investigation revealed that the breach affected nearly half of the 110-million credit cards recently used at Target, resulting in one of the largest known digital credit-card heists in history. Even before Target’s data breach personally affected millions of consumers, concern over the security of personal data was endemic. A survey conducted in March 2013 revealed that 82.1% of Americans were at least somewhat worried about a data breach involving banks, government entities, or other organizations, and roughly the same percentage were concerned about identity theft and credit-card fraud. With over 78- million data records containing personal information exposed to breaches in the first ten months of 2014 alone, it is unsurprising that a separate survey found that 77% of consumers agreed that expeditious notification of vulnerabilities involving stolen or lost data was important. Coupled with the potential widespread harm caused by data breaches, discrepancies in data-holders’ approaches to security vulnerabilities have prompted a call for a national response. Generally, two approaches exist for confronting data security issues: full disclosure and responsible disclosure. Proponents of the former argue that stifling communication about data breaches or vulnerabilities, no matter the source, is detrimental, conflicting with both public sentiment and constitutional rights. On the other end of the spectrum, supporters of a responsible disclosure policy suggest that allowing companies to rectify data security issues before public dissemination provides a better solution. In effect, responsible disclosure requires those who discover a data vulnerability to not only notify the affected organization, but also keep knowledge of the data security weakness confidential, regardless of its potential impact on consumers. Although the predominant industry approach, this Article argues that the responsible disclosure approach should not be legislatively or judicially adopted. Not only does a responsible disclosure policy violate the First Amendment as a prior restraint, but it also constitutes poor public policy, ultimately causing a chilling effect that would reduce business accountability. In an effort to avoid both limiting the development of enhanced data security safeguards and restricting the public’s ability to engage in self-help, Congress and the judiciary should allow basic market forces to pave the way for innovation in this continually evolving field.