Printable View
I hadnt heard about this until now, seems like TMM/Nats dont like it when people post about their security breaches/fuckups on webmaster message boards...
http://www.xbiz.com/news/107439
Yet again it seems like NATs is trying to strongarm customers and webmasters to keep quiet about issues that could have wide reaching consequences for those using their script.
Regards,
Lee
Oh and interestingly enough....
After filing this lawsuit until today, it would appear that NATs/TMM have issued fixes for no less than 4 security updates LOL
Regards,
Lee
oh popcorn time :D
my thoughts on this are that when security breaches pop up its good to act fast in shutting down those loop holes and update the software as soon as possible before huge harm is done. Ventilating the breach is not doing any good other than helping others jump on the waggon and exploiting it on other systems within hours of disclosing the breach.
However if I would've found out about a breach, had contacted the developing company and waited a few days and when nothing happens, I'd made it public so that others could save themselves from harm.
So what damages did TMM receive except a strong growth in revenue since than? oh right - it could've been better :D hehe
edit: i think companies should have to prove that they got damages like lets say find people that didn't buy their software for that very reason or name the losses from those not-buyers... like the RIAA with copyright thefts "ohhh we lost a trillion in sales due to copyright infringements"... no, get y'alls books on the table and prove it, damnit :D
The action they've taken against this woman, and their previous security issues, makes me see NATS / TMM in a bad light.
Suing to silence people, or strong arming others to silence them, just demonstrates a weakness and bullying that most webmasters in our industry shouldn't tolerate. Notice that the article states that part of the suite is trying to force her to reveal her sources WTF? She's written for the Wall Street Journal and Business Week, I hope they fail.
TMM has a long history of this. In fact, the major security breach that happened a year and a half ago had been going on for over a year. TMM knew about it and did nothing (they claimed they thought it was limited to a very few installs) and yet when OC3 Networks discovered a bunch of their customers who used NATS had the problem and attempted to warn people about it, TMM threatened to sue them and got them to shut up. It was only because a few courageous people described what was happening, and a bunch of people discovered that they also had the problem, that TMM was forced to admit the truth.
I know of another very large straight program that used NATS very briefly and found a ton of problems with it, but it too was threatened into silence.
Squirt i agree, i dont remember exactly when it was but a few years back when they had that MAJOR breach that hit all the mainstream media outlets, they were denying it even happened publicly on the boards for weeks prior to it getting publicized.
From my own interactions with NATs owners/reps on the boards and seeing how they react to others, it certainly isnt a software product i would be willingly using, that being said, i know there are program owners that swear by NATs.... Despite all the obvious pitfalls and hurdles we have all heard about over the years, real or not.
Regards,
Lee
I think it is well-established in US law that reporters cannot be forced to reveal their sources, so I have no doubt she will prevail.Quote:
Originally Posted by Squirt
I just hope that she was careful with her "allegeds"!
I worked with said company at a previous job and it was *** a **** experience.
Asteriks in place, of course, to protect myself! :)
Mary,
You actually bring up a good point there, specifically, are informative posts made on blogs and message forums considered 'newsworthy' in the eyes of the law?
We know true journalists do not have to give up their sources but what about the lowly blogger or adult webmaster posting on an industry message board to assist others and get this type of information 'out there' when at the time, it was glaringly obvious that TMM/NATs was trying to stiffle the information from becoming public knowledge?
Regards,
Lee
That is going to be a very interesting litmus test...
I could easily argue that a blog and a professional forum are both sources of information dissemination, and therefore protected by the same agreements. Freedom of Speech, freedom of information.
They could get her for liable, if she wasn't careful with the "allegeds", however.
With the new trend towards prosecution with online information (facebook, myspace pages, etc.) it could go either way for this person. But I think a reasonable judge would find in her favour.
To play devil's advocate, if in fact she did what she's accused of, posted things
that were untrue, AND did so with reckless disregard for the truth, TMM has
a point.
She didnt though.Quote:
Originally Posted by raymor
From what i understand she basically posted about that huge security breach they had a few years back, before it hit the mainstream media and TMM/NATs tried to stop it from becoming public knowledge.
Unfortunately for NATs, its only an accusation if it isnnt true, i really dont see what they are gaining through this other than showing how low they will actually go to stop people finding out about important issues with their software.
Regards,
Lee
Every attorney I've spoken with has said that libel and defamation cases are nearly impossible to win.
My understanding is that the standard is that you have to post or write something that's false *knowing* that it was false, *knowing* that it was likely to injure the other party, and doing so with malice and intent to harm the other party.
It's the last two that are very, very tough standards to reach.
Of course, filing a lawsuit and driving someone to financial ruin trying to defend it can also be an effective way of shutting people up. Fortunately, in California, that's illegal. Unfortunately, in New Jersey, it's not.
The thing I don't get is how a company like TMM can possibly think that suing people who speak about security breaches can possibly help them in the long term. Maybe it gets people to shut up for fear of being sued, and if so, perhaps that's the reasoning behind it. But I look at any company who does that sort of thing, and has a history of threatening other people with the same thing, and the only thought that comes to my mind is that they are either incredibly insecure about their public persona, or they have something to hide.
For a lot of companies these days litigation is becoming a part of their business model :(Quote:
Originally Posted by gaybucks_chip
What is interesting though... TMM/NATs always post on GFY how they are 'pro' free speech but it appears only when it isnt about them LOL
Regards,
Lee
Odd ... can you be pro free speech while using the legal system to silence people?
Can you be an open forum while banning people from posting the truth, with links?
I dunno it all seems dodgy to me these days.. behind the scenes manipulations to silence those with knowledge from posting the truth and suing those who post public knowledge of a corporations flaws.. it wreaks of desperation to me.
True it's hard times but pacifying the masses is not a successful business strategy, at least not in my experience.
Quote:
Originally Posted by Lee
Not in my opinion.Quote:
Originally Posted by Squirt
Complicated, and depends on the rules of the forum, but in general, forum operators try to walk a line between openness and keeping an environment that's inviting to posters. It is not an easy task making moderation decisions, but in general, I believe that presentation of facts that do not impinge on an expectation of privacy, and particularly when the facts might be useful to the community, should generally be an acceptable action.Quote:
Can you be an open forum while banning people from posting the truth, with links?
Integrity comes at a high cost. Most people would rather be silent and avoid delicate topics than risk alienating or angering people, because they don't want to affect their businesses or public perceptions. That's why Cybersocket got away with what it did for so long; people had the perception that they had the ability to destroy businesses, even though that wasn't the case. And that's why certain other companies are never spoken badly of publicly, while many people who have worked with them know that things are not what they appear to be, but won't say so publicly.Quote:
I dunno it all seems dodgy to me these days.. behind the scenes manipulations to silence those with knowledge from posting the truth and suing those who post public knowledge of a corporations flaws.. it wreaks of desperation to me.
It sucks, but it's probably true in every field of business.
there are companies out there who do nothing
but dig trough widely used software titles, including Microsoft's,
and firefox and pick any name looking for security holes, bugs and what not and announce them out to the public
in fact if I'm not mistaken that's how Microsoft was forced to
go in and start fixing Windows XP and delay what became known as Vista
they wouldn't fix security issues they were told about
and those who found them announced it to the world
to have something done
so if the security issues with NATS are true
not sure why they'd think they're more special then
MS in having their security problems aired for the world to see
if this reporter lied or whatever on purpose sure sue her
but NATS is also going to have to prove they did not in fact
have security issues.
The whole thing ends up drawing even more attention
That's true and that perspective has affected my view of community recently.Quote:
Originally Posted by gaybucks_chip
If a community is a group of people who care so little about others that they are willing to be silent when there's a threat to the community, so they feel safe and can maintain their bottom line, then the community is weak.
If the truth, with links, is considered a threat, or drama, then the community gets what it deserves for silencing people with integrity because there will be no voice to speak out when the scam artists come slithering back in. Newbies, and the unsuspecting in the community, will get sucked.
Online businesses seem to have unique issues that brick and mortar establishments haven't had before the internet.Quote:
Originally Posted by gaybucks_chip
It's amazing how offline reputations can be so completely different then online reputations. This is why people should post online, about what's happened offline, more often.
My sense of online communities has always been the same as real world communities.. look out for them and they'll look out for you, but I've since discovered that this isn't the case in online porn webmaster communities. You are only looked out for if it's convenient and safe. People tend not to share really helpful information, and people keep their mouths shut when releasing helpful information would be perceived as drama or conflicting with a companies online persona.
As you stated, this is why Cybersocket, NATS/TMM, and others have been able to do what they do.
To thwart this I've started supplementing my online connections with lots of offline communication to exchange valuable information that people just don't post out of fear. I should have done this years ago but I was just a bit daft and far to altruistic.
the old adages 'think before you speak' and 'choose your enemies wisely' certainly come into play here.
I do not see how they could/would win.
Imagine if Microsoft went around suing every single person that exposed a security threat?!
All too often you have to publicly expose something before any action will be taken.
It is a sad reality of today.
The issue is money.Quote:
Originally Posted by QueerLust
TMM owns a bunch of member sites, and it also owns Segpay, so they have money. This one blogger probably doesn't have a lot of assets. If TMM's attorney drags things out with a ton of discovery and pleadings and so forth, there isn't much the other party can do.
It sucks, but the system isn't really about equality. It's a lot more about how much money you have. If you have more than the other party, you can intimidate, threaten, delay, and run up the other person's bill to your heart's content, and in all but a few states, that's legal.
There is only going to be one winner and I can predict it this very second with 100% accuracy:Quote:
Originally Posted by gaybucks_chip
The Lawyers
Is anyone at all concerned with how this blogger wrote 'tmm threated to kill a client? I don't know for sure, but it sounds like the blogger said an anonymous source told me their lives were threated by TMM. No serious journalist would have included that without 1) being allowed to name the person who was threated or in this case the source 2) verifying it with 2 different other sources who heard it as well which they would have mentioned this in the article 3) heard it themselves on a tape which they would have said they heard and kept a copy of it.
The only time you are able to say or write something without any regard is on a bathroom wall. If you're turning your blog into a bathroom wall without regard to journalist ethics you diminish the value of real news.
I'm sorry but no one has the right to make serious allegations and not be able to back them up. Lets take a look at another angle. If I blogged that I was told by a former model of XYZ that after a shoot they were given beer and after they passed out he was locked in a cage for two days... should I be allowed to write about this without naming the model? Perhaps, but should I be allowed to do this without verifying it with other sources or without seeing a copy of a tape? Should I be allowed to write about this even though there was never a police report made about it? Is it ok for me to blindly accept what an accuser is saying about someone else as the truth and pass it off as factual news to my readers? God I hope not. I tend to want my news to be more than a gossip rag, which by the way do get sued all the time and they lose a lot too.
Yes, this blogger probably went a bit over the line.
But on the other hand, TMM did everything possible to squash this story, and it's well known that they squelched OC3 networks early on when they first noticed the problem, and did the same to many other program owners who independently discovered the problem over the ensuing YEAR that the security breach was known to them, but they failed to notify anyone.
And, even worse than that, some programs, after the breach was made public, sent out incredibly evasive statements to their affiliates, dodging whether or not their program had actually suffered a breach, and instead offering weak self-serving notices that they'd "done all updates recommended by TMM", when what affiliates really needed to know at that point was whether that program (and therefore, potentially, the affiliate's information) had been compromised.
Free speech isn't free. It has a high cost, and one of those costs is allowing people to say things that they believe to be true without fear of punishment. I suspect that blogger believed everything that she wrote about the situation, and if that's the case, then her statements very clearly do not rise to the standard required for a libel or defamation case, which requires the accuser to prove both that the libeling/defaming party *knows* that what they are saying is false, and that the libeling/defaming party intended, with malice, to harm the aggrieved party.
It may not be the answer you want to hear, but it's the way our laws work. If a company undertakes a libel or defamation action without proof of both of those things, then they're essentially trying to strip away that person's right to free speech, and I'm sure that TMM knows that by threatening people with legal action, a lot of people won't want to spend the money money to defend a frivilous defamation action (which can easily cost $50-100,000) and will simply shut up. And that is not OK. (It's also why there's legislation preventing such things in California.)
Yes, I can agree that nobody likes hearing bad things said about them. But I don't know of any other company in this industry where, over and over, you keep hearing stories of people being threatened into silence, and that is not a good thing.
I think, like with a lot of the 'bad' stuff that happens in the industry, many feel like they can put disinformation, or simply no information out there at all because for the most part, adult webmasters simply dont seem to care about a person or companies prior history.Quote:
Originally Posted by gaybucks_chip
Im sure most of us reading this thread right now can rattle off 5+ companies or individuals who in the last few years have caused some kind of financial or personal issues to individuals or, the gay webmaster community at large that many others reading this thread wont know about because... It has simply been forgotten.
Cybersocket, AVN, Epoch, SameBB, MaxPowers, were the 5 who came to mind immediately, many companies and individuals still do business with these individuals or companies because they simply are not aware (or care about) their past histories because 'drama' and 'censorship' has been turned in to a defensive tool by these same individuals and companies, enabling those threads to simply be cast aside as nothing more than just that 'drama' even when the reality is, they are being posted to inform the greater webmaster community about shady business practices.
Like with John at NATs threatening to sue anyone who posts negatively about TMM or NATs on a wide range of boards, as you said Chip, it puts a lot of people off from posting, because they simply are not able to afford a lengthy court battle.
For the most part anything that is posted these days which may cast a bad light on a company is put down to 'drama' and the person posting it is considered to be a 'troll' on many boards just looking for attention.
Of course, these companies and individuals also have schills working with them spreading dis-information, like in the case of the TMM/NATs breach, almost as soon as the mainstream media got hold of the story, posts started to appear on a wide range of message boards discussing how the 'industry' could protect its image, resulting in stories of how the 'breach' was incorrect, never happened and was simply 'drama'.
I guess what im saying is, so long as you are a company with the perception of 'power' the bad deeds you do go un-noticed and ultimately forgotten by the masses except for a small few who make a point of remembering their past histories, perhaps if more people paid attention to the 'drama' and who is doing the labelling of such threads/posts as such, these companies and individuals wouldnt be able to get away with it time and time again, but i guess that is to much to ask for, afterall most webmasters would sell their own mothers if it meant they could make a couple of extra signups.
Regards,
Lee
The right to free speach is a two way street between you and your governments. Thats it. There is no other right to free speach.
That would actually be incorrect.Quote:
Originally Posted by djdez
The freedom of speech is a HUMAN RIGHT which unfortunately, means everyone has it, irrespective of whether or not they are speaking out against an individual, corporation or government.
Saying that freedomn of speech is something between a citizen and a government is basically saying you are okay with censorship which, we all know you arent based on your previous history on GWW, unless you are just against censorship when your friends are the ones doing the posting.
Regards,
Lee
I'm not certain what you mean here. The First Amendment guarantees a level of freedom of expression that is almost unparalleled in any other country, and with very, very few exceptions, the courts have been consistent in upholding those rights. Yes, the Bush administration attempted to trample all over those rights, but fortunately it was an enforcement issue rather than actual changes in the law.Quote:
Originally Posted by djdez
I don't really see how it's a two way street; as Lee said, it's a protection that is pretty fundamental to our political system.
Quote:
Originally Posted by djdez
I believe the point djdez was making is that the first amendment only barsQuote:
Originally Posted by gaybucks_chip
the federal government from censorship and other similar infringements of
free speech - it in no way affects one party's ability to sue another. The wording
of the first amendment is:
So the first amendment doesn't say "NATS can't sue you for libel after you'veQuote:
Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, ...
said something". Rather, the first amendment is concerned with what congress
can and cannot do. Further, several high court decisions have well established
that the first amendment bars the government from preventing the speech AHEAD
OF TIME (censorship), but is not a protection from prosecution AFTERWARDS
if the speech is unlawful on it's face (threatening someone) or is unlawful in it's
intended effects (conspiracy to commit a crime, libel).
Where I disagree with djdez is that djdez implies that the first amendment, and
other similar laws elsewhere, CREATE the right of free speech. In fact the bill
of rights does not claim to create or establish any rights. What it does is bar the
government from INFRINGING on already existing rights, rights which the
founders felt were part of being human - "endowed by their creator". That rights
cannot be created by governments is also clear if you consider the definition
of a right. A right is something that the government cannot legitimately take away.
Obviously if the government gave you your rights, the government could take
them away. Since govt can't take away rights, govt must not have given them.
So yes, the constitution only prevents the government, and by it's words only
the federal government, from infringing on rights. The first amendment doesn't
have any affect on libel and slander suits. On the other hand, the first amendment
does recognize, by implication, that a right to free speech already existed before
the government was created. Since the right always existed, there must be some
limit to how much one person can interfere with the rights of another.
In fact, that limit is defined by the rights of the other person. The blogger has the
right to say what they will. NATS has a right to do business without malicious
interference by someone lying about them, falsely accusing them of making death
threats. The right of one person to earn a living probably takes precedence over
the right of another to attack them with lies, I would say.
And while the laws of slander, libel, and defamation do, in fact, provide a means of redress for someone who makes false accusations, our legislators have set the standards for proving libel and slander and defamation pretty high, most likely recognizing the chilling effect such laws could have on speech. And that's basically my point. These laws aren't written to prevent someone's feelings from being hurt, they are written to address actual damage to a reputation, and further protect speech by ensuring that unintentional speech isn't punishable.Quote:
Originally Posted by raymor
In this case as I understand it, under the law, unless TMM can prove that the original poster knew what she was saying was false, and intended to harm TMM, then defamation and libel has not occurred. Of course, the problem is, nothing in our current system prevents TMM from dragging her through the courts and bankrupting her, all the while knowing that their case doesn't meet the legal standard, and they will therefore lose. But even if they do lose, the blogger has lost a fortune in legal fees, not to mention the stress of dealing with the situation. And so, even if TMM loses, she still loses also.
I do understand that TMM doesn't want people going around saying nasty things about them. That's obvious given their history of threats of legal action and other actions to silence people. The difference here is that the act of saying nasty things that happen to be true is protected at a very high standard, and the people at TMM are not stupid, and have to know this.
The part I don't get is how anyone with a brain can possibly think that pursuing this course of action can possibly enhance or benefit one's reputation. At best, such a course of action will discourage others from speaking publicly about your product in a negative way, but I would think that the damage to one's reputation that results from going around suing (or threatening to sue) anyone in sight would be far, far worse than the honest expression of opinion or disclosure of fact about your product.
People should have integrity and post the truth on boards, not spin/lie to save their ass or a companies bottom line as it doesn' pay off because they are usually outed, but you have this woman guilty before the trial is over, which is not how the American legal system works.
All evidence to date shows she had complete regard for the information she was disseminating , not a lack of regard. As the article states, Shellee Hale is a contributor to the Wall Street Journal and Business week that's been writing on internet security issues for 5 years. She's hardly some loon writing on bathroom walls like you try to paint her.
When you read her blog dated April 26th regarding this issue you can see she's quite sane and level headed. She definately doesn't look like a crazy bathroom wall writing loon. See pic below.
http://blog.nj.com/ledgerupdates_imp...hy-lawsuit.jpg
Quote:
Originally Posted by djdez
She also is a licensed private investigator. As Squirt said, between her 5 years experience writing on Internet security, the publications where she's been published, and the levelheaded nature of her writing (and her concern for the bigger picture of protecting journalists' sources), I think we have someone here who is reasoned and levelheaded, hardly one of the sleazy 'writers' that write for the gossip rags.
Additionally, I wasn't aware that TMM was going after a *slander* claim until I read the article. That's a stretch at best, since slander is spoken and libel is written. I suspect the reason they're doing that is they know they have no chance under the stricter rules regarding libel... but how you can make the argument that something written by a journalist, in a blog (or on a message board) was somehow "spoken" is beyond me.
Here again, the adult industry relies on various free expression protections, and our forefathers recognized that a strong press, with access to confidential informants, is crucial to our democracy. The last thing a company working in the adult business should be doing is trying to strike down protections either in free expression, or in protection of journalists, yet TMM is doing both, yet when you read about this situation, a number of scholars are saying that this case has the potential to establish precedent that determines the level of protection bloggers have. If TMM wins, it will be a huge loss to everyone except TMM.
Sad, sad when people put their personal gripes ahead of what's good for the industry -- and the country as a whole. But, as Lee said, not terribly surprising.
These points may be fairly minor, but in fact under New Jersey law, like mostQuote:
Originally Posted by gaybucks_chip
common law countries and US states, the three things you just said aren't
actually correct.
There is no requirement that the defendant knows the accusation is false.
TMM only has to prove the she was negligent is this regard - that she
wasn't careful about whether what she said was true or not. That, and they
have to show that the statement was actually false, but they do not need to
show that she KNEW it to be false. That fits with common sense. I can't go
around saying "Chip is a registered sex offender" just because I don't KNOW
that to be a lie. I have no idea whether you are or not, so it would be reckless
for me to say one way or the other, and therefore unlawful. The exact level
of knowledge or negligence required depends on other factors, but simple
negligence can be enough.
Also, because the statement claims that TMM committed a felony, it is
defamation per se and they need not prove intent to harm. Any
reasonable person would know that if you falsely accuse someone of a
murder threat, that's going to harm their reputation and their business. T
here is no need to prove the obvious, hence the defamation per se statute.
Lastly, you said "These laws aren't written to prevent someone's feelings from
being hurt". In fact that is exactly what the "false light" statute is for. TMM is
suing for both defamation, which is the external damage to their reputation,
and "false light", which is the internal stress and upset caused when someone
goes around saying terrible things about you.
Not knowing the full facts of the case, but having read the complaint, I tend to
agree that the suit is probably a mistake. Interestingly, Hale did not do what
many defamation defendants do, seek to have the case summarily dismissed
by showing that the accusation was true. That's how she could have avoided
the hassle and expense of much of the legal process, but she has not done so.
That suggest that she probably cannot show that her claims are true.
Thanks Ray. You had it correct. The first amendment that gives Americans the right to free speach expressly says that government will not abridge freedom of speech. I support free speech and it has been recognized. I just wanted to get that part out of the way.
Just to be clear, the owners of NATS are not my friends. So I am not defending them out of some sort of Loyalty. It is simply at face value I do believe this lawsuit has some merit and isn't a complete sham as what some of you are saying.
This blogger specifically stated that credit card account numbers could have been compromised. With 5 minutes of research one would know right away this isn't the truth. Second she in a sense is turning this company into a band of gangsters and mob men by saying they had threatened to kill someone. She wrote this as fact because her informant had a nice telephone voice?
I say again, I do not believe that their was sufficient research and enough verifying of sources done to include some of the things she did. This is not responsible journalism. I reject the argument that this is the price of free speech.
Additionally, Chips first sentence in his rebuttal to my post was she probably crossed a line. A judge and possibly a jury will decide if the line was crossed. I am simply saying that when you come close to the line you can't be suprised when someone or another company exerts their legal right too. We all know of companies that have exerted their muscle with the sole intention on destroying a competitor or getting someone to shutup. In this case their is clear evidence of at least encroaching on a line and both parties should have their day in court.
When looking at this, it might also be helpful to know that I've had prior experience
when I very publicly criticized TMM, saying something that I regret, and John
handled it like a gentleman. My own experience suggests that TMM wouldn't file
a defamation suit at the drop of a hat without any legitimate reason. I don't know
the facts of this case, so I can't judge. However, I'm sure TMM didn't like some of
the things I said about them and they didn't file a frivolous law suit to shut me up,
but rather responded with some grace.
It is really, really unfortunate that New Jersey residents do not enjoy the protections that California residents do against bogus lawsuits. Whether or not the blogger crossed the line, I seriously doubt that it rises to at least the standard that most of the country adheres to; if New Jersey has a weakened standard for libel and defamation, that's unfortunate, but the fact that they are suing for *slander* when the statements were written rather than verbal would tend to point in the direction of knowing their case is weak.
Defend TMM all you want, where there's smoke, usually there's fire. There are the statements of OC3 networks, the Rhino (or whatever it was called) case, at least one very large adult program that abruptly dropped the product (long before the major breach happened) and cannot say anything about it except in very obtuse language, and a breach that affected a very large number of NATS programs which TMM reasonably should have known about based on the inquiries made to them, or at the very least, should have inquired about, but instead allowed these breaches to continue for a year.
Then, when a few courageous people came forward, they, too, were threatened, until it came out that enough programs were compromised that TMM would end up suing much of their client base if they went after everyone who reported a problem.
A lot of programs, such as ours, told affiliates the truth as soon as they became aware of the problem. A handful of others evaded the truth and dodged the entire question by sending out self-serving statements. A lot of customer data and God knows what else was compromised from a lot of programs. I suspect that people who were not affected still don't know what really happnened. Nearly all of it was preventable if TMM had been more proactive about warning of the possible breach.
What this blogger did was courageous. If she were in California, TMM would likely have no case, because of our anti-SLAPP statutes. Fortunately for the industry, she decided to take the high road and put the word out about the problem, and likely largely because of the national visibility she brought to the situation, the next time there was a security breach, TMM, in a complete about-face from their previous actions, actually let people know.
Ray, I hear what you say... but John had to also realize that taking action against you would amount to professional suicide. You and your products are so highly regarded in the industry that the bad will TMM would generate by going after you would have almost certainly destroyed TMM's reputation. TMM is nothing if not shrewd, and I'm inclined to think that had more to do with John's response than anything else.
I'm sorry to sound so cynical, and I am generally not terribly cynical about life, but if you look at all that's been said, all the people that are strangely silent, the actual events that have happened, it does not paint a pretty picture.