[1oooqooq]

> 1. It's probably not gross negligence - gross negligence is an extreme departure from ordinary standards of care - the ordinary standard here seems to be to suck at security :)

how hard it is to find a single company which does it right to testify? and then defense would have to find experts and several other legal counsels from similarly sized companies willing to testify that they also "do it wrong as a norm", with the extremely high risk of being included in the malpratice claim if the defense fails.

[tptacek]

That single company will be setting an extra-ordinary standard, so that doesn't help you.

[1oooqooq]

not if you frame it as "look at this randomly selected company pretty standard security practices"...

[tptacek]

If you find a company with strong security, it won't be randomly selected.