Mackenzie Arnold(@MackenZ_arnold):This isn’t how things work in any other incident reporting regime. Not aviation, not nuclear, not medical devices, not securities. Even in cyber (where the victims have valid reasons to keep the vulnerability quiet), they get max 90 days. Even in confidential reporting regimes (like CIRCIA and ASRS), they still release anonymized info. We’ve worked through these questions before, and the answer is never ~we defer to the wishes of the company.

Mackenzie Arnold

@MackenZ_arnold

Managing Director, US Law & Policy @Law_AI_

Joined June 2023

1.4K Following 1.3K Followers

Mackenzie Arnold@MackenZ_arnold

2026.09.25 20:49

This isn’t how things work in any other incident reporting regime. Not aviation, not nuclear, not medical devices, not securities. Even in cyber (where the victims have valid reasons to keep the vulnerability quiet), they get max 90 days. Even in confidential reporting regimes (like CIRCIA and ASRS), they still release anonymized info. We’ve worked through these questions before, and the answer is never ~we defer to the wishes of the company.