What would you do?

I don't think the hack is a crisis at all. It's a great opportunity to strengthen a vulnerability. The crisis hasn't happened unless the mop-up is sloppy. THerefore - you just need to have the student hacker, school and parents on board (not hard), cover off legalities, and finally deal with the journo (easiest thing of all). I've had journos sniffing around about much more controversial matters than this in real life - and it never hit the press because I handled it correctly - so this is a piece of cake. And yes I'm transparent and truthful. But no I don't always give out comment / all requested info to journos. I give out what organisations should say to protect the public, the reputation of the organisation, and to fix problems. Put out fires. It's like pyrotechnics which is why I LOVE media relations. The trickier the more interesting.

Just adding another response I received here (also below): https://www.dhirubhai.net/feed/update/urn:li:activity:6293986007398391808/ * Chad C. Besides awarding the kid a widely publicized full scholarship and internship? * Kevin Keith Thanks for responding Chad! It is really tricky! So playing devil's advocate, and applying UK law, would the child be arrested under the Computer Misuse Act? How would your clients [Ministry / Dept. of Defence] react to the scholarship move? * Chad C. Okay. Cool. Since we are just riffing here I'll riff: While rewarding precociousness might be a mistake, punishing such merit may be a bigger one. In reality, UK law would likely convict our young hero to prevent floodgates from opening. For the hack, alone, maybe not. Disseminating confidential information, though? Not sure even a minor could climb out from under that. While the Ministry/DoD would no doubt align with that, from a company perspective, they're lost as clients no matter what. That's why the positive PR gained by doing the cool thing (scholarship + internship) just might win the hearts of new ones, especially by being honest about the vulnerability ("How did we overlook this?"), sharing the experience transparently ("Oh, the brilliance of this kid!") and making it a memorable case worth celebrating and (who knows?) modelling in the future. Especially if it has a happy ending. The kid works his sentence off in whatever fashion the court deems appropriate and then is publicly reward for having earned an important lesson, which opens an important conversation in the public forum about privacy and discretion. Counter-intuitive? Perhaps. I still think it would be a move worth considering. * Kevin Keith It's great you are taking a strategic approach Chad! Just being devil's advocate again (!) the child may not want a scholarship from your firm and the journalist may think you are trying to buy you way out of trouble if you suggest it to him. At this stage, you do not know who the child is either. What would you say to the journalist when he calls? What would be your immediate few actions? * Chad C. Good point. This is a great exercise! Thank you, Kevin! If we don't know who the child is at this point and the journalist might suggest we are trying to buy our way out, then a better spin may be to go with that and offer the child a straight-up reward (cash) a la bug bounty program and it's not unusual to reward such actions in that way. I still think full transparency will work better than making up some story that doesn't resonate or make sense. Embracing it as a teachable moment, even as the company loses such a worthy client, creates accountability and openness to learning. Discussing appropriate elements of the client's cyber resilience strategy and framing it that way with the journalist would be an authentic response that wouldn't sound plastic and defensive or something industry folks and general public would likely see right through. Understating the importance of resilience, even as the company has pie on its face, may be the most positive, not to mention constructive, spin of all. * Kevin Keith Thanks again Chad. Some great points. Just one final reflection. It's absolutely critical in moments like these to define the crisis. It may relate to the hacking by a twelve year old, but it could equally relate a failure by the company to take immediate action to prevent further hacks (a classroom now knows how he did it). It could relate to the sensitive deals and issues revealed by the hacker - specifically what was said? It could be a failure to immediately notify your clients of this breach and subsequently their response to your organisation? This is not easy! I shall post a full response to the above hypothetical soon. Further comments welcome below...

Putin: first I'd immediately contact putins press sec and head of security . I'd apologise and advise we are looking into who is behind the bugging . I'd liaise with the venue and AFP to offer a new room - security agents can do a sweep. Id seek commitment from putins press sec to not raise this at the press conference seeing as we had dealt with the matter. If necessary i would delay the press conference until it had been resolved to a reasonable level of reassurance. DFAT and ASIS should be fully briefed

Cyber: bring the hacker onto the team in an advisory capacity and pay him / get him on a contract. This immediately protects against further leaks and hacks . Shut down any journalist stories easily by stating the companies ongoing commitment to best practice and securing the best talent possible

Putin: yes, PM, those are the ones he was meant to find. Here is the intel from the ones he didn't.