For the past few months, national retailer J.C. Penney has been fighting an under-seal court battle to keep you from knowing that its payment card network was breached by U.S. and Eastern European hackers.

The intrusions, by TJX hacker Albert Gonzalez and his overseas accomplices, occurred beginning in October 2007. J.C. Penney admits it was “wholly unaware” of the breach until the Secret Service told the company about it in May 2008, but now says with certitude that no identity or bank-card data was stolen in the breach it failed to detect. That’s why the company didn’t want to be identified to the public, says spokeswoman Darcie Brossart

“Because there was no reason to think that the hackers were successful, there was no need to alarm J.C. Penney customers,” says Brossart, “We believed we had a legitimate interest in not being linked to criminal activity that resulted in major thefts from other companies.”

So in court filings, J.C. Penney argued that it was entitled to anonymity under the 2004 Crime Victims’ Rights Act, a law intended to protect the “dignity and privacy” of victims. A federal judge on Friday ordered the company’s identity unsealed anyway, as well as that of a second breached company, clothing retailer Wet Seal.

It’s a familiar story. Companies have never been eager to have their security slip-ups revealed to consumers. What was different, and remarkable, this time around is that an assistant U.S. attorney argued that J.C. Penney and Wet Seal should be identified. The lead prosecutor in the largest identity-theft hacks in U.S. history argued for disclosure.

From a motion by Assistant U.S. Attorney Stephen Heymann, which was unsealed Monday:

The Secret Service went to J.C. Penney with the information and evidence that its computer system, used to process payment card transactions, had been broken into. Although the protective system used by J.C. Penney had unquestionably failed, the Secret Service had no evidence as to whether payment card numbers had been stolen.

Our presumption of public disclosure in charged criminal cases does not depend on the costly proof of evidence of negligence by the corporation, which we rarely can obtain, and then only with the full cooperation and guidance of the company. Most people want to know when their credit or debit card numbers may have been put at risk, not simply if, and after, they have clearly been stolen.

The presumption of disclosure has an additional significant benefit, though…. Knowing that card holders will be concerned whenever their credit or debit card information is put at risk, if they know of it, provides an incentive to companies to invest in the protections their customers would want. Transparency makes the market work in this area.

It’s a bit jarring to see a lucid pro-transparency, pro-security argument from a federal prosecutor. For years, law enforcement has had an informal policy of protecting companies from the public relations consequences of their poor security — a kind of omerta among intruders, the companies they hack and the feds, where only the public is left in the dark. To be sure, it’s never been set in stone, and not all feds have played ball. But it’s a common practice, and it corrodes accountability.

It began with the first big for-profit card breach of the internet era — the 1997 case of Carlos Salgado Jr., who was caught trying to sell 80,000 stolen credit card numbers on IRC. The government persuaded Salgado’s judge to permanently seal the identity of the company he hacked, in order to shield it from “loss of business due to the perception by others that computer systems may be vulnerable.” That the perception would be completely accurate didn’t matter in the least.

Back then, the feds were worried that companies would stop reporting intrusions if they got bad press. J.C. Penney raised this argument as well, warning that outing the company “may discourage other victims of cybercrimes to report the criminal activity or cooperate with enforcement officials.” It takes real cajones to tell a judge that chain stores around the country are prepared to commit the federal crime of misprision if J.C. Penney doesn’t get its way.

U.S. District Judge Douglas Woodlock shot back that he was “astonished” that a company would even think to not cooperate with law enforcement, and ultimately determined “there shouldn’t be privacy for corporations.” “It is so absurd to think that [corporations] are entitled to special benefits,” he said on Friday.

California’s 2003 breach-disclosure law, and similar laws now in effect in 45 states, have already done a lot to shatter the code of silence surrounding breaches, but that didn’t stop New Jersey federal prosecutors from initially promising J.C. Penney anonymity. It was only when the Gonzalez case was transfered to Boston — and a new prosecutor — that the public gained an advocate in the case. Heymann’s successful defense of transparency suggests a sea change in law enforcement: a recognition that data breaches don’t occur in a vacuum. They fester under a rock, and wither and die only when flooded with sunlight.

As Heymann acknowledged in his filing (.pdf), there can be valid law enforcement reasons for withholding identification of an intrusion target. But protecting the “dignity” of the company isn’t one of them. The Justice Department should adopt this prosecutor’s position as its default in identity-theft breaches.

Image courtesy Roadsidepictures

See Also:

• TJX Hacker Gets 20 Years in Prison
• Secret Service Paid TJX Hacker $75000 a Year
• Former Morgan Stanley Coder Gets 2 Years in Prison for TJX Hack
• Gonzalez Accomplice Gets Probation for Selling Browser Exploit
• Document Reveals TJX Hacker’s Assistance to Prosecutors
• Former Teen Hacker’s Suicide Linked to TJX Probe