Of course, I’m not suggesting he’s legally entitled to his job pending the outcome of his due process.
I’m saying that is the right thing to do, as opposed to instantly firing someone when there is only an allegation.
Although even in this case, I don’t think it warrants termination (unless he is physically unable to remain in the job because he is in prison, which would be a shame).
There is nothing wrong with paying a ransom, contrary to what the title implies. That’s not his crime. Those less familiar with the ransomware epidemic, and before that, the DDoS extortion/protection racket, might be surprised to hear that paying ransoms is not uncommon.
His alleged crime was essentially failing to disclose the breach. It’s not clear how much of that direction came from above him. Travis obviously knew about it at minimum, and he obviously did not direct him or Uber to disclose it.
It’s not difficult to imagine a complicated scenario where he was essentially in a position to be a whistleblower and forfeit his stock, also potentially damaging his reputation and ability to get a new job (doing the ‘right thing’ can still be career suicide), or just do what he was told.
That doesn’t absolve him of guilt in the eyes of the law, but good people make mistakes too, and this one would not seem to reveal anything that could jeopardize his current company. Again, he did not conceal it from the CEO, so presumably if he made that particular mistake at cloudflare, the CEO would direct him not to cover it up.
There could be other explanations as well. He hasn’t had an opportunity to present a defense. We only have the complaint, which is by design as adversarial and one-sided as possible.
