Defamation dosen't work like that though. The only thing that is relevant is what the author knew or should have known when they published the statement. There's no legal requirement to issue a retraction if you later know that your previous statement was false. Journalistic ethics says you should, but the law doesn't require it.
Issuing a retraction can potentially lessen the damages if the original statement leads to liability, but that's only relevant if the plaintiff first wins on the original statement being defamatory.
The right outcome here would be some form of retraction, and more visibility into how this came about in the first place.
As with all insider attacks, it's almost impossible to stop someone from doing the first bad thing, but you should have controls in place to easily identify who the bad actor was. Ubiquiti eventually did - with the assistance of the FBI, but not after the damage was done.
On the other hand, Krebs not vetting his source, and allowing this through resulted in a 20% drop to Ubiquiti's stock - which affected the company, their employees (who have a financial interest in the stock) and played into the attackers hands.
I'd like to see both of them come together and do a real strong analysis.
That said, the negative "tone" that came from these articles persists - take a look at this thread for evidence.
How many people know that Ubiquiti dropped the cloud login requirement? That their recent firmware and releases have been impressively solid (judging from my and community experience)?
I don't want Krebs or Ubiquiti to "win" here, I want people to behave ethically.
> There's no legal requirement to issue a retraction if you later know that your previous statement was false.
The public speech -> printed statement -> online publishing transition problematizes the meanings of "retraction" and "previous statement". Probably not legally, of course, but I'm thinking about the ordinary usage of these terms here.
Lots of traditional journalism outlets also publish online, but the way the reporting ends up being used is very different. Anything they put on their websites tends to live forever, and it's often difficult even for careful readers to remember to check the publishing dates.
If an article was published a year ago, but the page itself doesn't carry a retraction notice, I often assume the published information continues to be accurate. The lack of a retraction on an easily editable webpage indicates to me that the publishing individual or organization continues to endorse the material, as if it had been published the day I read it.
That's why organizations with journalistic integrity are so careful to add retraction notices to incorrect articles, even for small changes. I doubt it amounts to defamation to not add such a notice, but it certainly makes the violation of journalistic integrity much worse.
Issuing a retraction can potentially lessen the damages if the original statement leads to liability, but that's only relevant if the plaintiff first wins on the original statement being defamatory.