This is a wild one, but we have a client that is known to send out CUI regularly to his friends, family, etc (Unfortunately he cannot be fired as he owns the company). I am giving a presentation to the company later in the month and am having trouble finding the exact penalties for releasing or sharing CUI outside of the organization. Any ideas on exact penalties or anywhere to find cases brought against people? In reality I would like to scare him so the harsher the penalties the better.