not a troll

There is no law that says they must, although they could have government contracts that require it as most Federal government contracts have such clauses and I don't doubt they have contracts with the Federal government. The reason I believe so strongly that they did is that the consequences both with the SEC and stockholders are extreme for not reporting such criminal acts against the company. There are many examples in history of such things not being reported costing companies millions in lawsuits and I wouldn't doubt, although I don't know of one personally, that there is at least one example that cost a company it's existence.