Hacker News Reader

Comment by JumpCrisscross | Hacker News Reader

“The district court properly dismissed Plaintiffs’ claim for failure to satisfy the WPA’s statutory injury requirement. See WASH. REV. CODE § 9.73.060. To succeed at the pleading stage of a WPA claim, a plaintiff must allege an injury to ‘his or her business, his or her person, or his or her reputation.’ Id. Contrary to Plaintiffs’ argument, a bare violation of the WPA is insufficient to satisfy the statutory injury requirement” [1].

This sounds like the correct ruling. What we need is (a) evidence of harm and (b) legislation defining certain absolute rights to privacy, without an injury requirement. Given these data are provided to law enforcement, finding (a) shouldn’t be impossible.

[1] https://www.documentcloud.org/documents/24133084-22-35448

View on HN

> What we need is (a) evidence of harm

When corporate servers get hacked, 'harm' is simply assumed, even if the hack only copied information. Yet when that same kind of hack is perpetrated by corporations against consumers, via backdoor access they have hidden onto our devices, the courts pretend everything is fine.

I wonder if they would be as lenient if I sold phones I had backdoored to spy on calls and texts for me, out of my own backyard.

> When corporate servers get hacked, 'harm' is simply assumed, even if the hack only copied information

We’re not talking about a hack, but surreptitious recording. The legal owner of the conversation isn’t clear based on statute or case law within the context of relevant agreements. This is a case of the law needing to be tightened up.

It's a hack the same way that a locksmith making a surreptitious copies of his clients keys, then using those keys to plant listening devices through their homes, is breaking and entering.

Or my prior example of selling secretly backdoored phones from my yard - the only difference is the scale of the operation.

> my prior example of selling secretly backdoored phones from my yard

If you attached a long user agreement that discloses the back door, you’d be in roughly the same place under this statute.

As the 9th Circuit said in this case on 10/27/23:

“On appeal, Plaintiffs claim that a violation of the [Washington Privacy Act] itself is an invasion of privacy that constitutes remediable injury. But the statutory text does not support their interpretation.” [1]

So the ruling seems correct but also highlights what may be a flaw in the WPA.

[1]https://law.justia.com/cases/federal/appellate-courts/ca9/22....

What about people who might talk about personal injuries or mental illnesses that would affect their work? Wouldn't that risk damaging them if it was private information and sold?

Speaking of which, if a person had a mental illness and then started 'seeing ads' everywhere for the illness, could that exacerbate the illness? How would you prove evidence of harm?

I don't think the court would be satisfied by those, because they're both abstract hypotheticals. I think they want a specific person harmed in an explicit, documented way (e.g. Bob Smith has erectile dysfunction and had his reputation damaged because he was bombarded with ED ads in his car during a date, because the car manufacturer read his texts and used them to make an ad profile).

Reply on news.ycombinator.com