I'n not sure this is the correct lawsuit to demonstrate this.
So hypothetically, if say you lent a key to a handyman and then they posted a photo on it to twitter it seems pretty reasonable for them to cover the costs of replacing the locks. As opposed to having to wait for somebody to rob you and then trying to show that the robber did so from the photo.
They are. If you ever look at the damage caused by a hack it's in the millions and that's because they're including the time used to investigate and repair and mitigate further attacks is included.
Sure it is. Money was spent that wouldn't have been if the situation didn't happen.
There are two problems with this.
First, for normal damages, there is some limitation on the costs. If someone breaks the lock on your door and does nothing else, you replace the lock, damages of maybe $40. If someone gets into your servers, you what? Spend ten minutes to check the logs and rotate keys? Wipe and rebuild all the servers? Does the reasonableness of that depend on whether that's an automated process or a manual one? Maybe you should delete your entire code repository and have it rewritten from scratch, in case knowledge of the code could have helped some attacker? There is no upper limit to the amount of resources you could spend investigating something, and then companies with unlimited resources would effectively get to use it as a cudgel against someone who embarrassed them, because $10M is nothing to them but is a life-destroying amount of damages to some kid who made a mistake.
It's like claiming that someone broke the lock on your door so now you're not sure if someone might have been inside and you have to strip the whole building to the rafters to check if someone has planted a listening device or hidden some crypto mining hardware inside the walls, even though you're a company that sells tile and carpets.
Second, if doing the latter was in some way actually justifiable then the company should be periodically doing it anyway, because if a vulnerability existed then it could have been exploited whether anyone was detected or not, so if spending that level of resources could be justified "just in case" then it isn't money that was spent that wouldn't have been if the situation didn't happen. Unless they're full of crap that all of it was actually necessary.
While trying to be reasonable might have unexpected outcomes for either side sometimes, not having a line at all always unfairly skews the damages to one side.
Now suppose you're a disaster. There is a combination lock on the front door with the combination already punched into it and if anyone walks through the door they have full access to everything from your employees' bank routing numbers to the VPN credentials providing access to your suppliers' networks, with no logs of any kind. If someone gets inside and you want to know what they did you'll have to shutter the company for a year while a team of full-time engineers and forensic accountants tries to reconcile the numbers in each set of systems with the others and resolve any inconsistencies through some combination of vibes and whimsy.
Your costs in the second case are going to be dramatically higher, but that isn't a consequence of anything the person who walked through the door did. That's something you did to yourself.
Failure to mitigate is a thing. The damages in the first case would be zero or close to zero, which implies the damages in the second case should be the same because the party claiming the damages is the one responsible for the difference.
Moreover, this is the incentive we want, because we want organizations to minimize damages and suffer consequences if they don't.
The upper limit is what the courts decide is reasonable, based on the factors of the case, your justification of the requested damages, precedent of similar cases, etc.
>$10M is nothing to them but is a life-destroying amount of damages to some kid who made a mistake.
Again, the courts make these determinations literally all the time. We don't need to figure out what "reasonable" and "damages" mean from first principles.
>It's like claiming that someone broke the lock on your door so now you're not sure if someone might have been inside and you have to strip the whole building to the rafters to check if someone has planted a listening device or hidden some crypto mining hardware inside the walls, even though you're a company that sells tile and carpets.
This type of claim is not approved by the courts, because it is clearly unreasonable.
"The judge will render a decision" still requires you to have some rule for the judge to apply or the result is entirely subjective. You don't want the winner of every case to be the one who can afford to spend the most on lawyers.
> This type of claim is not approved by the courts, because it is clearly unreasonable.
I feel like you're only making my point. It isn't reasonable in the physical case, so why should it be reasonable in the digital case?
Good thing they can examine a century or two of case law, including lengthy debates on what constitutes “reasonable” and “damages”, to help make their decision.
>You don’t want the winner of every case to be the one who can afford to spend the most on lawyers.
That is pretty much how it works already. Better lawyers typically make better arguments and, on average, get better results. They also want more money because they are better.
You don’t want the winner of the case to be the one who made a worse argument just because they have less money.
>It isn’t reasonable in the physical case, so why should it be reasonable in the digital case?
Your extremely stretched example is not analogous to the situation.
"A status quo exists" is not an argument for what rule the law should use unless your argument is that status quo bias is the only acceptable mechanism for choosing policy.
> That is pretty much how it works already.
Is/ought dichotomy.
> You don’t want the winner of the case to be the one who made a worse argument just because they have less money.
No, what you want is for the law to be clear and reasonable so that spending millions on lawyers to argue over excessive ambiguities is not a prerequisite to attaining a just outcome.
> Your extremely stretched example is not analogous to the situation.
In what way is it not analogous?
>Is/ought dichotomy.
For some reason, you've started talking about what the law hypothetically should be and how court cases should be handled. I wish we had a perfect court system, too. But can we shift back to reality?
>In what way is it not analogous?
The first hint is that it's purposefully formulated to come across as absurd (crypto as an appeal to emotion? really?). It's unnecessarily exaggerated and lacks any context. This Automattic stuff has months of history that will be considered. It fails to map just about anything to the digital equivalent, represented in the lawsuit.
Analogies typically suck anyways, so why don't we just discuss what's actually happening? Some companies were obligated to implement manual security controls during the period where Automattic disabled their automated ones. In some cases they had to conduct additional (unscheduled, previously unnecessary) security assessments solely due to the actions of Automattic during their fued with another company about trademarks. Companies had to take time to assess if, how, and when they would move their websites. All of this costs money.
If you are an unrelated third-party caught in the crossfire of a frivolous dispute between two companies, seeking reimbursement for that money is reasonable.
All of these discussions are always about what should happen, because it hasn't happened yet, which means people can still affect the outcome, e.g. by changing the law or convincing a judge to do something different.
What would be the point of talking about something if there is nothing anybody can do about it?
> The first hint is that it's purposefully formulated to come across as absurd (crypto as an appeal to emotion? really?).
This is a thing that commonly happens in the actually analogous situation, i.e. someone who breaks into your servers installs crypto miners on them if they get in. And that was your objection? The point of that example was to provide something that could incur real measurable costs if it actually happened, i.e. giving the other side the benefit of the doubt that a genuine harm is hypothetically possible. The issue is that even assuming that, it's still purely speculative that it would have actually happened.
Moreover, you don't seem to like hypotheticals, but the hypothetical is the basis of the claim. "We had to spend money on this mitigation or otherwise hypothetical bad things could have happened." If they spent money in order to prevent nothing then it was wasted money and they were the ones who decided to waste it.
> Analogies typically suck anyways, so why don't we just discuss what's actually happening?
Analogies are fairly important because the law operates on the basis of analogies, and in particular, cases like this can set precedents that will be used in analogous cases.
Which means we might want to consider what happens if the defendant is a kid instead of a large business and whether you really want to level that amount of damages on them.
> All of this costs money.
All of everything costs money. If you're using some Google service as an important part of your business and then they discontinue it as is their custom, it could cause you a lot of trouble. Does that mean you should be able to sue them when they do that?
People are allowed to be petulant and your main recourse is to stop doing business with them. You can also get companies to promise in writing not to be petulant, but in general getting them to guarantee that requires paying them a buttload of money and people are often more inclined to risk the consequences than buy the insurance.
However, there were customers who migrated to other hosts because of the potential security risk. That is an actual damage. There are people who lost contracts because their potential client chose software other than WordPress. That is an actual damage. There are lots of actual damages that occurred.
Depends on the specific tort, but actual damages aren't the only thing for which there can be liability. Statutory damages, punitive damages, and non-damages based liability (unjust enrichment, disgorgement of profits, etc.) are all things that exist for various torts.
> "I could have been hacked, so I had to spend time/money on it" isn't actual damages unless they were _actually_ hacked.
Why wouldn't reasonable costs incurred to determine or rule out adverse effects of a wrongful act be considered actual damages of that act?
If you break my door lock I'm pretty sure I can't just leave my door wide open for months and then sue you for all of my stuff that got stolen. I need to fix the lock. And ask you to pay for that. Also not a lawyer, but pretty sure you've got to proactively mitigate your damages.
In your scenario, someone _could've_ broken the lock because you're renting a lock from a locking agency Lock Engine, who copied a lock design from LockPress, and LockPress decided not to mail them design flaws anymore.
In the real world, vulnerable locks don't ever get fixed. At worst, locks get recalled, and you get your money back. Lock designs don't get shared freely, and if they do, there is no expectation of informing people that may have copied designs of potential flaws.
If your house got broken into, you should sue Lock Engine, because they're not providing the service you're paying for. Suing LockPress for the lock design Lock Engine decided to copy wholesale is pure nonsense.
Is that ok for you that Apple appropriated the app? They offered the platform, the ecosystem and the store. Is it within their right?
That's what happened here.