Hacker News Reader

Comment by mikeash | Hacker News Reader

Shouldn't the potential risk be taken into account as well? They basically disabled HTTPS for a large number of people for a significant amount of time, leaving them open to great financial risk due to compromised bank accounts and such. That roughly nobody took advantage doesn't change the fact that the risk was there.

I mean, if I fired a gun at your house but was lucky enough not to injure anybody, shouldn't my punishment still be more than the cost of fixing the bullet holes? Of course that's separate from the question of whether you should receive more than the cost of fixing the bullet holes.

View on HN

That is essentially the difference between Criminal law and civil law. Civil suits are typically designed to make you whole. You get what you actually lost.

Sometimes putative damages can be awarded, which can look at the egregiousness of the actions of the plaintiff. I don't know if those are available here.

Then I guess the followup questions are: why aren't criminal charges being brought, and (if they're actually not) why aren't punitive damages being awarded?

Punitive damages would occur after any trial victory. This is just the very first step, essentially a legal accusation.

As to why the government hasn't tried to indict for criminal charges, there could be many reasons. The case might not be good. They might be waiting. They may think it's small fry stuff.

The doj doesn't go after everyone.

So who is responsible in the DoJ for deciding that it's OK to let company directors do arms length crimes and they're going to look the other way.

Is there any question as to what Lenovo actually did, are they denying they exceeded their authorisation in accessing computers and MitM-ing things like bank transactions? If the facts aren't in dispute there then surely the only thing the court would need to do is work out how long the directors who authorised/oversaw [or negligently didn't oversee] this are going to be put in prison for.

Well, the CFAA has a handy little "choose your own adventure" like section listing the various naughty activities, where you could be guilty of a.2.B or a.7.A, etc. Which combo do you think Lenovo is guilty of?

What a self-serving law. All it deals with is atomic data and financial institutions. How in the hell does this ever get applied to people downloading too many webpages?

What would the criminal charges be? The best outline for a prosecution I've seen goes something like "CFAA, mumble mumble, spying is bad." What specific law was broken? Lay out the case. For bonus points, pretend you're the defense attorney, and then outline the defense's case.

I'm not really familiar enough with the law to say.

Let's say that some company builds a bridge that doesn't match the spec, to the point that it's dangerous. Maybe it falls down if any truck weighing more than 10 tons goes over it, when it was supposed to hold 40 tons. And let's further say that this weakness was the result of intentional cost-saving measures and a complete failure to investigate their consequences. But then let's say that the fault with the bridge was discovered after a few months before any 11-40 ton trucks had gone over it, so nobody actually died.

Would that be illegal under some sort of negligence or endangerment law? It certainly seems like it ought to be. Lenovo's actions are basically equivalent, except that it was (probably) just property at risk, not lives.

It looks like endangerment is indeed a criminal offense, and it doesn't require that the harm actually happens, just that the potential was there and that it was foreseeable. Would that actually apply here?

Fair questions. Civil engineering projects may not be the best analogy, because there are some special laws in that space, but maybe consider automobile recalls. How many people went to prison because a car's brakes or ignition didn't work? Criminal product liability is pretty rare afaik.

Criminal proceedings against an entire company don't result in people going to jail, right? Holding people personally responsible is probably not appropriate with this, but holding the entire company criminally responsible and levying fines well in excess of actual damages seems reasonable.

Regarding automobile recalls, it looks like GM got hit with some fines for their ignition switch shenanigans, beyond actual damages. But it looks like this is a regulatory thing rather than a criminal thing. Maybe this is another place where special laws get in the way of generalizing.

Criminal proceedings against an entire company don't result in people going to jail, right?

While it seems pretty rare for this to happen, the officers of a corporation can be held criminally liable for the actions of the corp.

They can be, but that allows criminal proceedings against the officer, it doesn't change that proceeding against the company, as such, cannot result in any individual going to jail, since the individual isn't the company (they are distinct legal persons) and one person can't be sent to prison based on another person being convicted of a crime.

> What would the criminal charges be?

Not a lawyer but quoting from the document.

  COMPLAINT FOR:
  1) VIOLATION OF COMPUTER FRAUD AND ABUSE ACT (18 U.S.C. § 1030, et seq.);
  2) VIOLATION OF FEDERAL WIRETAP ACT (18 U.S.C. § 2510, et seq.);
  3) VIOLATION OF THE STORED COMMUNICATIONS ACT (18 U.S.C. § 2701, et seq.);
  4) VIOLATION OF CALIFORNIA INVASION OF PRIVACY ACT, PENAL CODE §§ 631, 637.2;
  5) VIOLATION OF CALIFORNIA BUS. & PROF. CODE § 17200, et seq.;
  6) TRESPASS TO CHATTELS;
  7) COMMON LAW FRAUD; and
  8) NEGLIGENT MISREPRESENTATION

Thanks, though I'm a little suspicious when I see this:

  2) VIOLATION OF FEDERAL WIRETAP ACT (18 U.S.C. § 2510, et seq.);
  3) VIOLATION OF THE STORED COMMUNICATIONS ACT (18 U.S.C. § 2701, et seq.);

You'd think one or the other, no? (AFAIK Superfish didn't touch anything even remotely covered by SCA). This looks like classic "all of the torts" shotgun filing. Which makes sense for a civil case, but it's not much of a guide as to what criminal cases would be viable.

>Which makes sense for a civil case, but it's not much of a guide as to what criminal cases would be viable.

But that is the guide book for criminal proceedings against individuals. The prosecutor dog piles on every single charge they can and then offers a scaled down plea bargain.

Reply on news.ycombinator.com