<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<TITLE>RE: Compromised machines liable for damage?</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<BR>
<P><FONT SIZE=2>Dave, RIAA wins almost 100pct vs p2p'ers ir sues. Its an interesting dichotomy.<BR>
<BR>
Marty<BR>
<BR>
<BR>
<BR>
-----Original Message-----<BR>
From: Dave Pooser [<A HREF="mailto:dave.nanog@alfordmedia.com">mailto:dave.nanog@alfordmedia.com</A>]<BR>
Sent: Sun Dec 25 23:09:02 2005<BR>
To: NANOG<BR>
Subject: Compromised machines liable for damage?<BR>
<BR>
<BR>
> This should be another thread completely, but I am wondering about<BR>
> the liability of the individual's who have owned machines that are<BR>
> attacking me/my clients.<BR>
<BR>
As a practical matter, I'd expect it to be difficult to try. Convincing a<BR>
jury that running a PHP version that's three months out of date constitutes<BR>
gross negligence because you should have read about the vulnerability on the<BR>
Web might be... tricky. Especially when you have to explain to the jury what<BR>
PHP is. Dueling expert witnesses arguing about best practice, poor confused<BR>
webmaster/Amway distributor looking bewildered at all this technical talk<BR>
("I figgered I just buy Plesk and I was good to go. I dunno nothin' about<BR>
PHP. Isn't that a drug?") Not to mention working out what percentage of the<BR>
damages you suffered should come from each host.<BR>
<BR>
But yeah, I'd like to see it tried. Lawyering up is one of our core<BR>
competencies here in the USA; maybe we could use it for good instead of<BR>
evil.<BR>
--<BR>
Dave Pooser<BR>
Manager of Information Services<BR>
Alford Media <A HREF="http://www.alfordmedia.com">http://www.alfordmedia.com</A><BR>
<BR>
<BR>
<BR>
</FONT>
</P>
</BODY>
</HTML>