<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<TITLE>RE: Compromised machines liable for damage? </TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<BR>
<P><FONT SIZE=2>Botnet code is open source, as far as I know. Maybe not by design, but I have gigs of it and its all googleable.<BR>
<BR>
Not being a lawyer, I'd guess the plaintiff size is highy debateable based on source or destination.<BR>
<BR>
Marty<BR>
<BR>
<BR>
<BR>
-----Original Message-----<BR>
From: Owen DeLong [<A HREF="mailto:owen@delong.com">mailto:owen@delong.com</A>]<BR>
Sent: Mon Dec 26 23:32:04 2005<BR>
To: Hannigan, Martin; Joseph Jackson<BR>
Cc: NANOG<BR>
Subject: RE: Compromised machines liable for damage?<BR>
<BR>
RIAA is a very different context from what we are talking about here.<BR>
<BR>
First, the number of people getting attacked from Open Source systems<BR>
is very small, so, you have a very small class of plaintiffs. Second,<BR>
said class of plaintiffs is probably not as well funded as RIAA.<BR>
<BR>
OTOH, the number of people/organizations being attacked from Micr0$0ft<BR>
based systems is relatively high, so, a large class of plaintiffs,<BR>
and, some of them being enterprises are relatively well funded.<BR>
<BR>
Second, in the case of RIAA, it is businesses suing to do what they<BR>
perceive as protecting their profit stream, and, they know they<BR>
are suing a collection of defendants that are relatively poorly<BR>
funded and have no organization. In the case of Open Source, I<BR>
think there is a pretty good track record of the community coming<BR>
to the aid of those that get sued for various reasons (DeCSS comes<BR>
to mind).<BR>
<BR>
Sure, it's easy to sue someone who doesn't have any money, but,<BR>
there's no point in doing so. Frankly, it's not the people with<BR>
no money that are at risk here. It's the people with some money<BR>
and some assets. If you have nothing, you're pretty safe ignoring<BR>
a civil suit because you have nothing to lose. Frankly, if RIAA<BR>
were to sue me, it wouldn't cost me $250,000 to fight it. It<BR>
might cost me a few thousand if I chose to involve a lawyer in<BR>
some portion of the process, but, initially, I think I could<BR>
make their life difficult enough to get them to go away without<BR>
involving a lawyer.<BR>
<BR>
I've already made MPAA/Disney go away twice without a lawyer. Admittedly,<BR>
they went away before even filing a suit, so, technically, I haven't been<BR>
sued, but, I've been threatened by them, and, I'm sure if I'd<BR>
buckled under or failed to confront them appropriately, I would<BR>
have either gotten sued or ended up handing over money.<BR>
<BR>
The costs of defending a suit are $0 until you hire a lawyer.<BR>
<BR>
Owen<BR>
<BR>
<BR>
--On December 26, 2005 11:18:46 PM -0500 "Hannigan, Martin"<BR>
<hannigan@verisign.com> wrote:<BR>
<BR>
><BR>
><BR>
> In the general sense, possibly, but where there are lawyers there is<BR>
> always discoragement.<BR>
><BR>
> Suing people with no money is easy, but it does stop them from<BR>
> contributing in most cases. There are always a few who like getting sued.<BR>
> RIAA has shown companies will widescale sue so your argument is suspect,<BR>
> IMO..<BR>
><BR>
><BR>
><BR>
><BR>
> -----Original Message-----<BR>
> From: Owen DeLong [<A HREF="mailto:owen@delong.com">mailto:owen@delong.com</A>]<BR>
> Sent: Mon Dec 26 23:11:13 2005<BR>
> To: Hannigan, Martin; Joseph Jackson<BR>
> Cc: NANOG<BR>
> Subject: RE: Compromised machines liable for damage?<BR>
><BR>
> I've seen this argument time and again, and, the reality is that it is<BR>
> absolutely<BR>
> false.<BR>
><BR>
> In fact, it will do nothing but encourage freeware. Liability for a<BR>
> product<BR>
> generally doesn't exist until money changes hands. If you design a piece<BR>
> of<BR>
> equipment and post the drawings in the public domain, you are not liable<BR>
> if someone builds it and harms themselves. You are liable if someone pays<BR>
> you for the design, because, the money changing hands creates a "duty to<BR>
> care".<BR>
> Outside of a "duty to care", the only opening for liability is if they<BR>
> can prove that you failed to take some precaution that would be expected<BR>
> of any "reasonably prudent" person.<BR>
><BR>
> So, liability for bad software and the consequences it creates would be<BR>
> bad for the Micr0$0ft and Oracles of the world, but, generally, very good<BR>
> for the Free Software movement. It might turn out to be bad for<BR>
> organizations<BR>
> like Cygnus and RedHat, but, that's more of a gray area.<BR>
><BR>
> As to the specific example cited...<BR>
><BR>
> If no update has been released, in the case of Open Source, that's no<BR>
> excuse.<BR>
> You have the source, so, you don't have to wait for an update. In the<BR>
> case<BR>
> of closed software, then, I think manufacturer liability is a good thing<BR>
> for the industry in general.<BR>
><BR>
> Owen<BR>
><BR>
><BR>
> --On December 26, 2005 10:07:20 PM -0500 "Hannigan, Martin"<BR>
> <hannigan@verisign.com> wrote:<BR>
><BR>
>><BR>
>><BR>
>> If you want to choke off freeware(gnu, et. Al), sure, go after them. I<BR>
>> doubt the licensing agreement allows it though. (IANAL).<BR>
>><BR>
>> I think all you'd do is encourage people to write more music about<BR>
>> 'freeing the software'. I'd rather not be stricken in that fashion.<BR>
>><BR>
>> I think that angle is DOA.<BR>
>><BR>
>> Martin<BR>
>><BR>
>><BR>
>> -----Original Message-----<BR>
>> From: Joseph Jackson [<A HREF="mailto:jjackson@aninetworks.com">mailto:jjackson@aninetworks.com</A>]<BR>
>> Sent: Mon Dec 26 03:13:02 2005<BR>
>> To: Hannigan, Martin<BR>
>> Cc: NANOG<BR>
>> Subject: RE: Compromised machines liable for damage?<BR>
>><BR>
>> What about the coders that write the buggy software in the first place?<BR>
>> Don't they hold some of the responsibility also? IE I am running some<BR>
>> webserver software that a bug is found in it. Attackers use that bug in<BR>
>> the<BR>
>> software to generate a DOS attack against you from my machines. No<BR>
>> update has been released for the software I am running and/or no warning<BR>
>> as been released. You sue me I sue the coders. What a wonderful world.<BR>
>> (I'm not for this but its another side of the issue.)<BR>
>><BR>
>><BR>
>><BR>
>> _____<BR>
>><BR>
>> From: owner-nanog@merit.edu [<A HREF="mailto:owner-nanog@merit.edu">mailto:owner-nanog@merit.edu</A>] On Behalf Of<BR>
>> Hannigan, Martin<BR>
>> Sent: Sunday, December 25, 2005 9:22 PM<BR>
>> To: Steven M. Bellovin<BR>
>> Cc: Dave Pooser; NANOG<BR>
>> Subject: Re: Compromised machines liable for damage?<BR>
>><BR>
>><BR>
>><BR>
>><BR>
>><BR>
>> Yes, I agree. As usual, I too am 'IANAL'.<BR>
>><BR>
>> Marty<BR>
>><BR>
>><BR>
>><BR>
>> -----Original Message-----<BR>
>> From: Steven M. Bellovin [<A HREF="mailto:smb@cs.columbia.edu">mailto:smb@cs.columbia.edu</A><BR>
>> <<A HREF="mailto:smb@cs.columbia.edu">mailto:smb@cs.columbia.edu</A>> ]<BR>
>> Sent: Sun Dec 25 23:52:27 2005<BR>
>> To: Hannigan, Martin<BR>
>> Cc: Dave Pooser; NANOG<BR>
>> Subject: Re: Compromised machines liable for damage?<BR>
>><BR>
>> In message<BR>
>> <80632326218FE74899BDD48BB836421A033001@Dul1wnexmb04.vcorp.ad.vrsn.c<BR>
>> om>, "Hannigan, Martin" writes:<BR>
>><BR>
>>><BR>
>>> Dave, RIAA wins almost 100pct vs p2p'ers ir sues. Its an interesting =<BR>
>>> dichotomy.<BR>
>>><BR>
>><BR>
>> "Wins" is too strong a word, since I don't think any have gone to<BR>
>> court -- see<BR>
>> <A HREF="http://www.nytimes.com/aponline/arts/AP-Music-Download-Suit.html">http://www.nytimes.com/aponline/arts/AP-Music-Download-Suit.html</A><BR>
>> <<A HREF="http://www.nytimes.com/aponline/arts/AP-Music-Download-Suit.html">http://www.nytimes.com/aponline/arts/AP-Music-Download-Suit.html</A>><BR>
>> as my source.<BR>
>><BR>
>> Besides, it's a very different situation. For my take on liability<BR>
>> issues -- note that I'm not a lawyer, and note that this is from 1994<BR>
>> -- see <A HREF="http://www.wilyhacker.com/1e/chap12.pdf">http://www.wilyhacker.com/1e/chap12.pdf</A><BR>
>> <<A HREF="http://www.wilyhacker.com/1e/chap12.pdf">http://www.wilyhacker.com/1e/chap12.pdf</A>><BR>
>><BR>
>> --Steven M. Bellovin, <A HREF="http://www.cs.columbia.edu/~smb">http://www.cs.columbia.edu/~smb</A><BR>
>> <<A HREF="http://www.cs.columbia.edu/~smb">http://www.cs.columbia.edu/~smb</A>><BR>
>><BR>
>><BR>
>><BR>
>><BR>
><BR>
><BR>
><BR>
> --<BR>
> If this message was not signed with gpg key 0FE2AA3D, it's probably<BR>
> a forgery.<BR>
<BR>
<BR>
<BR>
</FONT>
</P>
</BODY>
</HTML>