4 ms·

Can there be legal liability with anti malware? By example, could flagging some software as malware expose you to being sued for libel?

by jj999 3y ago

horsawlarway 3y ago
This is getting down voted and I'm not sure why. Google has flagged some of my personal domains as "deceptive login" (why: I could not fucking tell you... they give no info, and my logs show absolutely nothing going on. My best guess is I used chrome auto fill in them while testing letsencrypt staging certs after switching cert providers) But... they are very clearly publishing info claiming my site is malicious, and it's not. It seems like a super clear case of libel, which I won't pursue because it's personal sites and I'm not losing revenue or anything, but it seems open and shut. It's not even exempt due to general section 230 clauses. It's not user content. It's just them.
- yummypaint 3y ago
  If you're up for it, have a lawyer send them a nastygram/C&D and post on HN about what happens. Many people would probably be interested.
- rainsford 3y ago
  I'm not a lawyer, but my understanding of libel is that at least in the US you need an element of intent to be guilty of libel. Simply being wrong about something isn't libel unless you can prove they know it was wrong or should have known it was wrong. Unless you can show Google knows your site isn't malicious and is labeling it that way anyways, it seems more likely it would be an open and shut case in their favor. I'm also fairly confident Google's lawyers have put a fair amount of thought into this and are already prepared to demonstrate how their labeling is done in good faith, etc. I didn't do any downvoting, but I suspect it could be a reaction to the fact that treating this as libel would make operating any security company or service effectively impossible by requiring zero false positives. That seems like an obviously unworkable standard even if getting incorrectly flagged as malicious admittedly does suck.
  - horsawlarway 3y ago
    I've submitted more than a dozen reports to their service. To their credit - Mozilla pulled it from their copy of the safebrowsing list and no longer reports it as malicious. Google does though. Google also has no contact in place to appeal, and I've provided written contact information if they have any actual evidence of abuse that I can prevent. They have had these reports for more than 10 months now, and I resubmit roughly once every week or so.
efitz 3y ago
Yes [1]. In this case, the issue was that the AM software itself contained security bugs, but depriving you of use of your computer would probably be actionable. IANAL and have no idea if you could win that. The software does have disclaimer of warranties and limits on liability to the purchase price as part of the terms of use [2] [1] https://www.prnewswire.com/news-releases/consumers-file-class-action-lawsuit-against-symantec-for-defective-antivirus-software-300746568.html https://www.prnewswire.com/news-releases/consumers-file-clas... [2] https://www.microsoft.com/en-us/legal/terms-of-use https://www.microsoft.com/en-us/legal/terms-of-use [note: I am not 100% certain that this is the TOU specifically applicable to MS AM but most TOU look similar]
quags 3y ago
This would be similar to spam and blocklists. I know people have tried to sue blocklists (maps and spamhaus) but from memory they were not successful in the end. That included blocking email , sometimes with larger blocks with ip ranges not directly involved but in a similar range. Malware being flagged on an anti virus would be similar but in those case the user has an option to exclude the block. Google and Firefox block domains for phishing regularly as well.

Can there be legal liability with anti malware? By example, could flagging some software as malware expose you to being sued for libel?

by jj999 3y ago

Can there be legal liability with anti malware? By example, could flagging some software as malware expose you to being sued for libel?

horsawlarway 3y ago

This is getting down voted and I'm not sure why. Google has flagged some of my personal domains as "deceptive login" (why: I could not fucking tell you... they give no info, and my logs show absolutely nothing going on. My best guess is I used chrome auto fill in them while testing letsencrypt staging certs after switching cert providers) But... they are very clearly publishing info claiming my site is malicious, and it's not. It seems like a super clear case of libel, which I won't pursue because it's personal sites and I'm not losing revenue or anything, but it seems open and shut. It's not even exempt due to general section 230 clauses. It's not user content. It's just them.

yummypaint 3y ago
If you're up for it, have a lawyer send them a nastygram/C&D and post on HN about what happens. Many people would probably be interested.
rainsford 3y ago
I'm not a lawyer, but my understanding of libel is that at least in the US you need an element of intent to be guilty of libel. Simply being wrong about something isn't libel unless you can prove they know it was wrong or should have known it was wrong. Unless you can show Google knows your site isn't malicious and is labeling it that way anyways, it seems more likely it would be an open and shut case in their favor. I'm also fairly confident Google's lawyers have put a fair amount of thought into this and are already prepared to demonstrate how their labeling is done in good faith, etc. I didn't do any downvoting, but I suspect it could be a reaction to the fact that treating this as libel would make operating any security company or service effectively impossible by requiring zero false positives. That seems like an obviously unworkable standard even if getting incorrectly flagged as malicious admittedly does suck.
- horsawlarway 3y ago
  I've submitted more than a dozen reports to their service. To their credit - Mozilla pulled it from their copy of the safebrowsing list and no longer reports it as malicious. Google does though. Google also has no contact in place to appeal, and I've provided written contact information if they have any actual evidence of abuse that I can prevent. They have had these reports for more than 10 months now, and I resubmit roughly once every week or so.

efitz 3y ago

Yes [1]. In this case, the issue was that the AM software itself contained security bugs, but depriving you of use of your computer would probably be actionable. IANAL and have no idea if you could win that. The software does have disclaimer of warranties and limits on liability to the purchase price as part of the terms of use [2] [1] https://www.prnewswire.com/news-releases/consumers-file-class-action-lawsuit-against-symantec-for-defective-antivirus-software-300746568.html https://www.prnewswire.com/news-releases/consumers-file-clas... [2] https://www.microsoft.com/en-us/legal/terms-of-use https://www.microsoft.com/en-us/legal/terms-of-use [note: I am not 100% certain that this is the TOU specifically applicable to MS AM but most TOU look similar]

quags 3y ago

This would be similar to spam and blocklists. I know people have tried to sue blocklists (maps and spamhaus) but from memory they were not successful in the end. That included blocking email , sometimes with larger blocks with ip ranges not directly involved but in a similar range. Malware being flagged on an anti virus would be similar but in those case the user has an option to exclude the block. Google and Firefox block domains for phishing regularly as well.