3 ms·

I'm not a lawyer, but the legal claim made appears to me to be on shaky ground. In my understanding, there has to be actual damages arising out of an action. "I

by tyzoid 2y ago

I'm not a lawyer, but the legal claim made appears to me to be on shaky ground. In my understanding, there has to be actual damages arising out of an action. "I could have been hacked, so I had to spend time/money on it" isn't actual damages unless they were _actually_ hacked.

ordx 2y ago
I imagine it would be sufficient to show that he had to spend time or money analyzing the security impact of the event.
lesuorac 2y ago
Why aren't costs involved with a mitigation actual damages? I'n not sure this is the correct lawsuit to demonstrate this. So hypothetically, if say you lent a key to a handyman and then they posted a photo on it to twitter it seems pretty reasonable for them to cover the costs of replacing the locks. As opposed to having to wait for somebody to rob you and then trying to show that the robber did so from the photo.
- that_guy_iain 2y ago
  > Why aren't costs involved with a mitigation actual damages? They are. If you ever look at the damage caused by a hack it's in the millions and that's because they're including the time used to investigate and repair and mitigate further attacks is included.
- deleted 2y ago
  [deleted]
velcrovan 2y ago
I have received class action settlement payments from Verizon, Apple, and others for things I hardly noticed at the time. So maybe your idea of what precedent considers “damages” here is incomplete.
that_guy_iain 2y ago
Realistically, this is just going to piggy back on WPEngine's lawsuit. However, there were customers who migrated to other hosts because of the potential security risk. That is an actual damage. There are people who lost contracts because their potential client chose software other than WordPress. That is an actual damage. There are lots of actual damages that occurred.
ziddoap 2y ago
>"I could have been hacked, so I had to spend time/money on it" isn't actual damages Sure it is. Money was spent that wouldn't have been if the situation didn't happen.
- AnthonyMouse 2y ago
  > Sure it is. Money was spent that wouldn't have been if the situation didn't happen. There are two problems with this. First, for normal damages, there is some limitation on the costs. If someone breaks the lock on your door and does nothing else, you replace the lock, damages of maybe $40. If someone gets into your servers, you what? Spend ten minutes to check the logs and rotate keys? Wipe and rebuild all the servers? Does the reasonableness of that depend on whether that's an automated process or a manual one? Maybe you should delete your entire code repository and have it rewritten from scratch, in case knowledge of the code could have helped some attacker? There is no upper limit to the amount of resources you could spend investigating something, and then companies with unlimited resources would effectively get to use it as a cudgel against someone who embarrassed them, because $10M is nothing to them but is a life-destroying amount of damages to some kid who made a mistake. It's like claiming that someone broke the lock on your door so now you're not sure if someone might have been inside and you have to strip the whole building to the rafters to check if someone has planted a listening device or hidden some crypto mining hardware inside the walls, even though you're a company that sells tile and carpets. Second, if doing the latter was in some way actually justifiable then the company should be periodically doing it anyway, because if a vulnerability existed then it could have been exploited whether anyone was detected or not, so if spending that level of resources could be justified "just in case" then it isn't money that was spent that wouldn't have been if the situation didn't happen. Unless they're full of crap that all of it was actually necessary.
  - ziddoap 2y ago
    >There is no upper limit to the amount of resources you could spend investigating something The upper limit is what the courts decide is reasonable, based on the factors of the case, your justification of the requested damages, precedent of similar cases, etc. >$10M is nothing to them but is a life-destroying amount of damages to some kid who made a mistake. Again, the courts make these determinations literally all the time. We don't need to figure out what "reasonable" and "damages" mean from first principles. >It's like claiming that someone broke the lock on your door so now you're not sure if someone might have been inside and you have to strip the whole building to the rafters to check if someone has planted a listening device or hidden some crypto mining hardware inside the walls, even though you're a company that sells tile and carpets. This type of claim is not approved by the courts, because it is clearly unreasonable.
josefritzishere 2y ago
There is actually an important legal distinction between could and would. He just undermined his own case.
chasing 2y ago
Sounds like actual damages to me. If you break my door lock I'm pretty sure I can't just leave my door wide open for months and then sue you for all of my stuff that got stolen. I need to fix the lock. And ask you to pay for that. Also not a lawyer, but pretty sure you've got to proactively mitigate your damages.
- jeroenhd 2y ago
  Physical metaphors rarely work for software. In your scenario, someone _could've_ broken the lock because you're renting a lock from a locking agency Lock Engine, who copied a lock design from LockPress, and LockPress decided not to mail them design flaws anymore. In the real world, vulnerable locks don't ever get fixed. At worst, locks get recalled, and you get your money back. Lock designs don't get shared freely, and if they do, there is no expectation of informing people that may have copied designs of potential flaws. If your house got broken into, you should sue Lock Engine, because they're not providing the service you're paying for. Suing LockPress for the lock design Lock Engine decided to copy wholesale is pure nonsense.
sureIy 2y ago
Imagine you open Spotify on your phone, only to (maybe?) realize it's streaming from Apple Music. Is that ok for you that Apple appropriated the app? They offered the platform, the ecosystem and the store. Is it within their right? That's what happened here.
dragonwriter 2y ago
> In my understanding, there has to be actual damages arising out of an action. Depends on the specific tort, but actual damages aren't the only thing for which there can be liability. Statutory damages, punitive damages, and non-damages based liability (unjust enrichment, disgorgement of profits, etc.) are all things that exist for various torts. > "I could have been hacked, so I had to spend time/money on it" isn't actual damages unless they were _actually_ hacked. Why wouldn't reasonable costs incurred to determine or rule out adverse effects of a wrongful act be considered actual damages of that act?

by tyzoid 2y ago

ordx 2y ago

I imagine it would be sufficient to show that he had to spend time or money analyzing the security impact of the event.

lesuorac 2y ago

Why aren't costs involved with a mitigation actual damages? I'n not sure this is the correct lawsuit to demonstrate this. So hypothetically, if say you lent a key to a handyman and then they posted a photo on it to twitter it seems pretty reasonable for them to cover the costs of replacing the locks. As opposed to having to wait for somebody to rob you and then trying to show that the robber did so from the photo.

that_guy_iain 2y ago
> Why aren't costs involved with a mitigation actual damages? They are. If you ever look at the damage caused by a hack it's in the millions and that's because they're including the time used to investigate and repair and mitigate further attacks is included.
deleted 2y ago
[deleted]

velcrovan 2y ago

I have received class action settlement payments from Verizon, Apple, and others for things I hardly noticed at the time. So maybe your idea of what precedent considers “damages” here is incomplete.

that_guy_iain 2y ago

Realistically, this is just going to piggy back on WPEngine's lawsuit. However, there were customers who migrated to other hosts because of the potential security risk. That is an actual damage. There are people who lost contracts because their potential client chose software other than WordPress. That is an actual damage. There are lots of actual damages that occurred.

ziddoap 2y ago

>"I could have been hacked, so I had to spend time/money on it" isn't actual damages Sure it is. Money was spent that wouldn't have been if the situation didn't happen.

AnthonyMouse 2y ago
> Sure it is. Money was spent that wouldn't have been if the situation didn't happen. There are two problems with this. First, for normal damages, there is some limitation on the costs. If someone breaks the lock on your door and does nothing else, you replace the lock, damages of maybe $40. If someone gets into your servers, you what? Spend ten minutes to check the logs and rotate keys? Wipe and rebuild all the servers? Does the reasonableness of that depend on whether that's an automated process or a manual one? Maybe you should delete your entire code repository and have it rewritten from scratch, in case knowledge of the code could have helped some attacker? There is no upper limit to the amount of resources you could spend investigating something, and then companies with unlimited resources would effectively get to use it as a cudgel against someone who embarrassed them, because $10M is nothing to them but is a life-destroying amount of damages to some kid who made a mistake. It's like claiming that someone broke the lock on your door so now you're not sure if someone might have been inside and you have to strip the whole building to the rafters to check if someone has planted a listening device or hidden some crypto mining hardware inside the walls, even though you're a company that sells tile and carpets. Second, if doing the latter was in some way actually justifiable then the company should be periodically doing it anyway, because if a vulnerability existed then it could have been exploited whether anyone was detected or not, so if spending that level of resources could be justified "just in case" then it isn't money that was spent that wouldn't have been if the situation didn't happen. Unless they're full of crap that all of it was actually necessary.
- ziddoap 2y ago
  >There is no upper limit to the amount of resources you could spend investigating something The upper limit is what the courts decide is reasonable, based on the factors of the case, your justification of the requested damages, precedent of similar cases, etc. >$10M is nothing to them but is a life-destroying amount of damages to some kid who made a mistake. Again, the courts make these determinations literally all the time. We don't need to figure out what "reasonable" and "damages" mean from first principles. >It's like claiming that someone broke the lock on your door so now you're not sure if someone might have been inside and you have to strip the whole building to the rafters to check if someone has planted a listening device or hidden some crypto mining hardware inside the walls, even though you're a company that sells tile and carpets. This type of claim is not approved by the courts, because it is clearly unreasonable.

josefritzishere 2y ago

There is actually an important legal distinction between could and would. He just undermined his own case.

chasing 2y ago

Sounds like actual damages to me. If you break my door lock I'm pretty sure I can't just leave my door wide open for months and then sue you for all of my stuff that got stolen. I need to fix the lock. And ask you to pay for that. Also not a lawyer, but pretty sure you've got to proactively mitigate your damages.

jeroenhd 2y ago
Physical metaphors rarely work for software. In your scenario, someone _could've_ broken the lock because you're renting a lock from a locking agency Lock Engine, who copied a lock design from LockPress, and LockPress decided not to mail them design flaws anymore. In the real world, vulnerable locks don't ever get fixed. At worst, locks get recalled, and you get your money back. Lock designs don't get shared freely, and if they do, there is no expectation of informing people that may have copied designs of potential flaws. If your house got broken into, you should sue Lock Engine, because they're not providing the service you're paying for. Suing LockPress for the lock design Lock Engine decided to copy wholesale is pure nonsense.

sureIy 2y ago

Imagine you open Spotify on your phone, only to (maybe?) realize it's streaming from Apple Music. Is that ok for you that Apple appropriated the app? They offered the platform, the ecosystem and the store. Is it within their right? That's what happened here.

dragonwriter 2y ago

> In my understanding, there has to be actual damages arising out of an action. Depends on the specific tort, but actual damages aren't the only thing for which there can be liability. Statutory damages, punitive damages, and non-damages based liability (unjust enrichment, disgorgement of profits, etc.) are all things that exist for various torts. > "I could have been hacked, so I had to spend time/money on it" isn't actual damages unless they were _actually_ hacked. Why wouldn't reasonable costs incurred to determine or rule out adverse effects of a wrongful act be considered actual damages of that act?