5 ms·

>"I could have been hacked, so I had to spend time/money on it" isn't actual damages Sure it is. Money was spent that wouldn't have been if the situation didn'

>"I could have been hacked, so I had to spend time/money on it" isn't actual damages Sure it is. Money was spent that wouldn't have been if the situation didn't happen.

AnthonyMouse 2y ago
> Sure it is. Money was spent that wouldn't have been if the situation didn't happen. There are two problems with this. First, for normal damages, there is some limitation on the costs. If someone breaks the lock on your door and does nothing else, you replace the lock, damages of maybe $40. If someone gets into your servers, you what? Spend ten minutes to check the logs and rotate keys? Wipe and rebuild all the servers? Does the reasonableness of that depend on whether that's an automated process or a manual one? Maybe you should delete your entire code repository and have it rewritten from scratch, in case knowledge of the code could have helped some attacker? There is no upper limit to the amount of resources you could spend investigating something, and then companies with unlimited resources would effectively get to use it as a cudgel against someone who embarrassed them, because $10M is nothing to them but is a life-destroying amount of damages to some kid who made a mistake. It's like claiming that someone broke the lock on your door so now you're not sure if someone might have been inside and you have to strip the whole building to the rafters to check if someone has planted a listening device or hidden some crypto mining hardware inside the walls, even though you're a company that sells tile and carpets. Second, if doing the latter was in some way actually justifiable then the company should be periodically doing it anyway, because if a vulnerability existed then it could have been exploited whether anyone was detected or not, so if spending that level of resources could be justified "just in case" then it isn't money that was spent that wouldn't have been if the situation didn't happen. Unless they're full of crap that all of it was actually necessary.
- ziddoap 2y ago
  >There is no upper limit to the amount of resources you could spend investigating something The upper limit is what the courts decide is reasonable, based on the factors of the case, your justification of the requested damages, precedent of similar cases, etc. >$10M is nothing to them but is a life-destroying amount of damages to some kid who made a mistake. Again, the courts make these determinations literally all the time. We don't need to figure out what "reasonable" and "damages" mean from first principles. >It's like claiming that someone broke the lock on your door so now you're not sure if someone might have been inside and you have to strip the whole building to the rafters to check if someone has planted a listening device or hidden some crypto mining hardware inside the walls, even though you're a company that sells tile and carpets. This type of claim is not approved by the courts, because it is clearly unreasonable.
  - AnthonyMouse 2y ago
    > The upper limit is what the courts decide is reasonable, based on the factors of the case, your justification of the requested damages, precedent of similar cases, etc. "The judge will render a decision" still requires you to have some rule for the judge to apply or the result is entirely subjective. You don't want the winner of every case to be the one who can afford to spend the most on lawyers. > This type of claim is not approved by the courts, because it is clearly unreasonable. I feel like you're only making my point. It isn't reasonable in the physical case, so why should it be reasonable in the digital case?
    - ziddoap 2y ago
      >still requires you to have some rule for the judge to apply Good thing they can examine a century or two of case law, including lengthy debates on what constitutes “reasonable” and “damages”, to help make their decision. >You don’t want the winner of every case to be the one who can afford to spend the most on lawyers. That is pretty much how it works already. Better lawyers typically make better arguments and, on average, get better results. They also want more money because they are better. You don’t want the winner of the case to be the one who made a worse argument just because they have less money. >It isn’t reasonable in the physical case, so why should it be reasonable in the digital case? Your extremely stretched example is not analogous to the situation.
      - AnthonyMouse 2y ago
        > Good thing they can examine a century or two of case law, including lengthy debates on what constitutes “reasonable” and “damages”, to help make their decision. "A status quo exists" is not an argument for what rule the law should use unless your argument is that status quo bias is the only acceptable mechanism for choosing policy. > That is pretty much how it works already. Is/ought dichotomy. > You don’t want the winner of the case to be the one who made a worse argument just because they have less money. No, what you want is for the law to be clear and reasonable so that spending millions on lawyers to argue over excessive ambiguities is not a prerequisite to attaining a just outcome. > Your extremely stretched example is not analogous to the situation. In what way is it not analogous?
- bmicraft 2y ago
  This "where do we draw the line" talk is always so exhausting to he for me. The suggested answer inevitably boils down to "let's not have a line at all", instead of trying to draw a reasonable line and deciding on a case-by-case basis what is and isn't reasonable. While trying to be reasonable might have unexpected outcomes for either side sometimes, not having a line at all always unfairly skews the damages to one side.
  - AnthonyMouse 2y ago
    Suppose you've designed your systems according to sound and efficient practices. You have offsite and offline backups, monitoring systems, zero trust architecture, well-documented systems that can be rebuilt from scratch using automated processes, etc. If some compromise happens the scope is extremely limited and well-defined and the mitigation is swift and inexpensive. Also, there probably wouldn't have been one to begin with. Now suppose you're a disaster. There is a combination lock on the front door with the combination already punched into it and if anyone walks through the door they have full access to everything from your employees' bank routing numbers to the VPN credentials providing access to your suppliers' networks, with no logs of any kind. If someone gets inside and you want to know what they did you'll have to shutter the company for a year while a team of full-time engineers and forensic accountants tries to reconcile the numbers in each set of systems with the others and resolve any inconsistencies through some combination of vibes and whimsy. Your costs in the second case are going to be dramatically higher, but that isn't a consequence of anything the person who walked through the door did. That's something you did to yourself. Failure to mitigate is a thing. The damages in the first case would be zero or close to zero, which implies the damages in the second case should be the same because the party claiming the damages is the one responsible for the difference. Moreover, this is the incentive we want, because we want organizations to minimize damages and suffer consequences if they don't.
subjectsigma 2y ago
“I want to drive my car without airbags, but I have all these other stupid people on the road who might hit me, so I have to invest in airbags. Maybe I should just preemptively sue them for forcing me to invest in my safety.”
- ziddoap 2y ago
  This is one of the most stretched examples yet. It’s as if nuance, context, and the concept of “reasonable” have completely left the room.

>"I could have been hacked, so I had to spend time/money on it" isn't actual damages Sure it is. Money was spent that wouldn't have been if the situation didn't happen.

AnthonyMouse 2y ago

> Sure it is. Money was spent that wouldn't have been if the situation didn't happen. There are two problems with this. First, for normal damages, there is some limitation on the costs. If someone breaks the lock on your door and does nothing else, you replace the lock, damages of maybe $40. If someone gets into your servers, you what? Spend ten minutes to check the logs and rotate keys? Wipe and rebuild all the servers? Does the reasonableness of that depend on whether that's an automated process or a manual one? Maybe you should delete your entire code repository and have it rewritten from scratch, in case knowledge of the code could have helped some attacker? There is no upper limit to the amount of resources you could spend investigating something, and then companies with unlimited resources would effectively get to use it as a cudgel against someone who embarrassed them, because $10M is nothing to them but is a life-destroying amount of damages to some kid who made a mistake. It's like claiming that someone broke the lock on your door so now you're not sure if someone might have been inside and you have to strip the whole building to the rafters to check if someone has planted a listening device or hidden some crypto mining hardware inside the walls, even though you're a company that sells tile and carpets. Second, if doing the latter was in some way actually justifiable then the company should be periodically doing it anyway, because if a vulnerability existed then it could have been exploited whether anyone was detected or not, so if spending that level of resources could be justified "just in case" then it isn't money that was spent that wouldn't have been if the situation didn't happen. Unless they're full of crap that all of it was actually necessary.

ziddoap 2y ago
>There is no upper limit to the amount of resources you could spend investigating something The upper limit is what the courts decide is reasonable, based on the factors of the case, your justification of the requested damages, precedent of similar cases, etc. >$10M is nothing to them but is a life-destroying amount of damages to some kid who made a mistake. Again, the courts make these determinations literally all the time. We don't need to figure out what "reasonable" and "damages" mean from first principles. >It's like claiming that someone broke the lock on your door so now you're not sure if someone might have been inside and you have to strip the whole building to the rafters to check if someone has planted a listening device or hidden some crypto mining hardware inside the walls, even though you're a company that sells tile and carpets. This type of claim is not approved by the courts, because it is clearly unreasonable.
- AnthonyMouse 2y ago
  > The upper limit is what the courts decide is reasonable, based on the factors of the case, your justification of the requested damages, precedent of similar cases, etc. "The judge will render a decision" still requires you to have some rule for the judge to apply or the result is entirely subjective. You don't want the winner of every case to be the one who can afford to spend the most on lawyers. > This type of claim is not approved by the courts, because it is clearly unreasonable. I feel like you're only making my point. It isn't reasonable in the physical case, so why should it be reasonable in the digital case?
  - ziddoap 2y ago
    >still requires you to have some rule for the judge to apply Good thing they can examine a century or two of case law, including lengthy debates on what constitutes “reasonable” and “damages”, to help make their decision. >You don’t want the winner of every case to be the one who can afford to spend the most on lawyers. That is pretty much how it works already. Better lawyers typically make better arguments and, on average, get better results. They also want more money because they are better. You don’t want the winner of the case to be the one who made a worse argument just because they have less money. >It isn’t reasonable in the physical case, so why should it be reasonable in the digital case? Your extremely stretched example is not analogous to the situation.
    - AnthonyMouse 2y ago
      > Good thing they can examine a century or two of case law, including lengthy debates on what constitutes “reasonable” and “damages”, to help make their decision. "A status quo exists" is not an argument for what rule the law should use unless your argument is that status quo bias is the only acceptable mechanism for choosing policy. > That is pretty much how it works already. Is/ought dichotomy. > You don’t want the winner of the case to be the one who made a worse argument just because they have less money. No, what you want is for the law to be clear and reasonable so that spending millions on lawyers to argue over excessive ambiguities is not a prerequisite to attaining a just outcome. > Your extremely stretched example is not analogous to the situation. In what way is it not analogous?
bmicraft 2y ago
This "where do we draw the line" talk is always so exhausting to he for me. The suggested answer inevitably boils down to "let's not have a line at all", instead of trying to draw a reasonable line and deciding on a case-by-case basis what is and isn't reasonable. While trying to be reasonable might have unexpected outcomes for either side sometimes, not having a line at all always unfairly skews the damages to one side.
- AnthonyMouse 2y ago
  Suppose you've designed your systems according to sound and efficient practices. You have offsite and offline backups, monitoring systems, zero trust architecture, well-documented systems that can be rebuilt from scratch using automated processes, etc. If some compromise happens the scope is extremely limited and well-defined and the mitigation is swift and inexpensive. Also, there probably wouldn't have been one to begin with. Now suppose you're a disaster. There is a combination lock on the front door with the combination already punched into it and if anyone walks through the door they have full access to everything from your employees' bank routing numbers to the VPN credentials providing access to your suppliers' networks, with no logs of any kind. If someone gets inside and you want to know what they did you'll have to shutter the company for a year while a team of full-time engineers and forensic accountants tries to reconcile the numbers in each set of systems with the others and resolve any inconsistencies through some combination of vibes and whimsy. Your costs in the second case are going to be dramatically higher, but that isn't a consequence of anything the person who walked through the door did. That's something you did to yourself. Failure to mitigate is a thing. The damages in the first case would be zero or close to zero, which implies the damages in the second case should be the same because the party claiming the damages is the one responsible for the difference. Moreover, this is the incentive we want, because we want organizations to minimize damages and suffer consequences if they don't.

subjectsigma 2y ago

“I want to drive my car without airbags, but I have all these other stupid people on the road who might hit me, so I have to invest in airbags. Maybe I should just preemptively sue them for forcing me to invest in my safety.”

ziddoap 2y ago
This is one of the most stretched examples yet. It’s as if nuance, context, and the concept of “reasonable” have completely left the room.