12 ms·

Isn't this a crime that someone is liable for? What happened is that someone hacked into a computer system without permission. Maybe it wasn't intentional -- su

by 55555 2mo ago

Isn't this a crime that someone is liable for? What happened is that someone hacked into a computer system without permission. Maybe it wasn't intentional -- sure -- and that would be a factor at sentencing. But it sounds like they've admitted to a crime, and obviously our legal system considers the humans involved to be the liable parties; otherwise everyone would just say "my computer did the hacking" and wouldn't get in any trouble. I don't expect any prosecution here, but is the above legally accurate?

mikeweiss 2mo ago
Maybe. Hugging face would probably need to request charges for any to be filed unless OpenAI was already on the current admins naughty list..
edot 2mo ago
Laws don’t prosecute themselves, and they also don’t tend to remove themselves. Lots of laws, lots of selective enforcement. “Show me the man and I’ll show you the crime” and “The more corrupt the state, the more numerous the laws” are some ideas to ponder here.
tomjen3 2mo ago
Lifting mens rea on that is going to be... interesting.
voxic11 2mo ago
Most crimes require intent, hacking is one of them. The relevant law in this situation is: > (a) Whoever— (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— (C) information from any protected computer; shall be punished as provided in subsection (c) of this section. https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030 So if it can't be proven that you intended to access a computer without authorization, or exceed your authorized access, then you can't be found guilty of the crime. Consider the possible consequences of the law not requiring intent, if simply accidentally exceeding your authorized access could be a criminal act.
- fastball 2mo ago
  I'm sure that will change sooner rather than later, otherwise enterprising hackers will be able to claim that the model they were using went rogue.
  - pjc50 2mo ago
    This would be bad; we've already had a few cases on HN where someone noticed that they could increment the customer number in a URL or similar, resulting in police action.
    - OliverGuy 2mo ago
      Got a source for that?
      - voxic11 2mo ago
        Not from the US but https://www.cbc.ca/news/canada/nova-scotia/freedom-of-information-request-privacy-breach-teen-speaks-out-1.4621970 https://www.cbc.ca/news/canada/nova-scotia/freedom-of-inform... This news segment goes into more detail about how he downloaded the documents (by incrementing the document id in the url) https://x.com/Brett_CBC/status/984751373525901313 https://x.com/Brett_CBC/status/984751373525901313
        bornfreddy 2mo ago
        Wow, just wow. How about charging the website builders for negligence, for failing to protect sensitive data? Simply incredible.
      - jfyi 2mo ago
        IDOR is a well known security issue that can result in exactly the scenario described (someone incrementing a counter in a url) and has on many occasions in different jurisdictions caused legal issues for the person doing it. Unless you are specifically asking for a hn reference, which I don't understand the relevance but I'm sure they exist.
Tepix 2mo ago
My take is that there are at least four potential parties that can all be liable: 1. the creator for the LLM. In particular if neglicence or malice is involved. This can also be someone who did a finetune of an existing model. 2. the inference provider. Remember, a model can do harm just by creating tokens (for example cause someone to run amok or kill herself). Inference providers should do a minimal amount of due diligence when picking models. 3. the party that executes tool calls on behalf of the AI. They in particular need to have safeguards to prevent the model from attacking entities on the internet. 4. the user that does the prompting.
- titanomachy 2mo ago
  Isn’t the answer to all of these “OpenAI” in this case??
zdragnar 2mo ago
Presumably, without intent (based on sibling comments), the victims would need to sue for damages due to gross negligence.

by 55555 2mo ago

mikeweiss 2mo ago

Maybe. Hugging face would probably need to request charges for any to be filed unless OpenAI was already on the current admins naughty list..

edot 2mo ago

Laws don’t prosecute themselves, and they also don’t tend to remove themselves. Lots of laws, lots of selective enforcement. “Show me the man and I’ll show you the crime” and “The more corrupt the state, the more numerous the laws” are some ideas to ponder here.

tomjen3 2mo ago

Lifting mens rea on that is going to be... interesting.

voxic11 2mo ago

Most crimes require intent, hacking is one of them. The relevant law in this situation is: > (a) Whoever— (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— (C) information from any protected computer; shall be punished as provided in subsection (c) of this section. https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030 So if it can't be proven that you intended to access a computer without authorization, or exceed your authorized access, then you can't be found guilty of the crime. Consider the possible consequences of the law not requiring intent, if simply accidentally exceeding your authorized access could be a criminal act.

fastball 2mo ago
I'm sure that will change sooner rather than later, otherwise enterprising hackers will be able to claim that the model they were using went rogue.
- pjc50 2mo ago
  This would be bad; we've already had a few cases on HN where someone noticed that they could increment the customer number in a URL or similar, resulting in police action.
  - OliverGuy 2mo ago
    Got a source for that?
    - voxic11 2mo ago
      Not from the US but https://www.cbc.ca/news/canada/nova-scotia/freedom-of-information-request-privacy-breach-teen-speaks-out-1.4621970 https://www.cbc.ca/news/canada/nova-scotia/freedom-of-inform... This news segment goes into more detail about how he downloaded the documents (by incrementing the document id in the url) https://x.com/Brett_CBC/status/984751373525901313 https://x.com/Brett_CBC/status/984751373525901313
      - bornfreddy 2mo ago
        Wow, just wow. How about charging the website builders for negligence, for failing to protect sensitive data? Simply incredible.
    - jfyi 2mo ago
      IDOR is a well known security issue that can result in exactly the scenario described (someone incrementing a counter in a url) and has on many occasions in different jurisdictions caused legal issues for the person doing it. Unless you are specifically asking for a hn reference, which I don't understand the relevance but I'm sure they exist.

Tepix 2mo ago

My take is that there are at least four potential parties that can all be liable: 1. the creator for the LLM. In particular if neglicence or malice is involved. This can also be someone who did a finetune of an existing model. 2. the inference provider. Remember, a model can do harm just by creating tokens (for example cause someone to run amok or kill herself). Inference providers should do a minimal amount of due diligence when picking models. 3. the party that executes tool calls on behalf of the AI. They in particular need to have safeguards to prevent the model from attacking entities on the internet. 4. the user that does the prompting.

titanomachy 2mo ago
Isn’t the answer to all of these “OpenAI” in this case??

zdragnar 2mo ago

Presumably, without intent (based on sibling comments), the victims would need to sue for damages due to gross negligence.