5 ms·

It's very likely it violates the DMCA "breaking digital lock" provisions but the responsibility is sufficiently diluted that it's impossible to charge anyone in

by Xirdus 17d ago

It's very likely it violates the DMCA "breaking digital lock" provisions but the responsibility is sufficiently diluted that it's impossible to charge anyone in particular.

VyseofArcadia 17d ago
Do you have to charge an individual? Can you not charge the corporate "person" that is OpenAI? Sorry if it is a stupid question, as mentioned above I am legally naïve.
- colechristensen 17d ago
  The same concept that allows a corporation to sue and be sued allows it to be charged with crimes
  - brookst 17d ago
    Can you show intent? There is no negligent hacking statute, and HN of all places I would expect people to be sensitive to the implications of creating one.
    - VyseofArcadia 17d ago
      That may be true by the text of the law but there are plenty of individuals who have been sued or charged with crimes for accidental hacking. https://arstechnica.com/information-technology/2016/05/armed-fbi-agents-raid-home-of-researcher-who-found-unsecured-patent-data/ https://arstechnica.com/information-technology/2016/05/armed... https://en.wikipedia.org/wiki/Weev#AT&T_data_breach https://en.wikipedia.org/wiki/Weev#AT&T_data_breach https://cisomag.com/drone-maker-dji-cybersecurity-expert-embroiled-allegation-war/ https://cisomag.com/drone-maker-dji-cybersecurity-expert-emb... So what's the deal with these?
      - colechristensen 17d ago
        >Eaglesoft CFAA: Intentionally accessing poorly secured data >AT&T CFAA: Intentionally accessing poorly secured data >DJI Civil suit for violating terms of license agreement
- yonatan8070 17d ago
  I, too, have no idea about legal matters. But there have been many cases where companies (Google, Apple, Meta, etc...) got fined millions or billions of dollars for various violations like antitrust. I assume that breaching into third-party systems should carry similar fines. Especially for systems that are for all intents and purposes shared infrastructure. Just imagine how many systems you could compromise if you got hold of RubyGems, PyPI, NPM, Debian, etc.
  - godelski 17d ago
    Let's take a hypothetical example: Suppose you're a firework company and your fireworks blow up, burning down the entire town. Could the company be sued? What is considered reasonable safety measures? IANAL, but I'm pretty confident there would be a lawsuit. Who gets charged might differ, depending if it is the firework factory that didn't take adequate safety precautions or a chemical supplier or someone else. If there wasn't an ability to sue that would be fucking crazy and we should all get up in arms about it. And isn't insurance supposed to be there to help mitigate the damages, regardless of fault? Personally, given how it seems OAI's agents have been getting through either pretty obvious places (e.g. /etc/hosts) or that there wasn't close monitoring of the most obvious places (e.g. DNS, artifactory), I'd imagine it wouldn't be hard to find them negligent. Even if a single employee is to blame then are they not to blame for not monitoring the agents regardless? Unless the story is that the employee intentionally circumvented defenses (why?) then it seems it would be on OAI. But again, IANAL, I'm just someone who think if we can't sue we can sure riot until we can
    - zdragnar 17d ago
      There's a difference between being able to be successfully sued (civil liability, petitioned by a private entity) and charged (criminal liability, or petitioned by a government entity). The thresholds for suing and charging differ greatly depending on the circumstances. Another set of hypothetical examples that make things muddier: - If I drive a fishing boat into a pier, I am liable, not the manufacturer of the boat - If I drive a car over someone lying in the road, I am liable, not the manufacturer of the car - If my life is in danger and I shoot a gun and kill my attacker, neither I nor the manufacturer are liable so long as I obeyed the relevant self defense laws and gun possession of whatever jurisdiction I am in - If I fire a gun into a crowd indiscriminately, I am liable and several jurisdictions have used that to also hold gun manufacturer liable as well That last example has been less successful as of late, but there are other variations too.
- elmo2you 17d ago
  As far as I know (IANAL) it is in fact the only "person" you can charge. To the best of my knowledge, the whole point these "limited liability" legal constructions exist in the first place, is to protect individuals within a corporation for whatever they do as part of the business of a company (barring exceptions that have clearly not been part of that business and obvious individually committed crimes), typically "just following orders". If a company commits a crime, or in a worse case runs a criminal enterprise, it is the company that is legally responsible, not its employees. That is, in principle. This can get more complicated higher up the management tree, where decisions can also be prosecuted on personal little, but that's usually a far more complicated matter. Also, if a whole group of employees willingly conspires to commit crimes, they might also be prosecuted individually for those crimes (there are limits to limited liabilities). However, that usually only works under special conditions and it would e.g. require that there's an obvious criminal enterprise aspect to it, rather than individual cases of illegal conduct. That said, with the track record of some of these companies, actually designating some of the AI companies as a criminal enterprises may eventually happen (in due time) in some jurisdictions outside the USA. Certainly if it ever turns out that these companies have been storing and (ab)using everything they ever had access too, while blatantly lying about that just because some particular (post 9/11) US laws gives them that opportunity (and impunity) as long as the US government somehow requested them to do so (covertly; with gag order). Might legally work withing US jurisdiction, but would still be very much illegal everywhere else.
  - jasomill 17d ago
    "Limited liability" refers to shareholders' financial liability being limited to their investment, and has nothing to do with civil or criminal liability of employees for their own actions, whether "following orders" or not.
    - elmo2you 17d ago
      You might want to look up LLC (Limited Liability Company), which goes by other names in different countries but still basically mean the same (though details may vary between different company types). While there certainly are exceptions, as mentioned before, in principle the employees of a company are not personally legally accountable for their actions as performed in the service of a company. The legal entity of that companies is. If you sincerely believe otherwise, you either live in a rather unusual country or maybe just need to educate yourself a bit better.
- ryanhuff 17d ago
  Companies can certainly be charged with crimes. Punishments can be via fines or sanctions (court appointed monitors, etc). Individual employees can also be charged for their specific actions as part of the performance of a crime.
- trinsic2 17d ago
  There is no such thing as a Corporate person. Sounds like a something that was created by a legal system for people to absolve themselves of responsibility.
  - voidUpdate 16d ago
    https://en.wikipedia.org/wiki/Corporate_personhood https://en.wikipedia.org/wiki/Corporate_personhood
bix6 17d ago
How is the responsibility diluted? Charge the CEO…
- brookst 17d ago
  Great, you’re the attorney at the CEO’s trial. To get a conviction, you’re going to have to show that he willfully committed this specific crime. There are no negligent or stochastic hacking laws, you have to show this specific crime was at his direction. Do you think there is evidence of this?
  - bix6 17d ago
    Honestly yeah I bet there is and I hope to someday read about it if the government ever gets off its ass. Someone set up the “experiment”…
  - VyseofArcadia 17d ago
    It would seem to me that the difference between the corporate world and organized crime is that a corporation can get away with, "the responsibility is too diffuse" but the mafia at least has to go to the trouble of finding a fall guy.
  - shakna 17d ago
    > There are no negligent or stochastic hacking laws I'm sure that Andrew Auernheimer would be pleased to hear that. [0] For accessing a publicly accessible endpoint, that was completely undefended and didn't actually require "hacking", he was convicted of "exceeding authorised access". You _don't_ have to show intent under the Computer Fraud and Abuse Act, for the first count. > knowingly accesses a computer without authorization or exceeds authorized access [1] "Knowingly", not "intentionally", as in the other counts. You only have to show that: a) They trained a system to access without authorization (hacking) b) The system that was trained exceeded authorized access As responsibility falls to the operator with automated systems, the company becomes liable. [0] https://techcrunch.com/2013/01/21/ipad-hack-statement-of-responsibility/ https://techcrunch.com/2013/01/21/ipad-hack-statement-of-res... [1] https://www.energy.gov/sites/prod/files/cioprod/documents/ComputerFraud-AbuseAct.pdf https://www.energy.gov/sites/prod/files/cioprod/documents/Co...
oliwarner 17d ago
A copyright law seems an odd place to start. This is computer misuse.
- VyseofArcadia 17d ago
  The DMCA is a bit overly broad to be considered just a copyright law. For example, just breaking encryption on a DVD is technically illegal regardless of whether you then go on to do something otherwise illegal (make and sell bootlegs) or perfectly legal (make a space-shifted backup copy on your hard drive). IIRC this was an intentional handout to media companies who were angry that ripping CDs is perfectly legal. They had to find a way to make doing the same with DVDs illegal.
  - oliwarner 17d ago
    Those provisions are specifically for the breaking or circumvention of technical measures designed to prevent copyright infringement. I don't see a parallel here.
    - immibis2 17d ago
      They've been twisted to support almost anything, for example repairing your tractor is illegal because of this same law. But I agree this is just plain old hacking under a plain old reading of the CFAA and doesn't need any twists.
      - EMIRELADERO 17d ago
        > for example repairing your tractor is illegal because of this same law. No it's not. There has never been a case establishing that, and it's absurd on its face. The protection measures that the law makes illegal to break must control access to a copyrighted work, and you can't copyright functionality.
        immibis2 17d ago
        You see, they made it so you can't repair your tractor without circumventing a technological copy protection measure, which is illegal under DMCA 1201.
woah 17d ago
Issuing subpeonas, raiding offices, and dragging key employees into interrogation rooms as you would find in any normal criminal investigation would be more than enough to ensure "AI safety" without any new regulations, acts of congress, Bernie Sanders campaign speeches, or even charges filed.
stronglikedan 17d ago
There have been news stories where individual OpenAI users have been investigated based on their prompts. If OpenAI can point the police to specific users of their software, they can certainly point them to whichever of their own employees are involved in a crime. AI is just a tool, and the person prompting it is the one responsible for the outcome. No dilution there.
- atmosx 17d ago
  What is its one their "under development" models who escaped it's training, because it wasn't tuned properly?
  - hvb2 17d ago
    Counter argument being that this seems to indicate you can do whatever as long as you're innovating?
    - hi_im_greg_h 17d ago
      Isn’t that the tech industry motto?
      - xmcqdpt2 16d ago
        And the motto of every neoliberal governments where being accused of Luddism is political death.
  - aigetoutofjailf 17d ago
    [dead]
  - louthy 17d ago
    That’s corporate negligence. The executives are liable unless there is evidence of malfeasance by one of the employees.
  - IcyWindows 17d ago
    Is that different than cattle escaping and damaging property? I believe the rancher is at fault.
immibis2 17d ago
It doesn't need to be twisted to violate the DMCA anticircumvention clause because it is already just plain old hacking.
j2kun 17d ago
Sounds like we need discovery to determine who to charge.
Frieren 17d ago
> the responsibility is sufficiently diluted that it's impossible to charge anyone in particular. Was not that the goal when companies started using AI for their customer support? Be able to say anything without legal repercussions... But then this happened: https://www.bbc.com/travel/article/20240222-air-canada-chatbot-misinformation-what-travellers-should-know https://www.bbc.com/travel/article/20240222-air-canada-chatb... And support chatbot got a reality cold shower. The law will find a way to charge people in particular. Sadly will start with the less powerful in the chain before it actually acts on the people that can actually change things.
whateveracct 17d ago
how convenient
LastTrain 17d ago
That is a very convenient conclusion that certain entities would love for us to accept as true, but fuck that. If it is “diluted” as that the buck stops at the publisher of the model.
- Refreeze5224 16d ago
  Fuck that indeed. The buck should stop, and prison sentences should start, with the highest paid employee.

by Xirdus 17d ago

It's very likely it violates the DMCA "breaking digital lock" provisions but the responsibility is sufficiently diluted that it's impossible to charge anyone in particular.

VyseofArcadia 17d ago

Do you have to charge an individual? Can you not charge the corporate "person" that is OpenAI? Sorry if it is a stupid question, as mentioned above I am legally naïve.

colechristensen 17d ago
The same concept that allows a corporation to sue and be sued allows it to be charged with crimes
- brookst 17d ago
  Can you show intent? There is no negligent hacking statute, and HN of all places I would expect people to be sensitive to the implications of creating one.
  - VyseofArcadia 17d ago
    That may be true by the text of the law but there are plenty of individuals who have been sued or charged with crimes for accidental hacking. https://arstechnica.com/information-technology/2016/05/armed-fbi-agents-raid-home-of-researcher-who-found-unsecured-patent-data/ https://arstechnica.com/information-technology/2016/05/armed... https://en.wikipedia.org/wiki/Weev#AT&T_data_breach https://en.wikipedia.org/wiki/Weev#AT&T_data_breach https://cisomag.com/drone-maker-dji-cybersecurity-expert-embroiled-allegation-war/ https://cisomag.com/drone-maker-dji-cybersecurity-expert-emb... So what's the deal with these?
    - colechristensen 17d ago
      >Eaglesoft CFAA: Intentionally accessing poorly secured data >AT&T CFAA: Intentionally accessing poorly secured data >DJI Civil suit for violating terms of license agreement
yonatan8070 17d ago
I, too, have no idea about legal matters. But there have been many cases where companies (Google, Apple, Meta, etc...) got fined millions or billions of dollars for various violations like antitrust. I assume that breaching into third-party systems should carry similar fines. Especially for systems that are for all intents and purposes shared infrastructure. Just imagine how many systems you could compromise if you got hold of RubyGems, PyPI, NPM, Debian, etc.
- godelski 17d ago
  Let's take a hypothetical example: Suppose you're a firework company and your fireworks blow up, burning down the entire town. Could the company be sued? What is considered reasonable safety measures? IANAL, but I'm pretty confident there would be a lawsuit. Who gets charged might differ, depending if it is the firework factory that didn't take adequate safety precautions or a chemical supplier or someone else. If there wasn't an ability to sue that would be fucking crazy and we should all get up in arms about it. And isn't insurance supposed to be there to help mitigate the damages, regardless of fault? Personally, given how it seems OAI's agents have been getting through either pretty obvious places (e.g. /etc/hosts) or that there wasn't close monitoring of the most obvious places (e.g. DNS, artifactory), I'd imagine it wouldn't be hard to find them negligent. Even if a single employee is to blame then are they not to blame for not monitoring the agents regardless? Unless the story is that the employee intentionally circumvented defenses (why?) then it seems it would be on OAI. But again, IANAL, I'm just someone who think if we can't sue we can sure riot until we can
  - zdragnar 17d ago
    There's a difference between being able to be successfully sued (civil liability, petitioned by a private entity) and charged (criminal liability, or petitioned by a government entity). The thresholds for suing and charging differ greatly depending on the circumstances. Another set of hypothetical examples that make things muddier: - If I drive a fishing boat into a pier, I am liable, not the manufacturer of the boat - If I drive a car over someone lying in the road, I am liable, not the manufacturer of the car - If my life is in danger and I shoot a gun and kill my attacker, neither I nor the manufacturer are liable so long as I obeyed the relevant self defense laws and gun possession of whatever jurisdiction I am in - If I fire a gun into a crowd indiscriminately, I am liable and several jurisdictions have used that to also hold gun manufacturer liable as well That last example has been less successful as of late, but there are other variations too.
elmo2you 17d ago
As far as I know (IANAL) it is in fact the only "person" you can charge. To the best of my knowledge, the whole point these "limited liability" legal constructions exist in the first place, is to protect individuals within a corporation for whatever they do as part of the business of a company (barring exceptions that have clearly not been part of that business and obvious individually committed crimes), typically "just following orders". If a company commits a crime, or in a worse case runs a criminal enterprise, it is the company that is legally responsible, not its employees. That is, in principle. This can get more complicated higher up the management tree, where decisions can also be prosecuted on personal little, but that's usually a far more complicated matter. Also, if a whole group of employees willingly conspires to commit crimes, they might also be prosecuted individually for those crimes (there are limits to limited liabilities). However, that usually only works under special conditions and it would e.g. require that there's an obvious criminal enterprise aspect to it, rather than individual cases of illegal conduct. That said, with the track record of some of these companies, actually designating some of the AI companies as a criminal enterprises may eventually happen (in due time) in some jurisdictions outside the USA. Certainly if it ever turns out that these companies have been storing and (ab)using everything they ever had access too, while blatantly lying about that just because some particular (post 9/11) US laws gives them that opportunity (and impunity) as long as the US government somehow requested them to do so (covertly; with gag order). Might legally work withing US jurisdiction, but would still be very much illegal everywhere else.
- jasomill 17d ago
  "Limited liability" refers to shareholders' financial liability being limited to their investment, and has nothing to do with civil or criminal liability of employees for their own actions, whether "following orders" or not.
  - elmo2you 17d ago
    You might want to look up LLC (Limited Liability Company), which goes by other names in different countries but still basically mean the same (though details may vary between different company types). While there certainly are exceptions, as mentioned before, in principle the employees of a company are not personally legally accountable for their actions as performed in the service of a company. The legal entity of that companies is. If you sincerely believe otherwise, you either live in a rather unusual country or maybe just need to educate yourself a bit better.
ryanhuff 17d ago
Companies can certainly be charged with crimes. Punishments can be via fines or sanctions (court appointed monitors, etc). Individual employees can also be charged for their specific actions as part of the performance of a crime.
trinsic2 17d ago
There is no such thing as a Corporate person. Sounds like a something that was created by a legal system for people to absolve themselves of responsibility.
- voidUpdate 16d ago
  https://en.wikipedia.org/wiki/Corporate_personhood https://en.wikipedia.org/wiki/Corporate_personhood

bix6 17d ago

How is the responsibility diluted? Charge the CEO…

brookst 17d ago
Great, you’re the attorney at the CEO’s trial. To get a conviction, you’re going to have to show that he willfully committed this specific crime. There are no negligent or stochastic hacking laws, you have to show this specific crime was at his direction. Do you think there is evidence of this?
- bix6 17d ago
  Honestly yeah I bet there is and I hope to someday read about it if the government ever gets off its ass. Someone set up the “experiment”…
- VyseofArcadia 17d ago
  It would seem to me that the difference between the corporate world and organized crime is that a corporation can get away with, "the responsibility is too diffuse" but the mafia at least has to go to the trouble of finding a fall guy.
- shakna 17d ago
  > There are no negligent or stochastic hacking laws I'm sure that Andrew Auernheimer would be pleased to hear that. [0] For accessing a publicly accessible endpoint, that was completely undefended and didn't actually require "hacking", he was convicted of "exceeding authorised access". You _don't_ have to show intent under the Computer Fraud and Abuse Act, for the first count. > knowingly accesses a computer without authorization or exceeds authorized access [1] "Knowingly", not "intentionally", as in the other counts. You only have to show that: a) They trained a system to access without authorization (hacking) b) The system that was trained exceeded authorized access As responsibility falls to the operator with automated systems, the company becomes liable. [0] https://techcrunch.com/2013/01/21/ipad-hack-statement-of-responsibility/ https://techcrunch.com/2013/01/21/ipad-hack-statement-of-res... [1] https://www.energy.gov/sites/prod/files/cioprod/documents/ComputerFraud-AbuseAct.pdf https://www.energy.gov/sites/prod/files/cioprod/documents/Co...

oliwarner 17d ago

A copyright law seems an odd place to start. This is computer misuse.

VyseofArcadia 17d ago
The DMCA is a bit overly broad to be considered just a copyright law. For example, just breaking encryption on a DVD is technically illegal regardless of whether you then go on to do something otherwise illegal (make and sell bootlegs) or perfectly legal (make a space-shifted backup copy on your hard drive). IIRC this was an intentional handout to media companies who were angry that ripping CDs is perfectly legal. They had to find a way to make doing the same with DVDs illegal.
- oliwarner 17d ago
  Those provisions are specifically for the breaking or circumvention of technical measures designed to prevent copyright infringement. I don't see a parallel here.
  - immibis2 17d ago
    They've been twisted to support almost anything, for example repairing your tractor is illegal because of this same law. But I agree this is just plain old hacking under a plain old reading of the CFAA and doesn't need any twists.
    - EMIRELADERO 17d ago
      > for example repairing your tractor is illegal because of this same law. No it's not. There has never been a case establishing that, and it's absurd on its face. The protection measures that the law makes illegal to break must control access to a copyrighted work, and you can't copyright functionality.
      - immibis2 17d ago
        You see, they made it so you can't repair your tractor without circumventing a technological copy protection measure, which is illegal under DMCA 1201.

woah 17d ago

Issuing subpeonas, raiding offices, and dragging key employees into interrogation rooms as you would find in any normal criminal investigation would be more than enough to ensure "AI safety" without any new regulations, acts of congress, Bernie Sanders campaign speeches, or even charges filed.

stronglikedan 17d ago

There have been news stories where individual OpenAI users have been investigated based on their prompts. If OpenAI can point the police to specific users of their software, they can certainly point them to whichever of their own employees are involved in a crime. AI is just a tool, and the person prompting it is the one responsible for the outcome. No dilution there.

atmosx 17d ago
What is its one their "under development" models who escaped it's training, because it wasn't tuned properly?
- hvb2 17d ago
  Counter argument being that this seems to indicate you can do whatever as long as you're innovating?
  - hi_im_greg_h 17d ago
    Isn’t that the tech industry motto?
    - xmcqdpt2 16d ago
      And the motto of every neoliberal governments where being accused of Luddism is political death.
- aigetoutofjailf 17d ago
  [dead]
- louthy 17d ago
  That’s corporate negligence. The executives are liable unless there is evidence of malfeasance by one of the employees.
- IcyWindows 17d ago
  Is that different than cattle escaping and damaging property? I believe the rancher is at fault.

immibis2 17d ago

It doesn't need to be twisted to violate the DMCA anticircumvention clause because it is already just plain old hacking.

j2kun 17d ago

Sounds like we need discovery to determine who to charge.

Frieren 17d ago

> the responsibility is sufficiently diluted that it's impossible to charge anyone in particular. Was not that the goal when companies started using AI for their customer support? Be able to say anything without legal repercussions... But then this happened: https://www.bbc.com/travel/article/20240222-air-canada-chatbot-misinformation-what-travellers-should-know https://www.bbc.com/travel/article/20240222-air-canada-chatb... And support chatbot got a reality cold shower. The law will find a way to charge people in particular. Sadly will start with the less powerful in the chain before it actually acts on the people that can actually change things.

whateveracct 17d ago

how convenient

LastTrain 17d ago

That is a very convenient conclusion that certain entities would love for us to accept as true, but fuck that. If it is “diluted” as that the buck stops at the publisher of the model.

Refreeze5224 16d ago
Fuck that indeed. The buck should stop, and prison sentences should start, with the highest paid employee.