4 ms·

That is essentially the difference between Criminal law and civil law. Civil suits are typically designed to make you whole. You get what you actually lost. So

That is essentially the difference between Criminal law and civil law. Civil suits are typically designed to make you whole. You get what you actually lost. Sometimes putative damages can be awarded, which can look at the egregiousness of the actions of the plaintiff. I don't know if those are available here.

mikeash 12y ago
Then I guess the followup questions are: why aren't criminal charges being brought, and (if they're actually not) why aren't punitive damages being awarded?
- rhino369 12y ago
  Punitive damages would occur after any trial victory. This is just the very first step, essentially a legal accusation. As to why the government hasn't tried to indict for criminal charges, there could be many reasons. The case might not be good. They might be waiting. They may think it's small fry stuff. The doj doesn't go after everyone.
  - pbhjpbhj 12y ago
    So who is responsible in the DoJ for deciding that it's OK to let company directors do arms length crimes and they're going to look the other way. Is there any question as to what Lenovo actually did, are they denying they exceeded their authorisation in accessing computers and MitM-ing things like bank transactions? If the facts aren't in dispute there then surely the only thing the court would need to do is work out how long the directors who authorised/oversaw [or negligently didn't oversee] this are going to be put in prison for.
    - tedunangst 12y ago
      Well, the CFAA has a handy little "choose your own adventure" like section listing the various naughty activities, where you could be guilty of a.2.B or a.7.A, etc. Which combo do you think Lenovo is guilty of?
      - btdollar 12y ago
        What a self-serving law. All it deals with is atomic data and financial institutions. How in the hell does this ever get applied to people downloading too many webpages?
- tedunangst 12y ago
  What would the criminal charges be? The best outline for a prosecution I've seen goes something like "CFAA, mumble mumble, spying is bad." What specific law was broken? Lay out the case. For bonus points, pretend you're the defense attorney, and then outline the defense's case.
  - mikeash 12y ago
    I'm not really familiar enough with the law to say. Let's say that some company builds a bridge that doesn't match the spec, to the point that it's dangerous. Maybe it falls down if any truck weighing more than 10 tons goes over it, when it was supposed to hold 40 tons. And let's further say that this weakness was the result of intentional cost-saving measures and a complete failure to investigate their consequences. But then let's say that the fault with the bridge was discovered after a few months before any 11-40 ton trucks had gone over it, so nobody actually died. Would that be illegal under some sort of negligence or endangerment law? It certainly seems like it ought to be. Lenovo's actions are basically equivalent, except that it was (probably) just property at risk, not lives. It looks like endangerment is indeed a criminal offense, and it doesn't require that the harm actually happens, just that the potential was there and that it was foreseeable. Would that actually apply here?
    - tedunangst 12y ago
      Fair questions. Civil engineering projects may not be the best analogy, because there are some special laws in that space, but maybe consider automobile recalls. How many people went to prison because a car's brakes or ignition didn't work? Criminal product liability is pretty rare afaik.
      - mikeash 12y ago
        Criminal proceedings against an entire company don't result in people going to jail, right? Holding people personally responsible is probably not appropriate with this, but holding the entire company criminally responsible and levying fines well in excess of actual damages seems reasonable. Regarding automobile recalls, it looks like GM got hit with some fines for their ignition switch shenanigans, beyond actual damages. But it looks like this is a regulatory thing rather than a criminal thing. Maybe this is another place where special laws get in the way of generalizing.

mikeash 12y ago

Then I guess the followup questions are: why aren't criminal charges being brought, and (if they're actually not) why aren't punitive damages being awarded?

rhino369 12y ago
Punitive damages would occur after any trial victory. This is just the very first step, essentially a legal accusation. As to why the government hasn't tried to indict for criminal charges, there could be many reasons. The case might not be good. They might be waiting. They may think it's small fry stuff. The doj doesn't go after everyone.
- pbhjpbhj 12y ago
  So who is responsible in the DoJ for deciding that it's OK to let company directors do arms length crimes and they're going to look the other way. Is there any question as to what Lenovo actually did, are they denying they exceeded their authorisation in accessing computers and MitM-ing things like bank transactions? If the facts aren't in dispute there then surely the only thing the court would need to do is work out how long the directors who authorised/oversaw [or negligently didn't oversee] this are going to be put in prison for.
  - tedunangst 12y ago
    Well, the CFAA has a handy little "choose your own adventure" like section listing the various naughty activities, where you could be guilty of a.2.B or a.7.A, etc. Which combo do you think Lenovo is guilty of?
    - btdollar 12y ago
      What a self-serving law. All it deals with is atomic data and financial institutions. How in the hell does this ever get applied to people downloading too many webpages?
tedunangst 12y ago
What would the criminal charges be? The best outline for a prosecution I've seen goes something like "CFAA, mumble mumble, spying is bad." What specific law was broken? Lay out the case. For bonus points, pretend you're the defense attorney, and then outline the defense's case.
- mikeash 12y ago
  I'm not really familiar enough with the law to say. Let's say that some company builds a bridge that doesn't match the spec, to the point that it's dangerous. Maybe it falls down if any truck weighing more than 10 tons goes over it, when it was supposed to hold 40 tons. And let's further say that this weakness was the result of intentional cost-saving measures and a complete failure to investigate their consequences. But then let's say that the fault with the bridge was discovered after a few months before any 11-40 ton trucks had gone over it, so nobody actually died. Would that be illegal under some sort of negligence or endangerment law? It certainly seems like it ought to be. Lenovo's actions are basically equivalent, except that it was (probably) just property at risk, not lives. It looks like endangerment is indeed a criminal offense, and it doesn't require that the harm actually happens, just that the potential was there and that it was foreseeable. Would that actually apply here?
  - tedunangst 12y ago
    Fair questions. Civil engineering projects may not be the best analogy, because there are some special laws in that space, but maybe consider automobile recalls. How many people went to prison because a car's brakes or ignition didn't work? Criminal product liability is pretty rare afaik.
    - mikeash 12y ago
      Criminal proceedings against an entire company don't result in people going to jail, right? Holding people personally responsible is probably not appropriate with this, but holding the entire company criminally responsible and levying fines well in excess of actual damages seems reasonable. Regarding automobile recalls, it looks like GM got hit with some fines for their ignition switch shenanigans, beyond actual damages. But it looks like this is a regulatory thing rather than a criminal thing. Maybe this is another place where special laws get in the way of generalizing.