I've often wondered about this. How can there be no liability? And yes, I'm sure that there are usage terms buried somewhere. But warning people that you may attack them doesn't absolve you from criminal charges and/or civil liability.

Nothing stops you from suing them; if the real damages can be proved and are great enough to justify the cost of a lawsuit than it may even be worth doing. If real damages were in tens of thousands I'd at least hire a lawyer to send them a letter and see if you can get an easy settlement.

Not only difficult to prove, but also difficult to even get an idea of whom to sue.

Got burnt by some ransomware, now what? Use that backup you hopefully have and that's it. In the time between backup and damage, the primary browser would have touched just about every ad network in existence and nobody knows how many other unpublished holes might have been responsible for the malware to leak in.

Art the other end of the range, if you are a security expert analyzing the incoming flood, you may have an abstract case of attempted computer fraud, but no concrete damages.

Edit: could this change once ad-blockers have caused the introduction of server-side splicing of ads and content? (I suspect that this will become the main business of edge server operators not too far down the road)

> Edit: could this change once ad-blockers have caused the introduction of server-side splicing of ads and content? (I suspect that this will become the main business of edge server operators not too far down the road)

That's a good point. Maybe ad-blockers will impose accountability.

Edit: There's a tendency to be irresponsible when effectively anonymous. But there's still risk. Let's say that some ad network is hosting ransomware. Well over 99% of victims will have no provable damages. But maybe you take out some business and all of the day's backups. There's also the potential for class tort.

When it comes to computer intrusion, you often do not need to prove damages. Many jurisdiction has made it a criminal offense, and other has based damages on the amount of time a professional would spend on repairing the damages.

Each personal computer and laptop should be in the range of a $200. A work desktop or server should be in the range of $2000-5000, since then you got to verify the integrity of data and secrecy of costumers. Since a maladvertisement attack hits tens of thousands of users, a class action suit could be in any range, and it would be hard to guess the end result.

To me, you are describing one of the core problems of ad networks. As long as they are not accountable (or simply never have to account) for malware distribution ad blocking will be the best protection...