It would seem to be a violation of the DMCA, as it is software preinstalled to allow the eventual side-stepping of the end-user's security measures (using an HTTPS-capable browser).

"It also criminalizes the act of circumventing an access control, whether or not there is actual infringement of copyright itself."

https://en.wikipedia.org/wiki/Digital_Millennium_Copyright_A...

EDIT: Considering the huge number of victims systematically targeted on an ongoing basis, perhaps RICO would apply too. Certainly RICO is brought to bear by prosecutors when trying to intimidate less resourced individuals.

https://en.wikipedia.org/wiki/Racketeer_Influenced_and_Corru...

It would make my day to see companies (or the individuals who called for this retarded project) get punished under DMCA / RICO / CFAA. I bet we'd see those repealed real quick due to lobbying pressure if that kind of thing actually worked.

Nah, they'd just get revised by Congress, as part of the War on Citizens.

Does superfish circumvent copyright media protection? Not really. It's a huge stretch to call https a form of drm.

As big of a stretch as punishing teachers changing question answers under RICO?

With the amount of frivolous cases brought under the Computer Fraud and Abuse Act (http://www.networkworld.com/article/2908555/opensource-subne...), it'd be nice to see some charges filed for this.

Oh, look, another one: http://www.pcmag.com/article2/0,2817,2484018,00.asp

In the U.S., private prosecutions are not usually allowed. Additionally, government officials with prosecutorial authority have some amount of discretion in choosing which cases to prosecute and limited resources that prevent them from prosecuting every possible case. A private citizen cannot force prosecution, no matter how meritorious the case.

This is true, but one still wonders why government officials haven't pursued a criminal case.

One strategy the DOJ uses is to let a civil case go forward and then piggy back off it. Let the private attorneys do the heavy lifting and then swoop in for an easy victory.

Also, the way the law is structured, it's typically easier to get information in a civil suit since defendants have fewer rights.

Because it's such a minor issue.

Hacking several million computers is minor? What qualifies as major, then?

The Morris worm infected 2-3 orders of magnitude fewer computers...

http://en.wikipedia.org/wiki/Morris_worm

Well, there are surely more than three orders of magnitude more computers connected to the internet today than the 60,000 Paul Graham reports people guessing at in 1988.

Put another way, as dreadful as it is, Superfish was never at risk of partitioning the internet. The harm is restricted to those luckless individuals who purchased a Lenovo laptop in the particular time frame at issue; quite possibly a crime, but not, playing devil's advocate for reluctant prosecutors, a 'something must be seen to be done or I'll be lynched' level crime.

Consider what the outcome here would be if, instead of Lenovo expressly doing this, it was a single rogue employee who e.g. Modified the system image used by the factory with the exact same software in the exact same way and took the ad profits.

Whatever would happen in that situation should happen here. I would guess prison time would be involved.

You do not abuse the user's trust like that.

Uh, why?

US Judges in civil cases can be obligated for the court to be informed that a crime has been committed, which is then referred to the prosecuting authority. The prosecuting authority still has discretion and is not forced to prosecute the matter.

I found a reference to a case in Utah. http://e-discoveryteam.com/2011/04/10/judge-refers-defendant...