I mean, if I fired a gun at your house but was lucky enough not to injure anybody, shouldn't my punishment still be more than the cost of fixing the bullet holes? Of course that's separate from the question of whether you should receive more than the cost of fixing the bullet holes.

Sometimes putative damages can be awarded, which can look at the egregiousness of the actions of the plaintiff. I don't know if those are available here.

As to why the government hasn't tried to indict for criminal charges, there could be many reasons. The case might not be good. They might be waiting. They may think it's small fry stuff.

The doj doesn't go after everyone.

Is there any question as to what Lenovo actually did, are they denying they exceeded their authorisation in accessing computers and MitM-ing things like bank transactions? If the facts aren't in dispute there then surely the only thing the court would need to do is work out how long the directors who authorised/oversaw [or negligently didn't oversee] this are going to be put in prison for.

Let's say that some company builds a bridge that doesn't match the spec, to the point that it's dangerous. Maybe it falls down if any truck weighing more than 10 tons goes over it, when it was supposed to hold 40 tons. And let's further say that this weakness was the result of intentional cost-saving measures and a complete failure to investigate their consequences. But then let's say that the fault with the bridge was discovered after a few months before any 11-40 ton trucks had gone over it, so nobody actually died.

Would that be illegal under some sort of negligence or endangerment law? It certainly seems like it ought to be. Lenovo's actions are basically equivalent, except that it was (probably) just property at risk, not lives.

It looks like endangerment is indeed a criminal offense, and it doesn't require that the harm actually happens, just that the potential was there and that it was foreseeable. Would that actually apply here?

Regarding automobile recalls, it looks like GM got hit with some fines for their ignition switch shenanigans, beyond actual damages. But it looks like this is a regulatory thing rather than a criminal thing. Maybe this is another place where special laws get in the way of generalizing.

While it seems pretty rare for this to happen, the officers of a corporation can be held criminally liable for the actions of the corp.

Not a lawyer but quoting from the document.

  COMPLAINT FOR:
  1) VIOLATION OF COMPUTER FRAUD AND ABUSE ACT (18 U.S.C. § 1030, et seq.);
  2) VIOLATION OF FEDERAL WIRETAP ACT (18 U.S.C. § 2510, et seq.);
  3) VIOLATION OF THE STORED COMMUNICATIONS ACT (18 U.S.C. § 2701, et seq.);
  4) VIOLATION OF CALIFORNIA INVASION OF PRIVACY ACT, PENAL CODE §§ 631, 637.2;
  5) VIOLATION OF CALIFORNIA BUS. & PROF. CODE § 17200, et seq.;
  6) TRESPASS TO CHATTELS;
  7) COMMON LAW FRAUD; and
  8) NEGLIGENT MISREPRESENTATION

  2) VIOLATION OF FEDERAL WIRETAP ACT (18 U.S.C. § 2510, et seq.);
  3) VIOLATION OF THE STORED COMMUNICATIONS ACT (18 U.S.C. § 2701, et seq.);

But that is the guide book for criminal proceedings against individuals. The prosecutor dog piles on every single charge they can and then offers a scaled down plea bargain.

As for unfairness, I think the entrepreneurial class action system to punish very diffuse harms amounts to an inefficient regulatory regime and that inefficiency results in higher prices for everyone as compared to a more efficient system.

Re: cy pres awards, while Pearson v. NBTY (out of the 7th Circuit) did not involve a residual award, it did strongly imply that they would be unreasonable when, as here, the class members could be individually identified and compensated directly. More generally, after the 7th Circuit's recent cases on the subject, cy pres awards are low hanging fruit for objectors and plaintiffs' counsel have an incentive to structure settlements to avoid such challenges.

Without writing an entire law review article in the comments, I'd say if no government (state or federal) can be bothered, given that they could almost certainly get a fine for less than $4 million (that's a lot of GS-11 man-hours) then reliance on the reputation economy seems like a good alternative.

And while discovery can be useful for getting information, in this case the information was publicized based on the workings of a different reputation economy (the security research community).

There may be some case that slip through the cracks, but I am unconvinced that the sui generis (to the US) opt-out class action mass tort system does more good than harm.

There is the cost of removing the malware, and cleaning up any damages it caused. This is normally done by estimating how many hours a professional would spend on it, and the wages they would demand.

Second, is the for-profit claim of "TRESPASS TO CHATTELS". If someone goes and steal a car to run a taxi service, one would look at the ill-gotten gains as well as the potential economic loss the car owner might has sustained from not having access to the car. "borrowing" other peoples cars once the owner has parked it is not risk free, and the law recognize this beyond just looking at used up gasoline.

[0] http://support.lenovo.com/us/en/product_security/superfish_u...

What I do normally see is the court looking for guidelines regarding damages, and here the relevant question would be what a average person would have to pay in order to remove the malware and restore damages. A laywer could present rates of reputable repair shops has charge clients, and the defense lawyer could argue that the update helped reduce the time a professional would take.

And since the malware has already been removed at no cost, the actual, not just hypothetical, answer to that question is zero.