News for hackers. Stuff that matters.
Re:Class action lawsuit filed against Lenovo over Superfish by tedunangst on Monday May 11, 2015 @03:12PM (#9527164)
What would the criminal charges be? The best outline for a prosecution I've seen goes something like "CFAA, mumble mumble, spying is bad." What specific law was broken? Lay out the case. For bonus points, pretend you're the defense attorney, and then outline the defense's case.
Re:Class action lawsuit filed against Lenovo over Superfish by mikeash on Monday May 11, 2015 @03:20PM (#9527225)
I'm not really familiar enough with the law to say.

Let's say that some company builds a bridge that doesn't match the spec, to the point that it's dangerous. Maybe it falls down if any truck weighing more than 10 tons goes over it, when it was supposed to hold 40 tons. And let's further say that this weakness was the result of intentional cost-saving measures and a complete failure to investigate their consequences. But then let's say that the fault with the bridge was discovered after a few months before any 11-40 ton trucks had gone over it, so nobody actually died.

Would that be illegal under some sort of negligence or endangerment law? It certainly seems like it ought to be. Lenovo's actions are basically equivalent, except that it was (probably) just property at risk, not lives.

It looks like endangerment is indeed a criminal offense, and it doesn't require that the harm actually happens, just that the potential was there and that it was foreseeable. Would that actually apply here?

Re:Class action lawsuit filed against Lenovo over Superfish by tedunangst on Monday May 11, 2015 @03:46PM (#9527372)
Fair questions. Civil engineering projects may not be the best analogy, because there are some special laws in that space, but maybe consider automobile recalls. How many people went to prison because a car's brakes or ignition didn't work? Criminal product liability is pretty rare afaik.
Re:Class action lawsuit filed against Lenovo over Superfish by mikeash on Monday May 11, 2015 @04:03PM (#9527482)
Criminal proceedings against an entire company don't result in people going to jail, right? Holding people personally responsible is probably not appropriate with this, but holding the entire company criminally responsible and levying fines well in excess of actual damages seems reasonable.

Regarding automobile recalls, it looks like GM got hit with some fines for their ignition switch shenanigans, beyond actual damages. But it looks like this is a regulatory thing rather than a criminal thing. Maybe this is another place where special laws get in the way of generalizing.

Re:Class action lawsuit filed against Lenovo over Superfish by CWuestefeld on Monday May 11, 2015 @04:29PM (#9527628)
Criminal proceedings against an entire company don't result in people going to jail, right?

While it seems pretty rare for this to happen, the officers of a corporation can be held criminally liable for the actions of the corp.

Re:Class action lawsuit filed against Lenovo over Superfish by dragonwriter on Monday May 11, 2015 @04:36PM (#9527679)
They can be, but that allows criminal proceedings against the officer, it doesn't change that proceeding against the company, as such, cannot result in any individual going to jail, since the individual isn't the company (they are distinct legal persons) and one person can't be sent to prison based on another person being convicted of a crime.
Re:Class action lawsuit filed against Lenovo over Superfish by hurin on Monday May 11, 2015 @07:43PM (#9528597)
> What would the criminal charges be?

Not a lawyer but quoting from the document.

  COMPLAINT FOR:
  1) VIOLATION OF COMPUTER FRAUD AND ABUSE ACT (18 U.S.C. § 1030, et seq.);
  2) VIOLATION OF FEDERAL WIRETAP ACT (18 U.S.C. § 2510, et seq.);
  3) VIOLATION OF THE STORED COMMUNICATIONS ACT (18 U.S.C. § 2701, et seq.);
  4) VIOLATION OF CALIFORNIA INVASION OF PRIVACY ACT, PENAL CODE §§ 631, 637.2;
  5) VIOLATION OF CALIFORNIA BUS. & PROF. CODE § 17200, et seq.;
  6) TRESPASS TO CHATTELS;
  7) COMMON LAW FRAUD; and
  8) NEGLIGENT MISREPRESENTATION
Re:Class action lawsuit filed against Lenovo over Superfish by tedunangst on Monday May 11, 2015 @09:58PM (#9529131)
Thanks, though I'm a little suspicious when I see this:

  2) VIOLATION OF FEDERAL WIRETAP ACT (18 U.S.C. § 2510, et seq.);
  3) VIOLATION OF THE STORED COMMUNICATIONS ACT (18 U.S.C. § 2701, et seq.);
You'd think one or the other, no? (AFAIK Superfish didn't touch anything even remotely covered by SCA). This looks like classic "all of the torts" shotgun filing. Which makes sense for a civil case, but it's not much of a guide as to what criminal cases would be viable.
Re:Class action lawsuit filed against Lenovo over Superfish by Lawtonfogle on Tuesday May 12, 2015 @01:02PM (#9533144)
>Which makes sense for a civil case, but it's not much of a guide as to what criminal cases would be viable.

But that is the guide book for criminal proceedings against individuals. The prosecutor dog piles on every single charge they can and then offers a scaled down plea bargain.