RE: Who's liable?

["Shashi Dookhee" <dookhee.s () trafficproximity com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In the UK, usually the Company Directors would be held liable of any
and all criminal activaty originating from Company equipment -
hacking, piracy, warez...  Unless the Company Directors *actively*
looked into limiting this sort of behaviour.  Ignorance is not an
excuse.

S.



Shashi Dookhee
Head of IT Infrastructure

e-mail:  dookhee.s () trafficproximity com
Telephone (Direct Line):        +44 (0)20 7298 8222


- -----Original Message-----
From: Kelly Martin [mailto:kmartin () pyrzqxgl org]
Sent: 14 October 2001 00:39
To: incidents () securityfocus org
Subject: Re: Who's liable?


On Sat, Oct 13, 2001 at 06:57:13PM -0400, Rob Keown wrote:

> If the site from which the attack is launched is ignorant of any
> criminal activity then there is no *criminal* recourse. 

That's not necessarily true.  Under federal law, if you are
deliberately ignorant of (that is, you take affirmative efforts to
avoid having knowledge of) some fact or condition, then you can be
held to have had "knowledge" of that fact or condition, and if that
leads to criminal liability, then so be it.

Also, in general, there are lots of things where you can be
criminally
liable for things you didn't know about, if you were reckless with
respect to them.  The classic example is the act of throwing a rock
off a tall building.  You have no knowledge that this rock will hit
anyone (either in particular or generally), but you are reckless
towards the possibility that the rock will hit someone and are thus
criminally liable for the consequences if it does.

> Should this change? I don't think there is any legal precedent for
> someone who is not "aware" of criminal intent to be held culpable. 

I read a case in my criminal law class of a shop owner who was held
vicariously and criminally liable for the acts of a non-employee in
the shop without the shopowner's permission.  The law did not place
any requirement of culpability on the part of the shop owner (not
even
negligence); liability was absolute.  However, the Supreme Court did
limit the scope of vicarious absolute liability offenses to strictly
financial penalties.  The Court has held that the Constitution
requires at least a threshhold level of individual culpability for
liability for an offense which can lead to incarceration.

IMO, it is Constitutionally permissible for a state to make it a
criminal offense for a person to operate a computer system in such a
manner that a substantial, avoidable risk exists that that computer
system may be used in the furtherance of illegal acts, especially if
the operator of the computer is or should have been aware of the
substantial risk.  Whether any existing law does so is another
question.

Kelly

- ----------------------------------------------------------------------
- ------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

======================================================================
=========

Traffic Proximity Limited
191 Old Marylebone Road
London
NW1 5DW
United Kingdom
Registered number: 3164767
Registered in England

Tel:    +44 (0) 20 7298 8200
Fax:    +44 (0) 20 7298 8201


This email its contents and any files or images with it are intended
solely
for the addressee(s) and are confidential. If you have received this
email
in error you may not copy or use the contents, attachments or
information in
any way. Please destroy it and contact the sender on the number
printed
above, via the Traffic Proximity switchboard or via email return.

DISCLAIMER
Material contained in this email may be copyright material of 
Traffic Proximity or protected by other intellectual property rights.
It
may only be reproduced with the express permission of Traffic
Proximity. 
Traffic Proxmity does not accept responsibility for any changes made
to
this email by unauthorised parties after it was sent. Whilst Traffic
Proximity runs antivirus software on all Internet emails it is not
liable for any loss or damage caused by an infected email. The
recipient
is advised to run their own antivirus software. All information
contained
in this email has been prepared using information believed by the
author
to be reliable and accurate, but Traffic Proximity makes no warranty
as
to accuracy and completeness. Any opinions expressed in this email
are
those of the author and do not necessarily reflect the opinions of
Traffic
Proximity or its affiliates.

======================================================================
=========


-----BEGIN PGP SIGNATURE-----
Version: PGP 7.1

iQA/AwUBO8jsZR81+wdHSEUlEQLPVgCg51R661YFcsCBnQRCHE9tyXCmkYIAoOrO
KYzgqTnqOD7tYwmLX3bLRu0M
=9I2L
-----END PGP SIGNATURE-----

===============================================================================

Traffic Proximity Limited
191 Old Marylebone Road
London
NW1 5DW
United Kingdom
Registered number: 3164767
Registered in England

Tel:    +44 (0) 20 7298 8200
Fax:    +44 (0) 20 7298 8201


This email its contents and any files or images with it are intended solely
for the addressee(s) and are confidential. If you have received this email
in error you may not copy or use the contents, attachments or information in
any way. Please destroy it and contact the sender on the number printed
above, via the Traffic Proximity switchboard or via email return.

DISCLAIMER
Material contained in this email may be copyright material of 
Traffic Proximity or protected by other intellectual property rights. It
may only be reproduced with the express permission of Traffic Proximity. 
Traffic Proxmity does not accept responsibility for any changes made to
this email by unauthorised parties after it was sent. Whilst Traffic
Proximity runs antivirus software on all Internet emails it is not
liable for any loss or damage caused by an infected email. The recipient
is advised to run their own antivirus software. All information contained
in this email has been prepared using information believed by the author
to be reliable and accurate, but Traffic Proximity makes no warranty as
to accuracy and completeness. Any opinions expressed in this email are
those of the author and do not necessarily reflect the opinions of Traffic
Proximity or its affiliates.

===============================================================================


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com