Re: Who's liable?

[Kelly Martin <kmartin () pyrzqxgl org>]

On Sun, Oct 14, 2001 at 09:32:11PM -0400, Dom Genzano wrote:
> In most cases, someone would be required to have a conviction to pursue
> damages- if they try to sue without a conviction you can sue them right back
> for defamation of character.  

This is so glaringly false that it has to be debunked.  The absence of
a criminal conviction, or indeed of a criminal prosecution, is no bar
whatsoever, and in fact not even very closely related, to tortious
liability, especially for liability in negligence.  Most forms of
negligence are not criminal; not even all intentional torts are
criminal.  In most, but not all, states, it is true that a criminal
conviction automatically leads to civil liability; but the converse is
not the case.

The question as to whether your negligence as a sysadmin resulting in
your system being used as a platform for attacking someone else's
system can be the basis of civil liability for negligence is, as far
as I know, not been litigated.  Based on what I remember from my torts
class, I would tend to believe that it is possible.  A professional in
so field has a duty to perform those professional duties consistent
with the "minimal standards of the profession".  Failure to do so
would amount to a breach of duty, and could give rise to liability in
negligence.  IMO, it won't be long before a jury decides that the
failure to use an adequate firewall, or the failure to apply software
patches in a timely fashion, or some other such thing amounts to
professional negligence and can be the basis of liability.

As an aside, it is virtually impossible to prosecute a suit for
defamation in the United States.  Truth is an absolute defense, and
even the ultimate falseness of the alleged defamation is not
sufficient to create liability.

Kelly


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com