RE: Who's liable?

[Rob Keown <Keown () MACDIRECT COM>]

Yes, the reason for my word culpable. This an open book, no? 

It is good to see we have people on this list that can help us chart an
appropriate course for our organizations.

Am I wrong in saying that the majority of good people here want to have an
endpoint where people are held accountable for their hosts and networks? We
just don't, at this point, want  to prosecute an organization that is
getting on the net with no real understanding of what such liability means.

I have sent hundreds of messages to hosts infected by Nimda. I don't really
want these people to feel as if they should shut their operations down
because of criminal/civil liability.

Conversely, if Nimda's payload was more destructive I might feel
differently.

These are all good commments and observations.

Is there a better forum for this? I feel like we're treading on a line
regarding this forum. Some of us have these messages sent to our pagers in
the event there are valid and escalating intrusions.

Rob Keown
MAC DIRECT

-----Original Message-----
From: Jason Giglio [mailto:jgiglio () vt edu]
Sent: Saturday, October 13, 2001 7:54 PM
To: Rob Keown
Subject: RE: Who's liable?



> If the site from which the attack is launched is ignorant of any criminal
> activity then there is no *criminal* recourse. But let's also realize that

One thing you didn't make clear is that under the doctrine of respondent 
superior, an employee that is "on duty" who causes damages to someone else 
makes their employer responsible *civilly*.  So even if there is no 
criminal recourse, the company could be sued successfully civilly.

This makes a good argument if you are a consultant and you want to sell 
security services to small businesses who might otherwise just skip it.

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com