Hopefully, the Linux Foundation or someone with standing sends the university a bill - if they don't have intrinsic motivation to behave ethically, then the force of the market is a powerful motivation.

I have spent time doing contract development, and also made volunteer contributions to open source projects (not the Linux kernal, though). Certainly, if I were pulled into reviewing UMN kernel patches, I would be tracking my hours at my standard hourly rate, so that I would have the documentation for a claim for actual damages. Cleaning up other people's bad-faith crap is not what open source developers volunteer for. UMN caused real work for real people for bad-faith reasons, and should pay up. The work they caused is deflecting volunteers from otherwise productive activities.

I suspect many volunteer kernel developers do contract development to pay the bills -- it should not be hard for them to just create a billing code for UMN clean-up. The Linux foundation can aggregate them all and dump that on UMN.

(Also, I have a MSEE from UMN, and I can tell you that the next attempt at fund raising from me is not going to go well for them.)

Conspiracy to X is a criminal charge, not the basis for a lawsuit. You can only sue someone over actual damages (or statutory damages), not hypothetical damages. If some DA wants to pursue criminal charges against UMN, that's separate from anyone asking to be made whole for the consequences of UMN's actions.

There's also no general "Conspiracy" modifier to crimes. Rather, "Conspiracy to X" is a separate law for only a handful of X.

You misunderstand why syshum answered the way he did. GP used the phrase "actual damages" which is a precise term of art in law. Damages have to exist (actual damages already suffered, or statutory damages imposed on conduct which has already transpired) to form a basis for a lawsuit -- the law does not concern itself with hypotheticals.

Whether or not there could be 'large damage' in the future (your "once I or someone else takes advantage") is irrelevant, immaterial, and only barely actionable. You could seek an injunction to attempt to prevent further potentially-damaging conduct. But you would not be able to claim any actual damages and would generally not be entitled to any form of compensation, not even for the attorney's fees generated in seeking the injunction.

As a sibling points out, conspiracy is question of criminal law, not civil law. Furthermore, in almost all jurisdictions within the United States, conspiracy requires at least one of the members of the conspiracy to have actually committed some overt act in furtherance of the crime. It should be impossible to find these researchers guilty of a conspiracy -- even if you claim that introducing hypocrite commits was the overt act, it is already clear that their intention is to academically investigate (and improve, if you're feeling charitable) the state of open-source security. Their actions (introducing hypocrite commits) are not in and of themselves violations of criminal law, so you'd still have to prove that they actually conspired to do something actually criminally illegal as well, e.g. intent to actually damage in some specific way, facilitated by these commits, some specific entity Foo which uses the linux kernel. It's perfectly clear that no such intent existed.