Edit: MIT license provides a pretty broad disclaimer to say it isn’t fit for any purpose implied or otherwise.
One of those things is going to be fraud: if the maintainer is intentionally installing backdoors into their software and not telling the user, there's going to be some fraud-like statute that they'll be liable for.
Honestly, if I were involved in this, I'd hope that it was, say, the FBI that caught me. I think that'd be the best chance of staying out of the Guantanamo Bay Hilton, laws be damned.
I own you now. Sucks to be you I guess. Or maybe that's not how things work a) limits to what licenses can allow you to do and b) limits to who is bound by the license at all.
In the US, you are innocent until proven guilty.
In the US, you are innocent until proven guilty.
Apologies for having to be obnoxious about it, but it deserves repeating.
If you take a approach of presumed guilty where the accused have to prove their innocence: you have a problem. You'd have a very difficult time proving your innocence after being accused of a crime. Anyone can accuse you of a murder that happened at 2am, and your alibi of being asleep won't cut it. Remember, in this bizarro world, it's presumed you are already guilty. You need to convince the prosector and jury you didn't commit the crime. Even if you had 4K night vision video of you sleeping in your bed, it probably won't persuade anyone because the prosecutor will say you pre-recorded the video to deceive a jury, and since you're presumed guilty, it makes sense for you to manufacture evidence in your defense.
This is why guilty until proven innocent is genuinely stupid.
You also cannot avoid criminal charges for a crime simply by shouting "don't blame me"
I can imagine the case of maybe a "King of the Hill"-type game played on bare hardware, where you're actively trying to hack into and destroy other players' systems. Such a thing might have a license saying "you agree we may wipe your drive after downloading all your data", and that might be acceptable in that specific situation. You knew you were signing up for a risking endeavor that might harm your system. If/when it happens, you'd have a hard time complaining about it doing the thing it advertised that it would do.
Maybe. Get a jury involved and who knows?
But somewhere between those 2 examples is the xz case. There's no way a user of xz could think that it was designed to hack their system, and no amount of licensing can just wave that away.
For a real world analogy, if you go skydiving, and you sign an injury against waiver, and you get hurt out of pure dumb luck and not negligence, good luck suing anyone for that. You jumped out of a plane. What did you think might happen? But if you walk into a McDonald's and fall through the floor into a basement and break your leg, no number of "not responsible for accidents" signs on the walls would keep them from being liable.
Even this is a bad example, since it is just gross negligence and not intentional. A better analogy would be if mcdonalds shoots you.
The point about MIT is that they are saying to the world when publishing “as is” folks. Not claiming I haven’t backdoored it for Uncle Sam.in fact I’m not claiming anything, use at your own risk.
It used to be the law to implicitly do this by weak encryption for exports.
The harm in question is causing the backdoor to be inserted in the first place. Its irrelavent what else you do, like selling it, although that could be a separate crime.
> The point about MIT is that they are saying to the world when publishing “as is” folks. Not claiming I haven’t backdoored it for Uncle Sam.in fact I’m not claiming anything, use at your own risk.
Just because you think that is what those words mean, doesn't mean that is what those words actually mean.
> It used to be the law to implicitly do this by weak encryption for exports.
Not comparable. Even now, the MIT license would probably protect you from any consequenes of using super weak encryption. It would not protect you from the hypothetical you setup. They are very different sutuations.
The 30 remaining gitmo prisoners are all W Bush holdovers that all subsequent administrations forgot.
And in fairness, the whole nature of their secrecy means there's no way to know for sure. It might be just a boogeyman kept around as a useful tool for scaring people into not breaking national security-level laws. I mean, it's not as though I want to go around hacking the planet, but the idea of ending up at a CIA "black site", assuming such things even exist, would be enough to keep me from trying it.
Not in the United States. https://constitution.congress.gov/browse/article-1/section-9...
* where were the authors of the code, * where the code is stored, * who is attacked, * where are their servers, * who is attacking, * where are they based, * where did they attack from, * ...
IANAL but it seems very complicated from law perspective (we, humanity, don't have a global law)
Edit2: making a bullet point list is hard
Yes, subsection (b) of the CFAA covers attempts at acts described in subsection (a) of the CFAA. Which specific act under subsection (a) do you claim has been attempted?
> literally all of part a
It's not (1) or (2) as no exfiltration has occurred. It's not (3) as a government system has not been targeted. It's not (4) as "the thing obtained consists only of the use of the computer". It's not (5) as no system has been targeted or damaged (based on the statutory definition of 'damage'). It's not (6) as we have no evidence of the attacker sharing their Ed448 private key. It's not (7) as there has been no act of extortion.
> did someone just trip and fall on their keyboard over a period of months to accidentally carry out sophisticated social engineering to write a carefully hidden backdoor into a package targeted at hijacking widely used operating systems?
I'm not arguing that it was a weird accident. I'm arguing that this clearly malicious act does not, based solely on the information we have today, constitute a violation of the CFAA.
In terms of a plausible business model - I mean that's conspiracy to commit crime, like of course that's illegal? And depending on the state actor and the target system - literally treason if it's a cyber attack as a part of a war? You can put whatever you want into a license or contract but obviously that doesn't let you override the actual law