Hacker News Reader

The first time it happens you can say it’s negligence. Now that they know it keeps happening and they seemingly aren’t able to stop it but keep doing it. That has to be on them doesn’t it?

View on HN

I don't think you can infer that they "keep doing it" from additional attacks being revealed, because they all seem to have happened roughly during the same time frame, but are reported with varying delays.

Lawyer here: No. Not criminally. Knowledge that a certain result is likely is not the same as intent to cause the result. This is basically the difference between recklessness and intentionality. Doing something when you know of a likely result is reckless, but not intentional. Only doing something, trying to cause a result (likely or not) is intentional. In this case, the CFAA only covers intentional access without authorization, not reckless access without authorization.

What are the punishments for recklessness VS intent?

Or are OpenAI too well connected now to be punished for anything.

It depends on the statute, but if you're talking about 18 USC 1030, the standard is intentionality (if not to intentionally access something you shouldn't, then intent to defraud).

Reply on news.ycombinator.com