Hacker News Reader

Comment by Kronopath | Hacker News Reader

Question for the more legally-minded among us: Can Lenovo face consequences over this? I mean, they deliberately crippled the security systems of their consumer goods, presumably without properly notifying their customers. That sounds like the kind of thing a company could, or should, get sued for.

View on HN

Dutch IT lawyers [1] say that Lenovo could be breaching European and Dutch Law. More specifically the "cookie law" which says that explicit permission is needed to change and read data from a user's computer (Lenovo never asked explicit permission). I also hear mentions of breaching the "computer intrusion" law (classifying this as a hack) and even the "communications tapping" law (Lenovo is not licensed to MitM your connections). I do not think a EU class-action or private citizen lawsuit will follow, but perhaps the official institutions can hand out a big fine. However, if Lenovo MitM'ed your connections and you can prove that, that would in principle be enough to get this case in front of a tort judge.

[1] http://tweakers.net/nieuws/101472/lenovo-overtreedt-wet-met-... (lang:nl)

I don't know Dutch law but I'm interested you say "tort judge" - unauthorised access to computing systems is made a crime in EU. It should be a criminal prosecution.

Didn't they come that way? It's not like they secretly snuck into your house and changed your computer. They sold something broken. It's the difference between going to your house and breaking the latch on your window, vs selling you a window that won't latch.

If I sell you a window that only appears to latch, and then come by later and rob your house, I might face criminal charges.

Lenovo didn't just sell something with broken security. It purposely broke the security, and profited from it.

Adware is not a broken product, it is an illegal scheme to earn profit on other peoples hardware by deliberate deception.

Did they inform their customers in advertisements, in the stores, or in any way that sold devices was being used by Lenovo after sale? Were there a meeting of minds where customers agreed to have their traffic MiTM and have advertisement of Lenovo choice on their device in return for fair compensation? That could have made it legal, but as it stand, no aspects of consumer protection laws, advertisement laws, contract laws, computer crime laws, or data protection laws seemed to have be followed.

They secretly snuck into peoples private property, used a backdoor, and earned profits doing so. They didn't tell anyone for obvious reasons. Had it been a one-man company doing this, then that person would be facing jail time.

Lenovo actively circumvented your security and sold access to your computer to Superfish. If you want to compare it to windows, it's like a security door salesman who sells extra keys to organized crime on the side.

I'm sure they might claim that the user agreed to it, but it's important to remember that EU Data Protection law places limits on what people can agree to. You can store person data if it's proportionate for a cause. MitMing all SSL connections? No way is that proportionate.

IANAL;

In the Lenovo case, probably not. But in the case of an employer-provided system and network intended for business purposes which performs SSL interception for security and data leak prevention? I think it can clearly be considered reasonable for the company to do that, and the user's expectation of privacy is significantly different. I do feel it's important that Acceptable Use Policies, Employee handbooks, etc. disclose the activity though.

Definitely, but no way Lenovo can even get close to the same sort of justification. It's reasonable that my workplace monitor and manage how their network bandwidth is being used. It's not reasonable that Lenovo gets to spy on my specifically encrypted traffic just because I bought a computer from them for personal use.

In this case, Lenovo hardly is spying or even interested. The bad thing is they are

a) selling capability to advertise to you, without your real consent, and

b) when the do it, the implementation is so horribly broken that it exposes end users to be exploited by just about anyone.

I see little malice, I see a lot of incompetence and outright, unforgivable stupidity. This opens door to the malice of others.

@JustinBrookman just linked[0] to this FTC ruling against HTC in a similar case in 2013: http://www.ftc.gov/news-events/press-releases/2013/02/htc-am...

Choice quote: The settlement requires HTC America to develop and release software patches to fix vulnerabilities found in millions of HTC devices. In addition, the settlement requires HTC America to establish a comprehensive security program designed to address security risks during the development of HTC devices and to undergo independent security assessments every other year for the next 20 years.

[0] http://twitter.com/JustinBrookman/status/568466666771910657

Crippled isn't the word. They broke browser cryptography. The Superfish MitM proxy on the host is validating any cert it gets, even patently bogus ones. As a result it's possible for a networked MitM who is actively going after SSL/TLS traffic to see all traffic with no need to have the Superfish private.

Here's a screenshot of what their MitM proxy provides back to the browser for a compromised connection to Bank of America:

https://defaultstore.com/four.png

Note that my MitM proxy cert is one gen'd with OpenSSL and is not the Superfish private! While it's cool that the private can be extracted, given the failure of the Superfish software to properly validate the public in the SSL/TLS handshake, the Superfish private isn't something a bad guy needs to get in the middle of encrypted traffic.

Once Lenovo was bought by a chinese company... didn't everyone kind of assume the state of China would use this opportunity to do what the NSA does for American hardware? The extent of the NSA's actions weren't known at the time, but you had to assume China would be less bound by restrictions.

SuperFish is based in Palo Alto and funded by DFJ.

You're shitting me?

Lenovo has always been a Chinese company. I think what you are recalling is that they bought the PC part of IBM (thinkpads and whatnot).

AIUI, the only people who could claim damages in a civil suit are ones that could demonstrate actual costs as a consequence for Lenovo's action.

Maybe the cost of a security audit required as a consequence of this issue might qualify - I don't know. But there would have to be actual costs involved.

"AIUI"? What's that now?

Ok, googled it, wait for it... "As I understand it".

Whew!

Thank you. IRDUTPOTOA (I really don't understand the point of these obscure acronyms).

That's because you find them obscure. If your community used them more frequently you would just read them in place, like people do with IANAL, LGTM, AFAIK, etc.

Incidentally, I didn't understand this one, but I don't blame OP (oops, I mean 'original poster') for misunderstanding the linguistic norms of HN (hacker news).

Just spell it out!

Incidentally, first time I've seem LGTM, had to google it.

.lgbt as a gTLD? LGTM.

I agree. Nowdays I read things like "IANAL" or "AFAIK" as words, not acronyms. When one reaches this point, such acronyms are pretty convenient.

They're faster to type, and I suspect I find them more pleasant to read (this is hard to test). AIUI, IIRC and similar are good disclaimers to make, but they're basically boilerplate, and don't need to take up lots of space.

IIRC you don't need any of this, you will still hold copyright to what you have produced. This is just a friendly reminder to your readership.

IANAL but I believe you are correct although you get some extra legal protections by including the notice (which only need include the word or symbol and the name and year). Namely, an infringer cannot claim they did so accidentally... or something like that. FWIW.

Correct. The Berne Convention did away with 'formalities' like having to register your copyrights in order to hold them. You still need to have a registered copyright to sue for statutory damages in the USA, though.

No, you do not. Any work you do is automatically under copyright as long as that is a reasonable expectation (given a site's TOU, etc.)

They're a significant indicator that you're reading a message from someone who doesn't mind inconveniencing an unknown number of people to gain a negligible benefit for themselves. :) Or, at least, this is what I remind myself when I catch myself using them. Typing is not a hardship. I spend time trying to come up with the absolute clearest way of writing what I'm trying to say, so why would I then take a step backwards (potentially) in clarity just to save myself three seconds of typing?

fgsfds!

> AIUI, the only people who could claim damages in a civil suit are ones that could demonstrate actual costs as a consequence for Lenovo's action.

So, basically what you're saying is that I can secretly take nude photos of you (when you're not in a public place), and "enjoy" them (in whichever manner) but not share them with the public, and you can't sue me unless you can demonstrate my actions actually costed you money?

In general, that's correct.

However, depending on your jurisdiction that may be a crime. In that case, I or the state might be able to prosecute you under criminal law. I don't generally understand that to be within the meaning of "sue" though. And, again in general, criminal conviction leads mainly to punishment rather than reparations to the victims.

Oh, and exceptionally, if I'm your "model" then without me signing an appropriate release I own copyright on your photos, so I may be able to sue you for losses (probably to the value of you buying an equivalent market-rate DVD or something).

> if I'm your "model" then without me signing an appropriate release I own copyright on your photos

You sure about that? AFAIK the copyright is with the creator, i.e. the photographer. Model release is required on for privacy purposes, not for copyright.

That is correct, at least in the USA. Photog owns the copyright upon creation. Model release is required for (certain) uses in publication, but not all - for example, newspapers do not have to get model release from people in photographs used for editorial purposes.

In the United States it's actually the photographer who owns the copyright not the subject. Not positive if this is the case everywhere but I believe it is.

You don't own the copyright without a model release, but, in many (but not all circumstances), you can sue for renumeration if your likeness is used without your permission. With the exception of some work-for-hire scenarios, copyright is always with the creator (but the creator must be human; monkeys don't count[1]).

1.http://www.theguardian.com/technology/2014/aug/22/monkey-bus...

There's a distinction between civil and criminal law, and the post you responded to was only talking about civil law.

I'm no lawyer, but as I understand it, you sue people under civil law for some kind of compensation - for financial loss, loss of reputation, psychological consequences, etc. Your voyeur example would hopefully fall under criminal law, which deals with the things society considers morally wrong. But a criminal trial would be prosecuted by the government, not by you suing.

What about knowingly putting consumers at risk? Suppose you buy a new car from GM and you later find out they've installed worn-out second hand brakes (on purpose, knowingly, and for profit motivation). But you're an old lady that only used the car to drive once a week, at 15mph to a church five blocks from home, so no damage happened. You're telling me that GM couldn't be punished for anything?

In the US, at least, you must have "standing" to sue someone. That means that you have to demonstrate damages.

Those damages may be minor -- you don't have to have killed anyone -- but they have to exist.

If, in your example, GM only installed the worn out brakes on that one car, and the worn-out brakes never caused any damages, then no, GM cannot be sued for it.

Note that "I had to pay a mechanic to replace the brakes" is damages.

I am not a lawyer, this is not legal advice, I may be wrong, etc.

Since you mention cars, there is a lot of regulations and laws regarding the production, selling and importing of cars. As such, producing unsafe car is likely a criminal offense, and it would likely be NHTSA who would go after GM.

But in this case, there is good precedence for claim of damages. People has used time it have taken a engineer to investigate, clean, and fix a computer system after a computer intrusion. Even a few hours work will result in several thousands, much more than the laptop itself is worth.

The demonstration of harm is what would be key in this case. Showing that things have the potential to cause harm often isn't enough.

In UK, as I understand it, unauthorised access to computers and networks/communications under the Computer Misuse Act is a strict liability situation: you only have to do it to break the law, no harm needs to be shown. MitM-ing my connection would be unauthorised access. It's a crime.

Should there be some form in intention, I wonder?

According to the CMA [0];

The offence of unauthorised access requires proof of two mens rea elements, (see section 4 CMA):

    (1) there must be knowledge that the intended access was unauthorised; and
    (2) there must have been an intention to obtain information about a program or data held in a computer - section 1(2) CMA.

[0] http://www.cps.gov.uk/legal/a_to_c/computer_misuse_act_1990/

See also http://www.legislation.gov.uk/ukpga/1990/18 - the current unauthorised intercept of data, installation of a MitM system appears to be an offence under inter alia Section 1, 2 and 3 separately.

There is also negligence. Like in the original case [1] where a woman got ill and suffered emotional distress after drinking bottled ginger beer with a decomposing snail in it. Even though the manufacturer had no intent to sell "snail beer" -- a consumer has a trust relationship with them: in exchange for money they can reasonably expect the manufacturer to take enough care not to bug them.

[1] http://en.wikipedia.org/wiki/Donoghue_v_Stevenson "it was reasonably foreseeable that failure to ensure the product's safety would lead to harm of consumers."

Well anybody can file a class action lawsuit.

Anybody that is in the class. Not all of us have Lenovo laptops.

Anybody can file any kind of lawsuit. If you can't demonstrate harm to the person filing (with a few exceptions) that lawsuit will be tossed right out, though.

Reply on news.ycombinator.com