Hacker News Reader

Comment by compbio | Hacker News Reader

Dutch IT lawyers [1] say that Lenovo could be breaching European and Dutch Law. More specifically the "cookie law" which says that explicit permission is needed to change and read data from a user's computer (Lenovo never asked explicit permission). I also hear mentions of breaching the "computer intrusion" law (classifying this as a hack) and even the "communications tapping" law (Lenovo is not licensed to MitM your connections). I do not think a EU class-action or private citizen lawsuit will follow, but perhaps the official institutions can hand out a big fine. However, if Lenovo MitM'ed your connections and you can prove that, that would in principle be enough to get this case in front of a tort judge.

[1] http://tweakers.net/nieuws/101472/lenovo-overtreedt-wet-met-... (lang:nl)

View on HN

I'm sure they might claim that the user agreed to it, but it's important to remember that EU Data Protection law places limits on what people can agree to. You can store person data if it's proportionate for a cause. MitMing all SSL connections? No way is that proportionate.

IANAL;

In the Lenovo case, probably not. But in the case of an employer-provided system and network intended for business purposes which performs SSL interception for security and data leak prevention? I think it can clearly be considered reasonable for the company to do that, and the user's expectation of privacy is significantly different. I do feel it's important that Acceptable Use Policies, Employee handbooks, etc. disclose the activity though.

Definitely, but no way Lenovo can even get close to the same sort of justification. It's reasonable that my workplace monitor and manage how their network bandwidth is being used. It's not reasonable that Lenovo gets to spy on my specifically encrypted traffic just because I bought a computer from them for personal use.

In this case, Lenovo hardly is spying or even interested. The bad thing is they are

a) selling capability to advertise to you, without your real consent, and

b) when the do it, the implementation is so horribly broken that it exposes end users to be exploited by just about anyone.

I see little malice, I see a lot of incompetence and outright, unforgivable stupidity. This opens door to the malice of others.

I don't know Dutch law but I'm interested you say "tort judge" - unauthorised access to computing systems is made a crime in EU. It should be a criminal prosecution.

Didn't they come that way? It's not like they secretly snuck into your house and changed your computer. They sold something broken. It's the difference between going to your house and breaking the latch on your window, vs selling you a window that won't latch.

If I sell you a window that only appears to latch, and then come by later and rob your house, I might face criminal charges.

Lenovo didn't just sell something with broken security. It purposely broke the security, and profited from it.

Adware is not a broken product, it is an illegal scheme to earn profit on other peoples hardware by deliberate deception.

Did they inform their customers in advertisements, in the stores, or in any way that sold devices was being used by Lenovo after sale? Were there a meeting of minds where customers agreed to have their traffic MiTM and have advertisement of Lenovo choice on their device in return for fair compensation? That could have made it legal, but as it stand, no aspects of consumer protection laws, advertisement laws, contract laws, computer crime laws, or data protection laws seemed to have be followed.

They secretly snuck into peoples private property, used a backdoor, and earned profits doing so. They didn't tell anyone for obvious reasons. Had it been a one-man company doing this, then that person would be facing jail time.

Lenovo actively circumvented your security and sold access to your computer to Superfish. If you want to compare it to windows, it's like a security door salesman who sells extra keys to organized crime on the side.

Reply on news.ycombinator.com