CIO - It used to be that the rules of the game made suing a vendor for a security breach a losing proposition. It was easier to settle a dispute for less, or to take an insurance payout and move on.
No more. Because of changes in the insurance business and some recent court decisions, it looks like this is going to be the year to watch for computer security lawsuits.
The tipping point came in October 2001. That was when, looking at huge payouts post-9/11 and no end to the super-viruses (such as I Love You and Nimda), the Hartford Insurance Co. removed computer damages from its commercial general liability plans. Other insurers followed suit. In 2002, as computer damages from major viruses intensified, agencies such as the National Institute of Standards and Technology were establishing rules and standards for software security -- and security breach victims started to view the problem as one of negligence instead of liability.
"This is really a wave-of-the-future-type trend," notes Bill Cook, a partner at law firm Wildman, Harrold, Allen & Dixon in Chicago.
The decisions in this new wave of cases are sure to create new legal precedents that will go a long way to directing the security and quality of software for the future. In an essay on the topic, Cook highlights several recent cases he expects to shape future software security rulings. Here are three big ones:
No. 1: Worm attacks and similar misdeeds are predictable when it comes to computer systems attacks. That's the reading from the Maine Public Utilities Commission v. Verizon case.
After the Slammer virus a year ago, Verizon Communications Inc. asked for a refund from the money it pays Maine's utility commission for using its infrastructure. The refund would cover the time Verizon was unexpectedly down due to Slammer, and hence not using the network. Maine pushed back, saying that since Verizon hadn't implemented the Slammer patch, the company didn't deserve a waiver. (Maine also noted AT&T Corp. and WorldCom Inc. had no problems with Slammer.)
In April 2003, the judge sided with Maine, saying that sophisticated worm attacks are foreseeable even if you can't control them. Verizon didn't get its refund.
No. 2: The courts can step in to determine security procedures. That's what a government agency learned in Cobell v. Norton. In this case against the U.S. Department of the Interior over unpaid benefits to American Indians, the department's computer security (and resulting Web site outage) became a major issue (see story).
The judge in the case was so miffed at the Interior Department's
- Single-Vendor Security Ecosystems Offer Concrete Benefits Over Point Solutions IT security decision-makers from companies with 100 to 5,000 employees evaluates the current endpoint security solution market based on Forrester's own market data,...
- Case Study: Intuit Turns to Self-Service IT Intuit empowered its users to resolve their own IT issues with a consumer-like experience to free IT to focus on more strategic initiatives....
- Automation for a Better Tomorrow Check out the five most common annoyances facing enterprise IT service desks today, and how automation can resolve all of them. Download the...
- Beyond the Enterprise App Store Leverage proactive, secure and automated IT Service delivery to move beyond the traditional App Store and empower your users. Read the white paper...
- Business-driven data protection Setting up data protection infrastructures with your organizations' core mission or business in mind is key. In this webinar, the ARCserve team will...
- On-Demand Webinar: Mind the Gap! Watch the webinar featuring Bob Janssen, CTO and Co-Founder of RES Software, to start building a solid foundation for business and IT to... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!