CIO - It used to be that the rules of the game made suing a vendor for a security breach a losing proposition. It was easier to settle a dispute for less, or to take an insurance payout and move on.
No more. Because of changes in the insurance business and some recent court decisions, it looks like this is going to be the year to watch for computer security lawsuits.
The tipping point came in October 2001. That was when, looking at huge payouts post-9/11 and no end to the super-viruses (such as I Love You and Nimda), the Hartford Insurance Co. removed computer damages from its commercial general liability plans. Other insurers followed suit. In 2002, as computer damages from major viruses intensified, agencies such as the National Institute of Standards and Technology were establishing rules and standards for software security -- and security breach victims started to view the problem as one of negligence instead of liability.
"This is really a wave-of-the-future-type trend," notes Bill Cook, a partner at law firm Wildman, Harrold, Allen & Dixon in Chicago.
The decisions in this new wave of cases are sure to create new legal precedents that will go a long way to directing the security and quality of software for the future. In an essay on the topic, Cook highlights several recent cases he expects to shape future software security rulings. Here are three big ones:
No. 1: Worm attacks and similar misdeeds are predictable when it comes to computer systems attacks. That's the reading from the Maine Public Utilities Commission v. Verizon case.
After the Slammer virus a year ago, Verizon Communications Inc. asked for a refund from the money it pays Maine's utility commission for using its infrastructure. The refund would cover the time Verizon was unexpectedly down due to Slammer, and hence not using the network. Maine pushed back, saying that since Verizon hadn't implemented the Slammer patch, the company didn't deserve a waiver. (Maine also noted AT&T Corp. and WorldCom Inc. had no problems with Slammer.)
In April 2003, the judge sided with Maine, saying that sophisticated worm attacks are foreseeable even if you can't control them. Verizon didn't get its refund.
No. 2: The courts can step in to determine security procedures. That's what a government agency learned in Cobell v. Norton. In this case against the U.S. Department of the Interior over unpaid benefits to American Indians, the department's computer security (and resulting Web site outage) became a major issue (see story).
The judge in the case was so miffed at the Interior Department's
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts