Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Class action lawsuit filed against Lenovo over Superfish

unitedstatescourts.org

Post reply on HN
Print view View original

161–170 of 239 posts

Re: Class action lawsuit filed against Lenovo over Superfish

#161

Post by guelo »

bradleyjg wrote: post #55

A year or eighteen months from now look for a settlement in the case. Each of the affected class members will be entitled to a $5 discount on an anti-virus product plus up to $25 if they can provide detailed documentation showing actual economic losses. Any money left over after the coupons and payments are made will be given to a charity hand picked by the plaintiff's attorney. There will also be injunctive relief i…

Yes the attorneys will get most of the money but it's still A Good Thing™ because Lenovo will pay millions in punitive fees that should serve as a deterrent to them and others.

Re: Class action lawsuit filed against Lenovo over Superfish

#162

Post by tedunangst »

pbhjpbhj wrote: post #158
rhino369 wrote: post #111

Earlier quoted context omitted.

Punitive damages would occur after any trial victory. This is just the very first step, essentially a legal accusation. As to why the government hasn't tried to indict for criminal charges, there could be many reasons. The case might not be good. They might be waiting. They may think it's small fry stuff. The doj doesn't go after everyone.

So who is responsible in the DoJ for deciding that it's OK to let company directors do arms length crimes and they're going to look the other way. Is there any question as to what Lenovo actually did, are they denying they exceeded their authorisation in accessing computers and MitM-ing things like bank transactions? If the facts aren't in dispute there then surely the only thing the court would need to do is work ou…

Well, the CFAA has a handy little "choose your own adventure" like section listing the various naughty activities, where you could be guilty of a.2.B or a.7.A, etc. Which combo do you think Lenovo is guilty of?

Re: Class action lawsuit filed against Lenovo over Superfish

#163

Post by mikeash »

tedunangst wrote: post #160
mikeash wrote: post #88

Earlier quoted context omitted.

Then I guess the followup questions are: why aren't criminal charges being brought, and (if they're actually not) why aren't punitive damages being awarded?

What would the criminal charges be? The best outline for a prosecution I've seen goes something like "CFAA, mumble mumble, spying is bad." What specific law was broken? Lay out the case. For bonus points, pretend you're the defense attorney, and then outline the defense's case.

I'm not really familiar enough with the law to say.

Let's say that some company builds a bridge that doesn't match the spec, to the point that it's dangerous. Maybe it falls down if any truck weighing more than 10 tons goes over it, when it was supposed to hold 40 tons. And let's further say that this weakness was the result of intentional cost-saving measures and a complete failure to investigate their consequences. But then let's say that the fault with the bridge was discovered after a few months before any 11-40 ton trucks had gone over it, so nobody actually died.

Would that be illegal under some sort of negligence or endangerment law? It certainly seems like it ought to be. Lenovo's actions are basically equivalent, except that it was (probably) just property at risk, not lives.

It looks like endangerment is indeed a criminal offense, and it doesn't require that the harm actually happens, just that the potential was there and that it was foreseeable. Would that actually apply here?

Re: Class action lawsuit filed against Lenovo over Superfish

#164

Post by bradleyjg »

rayiner wrote: post #107
bradleyjg wrote: post #76

Earlier quoted context omitted.

I know that outright cy pres settlements are on the outs, but are residual cy pres clauses also under the same scrutiny? If so, change that clause to the company keeps whatever is left in the compensation pool. As for unfairness, I think the entrepreneurial class action system to punish very diffuse harms amounts to an inefficient regulatory regime and that inefficiency results in higher prices for everyone as compar…

Is there a more efficient system? That's not a rhetorical question. Especially for cases like these where actual damages are either speculative or small enough that they wouldn't ring the bell of government prosecutors. I think a compelling answer is: do nothing, let the reputation economy handle the situation. But the reputation economy works on information, and litigation generates a lot of very good (vetted and au…

Thank you for the reply.

Without writing an entire law review article in the comments, I'd say if no government (state or federal) can be bothered, given that they could almost certainly get a fine for less than $4 million (that's a lot of GS-11 man-hours) then reliance on the reputation economy seems like a good alternative.

And while discovery can be useful for getting information, in this case the information was publicized based on the workings of a different reputation economy (the security research community).

There may be some case that slip through the cracks, but I am unconvinced that the sui generis (to the US) opt-out class action mass tort system does more good than harm.

Re: Class action lawsuit filed against Lenovo over Superfish

#165

Post by yesplorer »

rubbingalcohol wrote: post #46
lessthunk wrote: post #24

.. reinstall any computer you get from scratch; Firmware Bios spying is of course much harder to get rid from.

Many of these computers don't even come with OS reinstallation media. They tend to have recovery partitions on the hard drives which will only restore the computer to its initial spyware-ridden state. I downvoted your comment because of your implication that spyware wouldn't be a problem if only everyone were as sophisticated as you.

I was reading HN on mobile but decided to pull my laptop over and upvote you (then comment; can't comment on mobile app) not because I agree with you or agree/disagree with parent comment but because you were highly civilized with your comment and your downvote.

You made a counterpoint, you didn't insult (the use of the word 'nonsense' is really common on HN counterpoints), you downvoted, then you explained your reason for the downvote. In all this now flame-wars were set.

I hope a lot of us will follow your path and make HN pleasant for everyone.

Thank you.

Re: Class action lawsuit filed against Lenovo over Superfish

#167

Post by tedunangst »

mikeash wrote: post #163
tedunangst wrote: post #160

Earlier quoted context omitted.

What would the criminal charges be? The best outline for a prosecution I've seen goes something like "CFAA, mumble mumble, spying is bad." What specific law was broken? Lay out the case. For bonus points, pretend you're the defense attorney, and then outline the defense's case.

I'm not really familiar enough with the law to say. Let's say that some company builds a bridge that doesn't match the spec, to the point that it's dangerous. Maybe it falls down if any truck weighing more than 10 tons goes over it, when it was supposed to hold 40 tons. And let's further say that this weakness was the result of intentional cost-saving measures and a complete failure to investigate their consequences.…

Fair questions. Civil engineering projects may not be the best analogy, because there are some special laws in that space, but maybe consider automobile recalls. How many people went to prison because a car's brakes or ignition didn't work? Criminal product liability is pretty rare afaik.

Re: Class action lawsuit filed against Lenovo over Superfish

#168

Post by nekopa »

pekk wrote: post #140
e40 wrote: post #94

Earlier quoted context omitted.

Absolutely not true. I control purchasing for my company, and have caused to be purchased a bunch of Lenovo's. No more, though.

I will continue to order as many Lenovo machines as I need. It is more important to me that the vendor serves my needs than what HN thinks about them. I'm not buying something crappy for my purposes because HN is mad.

This is a strange comment. Most people I see on HN like Lenovo because of the quality of their machines. Where I can see a purchasing manager or head of IT against them at the moment is because they surreptitiously installed software which caused a security risk.

If you're fine with your company's data possibly being compromised in the future then continue your ordering from Lenovo.

I will still buy from them because I always make it a habit to do a clean install whenever I get a new computer just because of all the crap every vendor adds to consumer PCs.

Re: Class action lawsuit filed against Lenovo over Superfish

#169

Post by LordKano »

btilly wrote: post #83
bradleyjg wrote: post #55

A year or eighteen months from now look for a settlement in the case. Each of the affected class members will be entitled to a $5 discount on an anti-virus product plus up to $25 if they can provide detailed documentation showing actual economic losses. Any money left over after the coupons and payments are made will be given to a charity hand picked by the plaintiff's attorney. There will also be injunctive relief i…

This is true, but do you know why it happens? The US has a protection against double jeopardy. If you've been sued once for something, you cannot be sued again (and again, and again) for the same thing. In most cases this is a good thing. It means that once the case is done, it is really done. But companies have learned how to take advantage of it. If they think they are going to have to fight a class action lawsuit…

If you've been sued once for something, you cannot be sued again (and again, and again) for the same thing.

If you do the same thing multiple times, you can be sued for each instance.

If you run a scam that affects a million people, you can face a million separate lawsuits.

Re: Class action lawsuit filed against Lenovo over Superfish

#170

Post by mikeash »

tedunangst wrote: post #167
mikeash wrote: post #163

Earlier quoted context omitted.

I'm not really familiar enough with the law to say. Let's say that some company builds a bridge that doesn't match the spec, to the point that it's dangerous. Maybe it falls down if any truck weighing more than 10 tons goes over it, when it was supposed to hold 40 tons. And let's further say that this weakness was the result of intentional cost-saving measures and a complete failure to investigate their consequences.…

Fair questions. Civil engineering projects may not be the best analogy, because there are some special laws in that space, but maybe consider automobile recalls. How many people went to prison because a car's brakes or ignition didn't work? Criminal product liability is pretty rare afaik.

Criminal proceedings against an entire company don't result in people going to jail, right? Holding people personally responsible is probably not appropriate with this, but holding the entire company criminally responsible and levying fines well in excess of actual damages seems reasonable.

Regarding automobile recalls, it looks like GM got hit with some fines for their ignition switch shenanigans, beyond actual damages. But it looks like this is a regulatory thing rather than a criminal thing. Maybe this is another place where special laws get in the way of generalizing.

Post reply on HN