The only question I have is, are you offering a service by not expressly disabling it? Clearly the "service" can be run. I agree that all analogies ultimately fail, and that the law only deals by analogies, so it is very imperfect. However, the "if it CAN be run it MAY be run" argument then permits SQL injection attacks, viruses, worms, Trojans, key loggers, and almost all malware, because you "allowed" it to be run. Now the Ritz case is different because it was a common service running, and reasonable people can differ about whether the use of that service was "authorized" or whether Ritz could be said to have KNOWN it was unauthorized (the standard in ND law.) Under these circumstances, the court looked at motive and intent, not just authorization. Why he did it rather than what he did. Another user, doing exactly the same thing either "accidentally" or inadvertently might have escaped liability.

PS I dont care how freking runny it is...

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/463/34890#34890