How does or can a Service Level Agreement (SLA) protect the provider from any liability in case the client knowingly breaks a law.

Example: AWS is a web hosting provider that sells computing resources to clients. The Clients can use these resources to host websites for example. Let's assume a client uses such a resource to host an e-commerce site that sells illegal products (guns, drugs and such). Another example would be that the client uses this resource to commit DDOS attacks (Denial of Service).

In what way a company like AWS can protects itself from any liability. Again, in continuation to the above example here are the relevant agreements from the company:



  • What kind of liability are you talking about? The client suing Amazon because shutting down their (presumably illegal) website violated the SLAs? Commented Nov 15, 2017 at 13:42

1 Answer 1


Section 230 of the Communications Decency Act (47 U.S.C. § 230), insulates providers of Internet services from liability for the actions of their users if the arrangement is defined in a particular way (i.e. so that the user material is user generated content which the provider has no involvement in creating or deleting except as allowed by Section 230 in cases where the immunity from liability it establishes still exists) and if the provider puts in place certain policies for dealing with copyrighted material displayed by a user via the service (DACA takedown notices).

The remainder of the SLA operates as a contract between the user and the service provider governing liability of one to the other, in which the service provider generally disclaims liability to a great extent and requires the user to indemnify it for harms that are defined to be the responsibility of the user.

  • I can see how this Section protects the provider in case the provider supplies hardware, but what is the case of a software provider. Let's say the provider created and supplied a software that enables the customer to automatically ping a web-address (with a valid use to check for server availability), but the customer uses this software to attack a webserver by continuously pinging an address and bringing it down ?
    – sokim
    Commented Nov 15, 2017 at 15:44
  • @sokim Section 230 actually applies predominantly to online service platforms (e.g websites with interactive features), ad only rarely to hardware. For example, Section 230 was used to successfully defend the firm and principals of the firm operating the "Backpage.com" website upon which many prostitutes and human traffickers sell sex services from civil and criminal liability as pimps or for racketeering.
    – ohwilleke
    Commented Nov 16, 2017 at 0:28
  • This is an interesting provision. I wonder if it has been tested in the context of a DDoS attack? Most of the cases seem to deal with defamation, and it is not clear that the immunity extends to criminal charges or the provision of services which wouldn't naturally be described as 'publication.'
    – sjy
    Commented Nov 16, 2017 at 6:41
  • @sjy So far, responses to DDoS attacks have generally involved the termination of business relationships in boardrooms, rather than litigation in courtrooms. See, e.g., a discussion of responses to concerns about DDoS in relation to WIkileaks starting at page 54 of the following article: cyber.harvard.edu/is2015/sites/is2015/images/…
    – ohwilleke
    Commented Nov 16, 2017 at 13:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .