3

If a company invents a padlock with some obscure weakness that most criminals would not guess, is there anything the company can do (before or after selling it to the public, or within some "user agreement" contract) to legally prevent people from publishing the details of that weakness?

For example, this video exposed a weakness, thereby hurting all owners of the padlock: https://www.youtube.com/watch?v=RxM55DNS9CE

In principle, the company could now sue the video's owner for negligence, but I doubt that the company would win, so I'm here asking if there is anything the company could have done beforehand to improve its chance of winning. Suppose the company and all customers are in Los Angeles, California.

  • Possibly related: RDBMS companies like Oracle and Microsoft ban publication of performance tests without approval in their license agreements. stackoverflow.com/questions/12115397/… – mkennedy Aug 9 at 19:09
  • "is anything the company could have done beforehand to improve its chance of winning." - Is don't do a bush-league job of the security for a device that is sold to provide security an answer to that? – whatsisname Aug 10 at 4:40
  • Regarding your statement "In principle, the company could now sue the video's owner for negligence" -- How, even theoretically, was the maker of the video negligent? – George White Aug 10 at 6:37
  • @GeorgeWhite Theoretically, he has helped criminals to defeat the lock and to steal any attached valuables. He could have exercised more caution by, for example, telling the company first and allowing one year for a product recall before posting the video. (Obviously, as you can tell from my question, I do not see this argument for negligence as strong enough, but you asked about theory.) – bobuhito Aug 10 at 14:54
  • Short definition of negligence - "In order to be sued for Negligence, the Defendant must have owed a duty to the Plaintiff. Breach: A breach is a violation of a law or duty. The Defendant must breach his duty in order to be liable for negligence." In the video scenario the random user of the lock who made the video has no conceivable duty to the lock maker. – George White Aug 10 at 18:42
4

On the one hand, there are statutes that prohibit the delivery of instructions which distort or circumvent the official/intended use or safety of a device. For a somewhat related example of this, see MCL 750.540c(1)(3).

On the other hand, the company/manufacturer is unlikely to prevail under contract law no matter how clearly and conspicuously its EULA prohibits the disclosure of discovered weaknesses. That is because the prohibition in the EULA is outweighed by the severe vulnerability to which all other unsuspecting customers are subjected.

From the standpoint of public policy, people's awareness of the discovered vulnerability is certainly in the public's best interest. The disclosure will warn both (1) potential customers not to purchase a product that fails or misses its primary purpose, and (2) current customers to adopt precautions now that the product's reliability has been disproved. Thus, the effectiveness of broadcasting the discovery of such weakness is in stark contrast with the technical deficits and managerial politics that typically hinder a company's ability (or its will) to respond to the issue.

If the weakness was known to the manufacturer prior to the disclosure, the release of that product would constitute fraudulent misrepresentation. The details of the demonstration in the video supports the argument that the manufacturer knew --or should have known-- about that weakness, since a padlock design is supposed to pass all kinds of tests of breakability and not be disabled by a screwdriver.

It is hard to deny that the notion that "the padlock is secure" induces customers to purchase the product. As such, the misrepresentation violates the contract law principle that a contract --such as a purchase-- be entered knowingly. See Restatement (Second) of Contracts at § 161-167. With respect to the publisher of the weakness, that misrepresentation renders the EULA-prohibition void. See Restatement at § 164(1).

Regardless of whether or not the manufacturer incurred misrepresentation, the manufacturer's decision to sue the publisher is only likely to backfire by bringing more attention to the poor design of the product.

In all, the manufacturer's best option is to do a product recall ASAP and enhance the design.

  • OK, all sounds reasonable for the Youtube example, thanks. But, I guess if I reworded "weakness" to "intentional backdoor in case of accidental user self-lock-out" (and it really could be justified by engineers as the best method given technical trade-offs like power consumption), your first paragraph would apply and the company might have a little hope in legally keeping the details secret - It would help me to try to find the boundary where a "weakness" becomes a "backdoor", but maybe there is no good backdoor precedent here since using a backdoor is an unlikely company strategy. – bobuhito Aug 10 at 3:39
  • @bobuhito That would be a futile game of words insofar as both backdoor and weakness lead to overcoming the advertised/official purpose of the product. More important, the company's argument of "intentional backdoor" will only reinforce the aforementioned notion of fraudulent misrepresentation, one that deprives customers of the opportunity to assess how reliable the product really is: Keep in mind that no reasonable person would buy a lock (except for things like making that video) knowing that it can be disabled by anyone using a screwdriver. – Iñaki Viggers Aug 10 at 11:32
  • Whoever downvoted this answer, it would be interesting if you came out of the shadows and explained what you "think" is wrong with it. Your fixation and/or personal animosity distorts the purpose and meaning of SE's voting model. – Iñaki Viggers Aug 10 at 11:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.