Referring to no one and no incident in particular, imagine that some individuals, interested in performing a social/technical experiment, designed some changes to an open source project, knowing that their changes would cause security vulnerabilities in the product. They then requested the maintainers of the project incorporate these changes into the product (using the standard mechanism by which dozens of such requests are made daily), giving no indication of the security problems. The perpetrators main intent was not to introduce bugs into the final product and there is no indication that they had intent to exploit these bugs; rather, they intended to experiment with the change submission system and procedures. However, the bugs' introduction was a deliberate and predictable side-effect of their actions that they took no measure to prevent.

Did these individuals commit a crime? Are they civilly liable for the damages caused by the resulting security vulnerabilities?

In this theoretical question, the perpetrators are located in MN, US, and the open source project is based in CA, US.

  • Your question is muddy: Did the open source project already contain contain the security sensitive bugs, or did the patch introduce the bugs? And if the "bugs' introduction was a deliberate and predictable side-effect of their actions", how could that possibly not be "main intent" of the perpetrators? – BlueDogRanch Apr 21 at 16:02
  • @BlueDogRanch apologies, my language was somewhat domain specific and I've edited to clarify. No, the project did not already contain the security bugs, but they were introduced as a part of the changes. Also, whether this counts as the "main intent" of the perpetrator is a part of the question that I am asking here (as I assume it will be legally relevant); an alternative interpretation is that the perpetrators viewed these as "side-effects" which they were not for or against. – DreamConspiracy Apr 21 at 16:10
  • 1
    The "alternative interpretation" of "side effect" that they didn't know of is simply the perps playing with words. If the "bugs' introduction was a deliberate and predictable side-effect of their actions" and "knowing that their changes would cause security vulnerabilities", how could the perpetrators possibly not have intent to do damage? Why not introduce a few harmless typographical errors that achieved the same result of testing the incorporation of changes into the project? – BlueDogRanch Apr 21 at 16:18
  • @BlueDogRanch who knows. In any case, if this is the legal sticking point, then an answer of the form "this is criminal unless the perps can prove that this was really not their intent" (and what exactly such proof could look like) seems like a possibility. – DreamConspiracy Apr 21 at 16:24
  • That "experiment" with the change submission system sounds like an "experiment" on unsuspecting human subjects, which opens a whole new sort of trouble. Or it isn't an "experiment" at all, but rather a demonstation of the well-known vulnerability of open source communities to this kind of attack. – o.m. Apr 21 at 18:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.