Free Radicals in Cyberspace: Complex Liability Issues in Information Warfare
Meiring De Villiers · Northwestern journal of technology and intellectual property · 2005
During the weeks leading up to September 11, 2001, successive versions of a particularly destructive and complex Internet worm, named W32/CodeRed, took information warfare to a new level of complexity and danger. W32/CodeRed was the forerunner of a new wave of malevolent software, known as a blended attack. A blended cyber attack exploits security vulnerabilities in a target computer system in combination with computer viruses carrying multiple destructive properties. The blended attack exploits synergies between the virus and the security vulnerability to enhance the effectiveness and destructiveness of the virus payload. Blended attacks present complex liability issues, including apportionment of liability among the original tortfeasor (the creator of the security vulnerability) and the second tortfeasor (the exploiter of the vulnerability.) The liability of an original tortfeasor is usually cut off by an intervening crime or intentional tort. The pattern of common law decisions suggests, however, that the liability of an original tortfeasor will be preserved if he or she created an opportunity for free radicals. Free radicals are individuals who are not deterred by the threat of liability. The analysis in the article suggests that virus authors and distributors have properties commonly associated with free radicals. The analysis informs, furthermore, that the factors that influence courts in holding a defendant liable for encouraging free radicals are present in a typical blended attack. We conclude that liability will be preserved against a primary tortfeasor whose negligence was responsible for a vulnerability intentionally exploited by a free radical cyber attacker. The primary tortfeasor is likely a solvent commercial entity, while the attacker is often judgment-proof, or otherwise shielded from liability. The result is therefore significant, especially for the victim of a blended attack seeking to recover damages related to the attack.