Re: Recent Attacks

["Marcus J. Ranum" <mjr () nfr net>]

Ryan Russell writes:
> It's not (IMO) fair to try to charge for potential lost customers.
> There's no way to tell exactly how much business would have been done,
> whether the customers came back later to buy the same item, etc..


"Fair"??

Actually, it is entirely reasonable to sue for damages based
on lost business. Especially if you can demonstrate a track
record in a business area. Let's say I run a site that
consistently generates revenues of $1m/day, at the average.
On one day, because of something someone did, I only am able
to generate revenues of $100,000. The next day, after they
stop doing whatever it was they did, it's back up to $1m/day.
That's an open and shut case - it's not a matter of arguing
"potential" customers at all. I couldn't argue they were
responsible for the entire $900,000 loss but the jury would
give me more than that in punitive damages if there was
enough evidence to warrant a verdict of guilty.

These little hacker kiddies have no idea the kind of sleeping
dragons they are trying to wake up. Once they do, they will
be screaming "Unfair! Unfair!"  I'm sure they'll still have a
lot of sympathizers, but, as I originally proposed, they made
a big mistake going after the media. Look for a downturn of
sympathy for hacking in the next year. A hard rain's 'a gonna fall...

And, lastly, as my sister the lawyer told me once, "The law is
not about 'fair' it's about 'legal'"

mjr.