Re: Recent Attacks

[Ryan Russell <ryan () securityfocus com>]

> "Fair"??
>
> Actually, it is entirely reasonable to sue for damages based
> on lost business. Especially if you can demonstrate a track
> record in a business area. Let's say I run a site that
> consistently generates revenues of $1m/day, at the average.
> On one day, because of something someone did, I only am able
> to generate revenues of $100,000. The next day, after they
> stop doing whatever it was they did, it's back up to $1m/day.
> That's an open and shut case - it's not a matter of arguing
> "potential" customers at all. I couldn't argue they were
> responsible for the entire $900,000 loss but the jury would
> give me more than that in punitive damages if there was
> enough evidence to warrant a verdict of guilty.

Hang on now, that's too easy an example.  I'm not THAT
lenient.  What I'm saying is that if Amazon normally
does 1M$/day, and on the day od the DDoS attacks,
they only do 800K$... but then do 1.2M$ the next day..
were there damages beyond investigative costs?

More realistically, Amazon's daily numbers are probably all over the
place, and it will be really hard to pick out how many dollars they lost
in two hours.  Which may have come back later, which may not matter.

All I'm trying to imply is that their getting slapped with 1.2B in damages
is silly.  As usual, one group pulls a number from their ass, and the
press repeats it as fact.

Not fair.

> These little hacker kiddies have no idea the kind of sleeping
> dragons they are trying to wake up. Once they do, they will
> be screaming "Unfair! Unfair!"  I'm sure they'll still have a
> lot of sympathizers, but, as I originally proposed, they made
> a big mistake going after the media. Look for a downturn of
> sympathy for hacking in the next year. A hard rain's 'a gonna fall...

They poked at particular dragons.  I'm not saying it was smart at all, but
it was deliberate.

> And, lastly, as my sister the lawyer told me once, "The law is
> not about 'fair' it's about 'legal'"

That is it's own problem.  Laws should be fair, I know they're often not.
I'll settle for not adding some more de-facto law through bad precedent.  

                                        Ryan