Meiring de Villiers, Assistant Professor, Management Science & Engineering, Stanford UniversityMonday, April 29, 2002
12:30-1:30 p.m.
Room 80 (Moot Courtroom)
Stanford Law School
All are welcome. Lunch will be served.
A victim of computer virus infection may bring legal action under a negligence theory against entities such as web site operators and other providers and distributors of infected software. Proof of specific negligence is simple in cases involving a familiar virus strain that could have been prevented cost-effectively. In cases involving complex and novel strains, and where lapses in compliance with the non-durable component of anti-viral precautions leave no evidentiary trace, such direct proof may be impossible. This article develops a theory of circumstantial evidence, based on the doctrine res ipsa loquitur, aimed at alleviating a virus victim's burden of proof. Res ipsa oquitur allows an inference of negligence based on the mere occurrence of an accident and the circumstances surrounding it, and does not require proof of
specific negligence.
The analytical core of the article consists of two components. (i) A probabilistic analysis of the res ipsa doctrine identifies the factors that make a strong res ipsa case. (ii) An analysis based on (a) the computer science of the structure, operation and detection of computer viruses, and (b) the law and economics of virus detection and elimination, establishes that a malfunction resulting from computer virus infection typically constitutes a strong res ipsa case. A general computer malfunction, in contrast, presents a weak res ipsa case. The res ipsa inference of negligence is particularly strong in cases of infected mission-critical software, such as components of the national critical information infrastructure. A final section addresses aspects of damages, including a model of damages and analysis of the economic loss rule in a computer virus context.