| ▲ | oceansky 3 hours ago |
| Also, why there's no accountability? Even if there's no intent, it's still a cyber attack. |
|
| ▲ | alexfortin 3 hours ago | parent | next [-] |
| Exactly. Think what would happen if it was a Chinese LLM company behind such an attack... |
|
| ▲ | root_axis 2 hours ago | parent | prev | next [-] |
| Who could possibly hold them accountable? |
| |
|
| ▲ | matthewdgreen 3 hours ago | parent | prev | next [-] |
| Because right now the Department of Justice is shut down for causes that the administration supports, which includes OpenAI, and none of the victims want to sue over it. |
| |
|
| ▲ | scotty79 3 hours ago | parent | prev | next [-] |
| We have a word for attack with no intent. It's accident. |
| |
| ▲ | DrewADesign 3 hours ago | parent | next [-] | | > We have a word for attack with no intent. It's accident. And we have a word for an accident caused by people that failed to implement proper risk mitigation, were not paying attention, and should have known better. It’s negligence. | |
| ▲ | 7 minutes ago | parent | prev | next [-] | | [deleted] | |
| ▲ | whateveracct 2 hours ago | parent | prev [-] | | i think (criminal) negligence is more like it |
|
|
| ▲ | cameldrv 3 hours ago | parent | prev | next [-] |
| It’s interesting that a lot of U.S. law requires intent. If you just give AI your objective without specifying the means, and the AI violates a bunch of laws requiring intent, but neither the AI nor the person can be prosecuted, this is very convenient. |
| |
| ▲ | elmer2 3 hours ago | parent | next [-] | | I don't think this true. If I throw a brick out my window and it hurts someone, I can still be held criminially liable, even if I didn't mean to do it. Do drunk drivers intionally kill people on the road? | | |
| ▲ | dghlsakjg 2 hours ago | parent | next [-] | | Not a lawyer, but the other responder definitely isn’t either. Whether intent is required is down to how the law is written. For many offenses “strict liability” applies, where intent is not required, they only have to prove you did it, not what your intent was. DUI is typically a strict liability crime. They don’t need to prove that you intended to drive drunk, only that you did drive drunk. | | |
| ▲ | wahern 2 hours ago | parent | next [-] | | A strict liability crime is something of an oxymoron. Crimes always require intent, the mens rea element. The question is intent for what. If somebody drugged you without your knowledge and you were charged with a DUI, you would have a defense--no intent to become intoxicated. The strict liability means once you choose to become intoxicated, you're liable for driving intoxicated, even if in some other context your intoxication would mean you couldn't form the requisite intent for something, e.g. have sex. If there's too much distance between the act you intend to do and the strict liability acts that complete the crime, then the crime would be considered unconstitutional. Criminal law in common law systems emerged from tort law, so there are many parallels, including the notion of strict liability. (Thus the old axiom about crimes being an offense to the king, specifically an injury to the peaceful society he's ostensibly trying to maintain.) But criminal law has a moral dimension that is absent or muted in other areas, so strict liability could never be as expansive as in tort law or regulatory law. | | |
| ▲ | nl 8 minutes ago | parent | next [-] | | > A strict liability crime is something of an oxymoron. Crimes always require intent, the mens rea element. This is wrong. In criminal and civil law, strict liability is a standard of liability under which a person is legally responsible for the consequences flowing from an activity even in the absence of fault or criminal intent on the part of the defendant. https://en.wikipedia.org/wiki/Strict_liability | |
| ▲ | deepwoods 2 hours ago | parent | prev | next [-] | | That is just not true. You can be held liable for DUI even if you did not intend to become intoxicated (though this may vary somewhat state-by-state). Speeding is another example - you do not need to intend to go over the speed limit, it just matters that you did it. The only possible exception would be duress or necessity, but those are affirmative defenses, which are separate from the elements of the offense. | |
| ▲ | dghlsakjg 2 hours ago | parent | prev | next [-] | | Are you a lawyer? Fairly certain that the entire point of strict liability is that mens rea is not required for certain crimes. As in, if I meant to travel at 70 and was instead doing 100 it doesn’t matter that I sincerely meant not to speed and did not know I was speeding, I can still be convicted even if the judge believes I had no intent. | | |
| ▲ | lanyard-textile an hour ago | parent | next [-] | | The way we use mens rea in our legal system is more like "mind of the criminal," not outright literal intent. Negligence can be "unintentional" but still land you in the realm of having a guilty criminal mind. I find it to be a reasonable take. If you're accidentally going 100 in a 70 (which is a misdemeanor in california), you're not being a careful enough driver, and we deem that lack of care criminal. | | |
| ▲ | jrflowers an hour ago | parent [-] | | > Negligence can be "unintentional" but still land you in the realm of having a guilty criminal mind. That’s just another way of saying “not all crimes require a guilty mind” with extra steps | | |
| ▲ | magicalist 33 minutes ago | parent [-] | | Strict liability literally is crimes that don't require a guilty mind. That's different (sometimes) when, for example, you're found guilty of criminal negligence leading to someone being injured. Prosecutors don't have to demonstrate that you intended for someone to get hurt for that, your mens rea is that you should have perceived the danger of what you were doing but didn't. edit: reading your other comments in this thread, maybe I missed your point, in which case, whoosh. |
|
| |
| ▲ | dataflow 2 hours ago | parent | prev [-] | | > As in, if I meant to travel at 70 and was instead doing 100 it doesn’t matter that I sincerely meant not to speed and did not know I was speeding, I can still be convicted even if the judge believes I had no intent. IANAL but from what I've looked up in the last there's at least willfulness that matters for these things. For example if you could prove that happened because your car accelerator pedal broke and you had no opportunity to react, I'm pretty sure you would not be guilty, strict liability or not. | | |
| ▲ | deepwoods an hour ago | parent | next [-] | | At that point you are not so much "driving" as you are sitting in the driver's seat of a renegade vehicle. | |
| ▲ | Spooky23 15 minutes ago | parent | prev [-] | | There are exceptions usually for extraordinary events. In New York there’s a concept of doing various things “in the furtherance of justice”. Judges have broad discretion to dismiss or reduce tickets. Often it so happens that those reductions increase the city/towns share of the revenue. In those cases, the judge may find that circumstances would make a traffic ticket unjust. But the standard of guilt is strict and clear cut. |
|
| |
| ▲ | jrflowers an hour ago | parent | prev [-] | | > Crimes always require intent, the mens rea element. LMAO “there’s no such thing as negligence” I type on my phone as my car plows through the doors of a Black Angus |
| |
| ▲ | LilBytes 2 hours ago | parent | prev [-] | | Negligence, criminal or otherwise is very well defined in most legal systems. |
| |
| ▲ | CGamesPlay 3 hours ago | parent | prev [-] | | Intent is the difference between murder and manslaughter, in that case. Drunk driving is common enough that prosecutors will argue that getting drunk in a situation where you have to drive is intent. Get OpenAI convicted of unintentional CFAA first, then say that the negligence qualifies as intent, I suppose. |
| |
| ▲ | Sanzig 3 hours ago | parent | prev | next [-] | | They can still be held civilly liable for negligence, though. | |
| ▲ | 3 hours ago | parent | prev | next [-] | | [deleted] | |
| ▲ | ambicapter 2 hours ago | parent | prev | next [-] | | CFAA says doesn't require intent, you use a computer system the way it "wasn't intended", you're liable. | |
| ▲ | deepwoods 2 hours ago | parent | prev | next [-] | | There are different levels of intent. Take murder, for example. A premeditated murder - you sat down, in a completely calm state, and made an affirmative decision to kill a specific person, and then you went out and did it - is the highest class of murder you can commit. If you go out generally looking to be violent in a way that kills people, and you kill someone, that's still murder, but it's a step down. But even if you didn't deliberately intend for something bad to happen, you may have been reckless. For example, you might decide to drive 90 miles per hour in a 25 mph zone. You could have a completely pure heart, but you are acting without regard for the safety of others, so you're reckless. That is enough for certain crimes and for civil liability in nearly all cases. Then there's negligence, where you're not taking reasonable care to avoid harm to others. Negligence usually isn't enough to support criminal liability - especially for felonies - but it is enough to win a civil lawsuit over most things. And then, as another commenter noted, there is strict liability, where there are certain things you are just not allowed to do no matter how careful you are about them or how pure your intentions are. For what it's worth, this is not totally uncharted territory for the law. AI agents are brand new, yes, but agency relationships have been recognized by the law for centuries. Generally speaking, if someone acts negligently while they are carrying out a task at your direction, you can be held responsible. Obviously this is fact-dependent, but I don't see any reason why it would be different if the agent is made of silicon rather than carbon. It holds true, with various nuances, even for less-than-human instrumentalities like a pet or an otherwise-lawful weapon. | |
| ▲ | lukewarm707 3 hours ago | parent | prev | next [-] | | the charges here would depend on negligence and acting recklessly. we might get something if they tried to cover it up. | |
| ▲ | oefrha 3 hours ago | parent | prev | next [-] | | Whether it’s intentional requires a legal investigation to establish. Since when is “hey we didn’t mean it!” in a corporate press release enough to establish lack of intent in a criminal matter? | |
| ▲ | croes 3 hours ago | parent | prev | next [-] | | At some point that recklessness looks like intent | |
| ▲ | Barrin92 3 hours ago | parent | prev [-] | | >It’s interesting that a lot of U.S. law requires intent. mens rea and the shift from responsibility to moral guilt is genuinely one of the stupidest legal innovations anyone has ever come up with, it's like affirmative action for imbeciles, in particular in a world of autonomous machines. "sorry my self driving car ran you over on the way home, didn't think it could happen, sorry it did though" I think this is a genuine reason to be bullish on the legal traditions like Nordic tort law or East Asian collective responsibility when it comes to adoption of these technologies. | | |
| ▲ | yeahforsureman 10 minutes ago | parent [-] | | Weren't we talking about criminal liability, though? And ‘tort’ — in addition to sounding like something you'd rather eat during a kaffepaus with those Nordic buddies of yours — is so common-law(ish) that if asking for trouble were a crime, using it in dialogue with those Nordic lawyers could well be deemed as intentional under most current local varities of criminal law theory up there, perhaps merely because you surely must've considered that consequence "quite probable", at minimum, or due to your indifference toward the same (or some combination of these) ;) |
|
|
|
| ▲ | gruez 3 hours ago | parent | prev [-] |
| No harm, no foul. Dog owners are on the hook for damages resulting from their dogs, but there must be some damage in the first place. If the dog gets loose and goes in your fenced backyard, disregarding your "no trespassing" sign, you can't punish the dog owner just because. Hacking into a server is closer to the latter. At best rubygems can claim some cleanup costs. |
| |
| ▲ | datsci_est_2015 3 hours ago | parent | next [-] | | Tell that to the script kiddies with a criminal record for "hacking" into their school's computer systems by entering "username: admin" and "password: password". | | |
| ▲ | gruez 3 hours ago | parent [-] | | Right, because in that case you'd have a hard time convincing the court that the access wasn't intentional. You might not know the law existed, but you intended to access the system. You'd have a pretty solid defense if you ran a crawler that was crawling every website ever, and stumbled upon some secure site. In fact there are companies which does this exact thing, eg. shodan. |
| |
| ▲ | wmf 3 hours ago | parent | prev | next [-] | | If any remediation was required, that's damage. This looks a lot smaller than the HuggingFace hack but it still required some cleanup. | | |
| ▲ | scotty79 3 hours ago | parent [-] | | Remediation mostly involved repairing pre-exising holes in the fences that the dog crawled through. | | |
| ▲ | sdf4j 3 hours ago | parent [-] | | Since when isn’t that a cyber attack? | | |
| ▲ | gruez 3 hours ago | parent [-] | | Because "attack" implies intent. Accidentally break a window? You might be on the hook to fix it, but you're not going to jail. Break the same window at 3am, while carrying a duffel bag and other burglary tools? Well that's (attempted) burglary, even if you chicken out and didn't steal anything. |
|
|
| |
| ▲ | none2585 3 hours ago | parent | prev | next [-] | | That's not really true. Unauthorized access to a system is a crime regardless if there was damage. https://www.law.cornell.edu/uscode/text/18/1030 | | |
| ▲ | gruez 3 hours ago | parent | next [-] | | You read your own source? >having knowingly accessed [...] >intentionally accesses a computer without authorization [...] | | |
| ▲ | magicalist 25 minutes ago | parent [-] | | intentionality was not what you were addressing, nor was it what the GP was clearly responding to. |
| |
| ▲ | none2585 2 hours ago | parent | prev [-] | | Ah I see you're releasing OpenAI from being the one controlling the tools and giving the agent agency. I'd argue they intentionally accessed systems they weren't meant to as they were the ones running the bots. I don't think you or I would get the same leniency if a bot on our network did the same. | | |
| ▲ | gruez 2 hours ago | parent [-] | | >I don't think you or I would get the same leniency if a bot on our network did the same. Well yeah, because if you coded a bot, realistically the two options are: 1) bot that crawls random sites/computers 2) bot that crawls random sites/computers, while trying a password list. The former is probably legal, there are whole companies dedicated to doing that, eg. shodan. With the latter, it's pretty obvious you're intending to break into computers, and hard to argue otherwise. Where openai lies on the spectrum between the first case and the second case is up for debate, but it's hard to argue it's anywhere close to the latter. Maybe you'd have a point if openai gave it a prompt like "you're a hacker for anonymous, just do whatever :)". | | |
| ▲ | Sharlin an hour ago | parent [-] | | > but it's hard to argue it's anywhere close to the latter. No it absolutely isn’t. These things did not learn hacking from thin air. |
|
|
| |
| ▲ | p-e-w 3 hours ago | parent | prev [-] | | > No harm, no foul. What? That’s not how criminal law works, at all. | | |
| ▲ | gruez 3 hours ago | parent [-] | | Yes, that's actually how it works: https://en.wikipedia.org/wiki/Mens_rea | | |
| ▲ | rpeden 2 hours ago | parent [-] | | Recklessness is a mens rea and given how often OpenAI and its spokespeople talk about safety and alignment, it's hard to argue they were unaware of the risk. https://lawprof.co/definition/recklessness/ | | |
| ▲ | gruez 2 hours ago | parent [-] | | >it's hard to argue they were unaware of the risk. So what does it mean for an owner of a german sheppard, who specifically got it because they want a ferocious dog that can bite intruders, then it turned out it bit the mailman? Should that be considered a crime (assault) in addition to paying the mailman's medical bills? That's not to say there's no circumstance where recklessness might be warranted, eg. if you let loose a bear in an elementary school, but you'd have to argue for more than "they hacked someone" and "they knew about the risks". | | |
| ▲ | Sharlin an hour ago | parent | next [-] | | > Should that be considered a crime Yes, of course! Negligent cause of injury or whatever it’s called in your particular jurisdiction. Wasn’t difficult to find examples of cases just like that. It would be astonishingly unjust if the postman had to personally sue for damages in civil court! Your stance in this debate is, honestly, flabbergasting. | |
| ▲ | shkkmo an hour ago | parent | prev [-] | | Depending on the facts of the case they could indeed be convicted of a crime. There was a infamous case recently where a woman was convicted of criminally negligent homicide due to owning a dangerous dog that killed a kid. https://www.mcda.us/index.php/news/portland-area-woman-convi... Owning a dog that has been trained to bite intrudes is a significant responsibility and owning such a dog without taking the correct precautions is criminal. |
|
|
|
|
|
