The argument laid out in this post very definitely is not how "intent" works in US criminal law. Under CFAA, they had to have wanted to break into the systems that were attacked; it is not enough to demonstrate that they built a system recklessly.

▲

dccoolgai an hour ago | parent | next [-]

Negligence is absolutely a part of US criminal law, though - the canonical example being "firing a shotgun into a tent even if you don't know someone is inside it". See "negligent homicide" etc.

▲

tptacek 18 minutes ago | parent | next [-]

It is. But different statutes set their own intent standards, and the intent standards for CFAA are high.

▲

kittomic an hour ago | parent | prev [-]

Negligence and “negligent homicide” are entirely different beasts.

Civil negligence would apply here but that would be limited to recovering damages.

The hacked website could sue to recover costs incurred, but what costs were incurred here? Maybe some wasted network bandwidth but that’s minimal.

You have to point to monetary losses caused by the hack. Only that would be covered.

Negligent homicide doesn’t apply because no one was killed.

▲

dccoolgai an hour ago | parent [-]

Yes, obviously (and thankfully) no one was injured. I'm just using that as an example to show that Negligence is definitely considered in US criminal law ( https://en.wikipedia.org/wiki/Criminal_negligence )

	▲	kittomic an hour ago \| parent [-]
		Ok but what aspect of the CFAA applies a negligence standard?

▲

tomrod an hour ago | parent | prev [-]

Eh. There is enough flexibility in the law for unintended damages to be prosecutable.

	▲	tptacek 18 minutes ago \| parent [-]
		Not under CFAA.