alt Hacker NewsIsn't this a crime that someone is liable for? What happened is that someone hacked into a computer system without permission. Maybe it wasn't intentional -- sure -- and that would be a factor at sentencing. But it sounds like they've admitted to a crime, and obviously our legal system considers the humans involved to be the liable parties; otherwise everyone would just say "my computer did the hacking" and wouldn't get in any trouble.
I don't expect any prosecution here, but is the above legally accurate?
Replies
Laws don’t prosecute themselves, and they also don’t tend to remove themselves. Lots of laws, lots of selective enforcement. “Show me the man and I’ll show you the crime” and “The more corrupt the state, the more numerous the laws” are some ideas to ponder here.
My take is that there are at least four potential parties that can all be liable:
1. the creator for the LLM. In particular if neglicence or malice is involved. This can also be someone who did a finetune of an existing model.
2. the inference provider. Remember, a model can do harm just by creating tokens (for example cause someone to run amok or kill herself). Inference providers should do a minimal amount of due diligence when picking models.
3. the party that executes tool calls on behalf of the AI. They in particular need to have safeguards to prevent the model from attacking entities on the internet.
4. the user that does the prompting.
Maybe. Hugging face would probably need to request charges for any to be filed unless OpenAI was already on the current admins naughty list..
Presumably, without intent (based on sibling comments), the victims would need to sue for damages due to gross negligence.
Lifting mens rea on that is going to be... interesting.
Most crimes require intent, hacking is one of them. The relevant law in this situation is:
> (a) Whoever— (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— (C) information from any protected computer; shall be punished as provided in subsection (c) of this section.
https://www.law.cornell.edu/uscode/text/18/1030
So if it can't be proven that you intended to access a computer without authorization, or exceed your authorized access, then you can't be found guilty of the crime.
Consider the possible consequences of the law not requiring intent, if simply accidentally exceeding your authorized access could be a criminal act.