united-kingdom hacking computer-misuse-act
Are we legally liable for negligence if a breach in a 3rd party happens due to us giving extra visibility to a vulnerable system?
<p><strong>TL;DR</strong> - Found a dangling DNS record that was pointing to an IP address we don't own, the server found on that IP address was running a vulnerable piece of software. Wondering if attackers found &amp; used the vulnerability whether we as a company are liable or not?</p>

<hr>

<p>Recently I discovered that we have an A record for one of our domains pointing to an IP address that we no longer own (this isn't uncommon especially when you have thousands of records &amp; DNS names). The company that now owns the IP address is hosting a web application on the server which is totally unauthenticated, you get logged straight in without interaction. I did some research on the web application that was running (I did not interact with their application merely just took the name &amp; version from the header) and I found out that there is a Remote Code Execution vulnerability in the software (essentially that means we can run arbitrary commands in the application which we could leverage to takeover the actual server). </p>

<p>Once I stumbled upon this I wondered the following; if we as a company have a DNS record we did not update and we're now pointing to an IP address we don't own, if an attacker used our DNS record to access the web application and then used the Remote Code Execution vulnerability are we in any way legally responsible for this? Bearing in mind that the server is regardless accessible to the world and does <strong>not</strong> require authentication to access it. However, by having a DNS record pointing to that IP - we are inherently giving it more visibility because anybody who previously visited our domains when we owned that address might now visit and be greeted with the new page.</p>

<blockquote>
  <p>if we as a company have a DNS record we did not update and we're now
  pointing to an IP address we don't own, if an attacker used our DNS
  record to access the web application and then used the Remote Code
  Execution vulnerability are we in any way legally responsible for
  this? Bearing in mind that the server is regardless accessible to the
  world and does not require authentication to access it. However, by
  having a DNS record pointing to that IP - we are inherently giving it
  more visibility because anybody who previously visited our domains
  when we owned that address might now visit and be greeted with the new
  page.</p>
</blockquote>

<p>I would be stunned if there was liability simply for pointing to a third-party IP address that used to be yours but is not longer yours, that happens to have a flaw in its security at it.</p>

<p>The act of setting up the software to point at the third-party IP address when it belonged to you was not itself negligent. </p>

<p>I also do not believe that there is a recognized legal duty to update bad links to web addresses, either in general, or as you become aware of them, which 99% of the time are merely harmless irritants that arise from the dynamic nature of the web. Indeed, there is a whole cottage industry that exists more or less entirely to exploit dead links for marketing purposes, so not updating IP addresses is not ordinarily see as a necessarily or foreseeably harmful thing to third-party successor owners of the address as a general rule. And, the new owner of the IP address is usually the "lowest cost risk avoider" and that is who the common law tends to impose responsibilities upon.</p>

<p>The harder questions are:</p>

<p><em>1. Is there a duty to warn a third-party system operator of a flaw that is discovered?</em></p>

<p>As a general rule, I don't think that this duty is legally recognized in the absence of a contractual relationship between you and their firm, in which case the duty of good faith and fair dealing between parties who have contractual relationships with each other may apply to create such a duty.</p>

<p><em>2. Is there a duty not to tell someone who you suspect will exploit the flaw?</em></p>

<p>If you were to post knowledge of the flaw on a known hacker's website used by people likely to exploit the flaw, this might be construed as a knowing and intentional attempt to conspire with another to hack the third-party's system and that might very well result in an imposition of liability upon you for the harm done. Communications that recklessly and intentionally are calculated to harm another are not necessarily protected by free speech considerations. </p>

<p><em>3. Is there a duty not to tell the public of the flaw?</em></p>

<p>On one hand, this information is still accessible to known hackers, but it also addresses a matter of public concern for which free speech considerations should receive more weight, and this might be particularly problematic if you hadn't warned the third-party a reasonable time in advance of the flaw and your intent to disclose it publicly.</p>

<p>I am not comfortable that I know how this fact pattern would come out.</p>

<p>But, merely driving an incidental amount of traffic to a website that a person knowledgable in IT security would be able to determine has a security flaw, alone, probably doesn't give rise to liability.</p>

<p>Admittedly, there isn't a huge amount of case law on this subject and the statutes aren't terribly clear in gray areas. So, I am basically doing a general tort and contract law principles analysis without reference to the specific cases or authorities that give rise to this liability. But, realistically, if someone did sue over something like this, they would probably be relying mostly on general statements in authoritative summaries of general modern contract and tort law principles, and very general statutory language, and trying to shoehorn those general principles into this fact pattern, rather than relying on well established case law (unless they got very lucky and came upon a favorable case on point that was controlling law).</p>
