[In January 1995, the US Bureau of Public Debt's Security Branch and
its legal department debated the issue of unintentional distribution
of computer viruses and the legal liability of institutions found to
have passed contaminated software or diskettes.  The discussions
were published in the US Bureau of Public Debt's Information Systems
Security Monitor newsletter and credited to Kim Clancy (Security
Branch), Jim Kramer-Wilt (Legal) and Lisa Martin (Legal). It is
reprinted here with permission.]

Security Branch:  "What, if any, boilerplate language exists that
we could put in contracts that would protect us if we received disks
that were infected with a virus?  What are [others] doing?

Legal:  "At present, Public Debt is not using any special language
in . . . contracts.  The present warranty clause does not protect
us from consequential damages.  Procurement uses a general clause
unless the Contracting Officer determines that a greater level of
protection is necessary.  We could insist that a clause be inserted
that the contractor has screened the software for any known viruses.
This, of course, would not protect us from unknown viruses.  It
appears that we should be making the screen ourselves, rather than
relying upon the contractor.  I would assume that such screens
are being made."

Security Branch:  "In the area of Interagency agreements - what is
our liability if, for example, we would send [someone] a diskette
with a virus?  Is exempting language available? Would it be
effective, such as in contracts with these [others]?"

Legal:  "Contracts between government agencies follow the general
outline of the first question above.  Government agencies are pretty
much self-insured for such damages.  Any diskettes sent to other
agencies should carry the following disclaimer:

WE HAVE SCANNED THIS DISKETTE FOR VIRUSES USING <SOFTWARE BRAND AND
VERSION INSERTED HERE>.  NONE OF THE DISKETTES HAVE ANY VIRUSES
ACCORDING TO OUR USE OF THESE PROGRAMS.  HOWEVER, BE AWARE THAT
THERE MAY BE VIRUSES OR OTHER DANGEROUS PROGRAMS THAT HAVE ESCAPED
DETECTION.  WE DO NOT WARRANT OR REPRESENT THAT ANY OF THE DISKETTES
ARE ABSOLUTELY FREE OF VIRUSES, TROJAN HORSES, WORMS, TIME BOMBS OR
ANY OTHER TYPE OF DANGEROUS COMPUTER PROGRAM.  YOU SHOULD PERFORM
YOUR OWN TESTING TO ASSURE THAT THE FILES YOU DOWNLOAD ARE TRULY
FREE OF VIRUSES OR OTHER DANGEROUS PROGRAMS.

This disclaimer could be in the form of a pre-printed sticker that
is affixed to the diskette package."

Security Branch:  "What should we do if we get a diskette with a
virus from another company?  Should we contact the vendor?  Are
there any repercussions if we do contact the vendor?"

Legal: "You should contact the vendor and inform them of your
finding.  Whatever action they choose to take is up to them.
I believe that there is a duty to contact the vendor and there
should be no legal repercussions.  We also feel that you should
pass along your findings to Main Treasury, e.g. 'I scanned the
diskette with a certain virus checker and found this virus,'
thereby making no statement as to how the virus got on the
diskette.  In other words, only reporting exactly what you
observed."

PART II: LIABILITY FOR VIRUSES, A NEGLIGENCE STANDARD

. . . Tort and civil liability is rarely discussed in the
context of [computer] viruses since there is a growing body of
criminal law regulating the introduction of them into a system.
The introduction of viruses _may_ allow an injured plaintiff relief
under the tort theories of conversion, trespass and tortious
interference with contractual relations. Tort liability has been
an issue of concern to the managers of computer systems and networks.
The failure of managers to safeguard their systems may lead to
recovery in tort by injured third parties.  One suggestion has
been to impose strict legal liability on the producers and vendors
of computer systems, services, networks and software, requiring
adequate safeguards and barriers to be placed to avoid unauthorized
invasions, and to carry adequate insurance should an invasion occur.
This standard may be too demanding since even the best boundaries
of technological protection have proved to be penetrable. A system's
need for the existence of trap doors for programming and debugging
will also be troublesome for managers should a strict liability
standard be implemented. Negligence may be a viable alternative
standard should strict liability be too harsh. A manager's duty to
the system would entail the reasonably prudent selection,
implementation and maintenance of the security provisions of the
system.

Application of negligence principles to the manager would require
her to use reasonable care to secure the system when it is
foreseeable that failure to secure it would result in injury to
foreseeable plaintiffs. A test similar to the one created by Judge
Learned Hand in United States v. Carroll Towing may be a viable
standard in this instance. Since there are times when every
computer system may be infected by a virus, the manager's
duty should be a function of three variables, paraphrased from
Judge Hand's decision in Carroll Towing:

     1) the probability of invasion by a virus;

     2) the gravity of the resulting injury; and

     3) the burden of adequate precautions.

The application of this test may provide a flexible and workable
alternative approach to manager's liability for the failure to
protect the computer system from viruses.

Suggestions for reasonable protection:

     1) Limiting computer access by terminated employees, particularly
     those who have been subjected to disciplinary action;

     2) Requiring a showing of need before allowing any employee to
     access system software on multiuser systems;

     3) Requiring staff to devote greater attention to monitoring the
     use of computer systems and to checking for evidence of unusual
     or suspicious activity.

Staff with responsibility for computer systems should be centrally
involved in analyzing these or other protective policies, and
should be given necessary resources to carry out these functions.


 _Establishment of Operational Safeguards_

In addition to establishing access restrictions, a number of steps
might be taken to reduce the risks of harm from a computer virus:

     1) Installing software programs that keep watch for computer
     viruses;

     2) Testing software [and storage media] for presence of computer
     viruses;

     3) Initially installing new software, particularly those of
     uncertain origin on an isolated computer system;

     4) Immediately investigating unexplained or suspicious activity,
     including unauthorized attempts to . . . alter files

     5) Immediately removing from computers any software that exhibits
     symptoms of possible virus infection;

     6) Establishing backup policies designed to assure that clean
     copies of uninfected application programs remain available for
     a reasonable time;

     7) Requiring the grandfathered rotation of backup copies, stored
     off-site;

     8) Conducting periodic security audits to determine whether
     reasonable steps have been taken to assess and counter any
     particular virus threat.