Abstract
A victim of computer virus infection may bring legal action under a negligence theory against entities such as web site operators and other providers and distributors of infected software. Proof of specific negligence is simple in cases involving a familiar virus strain that could have been prevented inexpensively. In cases involving complex and novel strains, and where lapses in compliance with the non-durable component of anti-viral precautions leave no evidentiary trace, such direct proof may be impossible. This article develops a theory of circumstantial evidence, based on the the doctrine \"res ipsa loquitur\", aimed at alleviating a virus victim\'s burden of proof. \"Res ipsa loquitur\" allows an inference of negligence based on the mere occurrence of an accident and the circumstances surrounding it, and does not require proof of specific negligence. The analytical core of the article consists of two components. (i) A probabilistic analysis derives a mathematical formulation of the \"res ipsa\" conditions, and identifies the factors that make a strong \"res ipsa\" case. (ii) An analysis based on on (a) the computer science of the structure, operation and detection of computer viruses, and (b) the law and economics of virus detection and elimination, establishes that a malfunction resulting from computer virus infection typically constitutes a strong \"res ipsa\" case. A general software malfunction, in contrast, presents a weak \"res ipsa\" case. The \"res ipsa\" inference of negligence is particularly strong in cases of infected mission-critical software, such as components of the national critical information infrastructure. A final section addresses aspects of damages, including a model of damages and analysis of the economic loss rule in a computer virus context.
Keywords
virus, negligence, legal, economic loss
