Mi Yodeya is a question and answer site for those who base their lives on Jewish law and tradition and anyone interested in learning more. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My rav frequently discusses contemporary halachic questions. He quotes a general rule from the Gemarrah (I assume it's from Baba Kama or one of the "Baba's") that a person who causes damages is always responsible, even if accidental (Excuse me if I may not be paraphrasing this rule, correctly.)

With this context, the rav claims that if I email you a file that has a virus, you open it, and the file damages your computer, (e.g. - destroys the hard disk or O.S.), I am responsible. My argument is that the sender is probably NOT responsible because:

1 - All computers, these days, are expected to have virus and security protection, and it is the receivers responsibility to scan all potential email viruses.

2 - There is no way to verify that the sender DIDN'T scan the file before uploading it. If we assume that he did, and there was no virus, a virus could have still been picked up during web trasnfer. It's quite posible...

share|improve this question
    
You have the added component that this is arguably not considered damage at all, as there is no physical damage being done (similar to the discussion of intellectual property rights). – Y ez May 18 '14 at 19:43
    
How could a virus be "picked up during web transfer"? – Daniel May 22 '14 at 17:39
    
@Daniel, in theory. In practice (unless you are a government target - based on my professional experience) if you see hoof prints, think horses not zebras. – Yishai May 22 '14 at 19:07
    
"There is no way to verify that the sender DIDN'T scan the file before uploading it." Ask him. – msh210 Jul 9 '14 at 4:45
    
@msh210 - Even asking and getting an affirmative answer doesn't confirm that it really was scanned. I have Norton installed on my computer, and within the product it says that it automatically scans every attachment before sending email. I assume that it actually does. But when I restart my computer the following day, and Norton has a warning icon telling me that I have to "fix" something, I can wonder how long that icon was there before I noticed it. So, did Norton REALLY scan the attachment? – DanF Jul 9 '14 at 13:09

In terms of actual damages the general discussion of this concept is around Grama and Garmi. A person is always responsible for their direct actions (except in an Ones - when forced). However, if the damage is indirectly related, then they are not, as a matter of Beis Din (G-d still holds you responsible). This is a disagreement between Rabbi Meir and the Chachamim (Bava Kama 100a). The conclusion is that at least some form of indirect damages is liable in Beis Din.

How, exactly, you define indirect damages is a matter of lengthy discussion. If the action itself is damaging, just not directly, like burning someone's loan documents, the loss of the paper is not the damage, it is the inability to collect the loan. That is the classic example of Garmi and the Halach is that it is liable.

However, if the damage was contributory - say someone thew something down from a roof and the damager came and quickly removed the cushion - this is a large discussion in terms of if the person is liable or not (most likely not, it is a very minority opinion otherwise) and exactly how you distinguish this from Garmi. This is called Grama.

Exactly how you apply that to this case is a question for a Rav/Beis Din and will most certainly be decided on a case by case basis, based on the totality of the facts.

[It seems to me that the fact that the person had to actively open the attachment to be damaged is going to make it hard to make the case that this was Garmi, but nothing in this Sugia is open and shut.]

share|improve this answer
1  
Remember, Grama is still Chayav latzeit yedei shamayim. – Yehuda May 16 '14 at 21:46
    
I have a vague recollection from years ago that the difference between g'rama and garmi is that the latter is done miyad, done b'yad, and with bari hezeka. Is that itself a matter of dispute (or am I wrong altogether)? – msh210 May 18 '14 at 4:10
    
@msh210 that is right, but not the only potential distinction. – Yishai May 18 '14 at 13:55

Nailed it. This is the last question in Rabbi Dovid Lichtenstein's Headlines: Halachic Debates of Current Events. (This entire discussion is summarized from pages 449-462 from that book.)

The first angle he approaches the question from is the Mazik of Eish. As recorded in the first several blatt of Bava Kamma, each Av of Nezek has its own characteristic, from which we may derive Toldos, other types of damage. A practical difference between which type of damage a particular Toldah is considered is its halachos: the times for which one is obligated for when their fire damages is very different than when their pit damages. To my knowledge, the only reason for this distinction is a Gezeiras HaKasuv.

The characteristic of Eish is that another force - namely, the wind - is responsible for the damage spreading (BK 3b). Likewise, one might argue that a computer virus is sent using a second force known as the Internet. Thus, it should be liable to the rules of Eish.

At this point in his discussion, R' Lichtenstein brings an argument that a virus might be subject to the dispute between Rashi and Tosfos regarding Tzeroros that I don't fully understand, but ultimately he concludes that even Rashi would agree it should be considered Eish.


Now, there's a dispute between R' Yochanan and Reish Lakish (BK 22a) regarding why one is chayiv to pay for Eish: Mishum Chetzyo, that Eish is considered Adam HaMazik, and thus one is liable to pay Chamishah Devarim (R' Yochanan); and Mishum Mamono, that Eish is considered one's property damaging, and thus you're only chayiv Nezek (both views). Since we pasken like R' Yochanan, we'll need to figure out which category computer viruses fall under.

The Gemara (BK 23a) brings a case of a fireproof wall that stood between the two properties at the time the fire was lit that had fallen afterwards, allowing the fire to spread. One can't say that it's Adam HaMazik, since there's no way for the person to have damaged in such a scenario. Thus, one can only be liable because his property damaged.

Thus, one might distinguish between a virus that infects the computer upon arrival versus one that requires the user to open the email. If it just needs to be on the computer's hard drive, it could be considered Mishum Chetzyo. If the user needs to open the email and let the malware inside, it could be considered Mishum Mamono.

On the other hand, perhaps one can say that since it's to be expected that people regularly check their emails, the potential for damage occurred as soon as the email was sent, and thus, even if the email hadn't been opened yet, it's still called Mishum Chetzyo. This is comparable to a wall surrounding the fire that can topple in a normal wind; it's only to be expected that the fire will escape, and thus it's called Mishum Chetzyo (Chazon Ish, BK 2:2).

On the third hand, one could distinguish between the wall that will topple, a natural occurrence, versus checking your email, a human act. The possibility of damage can't be said to be in place at the time the virus was sent if human intervention is required. After all, if you throw a fragile object at a cushion, you're absolved of damages that occur if someone removes the cushion, since when you threw the object, no damage was going to occur (BK 26b).


R' Lichtenstein now focuses on practical differences between Mishum Chetzyo and Mishum Mamono in our case of a computer virus:

  1. Sheves: Say that the virus is of a type that the computer exploded as soon as he opened the email, or the virus otherwise prevented him from doing his job and he therefore lost his income for the time being. If you hold that a virus is considered Eish Mishum Chetzyo, you would be liable to reimburse him for that, whereas if the virus is considered Mishum Mamono, you would be patur.

  2. Tamun: Another little piece I don't quite understand. There's a heter by Eish that you're not liable for things that are hidden, but you're still liable if their location can easily be made known. Since either way we're dealing with Eish, I'm not sure what the Nafka Minah is here.

  3. Your point that it's quite possible that the sender didn't know that the virus existed: if it's considered Eish Mishum Chetzyo, we pasken Adam Muad L'Olam and he would be liable (see SA CM 421:2). If it's considered Eish Mishum Mamono, he would be patur.

  4. Is it his virus, or is it one that he picked up from somewhere else and passed along to your computer? If it's not his virus, then according to Rashi (BK 22a), if it's Mishum Mamono, you would only be liable if you own the virus; if it's Mishum Chetzyo, you would be liable either way, since, as we said before, Adam Muad L'Olam.


There's one other aspect we need to consider: the victim had to participate for the damage to occur. The Gemara (BK 47b) absolves one who put poison in front of an animal, and the animal then ate it. After all, the animal didn't have to eat it. Most Rishonim explain that the culprit is not liable if the animal brought it upon itself. The Rosh (BK 6:3) explains slightly differently, saying that the owner of the animal should have taken measures to ensure that the animal didn't harm itself. It's not because of the indirect nature of the damage, the Rosh argues; it's because the owner didn't live up to a very reasonable expectation that he should have protected his animal.

Thus, if you hold it's an issue of indirect "you did it to yourself" damage, the sender should be absolved, whereas since one should not be expected to not open any email they receive, the Rosh would obligate the sender to pay. However, perhaps the rest of the Rishonim would agree you should have to pay, since it's not just an issue of indirect damage, but one of Garmi, common cases of indirect damage. Since viruses are more common than poison, perhaps they should be held liable, even where poison isn't.


As a final note, R' Lichtenstein points out that certain viruses could be considered hezek she'eino nikar and thus, in cases of viruses sent unintentionally, there's a question of whether one has to pay or not. If you sent this kind of virus intentionally, you are liable to pay d'Rabbanan.


In summary:

  • If you sent a virus intentionally, then you are certainly liable to pay for Nezek, but there's a question if you have to pay for Sheves.
  • If you sent a virus unintentionally, then you are liable if the virus would have infected the computer as soon as it was sent, and perhaps you would be liable even if it needed the victim's participation to infect his computer. In the event that you are liable, you might also be liable for Sheves. Depending on the situation, it might be called Hezek She'eino Nikar and you may be exempt on those grounds.

My problem with this approach:

The Gemara at the beginning of BK (5b) discusses learning out Avos from a combination of multiple Avos. Why don't we learn out the Toldah of a computer virus from the combination of Eish, as explained above, and Bor, whose attribute is that its sole purpose of existence is to damage (BK 3a)? Since a computer virus has both of these attributes, it should have both of their halachos. This could mean that you're entirely patur on havoc wreaked by malware, just like you're patur when keilim are damaged by a Bor.

share|improve this answer

No, you're not responsible, just as you aren't responsible if you send your friend a bottle of wine that gets poisoned somewhere along the way. As long as you didn't knowingly infect his computer, you're OK.

share|improve this answer
3  
Is this your own idea or do you have a source for it? – msh210 Jul 9 '14 at 4:45
2  
What if you send your friend a bottle of poisoned wine? – Shmuel Brin Jul 9 '14 at 6:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.