1. Damage Caused by Spreading a Computer Virus - Accountability on the Grounds of "Fire" a. Virus Spreading - Comparable to Damaging via Fire b. Responsibility for Indirect Damage c. "Hidden in Stacked Grain" 2. Accountability on the Grounds of "Pit" 3. Accountability on the Grounds of a "Person who Damages."
(What follows is a partial translation of a much longer article. The article in its complete Hebrew form goes on to examine other issues such as the Internet's implications concerning Sabbath and ownership rights.)1. Damage Caused by Spreading a Computer Virus - Accountability on the Grounds of "Fire" a. Virus Spreading - Comparable to Damaging via Fire
It is possible today, via Email or Internet, to transfer a "virus" from one's own computer to hundreds and even thousands of computers all over the world. Such a "virus" is capable of erasing files and programs, and even rendering a computer inoperable. There are also viruses that lay dormant for a period of time inside of the computer's system, causing damage at some later date. Virus damage is liable to spread inside the computer, going from one program to another. In addition, a virus is liable to be passed on to those computers with which the "infected" computer maintains correspondence. The damage caused by such viruses can be very costly, and because certain computer systems control the supply of vital resources (water, electricity, medical, military, and police services), it can also endanger life.
It is difficult to understand the motives of people who spread such viruses. It would appear that such doings contain both an element of "sport" and of willful destruction. From time to time these individuals are caught and put on trial in accordance with the laws of the country in which they reside. Many of them, though, manage to hide behind the computer screen and continue in their destructive ways.
Of Torah law's four principal categories of damage (ox, pit, fire, and a person who damages) from which all subordinate damages are deduced, this sort of damage most resembles "fire." Describing fire, the Torah states that it "goes out and spreads through weeds..." (Exodus 22:5). Similarly, in the case of a virus, one creates it in his own computer, and then sends it into the property of his fellow. It follows, then, that the ruling, "The one who started the fire must make restitution" (Ibid.), ought to apply in the case of one who spreads a computer virus as well. Just as fire causes damage via "another force mixed in with it" (Baba Kama 3b), so, too, a virus spreads by way of electricity, modems, and telephone.
In the tractate of Baba Kama (22a), we find a disagreement between two talmudic sages. Rabbi Yochanan says that one is held responsible for damage caused by his fire as if "his arrows" had caused the damage; Reish Lakish says that an individual is held responsible for damage caused by his fire as if "his property" had caused the damage. The discussion concludes with Rabbi Yochanan agreeing that, all the same, in a situation where "his arrows fall short" (Rashi: When he ignited the fire it was not capable of causing damage on another persons property) one is responsible for his fire as if "his property" had caused damage, and not "his arrows."
Rashi and Tosafot disagree regarding the question of whether or not one who ignites a fire with a burning coal that does not belong to him should be made liable on account of "his property?"
The law follows the opinion of Rabbi Yochanan (as spelled out in the Shulchan Arukh, Choshen Mishpat 418:17): "[In a case where] fire spread and caused injury to a person and wounded him, the igniter is obligated [to pay] for damage, unemployment, medical expenses, pain, and embarrassment as if he had injured him with his own hands. For, though the fire is [not his 'own hands' but merely] 'his property,' it is as if he damaged via 'his arrows.' All this holds true so long as the fire had the capacity to reach the location that it did at the time when it was ignited. If, though, it did not have the capacity to reach such a location - for example, where there was a wall separating them which happened to fall, unrelated to the fire... - [we view this as a situation in which] 'his arrows fall short' and [the fire thus] retains the status of 'his property' that caused injury to a person. In such a case one is held accountable for the damage alone, and exempted from the other four payments." Relevant here are the words of Rabbi Meir ben Yekutiel in his "Hagahot Maimoniot." He explains the position of Rabbi Yochanan as follows: "Not that he personally spread the fire; rather, any time a person is negligent and fails to guard his
burning coal, leaving it alone in an ordinary wind, it is [viewed as] 'his arrows.'"
A virus, then, is comparable to fire. Its creator is like one who ignites a fire. The one who sends it, even if he received it from somebody else, is comparable to one who fails to guard the burning coal that is in his possession
, allowing an "ordinary wind" to "spread it onward." In this manner, the plague continues to spread. The result is a destructive one: Computers are rendered inoperable, files are erased or changed, and all systems dependent upon the computer collapse.
It would appear that, according to Rabbi Yochanan, in the initial act - the sending of the virus to its first destination - the virus is considered like "his arrows," while in the chain of events that follow, the virus being passed on to additional computers, it is no longer viewed as "his arrows." This is due to the fact that, at the time of the initial act, these other computers were not in the virus's range. Only afterward, as a result of the additional acts performed by the first receiver and those who followed him, did the damage manage to spread. These acts, then, should be viewed not as damage caused by "his arrows," but damage caused by "his property." If this is indeed the case, then the law here is subject to the aforementioned disagreement between Rashi and Tosafot. According to Rashi, where the fire, or virus, is not his (i.e. it was formed by a second party) then he, the original owner, is no longer held accountable for damage as if it were caused by "his property."
It appears, though, that it is not accurate to classify a virus that was sent from the first receiver to additional computers as property that is no longer "his" (i.e. the original owner's) and to exempt him from liability in accordance with Rashi's opinion. This is because it is more accurate to view all of the viruses that were born in the computers of receivers, as "property born of property." All of them were created and formed by virtue of the impetus of the first virus, that which was created by the original damager. The fact that they were born in separate computers does not free the original creator of ownership, for the viruses were all born by virtue of his impetus. b. Responsibility for Indirect Damage
In light of the above, we find that neither the original creator
of a virus, nor those who received
and carelessly passed it on
, can be exempted from the obligation to pay for damage caused in the course of the virus's circulation. Theoretically, there is a difference if an individual is responsible on account of "fire" or a "person who damages." A "person who damages" is obligated to pay for five things: damage, unemployment, medical expenses, pain, and embarrassment. With the exception of "damage" itself, all of these are payments for indirect damages. These are things that the other three principal categories of damage are not obligated to pay for. For example, the owner of an ox (whether he injured a person or another ox) or a pit, are exempt from such compensation. If we were to claim that one who spreads a virus is responsible on account of "a person who damages" he would become liable for payment of indirect damages as well - for example, a computer's becoming inoperable. Yet, as we have said, one who spreads a received virus is guilty on account of "fire" as if "his property" had damaged. This being the case, the words of Rabbi Aryeh Leib HaCohen Haller in his "Ktzoth HaChoshen" apply: "[Only] regarding [damage caused by] a person to a person did the Torah imply responsibility for the payment of these four things...yet, concerning damage caused by an ox, the Torah obligated [a person to pay for] the damage alone... and there is no obligation to pay for unemployment in a case where a person injures an ox or any other property." Hence, the total amount of compensation which it is possible to demand from one who spreads a virus is the amount necessary to fix the computer's system - software and hardware alike; it is not possible, though, to hold a person accountable for the indirect damage caused, for example, eventually rendering a computer inoperable, or disabling those systems dependent upon the virus-struck computer. c. "Hidden in Stacked Grain"
Having reached the conclusion that one is held accountable for the continued circulation of a virus on grounds that it resembles a fire, it must be noted that one who damages via fire is exempt from damage caused to objects "hidden in stacked grain." Therefore, if one ignites a fire on his own property, and the fire spreads to the stacked grain of his neighbor, damaging some instruments that were hidden there, one only pays the price of the grain. This is the opinion of the Sages in the Mishna (Baba Kama 61b). Rabbi Yehudah disagrees with the Sages, but according to Ramban (Hilchot Nizkei Mamon 14:9) and the Shulchan Arukh (Choshen Mishpat 418:13) the law follows the opinion of the Sages. This exemption includes both those sorts of objects ordinarily hidden in stacked grain, for example, threshing equipment, and those not ordinarily hidden there, for example, a wallet. With regard to our subject, it is not uncommon for people to hide private documents inside computers. It stands to reason, then, that regarding such documents the one who damages should be exempt of payment.
This, though, as we have said, holds true only in a case where one ignites a fire on his own property and it spreads to the stacked grain of his neighbor. If, though, a person ignites a fire on his neighbor's property, the Sages agree that he is held liable even for those objects hidden in stacked grain (above Mishna; Shulchan Arukh, Choshen Mishpat, 418). In such a case, though, one is held liable only for objects ordinarily hidden there. Regarding objects not ordinarily hidden there one is exempt; one is not expected to take into consideration the owner's hiding these sorts of objects in such a place (above Talmud; Tosafot there beginning "Ella"). With regard to our subject, it is safe to say that even secret documents are "ordinarily hidden" in the computer. Therefore, if we view the one who spreads
a virus (i.e. one who receives a virus and passes it on to others) as one who ignites a fire on his neighbor's property, it becomes possible to hold him accountable even for damage caused to hidden and secret documents.
At any rate, the person who sends a virus to its first destination is unquestionably comparable to one who ignites fire on his neighbor's property. He is seen as having damaged with his own hands, and therefore becomes liable even for damage caused to objects not ordinarily hidden there (see Shach, 418:6 in the name of Maharshal; Chazon Ish 6, 8). Only regarding additional computers does the issue of "hidden in stacked grain" become a factor in obligating the original sender. In such a case, we need to differentiate between that which is ordinarily hidden in the computer and that which is not ordinarily hidden there.2. Accountability on the Grounds of "Pit"
It does not appear accurate to view a computer virus as a pit, likening it to a "pit that rolls at a persons feet" (Baba Kama 6a). To begin with, a pit is a passive damager, while a virus is clearly an active damager. A virus attacks its prey wherever he finds him. Another difference is that a virus causes damage via "another force mixed in with it" - via telephone and electricity; a pit lacks "another force mixed in with it."3. Accountability on the Grounds of a "Person who Damages."
It seems more reasonable to hold the initial sender of a virus accountable on the grounds of what the Sages refer to as a "person who damages." Creating a virus implies more than merely igniting fire on one's own property, and allowing a normal wind to kindle the flame and cause it to spread to the neighbor's field. The sending of a virus via Email into another's computer is like sending a long hand into the neighbor's field and igniting a fire there. It follows that there is room for holding one accountable for damage caused to documents hidden and concealed in every single computer that such a virus subsequently infects.
The virus should been viewed as "his arrows" for the entire resultant chain of damage. There is no such situation as "his arrows fall short," for there is no barrier whatsoever separating the computer in which the virus was originally created from other computers. What we are dealing with here is a chain reaction; every link in it is viewed as a direct act of the original virus sender, even if it continues for an extended period of time. We should view such a virus as we view a real virus in the medical world. If a one intentionally infects another person with his own sickness, and through him many others become infected, it is inconceivable to exempt the original virus carrier on the grounds that he only indirectly infected those individuals with whom he never had direct contact.
Furthermore, just as man, by his very nature, is a social being and given to interaction, so computers are designed for the purpose of communication and cooperative endeavor. Therefore, just as there is no room for the reasoning that claims "his arrows fall short" regarding the intentional spreading of diseases, there is no room for the reasoning that claims "his arrows fall short" regarding the "infection" of additional computers, for this is the very purpose of computers. If biblical Samson had sent the three hundred foxes with torches tied to their tails into Israelite fields, he would most certainly have been held accountable on the grounds of "his arrows." For, despite the fact that at the time when the fire was ignited, the fields were not in the range of fire, the very nature of the foxes in this sort of situation is to run in every direction. The same applies to computers, for computers are designed with the objective of interaction. The "infection" of one computer is like Samson's attaching torches to the tails of the foxes.
And if we accept that responsibility here is due to a "person who damages," it follows that there is no exemption from payment for damage caused to hidden objects. In the words of Rambam (Hilchot Chovel Umazik 7:17-18) and the Shulchan Arukh (Choshen Mishpat 388:1): "[In a case where] one damages the property of his fellow and does not know what it is that he damaged, the one who suffered damage takes an oath in accordance with the enactment of the Sages, and takes (what he claims to deserve)." The sole exemption would be in a case where it is assessed that the one damaged could not possibly have possessed that which he claims was damaged. Yet, when it comes to computers, certainly it can be assumed that every computer contains private files of great value.
Concerning compensation of the owner for the rendering of a computer inoperable, as we have said above (1/b) it is impossible to obligate a person who has damaged property to pay for unemployment. It follows that he is exempt from payment for such indirect damages.