A class action has been filed against Microsoft Corporation on behalf of all U.S. purchasers of Microsoft operating system software alleging the company does not properly protect operating system users from computer hacker attacks in violation of California consumer protection laws. The action seeks unspecified compensatory damages.
Emmy-winning film editor Marcy Levitas Hamilton is the CEO of TriCoast Studios in California, and the named plaintiff in this action. Earlier this year, hackers allegedly swiped her Social Security number and bank information. Her accounts were accessed and then frozen. During a business trip to Australia, she was forced to tally up a $1,700 phone bill trying to untangle the mess.
The action alleges that the majority of cyberattacks trace back to vulnerabilities in Microsoft software. Allegedly, it is Microsoft's dominance in desktop software that has created the global security risk. As a result of Microsoft's concerted effort to strengthen and expand its monopolies by tightly integrating applications with its operating system, the action alleges that the world's computer networks are now susceptible to massive, cascading failure.
The action echoes the arguments by seven prominent Internet technology security researchers in a report released in September 2003. That report argued that reliance by nearly everyone on Microsoft products has created monolithic Internet technology infrastructures that are less secure than relying on multiple operating systems. That report was distributed by the Computer and Communications Industry Association, a trade group representing Microsoft's rivals.
Because Microsoft's Windows operating system runs more than 90% of personal computers, it is a favored target for hackers seeking credit card numbers and other sensitive information. The action alleges that because Microsoft garners the profits of its virtual monopoly, it should be held responsible to aggressively warn users when new problems appear. Allegedly, Microsoft's security warnings are too complex to be understood by the general public and serve instead to tip off fast-moving hackers on how to exploit flaws in its operating system.
Microsoft is not selling a product in the typical sense. Instead, it maintains ownership and merely licenses the software for use by others. Licensing agreements provide far less recourse for unhappy customers, and they include language essentially freeing Microsoft from liability. The action alleges that Microsoft's "terms of use" constitute a fundamentally unfair condition barred by California law given the company's market dominance. The action also alleges that Microsoft has run afoul of a new California disclosure law, which requires businesses to warn customers when the firms believe personal information has been exposed to hackers or other unauthorized individuals. The disclosure law, which took effect July 1, 2003, was designed to force companies that own or license computerized data that includes personal information to let customers know when an intrusion occurred.
This action can be expected to reignite a simmering debate over whether the computer software industry should be held to the same standard of liability as other companies like automakers. The result could be to make computer software more secure, but at a greater cost.