Virus Ex Machina: Res Ipsa Loquitur

A victim of computer virus infection may bring legal action under a negligence theory against entities such as web site operators and other providers and distributors of infected software. Proof of specific negligence is simple in cases involving a familiar virus strain that could have been prevented cost-effectively. However, in cases involving complex and novel strains, and where lapses in compliance with the non-durable component of anti-viral precautions leave no evidentiary trace, such direct proof may be impossible. This article develops a theory of circumstantial evidence, based on the doctrine res ipsa loquitur, aimed at alleviating a virus victim's burden of proof. Res ipsa loquitur allows an inference of negligence based on the mere occurrence of an accident and the circumstances surrounding it, and does not require proof of specific negligence.

The analytical core of the article consists of two components. First, a probabilistic analysis of the res ipsa doctrine identifies the factors that make a strong res ipsa case. Second, an analysis based on (a) the computer science of the structure, operation and detection of computer viruses, and (b) the economics and law surrounding virus detection and elimination, establishes that a malfunction resulting from computer virus infection typically constitutes a strong res ipsa case. Indeed, the res ipsa inference of negligence is particularly strong in cases of infected mission-critical software, such as components of the national critical information infrastructure. In contrast, under this analysis, a general computer malfunction would present a weak res ipsa case. A final section addresses aspects of damages, including a model of damages and analysis of the economic loss rule in the computer virus context.