Chris Barton: Microsoft security flaws trampling on consumer rights

Is Microsoft a reckless company? I ask only because Section 251 of our computer crime laws states that anyone who "intentionally or recklessly and without authority" causes software or data on a computer "to be damaged, deleted, added to, modified, or otherwise interfered with or impaired" is liable to seven years imprisonment.

There's no doubt the maker(s) of this wretched Blaster worm which has wreaked havoc on Windows XP and 2000 PCs over the past week would be caught by this clause. So were they to be tracked down in New Zealand they would get their dues - although I think something involving grievous bodily harm would be more appropriate.

But the broad scope of Section 251 indicates Microsoft should be punished too. After all, it clearly intended the feature in Windows that allowed this to happen.

The "feature" that let the worm run riot goes back to Microsoft's 2000 version of Windows. A feature that's actually a gaping flaw left unfixed for all this time. I call that intentionally reckless - especially when security experts have been warning about the vulnerability for yonks.

Microsoft also admits it was at fault. But is it, or any other software company that releases poor code on the unsuspecting consumer, a criminal?

Judge David Harvey discusses this possibility in his book internet.law.nz. He says "the key words of 'intentionally' or 'recklessly' indicate a deliberate or unreasonable taking of a risk with a knowledge or understanding of possible outcome".

Just how hard would it be to show that some of Microsoft's army of code cutters - with their considerable programming expertise - knew Windows XP and 2000 had faults and security holes when it was released? And also knew those faults could have bad outcomes?

Microsoft might reason software is inherently never finished. And point out it does take reasonable steps to rid its software of bugs before release. Of course the idea is academic as no one would want to go against the mighty Microsoft on such an issue.

But would there be a case under our consumer protection law which now covers telecommunications services and computer software? The basic premise here is if you buy goods or services, then you can expect them to perform as they say they will for a reasonable length of time. If they don't then you can get redress - like money back or other remedies, and in some cases you can even claim consequential losses.

Judging by the number of calls to the Herald about the Blaster worm mayhem, I reckon there are thousands of Windows users who have paid to get their computers fixed. So would they have a Disputes Tribunal case against Microsoft to reclaim some of that money?

Microsoft would say it wasn't the primary cause of the damage - the worm was. True, but the worm got through because the software consumers bought in good faith had a serious flaw. It's like a car driving into the side of your house and the wall falling down - partly because of the crash, but also because the wall was badly built or of substandard materials.

Microsoft would argue it warned about its bad building last month and users should have downloaded the fix-it patch. True, it did warn on its website and in press releases. But where were the newspaper ads that you'd normally expect with a product recall?

Where, too, was the warning on the software? - "This product must be used with an automatic connection to the Microsoft update site. Failure to download critical updates may cause problems with your PC."

And where was the advisory? "If this product is connected to the internet, Microsoft recommends it should be used in conjunction with anti-virus software and a firewall."

For far too long users have accepted that software is different from other consumer products. And that the End User Licence Agreement you buy indemnifies the vendor against any claims, losses, or problems resulting from its use - even if the vendor knew about the problem before it sold the product. Our consumer protection law is supposed to stop that sort of cop-out.

* Email Chris Barton