IF this is on purpose and can be proven so, it is most definitely illegal!
back
3 comments
From their website:
>The licence only allows use of the Software with, and the Software will only work with Genuine FTDI Components (as defined in the Licence Terms). Use of the Software as a driver for a component that is not a Genuine FTDI Component MAY IRRETRIEVABLY DAMAGE THAT COMPONENT.
IANAL but I don't believe this disclaimer can possibly be valid. Personal property rights cannot be waived away with a disclaimer.
It amounts to an admission they are bricking clones on purpose.
How are your personal property rights being violated? If an ATI graphics card lied and claimed to be an nVidia card and the drivers cause it to overheat and catch fire, who is at fault? Should you be required to QA your drivers against counterfeit products?
Edit: nobody has shown that the driver is intentionally writing the ID to 0, the counterfeit chip isn't even close to the same circuitry and could be screwing up a legitimate instruction.
This isn't a misconfiguration issue, or that Linux bug that bricked certain SCSI devices. No, they are explicitly asking the counterfeit chip to rewrite its USB PID to 0, which renders it unusable.
That's intentional and clearly malicious.
Has this been proven by a corresponding packet dump listing "Write EEPROM, offset 0, 4 bytes: [0,0,0,0]?
Or are they -sneakily- bricking the device by evoking an unintended reaction to a seemingly innocuous command?
The former will be easy to prove, the latter.. probably not so much.
It's been proved by reverse engineering the FTDI drivers and annotating the code. It exploits some edge case in which the counterfeit device does not behave exactly like the original. https://marcan.st/transf/ftdi_evil.png
Check out FTDI's Twitter feed: https://twitter.com/FTDIChip/status/524928658180304896
They're being somewhat evasive, but it's clear that this is intended as a deliberate anti-counterfeiting strategy.
Wow they could have planned this misadventure a bit more carefully. Having decided to do this stupid destructive thing, they should at least have resolved not to admit they did it on purpose. The general public would have much more sympathy if the story was "after lengthy investigation, we've determined that the bug only affects counterfeit products... we have sympathy for all victims of counterfeiting." Instead, they've gone for "in your face, you cheap bastards!" Honesty is not always the best policy, especially when you're evil.
This isn't about damage from a lack of precautionary measures. It's about damage due to the drivers doing something completely irrelevant to ordinary use- code that has no reason to be in the driver in the first place.
If the drivers caused it to overheat because of an oversight, then that's just sad. If the drivers caused it to overheat because the company went in and wrote, if(counterfeit) overheat(); then they're liable. Surely this should be obvious.
You should look up the word 'intent' in law.
I wonder why this is voted down. The US has some severe laws against vandalizing computing devices and against unauthorized access. Why wouldn't these laws apply here?
There are a variety of laws that would apply here, and doing what they did, if done intentionally, is almost certainly cause for civil liability.
They are not allowed self-help in the form of destroying other pieces of hardware. If they have a problem with counterfeit chips, the solution is customs/legal process/etc
If they aren't happy with what that buys them, they should be pushing for legal change.
It's quite possibly a violation of U.S. Code 1030(a)(5)(A), a federal felony:
(5) (A) [Whoever] knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;
Now "protected computer" and the [ab]use of the Interstate Commerce Clause mean that the device with the FTDI would likely need to be connected to a network for this to apply. Plus I think they still need to show $5,000+ in damage, but it wouldn't be hard to reach that if the driver wrecked a prototype and delayed a product.
Was the driver pushed out by Windows Update from WHQL? That's via a network.
FTDI is not a US company.
But Future Technology Devices International Limited (USA) is.
http://www.ftdichip.com/FTContact.htm
Neither was Megaupload.
All they have to say is "We write our drivers to support our chips, if it messes with other chips that incorrectly identify as ours, that's just the way it went, it'd cost us extra to support them and why should we help our competitors". Practically impossible to prove otherwise.
"All they have to say is "We write our drivers to support our chips, if it messes with other chips that incorrectly identify as ours, that's just the way it went, it'd cost us extra to support them and why should we help our competitors"."
Buzz, thanks for playing. :)
That won't get them out of discovery for various torts, and the discovery (emails, code, etc) is likely to show they did this on purpose.
It's not practically impossible, it's trivially easy to disassemble and see if it does this on purpose. Then you argue it to a jury, and it's going to look really really bad for FTDI.
I wish German civil law had something like your discovery process.
Over here the claimant probably would not be able to peek into the defendant's stuff.
Especially if he can't specifically claim "on march 10th, Mr. Meier sent an email to Mr. Schmidt discussing topic X".
A simple "hand over your mails about the matter at hand" would be ruled a "fishing expedition", not admissible as a motion to discover.
They have a track record of trying to fingerprint and screwing with counterfeits, so it would appear there's evidence the driver doesn't happen to disable counterfeits, but actively disables them. To me there's a fuzzy distinction (possibly not reflected in law) between software that breaks when you make it do stuff you didn't design, versus having it attack things you don't want it to work with.
To quote CTZ: "You should look up the word 'intent' in law."