About a week ago, Legal Advocates for Safe Science and Technology (“LASST”) filed a suit against OpenAI over the Hugging Face hack. (Short version of the hack: OpenAI was testing an unreleased model. OpenAI asked the model to solve a cybersecurity problem, supposedly in a secure “sandbox” environment, and the model broke found a flaw in the software, managed to reach the open internet, and stole data from Hugging Face.)
As far as I can tell, other than being scary, this AI hack didn’t cause any substantive damage, and Hugging Face seems relatively copacetic about it.
But LASST is concerned. LASST, an organization exempt under section 501(c)(3), describes its mission as “[u]sing legal advocacy to make advances in science and technology safer for people and the planet.” And it is very visibly worried about what, in its complaint, it describes as the “risks of unsafe internal deployments.” To prevent these issues, LASST invokes a California law that ensures that the humans behind AI can be held liable for AI’s actions, even if AI takes actions in ways that the humans did not—and perhaps could not—anticipate.
Specifically, the law provides that “it shall not be a defense, and the defendant may not assert, that the artificial intelligence autonomously caused the harm to the plaintiff.”
Under this law, and to prevent unsafe internal deployments, LASST is asking for (a) an injunction forbidding OpenAI from accessing, themselves or through AI, any computer system without authorization, (b) an injunction forbidding OpenAI from unlawful and unfair business practices, (c) an injunction forbidding OpenAI from employing unfair business practices that threaten to harm the public, and (d) reasonable attorneys’ fees.
So far, so good. That all seems like reasonable relief—essentially, LASST seems to be asking the court to require OpenAI to enforce the law.
I see one significant issue with this suit, though: I’m not convinced that LASST has standing here. Now, LASST is clearly aware of this, and on page 30 of the complaint, they argue that, in fact, they faced cognizable harm from the hack. Specifically, they say, in light of the Hugging Face hack, LASST had to divert resources from its ordinary activities to “design, coordinate, and participate in a briefing regarding this incident for regulators.” Its staff has “diverted dozens of hours of work” from what they’d prefer to be doing to instead focus on this.
Now, I’m definitely not a procedure guy, and I’d love to hear what actual litigators think of this. But if I were in OpenAI’s shoes, I’d probably respond that nothing about the hack forced LASST to redeploy resources, that that was an internal decision, and that LASST lacks any personalized harm and, thus, lacks standing. Otherwise, any organization could get standing to sue over anything if it decided to redeploy resources.
I could be wrong, of course. But I suspect that the standing issue will prove insurmountable here.
Photo by Levart_Photographer on Unsplash
Recent Comments