Intel is facing class-action lawsuits over Meltdown and Spectre bugs

Plaintiffs claim compensation for security flaws and alleged slowdown that fixing computers will cause, while corporations count cost of corrections

Intel has been hit with at least three class-action lawsuits over the major processor vulnerabilities revealed this week.

The flaws, called Meltdown and Spectre, exist within virtually all modern processors and could allow hackers to steal sensitive data although no data breaches have been reported yet. While Spectre affects processors made by a variety of firms, Meltdown appears to primarily affect Intel processors made since 1995.

Three separate class-action lawsuits have been filed by plaintiffs in California, Oregon and Indiana seeking compensation, with more expected. All three cite the security vulnerability and Intel’s delay in public disclosure from when it was first notified by researchers of the flaws in June. Intel said in a statement it “can confirm it is aware of the class actions but as these proceedings are ongoing, it would be inappropriate to comment”.

The plaintiffs also cite the alleged computer slowdown that will be caused by the fixes needed to address the security concerns, which Intel disputes is a major factor. “Contrary to some reports, any performance impacts are workload-dependent, and, for the average computer user, should not be significant and will be mitigated over time,” Intel said in an earlier statement.

“The security vulnerability revealed by these reports suggests that this may be one of the largest security flaws ever facing the American public,” said Bill Doyle of Doyle APC, one of the lawyers representing plaintiffs Steven Garcia and Anthony Stachowiak who filed suit in the northern district of California. “It is imperative that Intel act swiftly to fix the problem and ensure consumers are fully compensated for all losses suffered as a result of their actions.”

Chris Cantrell of Doyle APC, told Law.com: “I fully expect there to be additional filings [on behalf of consumers and businesses] and that this will go the usual route of multidistrict litigation. Just the sheer number of devices that we’re talking about … most of the desktop and laptop computers in use today.”

Legal experts said consumers would have to prove concrete damages and harm to proceed with claims. But experts also expect that consumer class-action lawsuits may be just one cost Intel will face in the wake of the Meltdown revelations.

Eric Johnson, dean of Vanderbilt University’s Owen Graduate School of Management, said: “The potential liability is big for Intel. Everybody will be scrambling over the next few days to figure out just how big it is.”

Big cloud service providers such as Amazon, Google and Microsoft will likely seek some form of compensation from Intel for any software or hardware fixes they are forced to make and that could potentially impact their overall computational capacity, security experts said.

Amazon, Microsoft and Google all said they do not expect significant performance problems for most of their cloud computing customers.

But the incident is likely to spur cloud companies to press Intel for lower prices on chips in future talks, said Kim Forrest, senior equity research analyst at Fort Pitt Capital Group in Pittsburgh, which owns shares in Intel.

“What [Intel’s cloud customers] are going to say is, ‘you wronged us, we hate you, but if we can get a discount, we’ll still buy from you’,” Forrest said.

Forrest also suggests Intel may have to increase its chip development spending to focus on security.

Banks and financial services firms are trying to understand what it will cost to respond to the security issues, the Financial Services Information Sharing and Analysis Center (FS-ISAC) said in a statement.

The global industry group added: “In addition to the security considerations raised by this design flaw, performance degradation is expected, which could require more processing power for affected systems to compensate and maintain current baseline performance.

“There will need to be consideration and balance between fixing the potential security threat v the performance and other possible impact to systems.”