Liability

Liability is who pays when a product causes harm. Physical goods have centuries of law behind that question. Software has very little.

Standard license terms disclaim it (see L-03), moving the cost of a defect onto customers and operators. The party who can prevent the defect is not the party who pays for it.

Whether a duty exists, what satisfies it, and whether software is even a product are all live questions (see L-01, L-02, L-05). The EU has answered several. The US has not.

Discussion prompts

• Who bears the cost when your product has a security defect? Who spends more, you or your customers?
• How would your security investment change if you were legally liable for harm caused by security defects?
• What does your EULA say about liability for security defects — and is that position defensible?