Manufacturers vs. Operators

We never confuse an automaker with the driver. Drivers have real duties: maintenance, speed limits, seat belts. Designing out a defect is not one of them, and when a defect injures the driver, the automaker answers for it.

In software the words hide the parties. "Organizations" and "industry" can mean manufacturers, operators, or both. That ambiguity pulls attention toward what the operator should do about a defect, and away from what the manufacturer should do to eliminate it.

Operators have work to do. This is not it.

Discussion prompts

• Next time someone says "the industry needs to do better," what question reveals which party they actually mean?
• Pick a recent sentence you wrote or said about security responsibility. Did it name an actor, or did it let you avoid saying who?
• What would change if your policies always named "the manufacturer" or "the operator," never "the industry"?