Tort Liability for Buggy Software

Effectively there is no liability for manufacturers of buggy software.  This is not, however, due to a special exemption in the law enacted to ban software liability.  There is a special exemption to liability enacted by Congress for interactive computer services, and sometimes that overlaps with software.  Generally, however, the reason you can’t sue software creators for bugs is because Congress has not enacted or created such liability, not because they have banned such liability.  In the routine case, the software creator makes the end user agree through a licensing agreement to not hold the creator liable.  The end user must go along with that agreement, or else they can’t use the software (such as the Windows or Apple operating systems).  Congress have never limited such licensing agreements for software like they (or some state legislatures) have for regular products liability.

The exemption that does exist is called “Section 230 Immunity.”  Basically, it is immunity for Internet service providers (ISP’s), website hosting services, and websites.  Section 230 of the Communications Decency Act of 1996 states:

(c) Protection for “Good Samaritan” blocking and screening of offensive material

(1) Treatment of publisher or speaker

No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.

(2) Civil liability No provider or user of an interactive computer service shall be held liable on account of—

(A)

any action voluntarily taken in good faith to restrict access to or availability of material that the provider or user considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable, whether or not such material is constitutionally protected; or

(B)

any action taken to enable or make available to information content providers or others the technical means to restrict access to material described in paragraph (1).[1]

* * *

(f) Definitions As used in this section:

(1) Internet

The term “Internet” means the international computer network of both Federal and non-Federal interoperable packet switched data networks.

(2) Interactive computer service

The term “interactive computer service” means any information service, system, or access software provider that provides or enables computer access by multiple users to a computer server, including specifically a service or system that provides access to the Internet and such systems operated or services offered by libraries or educational institutions.

(3) Information content provider

The term “information content provider” means any person or entity that is responsible, in whole or in part, for the creation or development of information provided through the Internet or any other interactive computer service.

(4) Access software provider The term “access software provider” means a provider of software (including client or server software), or enabling tools that do any one or more of the following:

(A)

filter, screen, allow, or disallow content;

(B)

pick, choose, analyze, or digest content; or

(C)

transmit, receive, display, forward, cache, search, subset, organize, reorganize, or translate content.

In short, “Section 230 of the Communications Decency Act grants interactive online services of all types, including blogs, forums, and listservs, broad immunity from tort liability so long as the information at issue is provided by a third party.”  That immunity extends to liability for delivering malware (viruses, etc.) over the Internet.  It does not cover liability for writing and selling or licensing buggy software. See, SOFTWARE MANUFACTURER DENIED SECTION 230 IMMUNITY – HARDIN V. PDX, 2014 WL 2768863 (Cal. App. Ct. June 19, 2014), http://blog.ericgoldman.org/archives/2014/06/software-manufacturer-denied-section-230-immunity-hardin-v-pdx.htm .

The reasons that you can’t sue over buggy software are mostly 1) it is nearly impossible to prove the elements of tort liability under either the common law or the Uniform Commercial Code, as explained in this article; and 2) Congress has never enacted (and the courts have never discovered on their own) strict liability for software defects. (“Strict liability” is legal responsibility for damages or injury even if the person found strictly liable was not at fault or negligent.)  Thus, in almost all cases, you waived suits for liability in the license for the software.  Here is the license for Windows:

Last updated July 2016

MICROSOFT SOFTWARE LICENSE TERMS

WINDOWS OPERATING SYSTEM

IF YOU LIVE IN (OR IF YOUR PRINCIPAL PLACE OF BUSINESS IS IN) THE UNITED STATES, PLEASE READ THE BINDING ARBITRATION CLAUSE AND CLASS ACTION WAIVER IN SECTION 10. IT AFFECTS HOW DISPUTES ARE RESOLVED.

* * *

LIMITED WARRANTY

Microsoft warrants that properly licensed software will perform substantially as described in any Microsoft materials that accompany the software. This limited warranty does not cover problems that you cause, that arise when you fail to follow instructions, or that are caused by events beyond Microsoft’s reasonable control. The limited warranty starts when the first user acquires the software, and lasts for one year. Any supplements, updates, or replacement software that you may receive from Microsoft during that year are also covered, but only for the remainder of that one-year period or for 30 days, whichever is longer. Transferring the software will not extend the limited warranty.

Microsoft gives no other express warranties, guarantees, or conditions. Microsoft excludes all implied warranties and conditions, including those of merchantability, fitness for a particular purpose, and non-infringement. If your local law does not allow the exclusion of implied warranties, then any implied warranties, guarantees, or conditions last only during the term of the limited warranty and are limited as much as your local law allows. If your local law requires a longer limited warranty term, despite this agreement, then that longer term will apply, but you can recover only the remedies this agreement allows.

If Microsoft breaches its limited warranty, it will, at its election, either: (i) repair or replace the software at no charge, or (ii) accept return of the software (or at its election the Microsoft branded device on which the software was preinstalled) for a refund of the amount paid, if any. These are your only remedies for breach of warranty. This limited warranty gives you specific legal rights, and you may also have other rights which vary from state to state or country to country.

Except for any repair, replacement, or refund Microsoft may provide, you may not recover under this limited warranty, under any other part of this agreement, or under any theory, any damages or other remedy, including lost profits or direct, consequential, special, indirect, or incidental damages. The damage exclusions and remedy limitations in this agreement apply even if repair, replacement or a refund does not fully compensate you for any losses, if Microsoft knew or should have known about the possibility of the damages, or if the remedy fails of its essential purpose. Some states and countries do not allow the exclusion or limitation of incidental, consequential, or other damages, so those limitations or exclusions may not apply to you. If your local law allows you to recover damages from Microsoft even though this agreement does not, you cannot recover more than you paid for the software (or up to $50 USD if you acquired the software for no charge).

(emphasis in original)

If you don’t agree to that — or a provision like it in very nearly every software license — then you can’t use the software.  What choice do you have?  Only one: you could go to open source software.  But, as Bruce Schneier explains, by its very nature (it is written like a Wikipedia) there is no one to sue for bugs in open source software.

Thus, Dan Greer reportedly said at a Black Hat USA conference:

“Today the relevant legal concept is ‘product liability,'” said Geer, “and the fundamental formula is ‘If you make money selling something, then you better do it well, or you will be held responsible for the trouble it causes.’ For better or poorer, the only two products not covered by product liability today are religion and software, and software should not escape for much longer.”

He then advocated for extending liability for vulnerable software:

“The software houses will yell bloody murder the minute legislation like this is introduced,” said Geer, “and any pundit and lobbyist they can afford will spew their dire predictions that ‘This law will mean the end of computing as we know it!’ To which our considered answer will be, ‘Yes, please! That was exactly the idea.'”

In short, there is a special exemption for interactive computer services.  There is, usually, practical immunity for people who license or sell buggy software to you.  Congress could extend tort liability to the makers and sellers of buggy software.

COMMENTARY:

My personal opinion is this: Greer and Schneier (and others) are right that there should be liability for vulnerable software, but strict product liability would stifle innovation.  Some kind of middle ground such as liability for gross negligence only is appropriate.  Also, I believe that Professor McKnight is correct that “this issue [is more likely] to be addressed in the incoming administration than one more beholden to Silicon Valley’s sloppy business practices as usual.”

 

Share:

Tags: , ,

Authors

Untitled Document
Professor William Snyder

Professor William C. Snyderis a member of the faculty of the Institute for National Security and Counter-terrorism at Syracuse University after fifteen years with the United States Department of Justice.

Christopher w. FolkChristopher W. Folk

is a second year student at SU College of Law. Christopher is a non-traditional student, returning to academia after spending nearly twenty years in the high tech industry. Christopher served in the Marine Corps, graduated from Cornell University with a B.S. In Applied Economics and Business Management, attended Northeastern University’s High-Tech MBA Program and received a M.S. In Computer Information Systems. Christopher previously worked in Software Engineering and in addition to being a full-time student, Christopher is currently serving his second term as Town Justice for the Town of Waterloo. Christopher externed with a Cybersecurity firm in the Washington, D.C. area between his first and second year at SU College of Law. Full biography

Ryan D. White

Ryan D. WhiteRyan is currently a second year law student at Syracuse University College of Law, and is also pursuing a Master of Public Administration degree from Syracuse’s Maxwell School of Citizenship and Public Affairs. Ryan spent time with Homeland Security Investigations while pursuing his undergraduate degree at Wesleyan University, and spent his first summer of law school as clerk for the U.S. Attorney’s Office in the Western District of New York. He is a member of Syracuse Law Review, the Journal on Terrorism and Security Analysis, and participates in the Veteran’s Legal Clinic.Full biography

Anna Maria Castillo

is a third year law student at Syracuse College of Law. She is also pursuing a Master of Arts in International Relations at Syracuse University's Maxwell School of Citizenship and Public Affairs. She has interned at a London-based think-tank that specializes in transnational terrorism and global security and at the legal department of a defense contractor. She currently serves as an executive editor in the Syracuse Law Review. Full biography

Jennifer A. CamilloJennifer A. Camillo

is a third year student at Syracuse College of Law. She has served as a law clerk in the United States Attorney’s Office for the Northern District of New York and the Cayuga County District Attorney’s Office and as an extern in the Oneida County District Attorney’s Office. She is a member of the Syracuse National Trial Team and was recently awarded the Tiffany Cup by the New York Bar Association for her trial advocacy achievements.

Tara J. PistoreseTara J. Pistorese

holds Juris Doctor and Masters of Public Administration degrees from Syracuse University's Maxwell School of Citizenship and Public Affairs and its College of Law. She has served as a law clerk in the United States Attorney's Office for the Western District of New York and the Public Defender Service for the District of Columbia and as an extern in the United States District Court for the Western District of Washington. Full biography

Benjamin Zaiser

is both a scholar and a Federal Agent of the Federal Criminal Police Office of Germany. (Opinions expressed here are his own and not any part of official duty.) Full biography

Categories