Group E
Roxana Hernandez-Pastrana
Ryan Herring
Jinghua Luo
Kevin Mack
Shahram Rezaei
Software Liability
This document provides an overview of the debate on whether software
companies should be liable for damages incurred due to security flaws in their software.
There are several things that both sides agree on and it is important to mention them first.
Both sides agree that software security is an expensive problem. They also agree that
catching and prosecuting hackers who write malicious viruses should be a top priority.
The agreements are otherwise few and far between. One side thinks that software
companies should be required to pay damages, while the other side thinks that
distributing the cost of security flaws among multiple parties is the solution. The current
legal protocol of using “End-User License Agreements” is a contentious point of debate
with one side claiming they give far too much leverage to software companies, the other
side claiming that companies would be unable to stay in business without them. There
are good arguments on both sides.
Summary
Software companies should be liable for damages associated with security flaws in their
software. This means that companies would be required to pay the costs incurred by
users of the software if a security flaw was exploited by a hacker.
Affirmative

Liability increases the quality of software by forcing companies to consider the
costs of their decision to ignore security flaws.

The cost of the decision to ignore security flaws should be borne by the software
creator.

The threat of liability will level the playing field for software companies and
promote competition.

End-User License Agreements (EULAs) should not be upheld by the courts
because average consumers have no bargaining power and cannot possibly know
what the security flaws in the software are before signing the agreement.

The cost of software might increase, but it will be worth it to have secure
software.
Negative

Companies will simply raise prices to cover their legal charges without increasing
the security of their software.

Small companies will become no match for large companies because legal
charges will be a greater percentage of their costs. This will result in monopoly or
duopoly software industries.

Software can never be bug free, so hackers will always exist. The cost burden of
security flaws should be borne by hackers, network administrators, and consumers
in addition to software companies.

Court cases will take so much time that by the end of the case, the software will
be obsolete due to the pace at which software evolves.

The potential risk of liability will discourage companies from investing in
innovation and will thus hamper the growth of the software industry.

Let the market, rather than lawyers, do the job! If companies produce insecure
software, they will be punished by the market with loss in sales and damaged
reputation as customers turn to more secure software produced by other vendors.
Analysis of the major arguments
Increasing the financial liability of software companies will increase software quality.
Affirmative

Increased liability forces companies to consider the cost of delivering poor
products, giving those companies incentives to invest in quality.

Consumers might have to pay more for products, but at least the product will be
better and they will have legal recourse if the product fails.

Liability will force longer development cycles to ensure quality. Longer
development cycles encourage critical thinking about security and design of
software from the early stages.
Negative

Greater liability increases the cost to software companies, which they will pass on
to consumers in the form of increased prices and in many instances, will likely
result in no improvement in quality. Companies will simply charge more to cover
their legal expenses.

Software can never be bug free, so hackers will always find new ways to exploit
systems. The cost to consumers caused by security failures should be paid by the
criminals who write the viruses.

Longer development cycles mean consumers will be required to wait longer for
products and focus on security means that fewer features will be available. This
decreases the overall value of owning the software.
The cost of security flaws should be incurred by the software company.
Affirmative

The software provider is in the best position to ensure security in their software.
Consumers cannot be expected to know the details of the software in order to
prevent security breaches.

In economics terms, the cost of security failures to consumers is an externality
over which they have no control. Fundamentally, the decision maker (software
company) should bear the cost of its decision (providing flawed software).
Negative

It is not economically sound to place 100% of the cost burden due to security
failures on the software company. The majority of that cost should be incurred by
the hacker who wrote the code to take advantage of the security flaw.
Furthermore, network providers should also incur some of the cost since they are
responsible for ensuring the smooth interaction of many users and software
packages at once.
Increased liability will improve competition among software companies.
Affirmative

Companies will be forced to compete on the quality and price of their software
since they will be held accountable with stiff penalties for making a faulty
product.
Negative

Small companies are going to suffer because those companies can least afford
expensive legal charges. This will cause many companies to go bankrupt leaving
a monopolistic ruler for each particular area of software.

Under the current system, companies can distinguish their product by making it
more secure. This gives consumers with a tradeoff in terms of price, quality and
security.

In the case of a software industry where there is already a monopoly (i.e.
Microsoft), increased liability will simply result in increased prices to end
consumers with no increase in quality. Companies will only have incentives to
raise prices to cover legal expenses.
End-User License Agreements (EULAs) should not be upheld by the courts.
Affirmative

These agreements give far too much leverage to software companies. Consumers
have no bargaining power over the terms of the agreement.

Consumers do not have the opportunity to read the agreements until after having
purchased the software product. Consumers then have no choice but to accept
these agreements as it is usually difficult or impossible to get a refund for a
product.
Negative

These agreements are necessary to avoid endless litigation for software
companies.

Companies cannot foresee all of the possible uses of their product and must
protect themselves from uses that cause problems.