Standards for Software Liability: Focus on the Product for Liability, Focus on the Process for Safe Harbor

In the first paper for Lawfare 's new Security by Design Paper Series, Jim Dempsey argues that a workable standard for liability would include a rules-based floor and a process-based safe harbor; none of the existing frameworks for secure software development is sufficiently definitive, but the elements of floor and ceiling are readily at hand.

Section 1 of this paper sets the stage by briefly describing the problem to be solved. Section 2 canvasses the different fields of law (warranty, negligence, products liability, and certification) that could provide a starting point for what would have to be legislative action establishing a system of software liability. The conclusion is that all of these fields would face the same question: How buggy is too buggy? Section 3 explains why existing software development frameworks do not provide a sufficiently definitive basis for legal liability. They focus on process, while a liability regime should begin with a focus on the product—that is, on outcomes. Expanding on the idea of building codes for building code, Section 4 shows some examples of product-focused standards from other fields. Section 5 notes that already there have been definitive expressions of software defects that can be drawn together to form the minimum legal standard of security. It specifically calls out the list of common software weaknesses tracked by the MITRE Corporation under a government contract. Section 6 considers how to define flaws above the minimum floor and how to limit that liability with a safe harbor.

Download the paper here, or read it below: