More on flaws and viruses

Our story on the question of liability for viruses and the software flaws they exploit drew a large response, via e-mail and phone, on all sides of the issue. (See also the comments to my original post on the subject.) I'm taking notes on the phone calls and saving the e-mail messages as they come in, and I'll try to tabulate and summarize them in another post to this blog sometime soon.

In the meantime, here are some additional pieces of information and links to various resources that I came across while putting the story together:

* Cem Kaner's recent weblog entry on the subject, including his proposed Software Customer Bill of Rights. I spoke with Kaner, co-author of books including "Bad Software," for the story, and found him extremely knowledgeable. Here also is his home page, with lots of additional information under the articles link in the upper left.

* "Cybersecurity Today and Tomorrow: Pay Now or Pay Later," the report by the National Research Council's Computer Science and Telecommunications Board recommending, among many other things, that policy makers consider increasing the exposure of software vendors and others to liability for security breaches.

* A Washington State Supreme Court decision from 2000 in which the court took up the question of whether a general contractor was bound to the terms of a software end-user license agreement that limited damages to no more than recovery of the software purchase price after an alleged defect in the software (not Microsoft software, for what it's worth) resulted in a construction bid $1.95 million less than it should have been. The short answer to that long question: yes.

* That suit is among the EULA-related court cases compiled on this page, maintained by the Consumer Project on Technology, which was founded by Ralph Nader.

* The full text of a Microsoft End User License Agreement (EULA), this one for Office XP. See especially sections 8, 9 and 10. One reader who e-mailed, a retired lawyer, said our graphical excerpt that ran with the Friday story made it seem as if Microsoft was claiming more protection from liability than it actually is. I'll let you judge for yourself. (I don't have a postable copy of the full Windows XP agreement we used for that graphic, but the language is very similar.)

A Microsoft representative tells me that you can pull up your own EULA on a Windows-based machine, but I haven't yet figured out how to do that myself. I'll try to remember to post about it if I do figure it out. [Addendum, 9/16/03: Thanks to Nicole Hamilton for explaining how to do this. See her comment at the bottom of this post for details.]

* Bill Gates' January 2002 memo to employees in which he declared trustworthy computing the company's top priority. Here also is the page for Scott Charney, Microsoft's chief security strategist. Note especially the links at the bottom of Charney's page, including this one to a transcript of his recent speech to a U.S. House subcommittee. And here is Microsoft's security and privacy home page.

* The home page of Bruce Schneier, the computer security expert whose Firestone tires comment in the Friday story didn't sit well with several readers, some of whom considered it such an egregious and -- ironically enough -- flawed analogy that they thought I shouldn't have included it. For more thoughts from Schneier, click on the essays-and-writings link in his left-hand navigation bar. Or you could buy his book! But in no event shall I or my suppliers be liable for any special, incidental, indirect, or consequential damages whatsoever resulting from any feelings you may or may not have about what he writes.

* A good radio program on WAMU-FM in Washington, D.C., that addressed the issue, with guests on various sides of the debate. Scroll down to Tuesday, April 9, at 1 p.m., "Tech Tuesday: Software Liability and Security," to listen in RealAudio.

* Various EULA- and virus-related news stories from other publications:
"South Korean group sues Microsoft over Slammer,"
"Microsoft urged to compensate virus victims,"
"A legal fix for software flaws?"
"Millions of home computers may be at risk," and
"Is Microsoft liable for Nimda?"

* In this blog's comments, reader Jim Hudspeth also pointed to the ZDNet article, the last one in the list above, in which the reporter details his search for answers to essentially the same question that our Friday story sought to answer. Jane Winn, the law professor quoted extensively in the ZDNet story, is now at the University of Washington, and she helped me understand a lot of the nuances of the issue for the P-I story, even though I didn't end up having space to quote her directly. Here's one key point she made during our conversation, on the question of whether software companies should be held liable, given that there is, as she put it, "no obvious engineering solution" to the security problems raised by viruses:

"You don't want to set the liability regime today for the world that we'll have in 20 years, when we may have effective computer-security solutions."

* I'd like to point you to the full version of a recent New York Times Q&A with Bill Gates that touched on the subject of viruses, but enough time has passed that it has now slipped into that paper's premium archive. If you really want to pay for it, you can search for it here. (The Q&A ran with an Aug. 31 story about Microsoft's maturation.)

Here, at least, is what Gates said during the Q&A when asked by the Times' John Markoff if he was concerned about the possibility of product liability suits, in light of the problem of computer viruses:

"Well, we're doing our best to improve Windows and make it so our customers don't run into these problems. I think this is a critical issue for our customers, and solving this will be fulfilling the commitment we made on trustworthy computing. We're doing our very best, and that's all we can do."

That is a lot of information to digest, but it's an important subject, and I hope this post contributes some additional facts to the debate that has been going on in the comments to my original post. If you find any additional legal cases, Web sites or news stories on the subject, I'd be interested in seeing them. Feel free to e-mail me or to post a link to the information in the comments section below, along with any further thoughts you might have.

Posted by Todd Bishop at September 15, 2003 08:23 AM