Cybernation: The FUD, Facts, & Future of Software Liability/Security

The talk opens with the 2023 National Cybersecurity Strategy and its proposal to move liability onto software makers, which the speaker argues is less novel than the online reaction suggested. Software liability is treated here as several distinct legal strands: contract terms that divide risk between vendors and customers, regulatory enforcement, corporate governance claims, criminal fines, and tort law. Each strand is illustrated with a concrete case or agency example.

Examples include FDA software recalls, a Delaware shareholder case involving Meta's board, a criminal fine tied to Volkswagen's emissions defeat device, and design-defect suits against Snapchat and TikTok that got past early dismissal motions. The history runs from 1980s medical device failures and Y2K through to Centralia, Pennsylvania, whose underground mine fire is used as a warning about systems whose interactions no one anticipated.

For practitioners, the main takeaways are that courts and regulators weigh duty, intent to engage in the conduct that caused harm, and the promises a company made publicly. The speaker advises employees to keep their own records of security decisions and to build trusted allies inside the organization. She proposes extending threat models with social sustainability, substantiation of design choices, and non-technical stakeholders, and closes by calling for a technology regulator of last resort.