Computer Security and Liability Roxana Hernandez-Pastrana Ryan Herring Jinghua Luo Kevin Mack Shahram Rezaei Dec. 6, 2005

2 of 8 One Word Answer Should software companies be liable for damages incurred due to security flaws in their software? NO!

3 of 8 Major Arguments: 1.Increasing the financial liability of software companies does not increase software quality. 2.The cost of security flaws should not be incurred just by the software company. 3.Increased liability will reduce competition among software companies. 4.End-User License Agreements (EULAs) should be upheld by the courts.

4 of 8 Further Analysis (1): 1.Increasing the financial liability of software companies does not increase software quality. Greater liability increases the cost to software companies, which they will pass on to consumers in the form of increased prices. Software can never be bug free, so hackers will always find new ways to exploit systems. Longer development cycles mean consumers will be required to wait longer for products and focus on security means that fewer features will be available. This decreases the overall value of owning the software.

5 of 8 Further Analysis (2): 2.The cost of security flaws should not be incurred just by the software company. The majority of that cost should be incurred by the hacker who wrote the code to take advantage of the security flaw.  Placing the burden on software vendors will discourage them from investing in innovation and will thus hamper the growth of the software industry.

6 of 8 Further Analysis (3): 3.Increased liability will reduce competition among software companies. Small companies are going to suffer because those companies can least afford expensive legal charges. Under the current system, companies can distinguish their product by making it more secure. This gives consumers with a tradeoff in terms of price, quality and security. Let the market, rather than lawyers, do the job!

7 of 8 Further Analysis (4): 4.End-User License Agreements (EULAs) should be upheld by the courts. These agreements are necessary to avoid endless litigation for software companies. Companies cannot foresee all of the possible uses of their product and must protect themselves from uses that cause problems.

8 of 8 Conclusion: Enforcing liability on software companies results in no additional benefit to average consumer.