No good deed goes unpunished: can we now be sued over software we give away?
kevinboone.me
kevinboone.me
I can see why someone would have added this provision, if you think in terms of what loophole would exist without it.
Imagine a company that sells you a router, and they declare that the necessary software is provided "free of charge", and as an extra convenience they've pre-installed it for you.
Sure, maybe the device won't work with any other software, and maybe the software can't be installed on any other device, but anybody can download a copy from their website, so it is free...
If this meant that routers booted off of swappable SD cards then that'd be awesome.
Businesses that rely on open source software will either have to accept liability for defects, or contract out to a third party who accepts liability.
That seems like it might encourage open-source business models that encourage selling support, even just for the liability protection.
Or am I being too hopeful?
It would be very clear to a lawyer what "in the course of a commercial activity" means. And accepting open source contributions from a business entity normally isn't considered "in the course of a commercial activity". (It's like buying apples from the supermarket is not a engaging in commercial activity on the part of the customer, even if the supermarket is.)
No disrespect to the author, but even consulting with a law student would clear up the issue. Maybe better access to law would be nice, but if the OSS community is really concerned with this issue some lawyer would have clarified this already.
IANAL of course, and this is not legal advice.
Edit: I'm not talking about deliberate poisoning or any other malicious intent. (Apparently this wasn't obvious?)
You certainly cant hand out poison apples for free without liability.
What you said is true, if there's negligence or malicious intent you're generally liable. In tort. (Edit: also criminally liable as well but that's far off topic)
However, whether you sold it or gave it out for free does matter, because for sales of goods, there's also contract law involved, there's usually additional implied warranties about the product being "merchantable" (you see this word in OSS disclaimers as well), and generally you can't disclaim your liability if you sold the product for money.
If there's no money and no other considerations involved when you give away the apple, then there's no contract, so only the tort part applies.
Generally the idea of holding the seller of a product liable for harms caused by the product is that the law (or society at large) don't like businesses profiting from selling stuff yet shifting risks to the consumer at the same time.
Again, IANAL and not legal advice.
New word for me.
A tort is a civil wrong, other than breach of contract, that causes a claimant to suffer loss or harm, resulting in legal liability for the person who commits the tortious act. Tort law can be contrasted with criminal law, which deals with criminal wrongs that are punishable by the state. While criminal law aims to punish individuals who commit crimes, tort law aims to compensate individuals who suffer harm as a result of the actions of others
>Generally the idea of holding the seller of a product liable for harms caused by the product is that the law (or society at large) don't like businesses profiting from selling stuff yet shifting risks to the consumer at the same time.l
I think it is more about the law attempting to mirror social expectations than having high-minded objectives itself.
https://www.usda.gov/about-usda/news/blog/good-samaritan-act...
Perhaps you could find a law student who didn't appreciate those second-order consequences, but no one who's ever had involvement with a real nontrivial proceeding would. I think whatever training you've received has given you some false confidence here.
A real lawyer's answer to almost any question is stereotypically "it depends", and that's for good reason. Even the smallest points of uncertainty can get expensive fast, both in legal fees and in expected value when a small probability gets multiplied by a very large worst-case loss. The EU has created a new such point here. That's probably more from sloppy drafting than from any intent, but it's unfortunate.
Is a rational person supposed to be worried about the < 0.1% chance of financial ruin? To the extent they have to take draconian measures to protect themselves while working on OSS?
"It depends" is correct but totally useless advice. Sure, a lawyer should probably remind the client that people sue others for unsubstantiated reasons as well so there's always some legal risk in new legislation where there's more uncertainty as to what the words mean... but as I said I'm not a lawyer and I'm certainly not the OP's lawyer or your lawyer. As in, I'd probably cover my ass a bit more if I were, but the fact is that the legislation wasn't intended to impose strict liability on OSS devs and unlikely will have that effect.
I think they've constructed roughly that effect here. I believe that's worth complaining about, both in principle and to the extent that same demonstrated carelessness might create more serious practical problems in future. That's especially true since as far as I can tell, this would have been an easy fix, just better drafting with no intended policy change.
Of course that's different from what a lawyer considering only their client's current personal interests should care about. There I think most developers would take no action (and I don't plan to myself), though the lawyer would probably consider that a business decision and leave it for their client to make in the context of their legal advice. I might take action if I worked on a high-risk (e.g. cryptocurrency per below) project, to use a pseudonym, minimize assets in the EU, etc.
There's that, and and there's also the fact there's no point in suing people with little money.
An aggrieved company isn't going to go after a random open source dev, because that cost more than it is worth. They will find an actual commercial vendor to sue.
Probably they'd lose eventually. The effect on the defendant would be big regardless though, and that's the point. A lawsuit doesn't have to win to be a useful economic weapon, just to survive long enough to inflict the intended pain on your opponent.
Most likely it will mean that European software suppliers must pay for very expensive outsourcing of liability protection or liability insurance, yielding higher prices for European customers, and many other companies will simply give up on selling their software in the EU at all. The fact that shipping faulty software is a strict liability crime there means that you can't even solve the problem by using high quality processes and standards, which is presumably the goal, because it literally doesn't matter how much effort you made in good faith to reduce the fault rate. This changes the economic equation for selling software in Europe quite considerably. Hopefully, the UK does not make the same problems when it attempts to draft a similar law, or better, it simply doesn't draft such a law at all.
It says a lot about the cultural problems in Europe, and I say that as someone who is born and lives there, that the author simply blows this problem off as only affecting "mega corporations".
Whether the end result of that stance is a good thing is of course debatable.
Personally I'd say I'd rather have a dozen companies providing some service to choose from than one or two gigantic ones.
Seems to me this would be perfectly enforceable in the US, but EU laws often feel like they'd rather force software authors to take on liability and not be able to opt out of the whole problem. I'm unfamiliar with this area of law.
I'm unsure if this modification would still qualify as Free software (as defined by FSF)... It would seem to interfere with Freedom 0 in a way that isn't really obvious. The legal environment would constrain what the software could be used for, because the license would terminate in case the author would be liable for defects.
Furthermore, similar clauses have existed for patents. E.g., if you use an Apache licensed library, but sue one of the contributors for patent infringement having to do with the library in question, then any grants of the Apache license terminate, so you can then be countersued. The way you framed your text, this would qualify as an interference with Freedom 0, as you can't eat your cake and have it too.
Lest we forget, here's what the MIT license, one of the most permissive ones, have to say:
"THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE."
So the MIT license already says what you think is against Freedom 0.
Or what if the open source library itself is provided by a company. Let’s say Intel’s IPMI library has a vulnerability that affects Dell servers and causes a breach at a bank in Paris.
Which seems like common sense to me. It's good when the law mirrors common sense.
That is incorrect per my understanding. If that open source org offers eg paid support, they likely have liability, at least in the EU. Now they're probably, practically speaking, judgement proof. But they do have liability. see [1]
[1] https://ubuntu.com/blog/the-cyber-resilience-act-what-it-mea...
Note that "can be liable" does not mean "will pay so much money they go bankrupt". It just means that normal liability rules will apply and that person is not shielded from liability. If I sold you a broken car saying it was in perfect order, I may be liable, but if I can prove a mechanic told me it was in perfect order and I didn't break it after that, I may be able to transfer my liability to them. Now, if because the car was faulty, you crashed into a children's picnic, your car exploded into flames and and killed an entire orphanage, I or the mechanic may still go bankrupt paying their medical bills...
And something now that only idiots do. And the reason no physical world analogies apply in the slightest is even if you give away (not sell) a car or some other physical possession, you don't sell a million copies and incur liability across a million users. For that same $0 cost. While that free download incurs effectively unbounded liability.
Offering $1k of support to a user of your code creates an obligation to any user in the EU, regardless of whether you know their name or not.
This applies to all software that is part of a commercial interaction, no matter whether the other party has to pay for the software or not. The software could be part of a device or be part of a certain service.
I understood that as long as the developers of open software are not involved in a commercial interaction, they cannot be held liable. I guess that if you receive some kind of support (a grant) for developing open source software, you are not immediately in a commercial interaction. But if you have some kind of agreement with an organization to develop or maintain open source software specific for that organization, that could count as commercial interaction.
I think that's the risk. It's not clear what counts as a commercial interaction. eg I built a lib used for data analysis of bio samples. I have occasionally done some consulting for users, but nothing in over a decade. Does that count as commercial interaction? It's unclear to me. I'm considering deleting the open source and/or updating the license to ban the EU.
Like obviously this is a very low probability risk, but I don't care to take any risks for something that I give away for free :shrug:
Separately, the idea that I have to have a security policy or any other thing; I decline.
It seems very unlikely that such a lib in itself has any cyber security risk as long as it itself does not query an external database through a network connection.
The users of the lib have to asses that it has no security risk.
Did you sign any formal agreement with the users of the lib? Is there still any obligsation on your side with respect to the lib?
If you would discover some security issue, like a buffer overrun, would you fix it? Then just mentioning it, would be enough. The users of the lib bear the greatest responsibility. They have to regularly check your lib for security problems.
It almost certainly has tons, because it was not designed to read attacker-controlled images or data files. If someone uses it that manner, I would be absolutely shocked if it doesn't. The testing suite focuses exclusively on correctness and speed.
> If you would discover some security issue, like a buffer overrun, would you fix it?
No. I don't use this work; I no longer work in science; etc. It's just a gift to other people of several years of work and a ton of time in vtune making it go fast.
The company owning the certification owns the responsibility. No cheating through cheap cyber security consultant chop shops from India anymore.
The plaintiff alleged that they had 'lost' (through no fault or negligence of ours) in a 'hack' the private keys to some $4 billion dollars in Bitcoins and that we owed them tortuous and/or fiduciary duties to aid them in "recovering" these assets.
Our position was that there wasn't anything we could do to help, that even if there were we had no obligation to do so, owing to the fact the software we published was MIT licensed with a forceful disclaimer of liability which the plaintiff had accepted and without which we wouldn't have allowed the plaintiff to use or redistribute the software we wrote and the fact that normally no one has an active duty to save another (e.g. a police officer can stand holding a life preserver as you drown, and finally that their claim of ownership was obviously fraudulent.
(plaintiff's position was that we could help by publishing backdoored software, we were never able to pin them down how how we were supposed to force anyone to adopt it in order to give it any effect at all, among other issues)
We originally succeeded at getting the case tossed as having no reasonable prospect of success, but the dismissal was overturned by the appeals court.
Fortunately (???) the fraudster behind the claim brought an additional spurious claim against us (this time demanding hundreds of billions in damages) during the brief window before the initial dismissal was overturned. Owing to a spectacular tactical blunder by our opponent the new case was joined in with other cases involving him which were more advanced in their development, and we were able to factually destroy all of the evidence that his initial case used to show his ownership as a collateral effect.
All in all our litigation cost millions of dollars, tens of millions in for all parties across all the related cases. Fortunately good actors in the Bitcoin space stood up to pay our costs or otherwise we would have been personally ruined long before successfully winning the case on its merits, which was presumably his strategy. -- this is a thing often missed in these discussions: that it doesn't matter so much if you would ultimately win when if you can't immediately get a summary dismissal the legal costs will ruin you long before you get that opportunity. Not every project has supporters as wealthy as ours.
Unfortunately, we had essentially no support from the free software legal or online rights world. I hope we avoided the precedent created by the initial reversal trashing things up for the future, time will tell. I was disappointed by parties who denied us support out of ick at anything cryptocurrency... when it comes to defending civil liberties you can't necessarily pick who you defend. There is a lot of good free speech law in the US thanks to the deplorable people at the Westboro Baptist Church.
Our case was in the UK even though none of the defendants were there and many were in the US, because that's where the plaintiff brought it. Unfortunately when you write software that's used world wide you're potentially exposed to the systems of other countries, at least ones your own country will domesticate judgements from, regardless of your desires. (and perhaps an absence of choice of venue clauses is a defect in popular licenses...)
> the fact that normally no one has an active duty to save another (e.g. a police officer can stand holding a life preserver as you drown
No idea about the UK but in many jurisdictions you have the duty of first aid to people as long as it doesn't put your own life at risk
I wonder to what extent this is enforced in places that have it, and I assume it's only applicable to obvious life/death situations? Particularly given that a sizable part of the population freezes in response to danger/shock I'm having a hard time imagining that it's a real rule in practice.
> I guess somewhat a solution to this is to contribute anonymously, via Tor/VPN, incl. any emails so that nothing can be traced back to you.
Being strongly anonymous over a long period of time is extremely difficult. If you mean just throwing something over the wall and vanishing then that's potentially possible but any long term collaboration is almost sure to out you given enough time. And then when it does your anonymity is vulnerable to being spun to argue that you knew what you were doing was wrongful. You're also less likely to be protected in other ways since you thought your identity was a secret.
But perhaps most importantly, I believe the US is the only major jurisdiction where you have a right to defend yourself while anonymous. In the UK you can't even hire a solicitor as an anonymous party, and a related satellite case to ours (over the operator of Bitcoin.org who is anonymous) went all the way to the UK supreme court on this point. So if you're anonymous and the lawsuits come in you have to expose yourself there or lose by default. And if you lose by default and don't comply with the court's orders you could end up with an arrest warrant against you-- which is no problem, until your identity is somehow exposed and its suddenly a major problem.
A lot of the way that liability in this space is damaging is that just because a case is weak, even farcical, you have to defend it vigorously because there are no retries... and there are plenty of procedural footguns where someone who is obviously in the right can lose none the less.
At least for commercial software you can view liability as a cost of doing business, but the incentives for Open Source are shallow enough that they obviously can't cover it. Moreover, there might be a selection effect where more thoughtful contributors opt out while fools rush in-- ultimately to the detriment of the public.
Why?
In my opinion, this would likely clarify the intent behind the text.
> "Of course, here in the UK we aren’t subject to the EU CRA. I’m hoping that, by the time we get our own version, it will be clearer how the law will work."
The current British government is, of course, not very high quality and may well make very similar mistakes in the drafting of its own law. But that isn't clear because it isn't written yet. This article is purely about the EU.