> How do we decide when it is negligence, and when there was nothing that could be done? This isn't an insoluble issue: courts deal with similar decisions in c

> How do we decide when it is negligence, and when there was nothing that could be done? This isn't an insoluble issue: courts deal with similar decisions in car crashes, medical malpractice, and many other scenarios. A plaintiff could argue that the respondent should have been aware of certain vulnerabilities because they were widely disseminated, or that certain practices are explicitly warned against in common training materials. Respondents might counter by arguing that they test for that type of vulnerability using a widely-accepted tool, but it failed to flag this one issue, or something like that. I agree that it can't be a purely algorithmic process, but almost nothing in a courtroom is.