The state of liability for insecure software in America is woefully bad. You’re not going to be able to apply breach of warranty under UCC. As a threshold matt

The state of liability for insecure software in America is woefully bad. You’re not going to be able to apply breach of warranty under UCC. As a threshold matter, software might not even be considered a “good” and so it might not even governed by UCC. But if you did manage to apply UCC to software, the contract or license under which software is provided would have to be incompetently drafted if it were to be found that it did not effectively disclaim liability or if it was found unconscionable. There are some additional procedural hurdles concerning probity of contract but let’s leave it there Under basic tort law, a software provider would need to be found to have a duty of care in order to be found negligent, but surprisingly, this is seldom found to exist. There is also no clear standard to measure whether a software provider may have breached that duty. Intervening or superseding cause exists in almost every breach, although for security-specific software, this might not be the case (e.g., a firewall fails open might be reasonably foreseeable to cause damage by means of a hacker, against whom the firewall is meant to protect). Finally even if you get to this point, recovery may be barred or limited by the economic loss doctrine. Defective product law is even worse, due to the (inscrutable) fact that while most courts would call software a good for UCC purposes, they would not call it a product for the purposes of product defect law. There are some additional wrinkles here concerning design of software versus manufacture of software in the context of defective product design law, but we’re starting to wander out of HN post territory and into CLE territory here. Frankly if Joe Biden wanted to change every thing I just red it would be superb but I think we have to be realistic about how much influence the federal government can apply here without causing massive terrible second and third order effects. For example look back to 43 and Obama’s heavy reliance on cybersecurity insurance to advance national security interests and how quickly that turned into free payouts for everyone who could manage to get a random reared out to work.