In my analogy, the motorist is the ISP customer, the thief is the hacker, and the DMV is the ISP. If I were to draw the corresponding links in your analogy, the

In my analogy, the motorist is the ISP customer, the thief is the hacker, and the DMV is the ISP. If I were to draw the corresponding links in your analogy, the motorist is still the customer, the auto maker is the router manufacturer. Whatever duty is owed to the owner of a faulty car, that duty is not on the DMV. It's on the manufacturer. > Why shouldn't firewall manufacturers be required to have some responsibility when the firewall is shown to not actually firewall? They should! I'm not arguing against holding companies responsible for their crap products. I'm arguing that the ISP shouldn't be forced to keep an attack vector on their network. If a shitty home router becomes a bot in a DDOS botnet, that's not the ISP's responsibility. From their perspective, it's on the subscriber. From the subscriber's perspective, it's on the maker of that shitty router. (ISP-provided equipment is obviously different)