S6E7 - Chinmayi Sharma & Jim Dempsey - Software Liability and Safe Harbor

Resilient Cyber

- First off, for folks not familiar with your backgrounds, can you please each tell us a bit about yourselves?
- Let's set the table a bit, what is software liability and what is driving the increased calls for it? For example the recently released National Cyber Strategy, and commentary by U.S. leaders such as from CISA's Jen Easterly
- What are some examples the software industry can pull from to try and establish a foundational liability regime?
- What are some of the unique challenges that make software a nuanced domain to try and implement something like this in, compared to some other industries?
- Jim - you recently wrote a paper about "establishing the floor", can you elaborate on that for us a bit? How about you Chinmayi, any thoughts?
- Some of have of course exclaimed something like this could/would kill innovation and have major economic consequences, or lead to "ambulance chasing" type behavior pursuing litigation as a weapon against vendors. What do you think about that?
- Chinmayi - you had a paper titled "A Bug in the Software Liability Debate", where you talked about challenges of defining a duty of care, can you elaborate, and dealing with unknown vulnerabilities. Can you expand on that a bit?
Jim - You've talked about focusing on the outcomes/product, not the process, why do you think that's important?
- Another equally critical part of the conversation is Safe Harbor, that is protections for those who due perform the duty of care or act responsible. Can you touch on that topic, and each give your thoughts on what that may look like if it were to take shape?