Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.
Security Vulnerabilities, the Current State of Consumer Protection Law, & how IOT Might Change It Wendy Knox Everette @wen...
This is not legal advice I’m not (yet) a lawyer. But I am interested in your thoughts on this topic! Please find me around...
https://twitter.com/WeldPond/status/650638805528125440
Let’s compare these consumers One consumer buys a coffeemaker. It has a flaw that causes it to overheat, break, and scald ...
Why?
What if there’s an agreement between two people? That agreement governs. Think of EULAs, Clickwraps, Terms of Service. Wha...
What if there is no pre-existing agreement? Tort law: how we deal with harm to people in car accidents, roller coaster mal...
What do I need for a Product Liability suit? You need more than pure economic loss: • Physical harm to the consumer • Prop...
What changes with IOT?
What’s your Smart Blender patching strategy? Software is now in devices capable of interacting with the physical world. Th...
Products Liability as Insurance, 1916 https://www.flickr.com/photos/historicbremen/22862058079/
Products Liability as Consumer Protection When a product harms a consumer, they allege one of these types of problems: 1. ...
Why do we have knives but not lawn darts? Risk - Utility balancing is a core part of products liability: Product Liability...
What do you mean by serves an insurance function? Consumers expect products to be safe. Are you really worried about your ...
Ok...how would this actually work?
Empowering consumers is nice, but is this even feasible? Failure to warn as a framework: Should software companies have to...
What does a Failure to Warn claim look like? 1. Risk reduction warning: “Wear goggles and don’t stand on a ladder” 2. Info...
Can Failure to Warn provide incentives for better practices? Could provide incentives for better practices like: Designing...
What is warning overload? Failure to warn doctrine takes into consideration cost-benefit analysis that might be adapted to...
What about obvious risks? “You should have known” is a defense. Would make it hard to blame lack of warnings if you just h...
What about open source? Turns out products liability has worried about this sort of problem before. Components in product ...
How does this relate to the way we develop and patch software?
What changed after 1916? Mass production and supply chains changed how we bought & sold products. Consumer safety increase...
Could change happen again? IOT changes how software interacts with the world. So now what?
So this is a perfect solution, right? Lots of problems. When should a company disclose un-patched vulnerabilities? Does th...
Where do we go from here?
Do the things you already know you should Make sure you’re set up to receive and validate vulnerability reports. Test. Imp...
Thank you! Come talk to me about software product liability: @wendyck Thank you to BSidesLV Proving Ground & Chris Eng!
Upcoming SlideShare
Loading in …5
×

Security Vulnerabilities, the Current State of Consumer Protection Law, & how IOT Might Change It

323 views

Published on

BSides Las Vegas 2016 - Proving Ground Track
If a consumer purchases software (like, perhaps, a word processor or a note taking software) and that leads to some harm- perhaps the software allows malware to run on their computer, locking all their data for ransom, or their private data is stolen, then do they have any recourse?

In the area of private law suits, a consumer would likely first look to products liability. Product liability law acts as a form of insurance to protect users - if a product is built in an unsafe way, and it injures you, you may sue the retailer or manufacturer of the product.

There are three general theories a consumer can recover under:

Design defect: the product was designed in an unsafe way
Manufacturing defect: the specific instance of a product was assembled incorrectly and had a one-off manufacturing flaw
Failure to warn claim: the product had non-obvious ways it could harm the consumer, that the consumer should be told about

Although these suits are common for defective products such as lawn mowers, coffee makers, and other consumer goods, they are not used by purchasers or users of software. The primary reason why this is so far is that products liability is so focused on physical harms- it covers serious injuries like losing your finger to a bagel cutter, for instance, and the fact that until somewhat recently, most software couldn’t physically harm you. (Although alternatively, some users can recover if they had a contract with the software creator or provider - as in the Trustwave Incident Response suit)

The rise of the Internet of Things is about to change a lot of that. There have already been a small number of cases where liability was found where buggy software caused physical harm to some consumers. Returning to the fridge, what if someone could connect remotely to your fridge, and adjust the temperature to be a little too warm, leading you to get food poisoning? What if they could do so without the temperature display in the fridge changing, so it looked like it was still cold enough?

This talk will explore the background of product liability law, and discuss how and why IOT might bring about a change in expanding coverage of software flaws.

Published in: Software
no profile picture user

  • Be the first to comment

  • Be the first to like this

Security Vulnerabilities, the Current State of Consumer Protection Law, & how IOT Might Change It

  1. 1. Security Vulnerabilities, the Current State of Consumer Protection Law, & how IOT Might Change It Wendy Knox Everette @wendyck BSides LV Proving Ground 2016
  2. 2. This is not legal advice I’m not (yet) a lawyer. But I am interested in your thoughts on this topic! Please find me around, or tweet me (@wendyck)
  3. 3. https://twitter.com/WeldPond/status/650638805528125440
  4. 4. Let’s compare these consumers One consumer buys a coffeemaker. It has a flaw that causes it to overheat, break, and scald the user. Would this consumer probably be able to get the manufacturer to pay for any losses? Probably yes, using product liability law. Another consumer buys a router & hooks it up in her home office. There’s a flaw in it, and her files are exposed to the internet. Can this consumer get the manufacturer to pay for any losses? Probably not.
  5. 5. Why?
  6. 6. What if there’s an agreement between two people? That agreement governs. Think of EULAs, Clickwraps, Terms of Service. What happens in a contract stays in a contract.
  7. 7. What if there is no pre-existing agreement? Tort law: how we deal with harm to people in car accidents, roller coaster malfunctions, and similar problems Product Liability law: how we deal with harm to consumers from products they purchased
  8. 8. What do I need for a Product Liability suit? You need more than pure economic loss: • Physical harm to the consumer • Property damage
  9. 9. What changes with IOT?
  10. 10. What’s your Smart Blender patching strategy? Software is now in devices capable of interacting with the physical world. This is a fundamental shift that affects a main reason why we’ve lacked software liability in the past.
  11. 11. Products Liability as Insurance, 1916 https://www.flickr.com/photos/historicbremen/22862058079/
  12. 12. Products Liability as Consumer Protection When a product harms a consumer, they allege one of these types of problems: 1. Manufacturing Defect 2. Design Defect 3. Failure to warn
  13. 13. Why do we have knives but not lawn darts? Risk - Utility balancing is a core part of products liability: Product Liability is strict liability; that is liability without fault. But not really. Foreseeability of use & obvious dangers play a part. These are most important for design defect & failure to warn cases.
  14. 14. What do you mean by serves an insurance function? Consumers expect products to be safe. Are you really worried about your blender harming you? What if I tell you that your blender is internet connected- why are you concerned now?
  15. 15. Ok...how would this actually work?
  16. 16. Empowering consumers is nice, but is this even feasible? Failure to warn as a framework: Should software companies have to warn about known vulnerabilities?
  17. 17. What does a Failure to Warn claim look like? 1. Risk reduction warning: “Wear goggles and don’t stand on a ladder” 2. Informed choice warning “Product is dangerous. Here’s what you need to know to weigh that risk”
  18. 18. Can Failure to Warn provide incentives for better practices? Could provide incentives for better practices like: Designing items that can be patched Publishing a security contact form Triaging issues and releasing patches regularly Fixing usability issues with end consumer patching
  19. 19. What is warning overload? Failure to warn doctrine takes into consideration cost-benefit analysis that might be adapted to vulnerability disclosure. What warnings are reasonable? For what audience? Should we warn even if there isn’t a patch available?
  20. 20. What about obvious risks? “You should have known” is a defense. Would make it hard to blame lack of warnings if you just have bad security practices Photo by JohnnyXmas
  21. 21. What about open source? Turns out products liability has worried about this sort of problem before. Components in product liability: if your component is used in a product, not strictly liable, unlike the retailer or supplier, unless your product was also defective. Focus is on commercial sellers, not hobbyists.
  22. 22. How does this relate to the way we develop and patch software?
  23. 23. What changed after 1916? Mass production and supply chains changed how we bought & sold products. Consumer safety increased as certain factory practices become standard: presumption that your product is safe by following industry norms.
  24. 24. Could change happen again? IOT changes how software interacts with the world. So now what?
  25. 25. So this is a perfect solution, right? Lots of problems. When should a company disclose un-patched vulnerabilities? Does this impact innovation? What about warning overload fatigue?
  26. 26. Where do we go from here?
  27. 27. Do the things you already know you should Make sure you’re set up to receive and validate vulnerability reports. Test. Improve your SDLC. Take reasonable care to put a safe product on the marketplace.
  28. 28. Thank you! Come talk to me about software product liability: @wendyck Thank you to BSidesLV Proving Ground & Chris Eng!

×