Of the different theories under which a program could be sued (strict liability, negligence, criminal, intentional tort, fraud, negligent misrepresentation, malpractice, …), the most accurate and used are strict liability and negligence: the first applies to defective products, but negligence is more suitable for services. In the past decades, most software was characterized as a product: COTS and shrink-wrap products are clearly products, and even custom developed programs are products that may have support services under a different contract than that of the software license. These distinctions came from a time when traditional manufacturers were inflicting serious negative externalities on clients, but those of services were of little importance: much have been written about the need to impose strict liability without fault on software as a way to improve responsibility and quality, transferring the full cost of negative externalities to software companies. But this theory of liability has been rarely applied to software products, the truth being that the destructive potential of software is quite low except for medical devices, which are regulated by other provisions: strict liability covers unexpected and significant harm, and this is a rare event in software programs.

Forcing strict liability on programs will put many small software vendors out of business, and open-source will just disappear: as Alex Tabarrok notes, this is what happened in the aviation industry when manufacturers found that they could be sued for any aircraft ever produced. Only lifting these liabilities for old planes did revitalize the industry, with the unintended consequence that the end of manufacturers’ liability was associated with a significant reduction in the probability of an accident, opposite to what the former regulations intended. Moral hazard was small but pervasive, even in the face of death.

But SaaS and cloud computing are changing the software landscape: these really are services, so the negligence standard clearly applies. For sure, it’s the standard that best balances the interest of the parties: the cloud is full of SLAs, indeed. And even if these guarantees are not strong as the standard of strict liability, I wonder how much moral hazard will be introduced due to their proliferation: nowadays, the excuse that cloud providers are the root cause of system failure is getting more and more common.