A Lemon Law for Software?

If Microsoft made cars instead of computer programs, product-liability suits might by now have driven it out of business. Should software makers be...
Economist StaffMarch 15, 2002

Events of the past six months have shown just how fragile the industrial world’s technological infrastructure can be. No question that terrorism can bring business districts, power grids, computer networks or air-traffic-control systems to their knees. But so, too, can stupidity, carelessness and haste. Indeed, from Titanic to Chernobyl—and in nine out of ten accidents in the air and on the road—human error has accounted for vastly more fatalities than malfunctioning parts or sabotage. Unfortunately, that is about to get even worse.

There is no escaping the trend towards replacing slow, cumbersome yet ultimately reliable bits of machinery with cheap, quick and compact “fly-by-wire” controls that are managed entirely by software. All well and good—except that there is no such thing as a bug-free piece of software. Even experienced programmers make on average one error for every ten lines of code. And all it takes is three or four defects per 1,000 lines of code for a program to start doing unpredictable things. With commercial software containing not thousands but increasingly millions of lines of code, the potential for disaster is all too clear.

Software defects would be bad enough if all they did was require the hardware to be reset. But defects invariably provide security holes for malicious hackers to exploit. Making matters worse, instead of working to close security holes in their existing products, software firms tend to cram more and more features into their programs to entice customers to buy the latest upgrades.

Drive Business Strategy and Growth

Drive Business Strategy and Growth

Learn how NetSuite Financial Management allows you to quickly and easily model what-if scenarios and generate reports.

Yet software does not have to be so vulnerable. Techniques such as “extreme programming” or the “five-step capability maturity model” which require programmers either to work in pairs or to follow rigid sets of rules, can produce remarkably clean code first time round.

But the disciplined approach is alien to the software industry’s quick-and-dirty culture. Software firms prefer to bash out code and then try to catch as many bugs as possible while racing to ship the product. Unfortunately, that means that customers end up doing much of the quality-assurance work—as they track down and report errors, install security patches and buy upgrades. According to the Standish Group, a market-research firm, faulty software cost American firms $100 billion last year.

After a sequence of embarrassing flaws that have made many of Microsoft’s flagship products crash or become vulnerable to attack, the company’s chairman, Bill Gates, recently instructed his firm’s software developers to put security and privacy above all else. Fine words. But Microsoft has a record of being slow to correct gaping holes in its software and being quick to criticise security experts for publicising them. However, whistle-blowers have a greater responsibility to users, who need to know immediately if the software they depend on to run their businesses, banks or hospitals is compromised in any way. After all, users are on their own, with little in the way of legal redress for any damage caused by faulty software.

Ship and Forget

Unlike makers of cars, cookers, medical devices or anything else, software companies in America and elsewhere are in effect exempt from product-liability and “lemon” laws. They evade responsibility for the quality and safety of their goods by selling licences to use them, not to own them, with a long list of disclaimers if customers open the packet.

A panel of experts at the National Academy of Sciences in Washington, DC, wants legislation introduced to end the software industry’s special exemption from product-liability suits. But, if anything, American lawmakers seem bent on giving the software industry even more protection. The Uniform Computer Information Transactions Act, already enacted by Maryland and Virginia, allows software producers to escape liability for damages caused by defects that they knew existed when the software was shipped, and to prevent customers from openly criticising the product.

Many believe this is going to have a chilling effect on innovation and competition—to say nothing of accountability—within the software industry.