open-source-software hacking
Am I liable for problems caused by unendorsed software modification on my products?
<p>Imagine the following hypothetical.
My firm produces electronic controllers for a variety of products. Let's focus, say, on a commercial washing machine.</p>

<p>We design the electronics and develop the software that controls user interface and washing cycles. In those regards, everything works perfectly.</p>

<p>In this scenario I am a software engineer working in said firm. Being an idealistic follower of the open source philosophy, I publish a tutorial on how to reprogram and customize the washing machine. Important points to note:</p>

<ul>
<li>I do this work independently (i.e. the publication is not officially endorsed by my firm).</li>
<li>I am not disclosing any information that would not be inferable by analyzing the device itself; the original source code and schematics are kept secret.</li>
<li>I am not in conflict with my firm: they know what I am doing and are not opposed to it - although they don't officially support it.</li>
<li>I warn in capital letters to be wary of any modification to the original product, specifying that the firm does not encourage it. I don't mention my connection to the firm at all.</li>
</ul>

<p>Following my instructions, a user successfully reprograms one of our devices. Due to those software modifications the machine malfunctions, causing damage to people and/or property.
In the wake of this accident the user decides to sue my firm, claiming that the product is at fault.</p>

<p>The question is: is there any legal ground on which such a claim could stand?</p>

<p>It is my understanding that since the procedure to modify the existing software is not officially endorsed it is basically tampering, and the firm cannot be held responsible.</p>

<p>I live in Europe (Italy), but I am interested in answers from any legal system.</p>

<p>I suspect the answer is going to depend on the exact facts of the case (doesn't it always).  If the firm had a warning on their instructions ("Do not attempt to modify the installed software") they would probably be in the clear (by analogy with "no user serviceable parts inside").  If the instructions were silent on the matter, but the firm was aware there was guidance available for reprogramming the device I think it would depend precisely on the jurisdiction and even more on the exact facts.</p>

<p>The whole question is pretty implausible IMHO - point three is just never going to happen.  Even if the claim is worthless, the firm will have to defend it and get the case thrown out - and they have better things to do with their time.  Much better to just forbid you from publishing the information (or go all the way and publish instructions themselves on how to reprogram - with suitable warnings.)</p>

<p><a href="/questions/tagged/united-states" class="post-tag" title="show questions tagged &#39;united-states&#39;" rel="tag">united-states</a> </p>

<p>As, in the US, product liability cases use a theory of strict liability, it might be contended that the company knew (or should have known) that it was possible to make such modifications, and that they should have made it impossible, or possible only with a password not generally available, or possible only through some other security mechanism.</p>

<p>It might also matter if the person suing was also the person who did the modification, or if a malicious third party modified someone else's appliance. If the suit is over the user's own modifications to his or her own device, a "clean hands" or contributory negligence theory might be applied, especially if the user knew or should have know that the action was unsafe. But if a hacker hacked someone else's  device, the device owner might have a case.</p>

<p>I agree that it is highly improbable that the company would consent, even passively, to such instructions being published, but if we suppose that they were published not by an employee, but by a non-employee who did reverse engineering to learn how to modify the software, that may not protect the company.</p>

<p>The detailed facts will matter. Including how reasonable it was to expect such harm to occur, and how hard adding security would have been.</p>
