united-states contract-law california negligence
Keeping a Weakness Secret
<p>If a company invents a padlock with some obscure weakness that most
criminals would not guess, is there anything the company can do
(before or after selling it to the public, or within some "user
agreement" contract) to legally prevent people from publishing the
details of that weakness?</p>

<p>For example, this video exposed a weakness, thereby hurting all 
owners of the padlock:
  <a href="https://www.youtube.com/watch?v=RxM55DNS9CE" rel="nofollow noreferrer">https://www.youtube.com/watch?v=RxM55DNS9CE</a></p>

<p>In principle, the company could now sue the video's owner for negligence,
but I doubt that the company would win, so I'm here asking if there is
anything the company could have done beforehand to improve its
chance of winning.  Suppose the company and all customers are in
Los Angeles, California.</p>

<p>On the one hand, there are statutes that prohibit the delivery of instructions which distort or circumvent the official/intended use or safety of a device. For a somewhat related example of this, see <a href="http://www.legislature.mi.gov/(S(j44pfulxvqjfox2egdt1nlq0))/mileg.aspx?page=getobject&amp;objectname=mcl-750-540c" rel="noreferrer">MCL 750.540c(1)(3)</a>.</p>

<p>On the other hand, the company/manufacturer is unlikely to prevail under contract law no matter how clearly and conspicuously its EULA prohibits the disclosure of discovered weaknesses. That is because the prohibition in the EULA is outweighed by the severe vulnerability to which all other unsuspecting customers are subjected.</p>

<p>From the standpoint of public policy, people's awareness of the discovered vulnerability is certainly in the public's best interest. The disclosure will warn both (1) <em>potential</em> customers not to purchase a product that fails or misses its primary purpose, and (2) <em>current</em> customers to adopt precautions now that the product's reliability has been disproved. Thus, the effectiveness of broadcasting the discovery of such weakness is in stark contrast with the technical deficits and managerial politics that typically hinder a company's ability (or its will) to respond to the issue.</p>

<p>If the weakness was known to the manufacturer prior to the disclosure, the release of that product would constitute <em>fraudulent misrepresentation</em>. The details of the demonstration in the video supports the argument that the manufacturer knew --or should have known-- about that weakness, since a padlock design is supposed to pass all kinds of tests of breakability and not be disabled by a screwdriver. </p>

<p>It is hard to deny that the notion that "the padlock is secure" <em>induces</em> customers to purchase the product. As such, the misrepresentation violates the contract law principle that a contract --such as a purchase-- be entered <em>knowingly</em>. See <a href="https://nylitigationfirm.com/files/restat.pdf" rel="noreferrer"><em>Restatement (Second) of Contracts</a> at § 161-167</em>. With respect to the publisher of the weakness, that misrepresentation renders the EULA-prohibition void. See <em>Restatement at § 164(1)</em>.</p>

<p>Regardless of whether or not the manufacturer incurred misrepresentation, the manufacturer's decision to sue the publisher is only likely to backfire by bringing more attention to the poor design of the product.</p>

<p>In all, the manufacturer's best option is to do a product recall ASAP and enhance the design.</p>
