>The good news is the ransomware attack on Colonial Pipeline in May 2021 probably marks the beginning of the end. Comforting as that might sound, it tells us very little about how that ending will turn out.

I wonder what level of liability would be reasonable when considering the increasing sophistication of these types of hacks. Going back to the bridge analogy, we would hold the licensed engineer responsible if the bridge they built collapsed because of a thunderstorm, but not if the bridge collapsed because a terrorist or rival nation state bombed it. Which of those situations is more analogous to getting hit with ransomeware or some other type of hack?

Say a piece of software from a small company is compromised, should the liability be different if the attacker is some script kiddie versus if it's some hacking group that likely has ties to a foreign intelligence service? Is it reasonable to expect every software company to be able to fend off even the most well-financed attack?