Biden National Cyber Strategy Seeks to Hold Software Firms Liable for Insecurity

I’m undecided if this is wise policy or not.

One of the things the article doesn’t consider, but makes me curious, is the ancillary consequences of this. For example, medicine in the US functions this way. In practice, bad outcomes are illegal and policed with big financial liability. (Yes, yes— “negligence,” not outcomes are banned, but run it through a system of insurance underwriters, the court system incentives, and lawsuit settlement practices and the distinction collapses.) What’s the result?

One of the results is a wild employment market. Doctors are highly paid, partly as compensation for the liability risk. (Including risk they legally assume from nurses and mid-levels.) Health care systems won’t gamble on anybody else. There are high barriers to entry in the profession, which pulls young talent mostly from privileged backgrounds. (Hell, it’s practically hereditary in many cases. Attend a med school graduation and see how many parents and grandparents rise to renew their Hippocratic oaths.) Disruptive innovation in medicine is vanishingly rare at this point, in part because new approaches can be vetoed at many different points by stakeholders in this elaborate risk management system.

Curious if there’s a reason why the same downstream effects wouldn’t apply to tech or security work specifically, or if anybody foresees others.

(Btw, I don’t mean to dunk on American medicine. It’s a good system with some hard trade offs. It currently chooses high cost and high quality.)

Article: https://archive.ph/sDDvq

Also, an explainer: https://www.wsj.com/articles/how-the-u-s-national-cyber-stra...